• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.10 no.11
• /
• pp.1983-1988
• /
• 2006

There are gradually built on electronic commerce and business information system for the effective and automated use of internet while the mainstream of industry moves on information. It is necessary that a company should develop a electronic approval system because the business documents have application to an electronic commerce, business information system as well Currently, electronic approval system on groupware is using the way of inserting the image of an approval signature, which is vulnerable on a security by attacks of fraudulent use of electrical signature and eavesdropping on electronic documents. In this paper, we implementation XML form generator based on DTD having business documents structure for creating a valid business XML documents. we designed electronic approval system based on secured XML which transfers encrypted documents. For the security issues of written XML business documents, it makes use of the crypto algorithm having high performance transaction by the interchange of public key between a server and a client.

• Proceedings of the KAIS Fall Conference
• /
• 2007.05a
• /
• pp.203-207
• /
• 2007

NEMO 기본 지원 (NEMO-BS, NEMO Basic Support) 프로토콜에서 MNN(Mobile Network Node)가 CN(Correspondent Node) 과 통신을 하기 위해서는 항상 MR(Mobile Router)과 HA(Home Agent) 사이의 양방향 터널을 이용해야 한다. 그러나 NEMO-BS 방식은 노드 간 데이터 전송 지연과 부분 구간에 대한 공격 가능성이 존재한다. 따라서 본 논문에서는 NEMO를 위한 인증된 경로 최적화(ATRO) 프로토콜을 제안한다. MR은 홈 링크로부터 멀어졌다고 판단되면 MNN으로부터 위임 권한을 얻기 위해 권한 위임 프로토콜을 수행한다. 그런 후에 MR과 CN은 공개키 암호 방식을 이용하여 자신의 의탁주소(CoA, Care-of Address)를 MNN의 홈 주소(HoA, Home-of Address)와 매핑하기 위한 등록 과정을 수행한다. 이때 각 노드의 주소 소유권 증명을 위해 암호학적으로 생성한 주소(CGA, Cryptographically Generated Address)를 이용한다. 성능분석에서는 구간별 안전성과 종단간 패킷 전송 지연 시간을 통해 프로토콜을 분석한다.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 1999.05a
• /
• pp.65-69
• /
• 1999

인터넷 등 네트워크상의 거래에서의 인증은 주요한 인프라이다 네트워크상에서의 거래에서는 일반적 대면거래에서와 달리 상대방 확인과 내용에 대한 확인을 할 수 없다. 이러한 문제점을 해결해주는 것이 바로 인증이며 인증은 암호방식을 사용하며 신뢰받는 제3자에 의해 수행된다. 인증사업을 위한 제도적 뒷받침을 위해 각국은 디지틀서명 및 인증기관에 관한 디지틀 서명법을 제정하고 있으며, 민간부문 뿐만 아니라 공공부문을 포괄하는 상호인증을 가능케하는 국가적 차원의 공개키기반구조 확립에 주력하고 있다. 본고에서는 이러한 인증의 개념과 국내외 인증사업 및 정책에 대해 살펴보았다.

• Convergence Security Journal
• /
• v.24 no.1
• /
• pp.51-57
• /
• 2024

Although industrial control systems (ICSs) recently keep evolving with the introduction of Industrial IoT converging information technology (IT) and operational technology (OT), it also leads to a variety of threats and vulnerabilities, which was not experienced in the past ICS with no connection to the external network. Since various control command messages are sent to field devices of the ICS for the purpose of monitoring and controlling the operational processes, it is required to guarantee the message integrity as well as control center authentication. In case of the conventional message integrity codes and signature schemes based on symmetric keys and public keys, respectively, they are not suitable considering the asymmetry between the control center and field devices. Especially, compromised node attacks can be mounted against the symmetric-key-based schemes. In this paper, we propose message authentication scheme based on double hash chains constructed from cryptographic hash function without introducing other primitives, and then propose extension scheme using Merkle tree for multiple uses of the double hash chains. It is shown that the proposed scheme is much more efficient in computational complexity than other conventional schemes.

• Proceedings of the Korean Information Science Society Conference
• /
• 1998.10a
• /
• pp.530-532
• /
• 1998

