Penerapan Role-Based Access Control Berbasis Klaim JWT untuk Mitigasi Ancaman Orang Dalam pada Jitsi Meet

Abdul Hadi; Muzakkir Pangri; Doddy Teguh Yuwono

doi:10.33506/insect.v12i2.6241

Authors

Abdul Hadi STMIK Palangkaraya
Muzakkir Pangri Program Studi Teknik Informatika, Universitas Muhammadiyah Sorong
Doddy Teguh Yuwono Program Studi Manajemen Informasi Kesehatan, Universitas Muhammadiyah Palangkaraya

DOI:

https://doi.org/10.33506/insect.v12i2.6241

Keywords:

Role-Based Access Control, JSON Web Token, Jitsi Meet, ancaman orang dalam, eskalasi hak

Abstract

Sebagian besar ajakan untuk mengganggu pertemuan daring (zoombombing) berasal dari orang dalam, yaitu peserta sah yang memiliki tautan dan hak akses ke ruang pertemuan. Penelitian terdahulu menerapkan Role-Based Access Control (RBAC) dan JSON Web Token (JWT) pada antarmuka dan API aplikasi web, tetapi belum membatasi hak peserta di dalam ruang konferensi video. Penelitian ini bertujuan menerapkan RBAC berbasis klaim JWT pada server Jitsi Meet stable-11146-2. Server tersebut digunakan oleh lima akun pengelola untuk 16 kelas dengan 306 catatan kehadiran peserta. Peran administrator, pemilik kelas, moderator, dan peserta dipetakan ke dalam klaim JWT bertanda tangan HS256 yang memuat status moderator, izin perekaman, nama ruang, masa berlaku, penerbit token, dan audiens. Token diverifikasi oleh server Prosody, lalu modul token_affiliation menetapkan peran peserta di dalam ruang. Pengujian menggunakan matriks kontrol akses berisi 21 skenario ancaman orang dalam dan 9 hak sah. Setiap kasus diuji tiga kali pada empat konfigurasi, yaitu konfigurasi bawaan Jitsi, JWT seragam, model awal, dan model setelah perbaikan. Pada sembilan kasus serangan yang berlaku di semua konfigurasi, tingkat eskalasi hak mencapai 33,3% pada konfigurasi bawaan dan 88,9% pada JWT seragam, sedangkan pada kedua model sebesar 0%. Pada matriks lengkap, model awal masih meloloskan 2 dari 21 serangan (9,5%), yaitu perolehan hak moderator oleh akun moderator portal di kelas milik pengguna lain dan permintaan perekaman yang tidak diperiksa server. Setelah hak moderator dibatasi pada pemilik kelas dan modul filter_iq_jibri diaktifkan, tingkat eskalasi dan tingkat penolakan keliru menjadi 0%, sedangkan kesesuaian terhadap matriks RBAC mencapai 100% pada ketiga ulangan.

References

1] G. Elmer, S. J. Neville, A. Burton, and S. Ward-Kimola, “Zoombombing during a global pandemic,” Social Media + Society, vol. 7, no. 3, 2021, doi: 10.1177/20563051211035356.

[2] C. Ling, U. Balcı, J. Blackburn, and G. Stringhini, “A first look at zoombombing,” in Proc. 2021 IEEE Symposium on Security and Privacy (SP), 2021, pp. 1452–1467, doi: 10.1109/SP40001.2021.00061.

[3] A. Alammary, M. Alshaikh, and A. R. Pratama, “Awareness of security and privacy settings in video conferencing apps among faculty during the COVID-19 pandemic,” PeerJ Computer Science, vol. 8, p. e1021, 2022, doi: 10.7717/peerj-cs.1021.

[4] D. Kagan, G. F. Alpert, and M. Fire, “Zooming into video conferencing privacy,” IEEE Transactions on Computational Social Systems, vol. 11, no. 1, pp. 933–944, 2024, doi: 10.1109/TCSS.2022.3231987.

[5] Y. Yang, J. West, G. K. Thiruvathukal, N. Klingensmith, and K. Fawaz, “Are you really muted?: A privacy analysis of mute buttons in video conferencing apps,” Proceedings on Privacy Enhancing Technologies, vol. 2022, no. 3, pp. 373–393, 2022, doi: 10.56553/popets-2022-0077.

