Your Grades Are Not
Behind a Password.
They Are Behind a Proof.
GENIE was built with a single assumption about the threat environment: every admin portal is a target, every predictable URL is a vulnerability, and every unverified grade record is a liability. Our security architecture was designed accordingly — not as a feature, but as the foundation.
threat_register — known attack vectors
We Designed For
Every Adversary.
Academic software has historically been built for usability in trusted environments. The assumption was that the threat was low. That assumption has been systematically disproven. Grade manipulation, credential stuffing, transcript forgery, and insider data exfiltration are documented, active threats in tertiary institutions across Africa and the Global South.
GENIE does not extend trust to any environment. Our security model treats every network as hostile, every access request as unverified until cryptographically proven otherwise, and every data record as a target worth protecting with mathematical certainty — not just organisational policy.
A 2023 audit of West African university systems found that 67% of active student portals exposed their admin login URL publicly with no rate limiting, no multi-factor requirement, and no brute-force lockout. GENIE has none of these exposures by design.
genie.security — active threat register
| Threat | GENIE Countermeasure | Status |
|---|---|---|
Admin Portal Bot Scan Automated path enumeration | Hidden Vault Routing — no static admin path exists | neutralised |
Grade Record Tampering Direct DB write / API abuse | HMAC-SHA256 grade sealing at submission | neutralised |
Credential Stuffing Known password lists + automation | Adaptive rate limiting + device-bound JWT | neutralised |
Transcript Forgery Doctored PDF / offline manipulation | SHA-256 content hash in public verification ledger | neutralised |
Proxy-Based Attendance Shared credentials, location spoofing | Device fingerprint + GPS geofence + TSDA | neutralised |
Insider Data Exfiltration Privileged staff direct DB access | Field-level encryption; engineers cannot read grades | neutralised |
JWT Token Replay Intercepted access token reuse | Short-lived tokens (15 min) + rotating refresh tokens | neutralised |
API Abuse / Mass Data Scrape Unauthenticated or over-scoped API calls | HMAC request signing + per-institution rate limits | neutralised |
Backup Data Exposure Cloud storage misconfiguration | AES-256 at rest; HSM key management; keys not co-located | neutralised |
Zero-Day Exploit Monitoring Novel dependency vulnerabilities | Automated dependency scanning + 72h patch SLA | monitored |
Classification: Hidden Vault Routing
There Is No Admin Portal
at a Predictable Address.
Every institutional software product in existence ships with the same structural vulnerability: a static, discoverable admin URL. The pattern is universal and lethal. Automated bot networks scan for /admin, /dashboard, /wp-admin, /login across millions of IP addresses every hour. If your academic portal is at a known address, it is already receiving thousands of probes per day.
GENIE's institutional admin portal does not exist at a predictable address. Each institution's access gateway is served at a cryptographically derived URL path — computed from a combination of the institution's unique identifier, a time-seeded nonce, and a server-side rotation key held in the HSM. The path is not guessable, not enumerable by a bot, and not present in any publicly accessible sitemap or robots.txt file.
This is not security through obscurity. The path is a credential. Its derivation is cryptographically sound. Knowing the algorithm does not help an attacker who does not possess the institution's unique identifier and the current server-side seed.
path enumeration scan — external bot
# scanning for institutional admin panel...
/[VAULT_PATH] → ???
Institution Seed
A unique, server-generated secret is provisioned for each institution at onboarding. It is stored exclusively in the HSM — not in the application database.
Time-Seeded Nonce
A time-based nonce is generated using the current 30-day rotation window. The nonce is deterministic for the window duration but unpredictable outside it.
HMAC-SHA256 Derivation
Institution seed + time nonce → HMAC-SHA256 → URL-safe hex path segment. The resulting path is 32 characters. Brute-force enumeration is computationally infeasible.
Encrypted Delivery
The derived path is delivered to the authorised Registrar via TLS-encrypted email only. On each rotation, the old path is invalidated and the new one is delivered automatically.
grade_seal.verify() + transcript.hash_check()
A Grade Is Not a Number in a Cell.
It Is a Cryptographic Commitment.
Once a Lecturer submits grades through GENIE, the record cannot be silently altered. Every modification — legitimate or otherwise — is mathematically detected and attributed.