본 연구에서는 안전한 네이밍 서비스를 제공하는 기존 Secure DNS를 확장시켜 GUI방식의 관리자 인터페이스를 설계하였다. 따라서 시스템 설정에 대한 configuration과 보안관련 도구의 핵심이라 할 수 있는 로그의 관리가 용이해 졌다. 또한 관리자 인터페이스에 의해 각각의 자원 레코드에 대한 자동적인 삽입, 삭제가 가능하며, 암호화 알고리즘의 추가를 interactive하게 처리한다. 그밖에 기존 Secure DNS에서는 새로운 암호와 알고리즘을 추가할 때마다 재 컴파일 해야하는 단점이 있다. 이를 해결하기 위해 'Dynamic link interface'를 설계하였다. 이는 암호화 알고리즘의 입출력 표준을 정하고 이를 단일한 시스템 API로 구성하여 Secure DNS가 초기화 될 때 동적 라이브러리를 사용하여 각각의 암호화 알고리즘을 메모리에 적재하는 방식을 택한다. 그 밖에 Secure DNS를 이용하여 제공할 수 있는 응용방안으로 개인의 공개키 분배서비스와 X.509 체계를 이용한 인증서를 제공하는 서비스를 제안한다. 따라서 본 연구에서는 인터넷의 기본 인프라스트럭쳐인 DNS를 최대한 활용할 수 있는 여러 가지 방안과 그 해결책을 제시한다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2009.11a
• /
• pp.635-636
• /
• 2009

공개키 암호 시스템을 이용하는 공인인증서는 IT 기술의 발달과 함께 e-Banking, e-Commerce, e-Finance 등 다양한 분야에서 사용자 인증을 제공하는 수단으로 사용되고 있다. 그러나 최근에 다양한 해킹툴과 사용자 PC의 취약점을 이용하여 PC에 저장된 공인인증서가 유출되는 사고가 발생하면서 전자금융에 대한 안전성을 위협받고 있다. 따라서 본 논문에서는 기존에 공인인증서를 하드디스크에 저장하여 발생하였던 문제점을 해결하고자 모바일 디바이스를 이용하여 전자서명을 수행하는 MobiSign의 공인인증서 이동방식 및 전자서명 방식을 분석한다. 또한 모바일 환경에서 악성코드에 의해서 발생할 수 있는 MobiSign 서비스의 보안 위협을 분석한다.

• The KIPS Transactions:PartD
• /
• v.12D no.3 s.99
• /
• pp.499-506
• /
• 2005

A hash chain is a structure organized by hash function with high speed in computation. Systems using the hash chain are using extensively in various cryptography applications such as one-time passwords, server-supported signatures and micropayments. However, the most hash chain based on the system using pre-paid method provides anonymity but has the problem to increase payment cost. In this paper, we propose a new hash chain based on the micropayment system to keep user anonymity safe through blind signature in the withdrawal process of the root value without disclosing privacy information, and to improve efficiency by using secret key instead of public key in the system without the role of certificate.

• Journal of Convergence for Information Technology
• /
• v.11 no.11
• /
• pp.66-74
• /
• 2021

With the development of the Internet, user authentication technology that proves me online is improving. Existing ID methods pose a threat of personal information leakage if the service provider manages personal information and security is weak, and the information subject is to the service provider. In this study, as online identification technology develops, we propose a DID-based self-authentication model to prevent the threat of leakage of personal information from a centralized format and strengthen sovereignty. The proposed model allows users to directly manage personal information and strengthen their sovereignty over information topics through VC issued by the issuing agency. As a research method, a self-authentication model that guarantees security and integrity is presented using a decentralized identifier method based on distributed ledger technology, and the security of the attack method is analyzed. Because it authenticates through DID Auth using public key encryption algorithms, it is safe from sniffing, man in the middle attack, and the proposed model can replace real identity card.

• The Journal of Society for e-Business Studies
• /
• v.16 no.4
• /
• pp.1-16
• /
• 2011

A digital certificate mandated by the Electronic Signature Act has become familiar in our daily lives as 95% of the economically active population hold certificates. Due to upgrades to 256 bit level security that have become effective recently, the security and reliability of digital certificates are expected to increase. Digital certificates based on Public Key Infrastructure (PKI) have been known as "no big problem," but the possibility of password exposure in cases of leaked digital certificates still exists. To minimize this vulnerability, various existing studies have introduced alternative password methods, expansion of certificate storage media, and multiple certification methods. These methods perform enhanced functions but also have limitations including the fact that the secureness of passwords is not guaranteed. This study suggests an alternative method for enhancing the level of password secureness as a way to improve password security. This new method improves security management and enhances the convenience of using digital technologies. The results may be used for developing digital certificate related security technologies and research in the future.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.15 no.3
• /
• pp.31-42
• /
• 2005

We consider a network storage model whose administrator can not be fully trusted. In this model, we assume that all data stored are encrypted for data confidentiality and one owner distributes the decryption key for each time period to users. In this paper, we propose three privilege management schemes. In the first scheme, called Temporal Privilege Management (TPM), we use a symmetric encryption based on one-way function chains for key encapsulation. In the second scheme, called Asymmetric Temporal Privilege Management (ATPM), anyone can encrypt the data using the public key of owner, but only privileged users can decrypt the encrypted data. Finally, we present a scheme to restrict writers' privilege using ID-based signatures in ATPM. In our schemes, the privilege managements are based on the time and the addition of users is efficient. Specially, applying TPM and ATPM, we can solve the back-issue problem.