Rails 4 has many new features, and Strong parameter is one of them. Strong parameter allows us to choose attributes that can be whitelisted for mass assignment. In rails 3 we were doing this by listing accessible attributes in the model. But in rails 4 strong parameter are moving mass-assignment protection from model to controller.
It provides an interface for protecting attributes from end-user assignment so that Action Controller parameters are restricted to be used in Active Model mass assignments until they have been whitelisted. For this it has two methods:

1) require : It is used to mark the parameters as required.
2) permit : It is used to describe which attriibutes are allowed for mass assignment.

Lets explain this with an example:

class UserController < ActionController::Base

  def create
    User.create(user_params)
  end

 
  def update
    user = User.find(params[:id])
    user.update_attributes(user_params)
    
  end

  private
   
    def user_params
      params.require(:user).permit(:name, :email)
    end
end

If we try to use these attributes(name, email) directly without whitelisting in mass assignment, it will give ActiveModel::ForbiddenAttributesError.
There is one difference between require and permit, require returns the actual value of the parameter, and permit returns the hash.

For example:

params = ActionController::Parameters.new(username: "john")
params.permit(:username)
# => { "username" => "john" }
params.require(:username)
# => "john"

If we want to use accepts_nested_attributes_for with Strong Parameters, we need to specify in models, which nested attributes should be whitelisted.

class User
  has_many :accounts
  accepts_nested_attributes_for :accounts
end

Then mass-assign in controller:

class UserController < ActionController::Base
  def create
    User.create(user_params)
  end

  private

    def user_params
      params.require(:user).permit(:name, :email, accounts_attributes: [ :id, :category ])
    end
end

It provides two options that specify the behavior of any instances:

1) permit_all_parameters - By default this option is false. but if it is set to true, all the parameters will be permitted by default.

2) action_on_unpermitted_parameters -It specify what is need to be done when the parameters that are not permitted are mass-assigned. if the value of this option is set to :log, it will write a message on logger or if it is set to :raise, it will raise an ActionController::UnpermittedParameters exception.
The default value is :log in test and development environments and false in other environments.