Grade Sealing
HMAC-SHA256 · Per-record signing · Tamper-evident
Input components
Lecturer device key + course ID + student matric + score + submission timestamp
Algorithm
HMAC-SHA256 over concatenated components
Output
A 64-character hex digest stored alongside the grade record
Verification
System recomputes digest on every grade read. Mismatch triggers immutable GRADE_TAMPER audit event
Post-submission changes
Permitted only via authorised Dispute Resolution workflow — each change generates a new signed record; old record is preserved, not overwritten
# example grade record (sealed)
student: CSC/2023/0089
course: STAT302
ca_score: 52
exam_score: 61
seal: a3f8e1c9d2b74056e1f3...
status: VERIFIED ✓
Transcript Integrity Hash
SHA-256 · Public verification · Forgery-proof
Hash input
Entire transcript content (all courses, all scores, student identity fields, institution ID, generation timestamp)
Algorithm
SHA-256 over canonicalised JSON representation of transcript data
Hash storage
Stored separately from the transcript PDF — in a tamper-evident log not writable by the application layer
Third-party verification
Employers and institutions can verify authenticity at verify.genie.ng by submitting the transcript's reference code — no GENIE account required
Forgery detection
A single character change in a doctored transcript breaks the SHA-256 hash. The verification endpoint returns INVALID immediately
# public verification — no login required
GET verify.genie.ng/TXN-2024-MAPOLY-0089
→ 200 OK
transcript: AUTHENTIC ✓
issued: 2024-11-14T09:22:31Z
hash_match: true
institution: MAPOLY · Verified Signatory
Security Stack — Layer by Layer
Nine Layers.
No Single Point of Failure.
Expand each layer to inspect the specific implementation decisions, algorithms, and technical standards in use.
The Insider Threat Model
GENIE Engineers
Cannot Read
Your Students' Grades.
The most dangerous threat to any data system is not external. It is the trusted insider — the engineer with production database access, the support agent with elevated permissions, the contractor with a legacy credential that was never rotated.
GENIE's architecture operates on the principle that internal access must be no more trusted than external. Our engineers do not have persistent production database access. All production access is time-bound, requires multi-party approval, is fully logged, and operates against data that is encrypted at the field level with keys the engineering team does not hold.
A GENIE engineer with full production database access sees encrypted ciphertext for every student grade record. The decryption keys are in the HSM — accessible only to the application runtime and only for authorised read operations by authenticated institutional users.
Production DB Access
ControlledRequires dual approval from two senior engineers. Access is time-limited to 4 hours. Every query is logged. Access cannot be self-approved.
Encryption Key Access
ImpossibleHSM keys are never extractable. The HSM hardware enforces this at the silicon level. No human can read the master key, including GENIE's own infrastructure team.
Grade Record Visibility
EncryptedField-level encryption means grade records in the DB are ciphertext blobs. A raw SQL query against the grades table by an engineer with DB access returns encrypted data only.
All Internal Actions Logged
AuditedEvery internal access event — including approved production access sessions — is written to the same immutable audit log that governs institutional activity. No exception.
Security Posture Metrics
The Numbers Behind the Assurance.
AES-256
Encryption at rest
NIST FIPS 197 standard
TLS 1.3
Encryption in transit
RFC 8446 · PFS enabled
15 min
Access token TTL
Industry minimum standard
72h
Critical patch SLA
CVE severity: Critical
0
Static admin paths
Hidden Vault only
7 yrs
Audit log retention
Full academic career
99.94%
Historical uptime
Last 36 months
NDPR
Regulatory compliance
+ GDPR-aligned principles
Regulatory & Standards Alignment
NDPR 2019
CompliantNigeria Data Protection Regulation
NDPR Amendment
Compliant2023 Amendments — data processor obligations
GDPR Principles
AlignedLawfulness · Minimisation · Purpose Limitation
NIST AES-256
ImplementedFIPS 197 Advanced Encryption Standard
RFC 8446
EnforcedTLS 1.3 Transport Layer Security
OWASP Top 10
AddressedWeb application security risks mitigated
HSM FIPS 140-2
Level 3Hardware Security Module key management
NUC Accreditation
SupportedAudit-ready data exports for NUC/NBTE
security.briefing.available()
Bring Your Security Architect.
We Will Answer Every Question.
Every institution deploying GENIE is entitled to a full technical security briefing — attended by our lead security engineer — before signing any deployment agreement. If our posture does not satisfy your institution's security requirements, we will not deploy.
ops@thegenieos.com · Encrypted communications preferred (PGP key available on request)