[6] G. Achilleos, K. Limniotis, and N. Kolokotronis, “Exploring personal data processing in video conferencing apps,” Electronics, vol. 12, no. 5, p. 1247, 2023, doi: 10.3390/electronics12051247.

[7] I. B. A. I. Iswara and I. P. P. K. Yasa, “Analisis dan perbandingan quality of service video conference Jitsi dan BigBlueButton pada virtual private server,” Jurnal RESISTOR (Rekayasa Sistem Komputer), vol. 4, no. 2, pp. 192–203, 2021, doi: 10.31598/jurnalresistor.v4i2.794.

[8] Q. Pristiadi and L. Lukman, “Uji kualitas video conference Jitsi berbasis container pada Amazon Web Services (AWS),” Pseudocode, vol. 10, no. 2, pp. 74–79, 2023, doi: 10.33369/pseudocode.10.2.74-79.

[9] H. Mahmoud and R. Abozariba, “A systematic review on WebRTC for potential applications and challenges beyond audio video streaming,” Multimedia Tools and Applications, vol. 84, no. 6, pp. 2909–2946, 2025, doi: 10.1007/s11042-024-20448-9.

[10] R. A. Alsowail and T. Al-Shehari, “A multi-tiered framework for insider threat prevention,” Electronics, vol. 10, no. 9, p. 1005, 2021, doi: 10.3390/electronics10091005.

[11] F. R. Alzaabi and A. Mehmood, “A review of recent advances, challenges, and opportunities in malicious insider threat detection using machine learning methods,” IEEE Access, vol. 12, pp. 30907–30927, 2024, doi: 10.1109/ACCESS.2024.3369906.

[12] M. Mehmood, R. Amin, M. M. A. Muslam, J. Xie, and H. Aldabbas, “Privilege escalation attack detection and mitigation in cloud using machine learning,” IEEE Access, vol. 11, pp. 46561–46576, 2023, doi: 10.1109/ACCESS.2023.3273895.

[13] M. Alohaly, O. Balogun, and D. Takabi, “Integrating cyber deception into attribute-based access control (ABAC) for insider threat detection,” IEEE Access, vol. 10, pp. 108965–108978, 2022, doi: 10.1109/ACCESS.2022.3213645.

[14] D. F. Ferraiolo, R. Sandhu, S. Gavrila, D. R. Kuhn, and R. Chandramouli, “Proposed NIST standard for role-based access control,” ACM Transactions on Information and System Security, vol. 4, no. 3, pp. 224–274, 2001, doi: 10.1145/501978.501980.

[15] A. K. Y. S. Mohamed, D. Auer, D. Hofer, and J. Küng, “A systematic literature review for authorization and access control: Definitions, strategies and models,” International Journal of Web Information Systems, vol. 18, no. 2/3, pp. 156–180, 2022, doi: 10.1108/IJWIS-04-2022-0077.

[16] W. K. Abdulraheem, E. M. Ibbini, H. Kanaker, S. Smadi, N. A. Karim, H. N. Fakhouri, L. Albdour, and S. Fakhouri, “Least-privilege role-based access control improvement for cloud container security,” Computers, vol. 15, no. 5, p. 326, 2026, doi: 10.3390/computers15050326.

[17] A. Anas, S. Elgamal, and B. Youssef, “Survey on detecting and preventing web application broken access control attacks,” International Journal of Electrical and Computer Engineering (IJECE), vol. 14, no. 1, pp. 772–781, 2024, doi: 10.11591/ijece.v14i1.pp772-781.

[18] E.-T. EL Ghachi and B. Raouyane, “Web application security: A review of broken access control in web applications,” in Lecture Notes on Data Engineering and Communications Technologies. Cham, Switzerland: Springer, 2025, pp. 25–34, doi: 10.1007/978-3-031-91351-8_3.

[19] Abdurrasyid, Y. Asnar, and G. A. P. Saptawati, “Mutation based improvement of security test case quality for broken access control,” EURASIP Journal on Information Security, vol. 2026, no. 1, p. 7, 2026, doi: 10.1186/s13635-026-00226-w.

[20] T. Zhang, F. Hao, Y. Wang, B. Zhang, and G. Xie, “VeriFlow: A framework for the static verification of web application access control via policy-graph consistency,” Electronics, vol. 14, no. 18, p. 3742, 2025, doi: 10.3390/electronics14183742.

