• Journal of KIISE
• /
• v.45 no.1
• /
• pp.45-52
• /
• 2018

With the advent of BCI technology in recent years, various BCI products have been released. BCI technology enables brain information to be transmitted directly to a computer, and it will bring a lot of convenience to life. However, there is a problem with information protection. In particular, EEG data can raise issues about personal privacy. Collecting and analyzing big data on EEG reports raises serious concerns about personal information exposure. In this paper, we propose a secure privacy-preserving BCI model in a big data environment. The proposed model could prevent personal identification and protect EEG data in the cloud environment.

• Convergence Security Journal
• /
• v.10 no.4
• /
• pp.1-11
• /
• 2010

Recently, We have many private information leakage cases through internet which cause social problems and it is impossible to change or update the leaked information, it is also used to the third crime such as identity theft, internet fraud. Hackers are interested in stealing private information for making money, in this point private information leakage problems are constantly increased hereafter. In this paper, I surveyed the authorization model on site registration which is currently used in Korea, and the problem of collecting personal identification number, I proposed policy model of useless method of private information, especially leaked information can not be used anymore in internet.

• Review of KIISC
• /
• v.18 no.5
• /
• pp.49-61
• /
• 2008

IT기술의 변화에 따라 금융기관의 정보보호 또한 안정성을 보장하면서도 새로운 비즈니스모델에 적합한 보안대책이 요구되고 있다. 금융 어플리케이션의 보안은 정보의 기밀성, 무결성, 가용성을 만족하는 안전하고 신뢰할 수 있는 시스템과 네트워크, 그리고 보안사고에 큰 비중을 차지하고 있는 내부 사용자에 대한 적절한 권한 부여와 접근통제가 요구되어진다. 정당한 사용자가 접근하여 발생하는 보안 문제, 즉 내부자에 의한 악의적인 행위나 오용, 실수 등에 의한 기업의 피해는 외부자에 의한 의도적인 공격보다 피해 규모가 크다. 따라서 정당한 사용자로 인증을 받았다고 할지라도 업무처리에 있어서 필요한 최소한의 권한만을 부여하는 것이 필요한 것이다. 이를 위해 금융기관에 적합한 접근통제가 필요하다. 역할기반 접근통제는 적용범위가 제한적인 강제적 접근통제와 분산된 보안관리로 중앙에서 통제가 어려운 자율적 접근통제의 단점을 보완하고, 실제 업무처리에 적합한 특성을 갖는다. 하지만 기존 역할기반 접근통제를 금융기관의 다양한 금융 어플리케이션에 적용하면 다음과 같은 문제가 발생할 수 있다. 첫째, 금융 어플리케이션에서 사용되는 역할 추출 및 관리가 어렵다. 둘째, 다양한 비즈니스모델이 원하는 직무분리가 복잡하고 어렵다. 셋째, 악의적인 내부 사용자가 역할을 변조하여 과도한 권한을 가질 수 있다. 따라서 본 논문에서는 기존의 역할기반 접근통제에 인사정보 연동을 통한 효율적인 역할 추출 및 분류방안과 역할관리, 직무분리의 세분화 그리고 역할의 안전한 관리를 위해 X.509기반의 권한관리 기반구조(PMI)를 이용한 권한관리 기술을 금융 어플리케이션 환경에 효율적으로 적용하는 방안을 제시한다.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.29 no.11C
• /
• pp.1592-1599
• /
• 2004

In this paper, we proposed the 3D mesh watermarking using projection onto convex sets (POCS). 3D mesh is projected iteratively onto two constraint convex sets until it satisfy the convergence condition. These sets consist of the robustness set and the invisibility set that designed to embed watermark Watermark is extracted without original mesh by using the decision values and the index that watermark is embedded. Experimental results verified that the watermarked mesh have the robustness against mesh simplification, cropping, affine transformation, and vertex randomization as well as the invisibility.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.7 no.6
• /
• pp.1185-1193
• /
• 2006