[21] M. Jones, J. Bradley, and N. Sakimura, “JSON Web Token (JWT),” RFC 7519, RFC Editor, 2015, doi: 10.17487/RFC7519.

[22] Y. Sheffer, D. Hardt, and M. Jones, “JSON Web Token best current practices,” RFC 8725, RFC Editor, 2020, doi: 10.17487/RFC8725.

[23] V. Bertocci, “JSON Web Token (JWT) profile for OAuth 2.0 access tokens,” RFC 9068, RFC Editor, 2021, doi: 10.17487/RFC9068.

[24] L. Zhang, C. Zhou, and J. Wen, “APSH-JWT: An authentication protocol based on JWT with scalability and heterogeneity in edge computing,” Wireless Networks, vol. 31, no. 3, pp. 2939–2953, 2025, doi: 10.1007/s11276-025-03926-2.

[25] A. Venčkauskas, D. Kukta, Š. Grigaliūnas, and R. Brūzgienė, “Enhancing microservices security with token-based access control method,” Sensors, vol. 23, no. 6, p. 3363, 2023, doi: 10.3390/s23063363.

[26] F. C. Ramdani, A. Rahmatulloh, and R. N. Shofa, “Implementation of JSON web token on authentication with HMAC SHA-256 algorithm,” Sistemasi: Jurnal Sistem Informasi, vol. 12, no. 1, pp. 194–205, 2023, doi: 10.32520/stmsi.v12i1.2450.

[27] S. Dalimunthe, E. H. Putra, and M. A. F. Ridha, “Restful API security using JSON web token (JWT) with HMAC-Sha512 algorithm in session management,” IT Journal Research and Development, vol. 8, no. 1, pp. 81–94, 2023, doi: 10.25299/itjrd.2023.12029.

[28] Y. Yuricha and I. K. Phan, “Penerapan role based access control dalam sistem supply chain management berbasis cloud,” MALCOM: Indonesian Journal of Machine Learning and Computer Science, vol. 3, no. 2, pp. 339–348, 2023, doi: 10.57152/malcom.v3i2.1259.

[29] Y. A. Prasetia and D. Manongga, “Role-based access control (RBAC) untuk sistem otorisasi terpusat berbasis Flask studi kasus PT. XYZ,” JIPI (Jurnal Ilmiah Penelitian dan Pembelajaran Informatika), vol. 9, no. 4, pp. 1768–1778, 2024, doi: 10.29100/jipi.v9i4.5403.

[30] D. Fitrianto and W. Y. Sulistyo, “Penerapan role-based access control untuk keamanan data multi-tenant SIMPEL Lazismu,” Insect (Informatics and Security): Jurnal Teknik Informatika, vol. 12, no. 1, pp. 1–10, 2026, doi: 10.33506/insect.v12i01.5009.

[31] R. Firmansyah, A. Hamdi, and D. Riandini, “Perancangan sistem autentikasi multi-role berbasis RBAC pada platform e-learning pemberdayaan ekonomi perempuan,” Rabit: Jurnal Teknologi dan Sistem Informasi Univrab, vol. 11, no. 1, pp. 1094–1104, 2026, doi: 10.36341/rabit.v11i1.7226.

[32] I. Gamayanto, M. C. Kurniawan, and G. K. Sanyoto, “Security evaluation of Keycloak-based role-based access control in microservice architectures using the OWASP ASVS framework,” Journal of Applied Informatics and Computing, vol. 9, no. 6, pp. 3964–3973, 2025, doi: 10.30871/jaic.v9i6.11604.

[33] M. H. Prayitno, A. Hiswara, and J. X. Guterres, “Mitigating access control vulnerabilities through ISO/IEC 27001-based granular role-based access control rights mapping,” MATRIK: Jurnal Manajemen, Teknik Informatika dan Rekayasa Komputer, vol. 25, no. 3, pp. 641–650, 2026, doi: 10.30812/matrik.v25i3.6653.

[34] A. Muhammad, A. I. Hadiana, and R. Ilyas, “Eksploitasi broken access control untuk eskalasi hak akses pada LMS Universitas XYZ,” Jurnal Algoritma, vol. 22, no. 2, pp. 1–11, 2025, doi: 10.33364/algoritma/v.22-2.2287.