The next generation networked information system over unbounded internet is open to various network attacks and incidents, so many users suffer from damage and financial loss. In this paper we propose a survivability management model to evaluate the tradeoffs between the cost of defence mechanisms for information systems with weighted service and the resulting expected survivability after a network attack or occurrence of incidents. By varying the level of defence in the simulation, we examine how survivability changes according to the defense level. We derive a cost/survivability and weighted service/survivability curve that managers can use to decide on the appropriate level of defense for the network system of their organizations.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.12 no.6
• /
• pp.1022-1025
• /
• 2008

Session Initiation Protocol (SIP) has become the call control protocol of choice for Voice over IP (VoIP) networks because of its open and extensible nature. However, the integrity of call signaling between sites is of utmost importance, and SIP is vulnerable to attackers when left unprotected. Currently a herby-hop security model is prevalent, wherein intermediaries forward a request towards the destination user agent sewer (UAS) without a user agent client (UAC) knowing whether or not the intermediary behaved in a trusted manner. This paper presents an integrated security model for SIP-based VoIP network by combining hop-by-hop security and end-to-end security.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.21 no.6
• /
• pp.67-81
• /
• 2011

In recently years, there are cyber-weapon aim to national infrastructure such as 'stuxnet'. Security experts of the world are paying attention to this phenomenon. The networks which controls traffic, subway, waterworks of the city are safe from threats such as computer virus, malware, because the networks were built on closed-networks. However, it's about time to develop countermeasure for the cyber-weapon. In this paper, we review status-quo of the control systems for metropolitan infrastructure and analyze the risk of industrial control system in SCADA(Supervisory Control And Data Acquisition) network. Finally, we propose a security model for control systems of metropolitan infrastructure.

• Journal of the Korea Society for Simulation
• /
• v.19 no.1
• /
• pp.113-123
• /
• 2010

The interest in combat network systems rises among specialists as the military technology advances. This study considers some new elements such as characteristics of weapon systems, force moving rules at the end of each small battle, etc. to improve the accuracy of the analysis of series of mini battle problems. There is a significant difference in MOEs among the scenarios and the models. This study suggests some further works in weapon allocation, moving speed, tactics, weather, and topography which need to be investigated.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.29 no.6C
• /
• pp.893-900
• /
• 2004

While security traditionally has been an important issue in information systems, the problem of the greatest concern today is related to the availability of information and continuity of services. Since people and organizations now rely on distributed systems in accessing and processing critical services and mission, the availability of information and continuity of services are becoming more important. Therefore the importance of implementing systems that continue to function in the presence of security breaches cannot be overemphasized. One of the solutions to provide the availability and continuity of information system applications is introducing an intrusion tolerance system. Security mechanism and adaptation mechanism can ensure intrusion tolerance by protecting the application from accidental or malicious changes to the system and by adapting the application to the changing conditions. In this paper we propose an intrusion tolerance model that improves the developmental structure while assuring security level. We also design and implement an adaptive intrusion tolerance system to verify the efficiency of our model by integrating proper functions extracted from CORBA security modules.

• Journal of Internet Computing and Services
• /
• v.15 no.3
• /
• pp.91-100
• /
• 2014

While IT security investment of organizations has been increased, the amount of the monetary loss of organizations caused by IT security breaches did not decrease as much as their expectation. Also, from surveys, it was discovered that the poor usage of their security budget thwarted the improvement of the organization's security level. In this paper, to resolve the poor usage of security budget of organizations, we propose a comprehensive economic model for determining the optimal amount of investment in security solutions, including the proactive security solutions(PSSs) and the reactive security solutions(RSSs). Using the proposed analytical model under different parameters of security solutions, we show the optimal condition to maximize the expected net benefits from IT security investment of organizations. Also, we verify the common belief that the optimal level of investment in security solutions is an increasing function of vulnerability. Through simulations, we find the optimal level of IT security investment, given parameters of different characteristics of security solutions.