• Annual Conference of KIPS
• /
• 2007.11a
• /
• pp.282-285
• /
• 2007

최근 금융, 공공기관 등에서 개인 정보 유출이 빈번해짐에 따라 사회적으로 심각한 문제가 발생하고 있다. 한국산업기술진흥협회의 조사에 따르면, 이런 정보 유출이 외부의 불법적 시스템 침입으로 인해 발생하는 것보다, 대부분 데이터 접근이 인가된 내부자 소행으로 나타나고 있다. 이는 데이터베이스의 보안 취약성으로 인해, 내부의 비인가자 또는 인가자의 데이터 접근에 대한 통제 정책이 제대로 이루어지지 않기 때문이다. 이에 따라, 본 논문에서는 클라이언트에서 데이터베이스 서버로 요청되는 네트워크상의 패킷 분석을 통한 데이터베이스의 접근통제방법을 제안한다. 제안된 보안모델에서는, 사용자 정보 및 SQL 의 위 변조를 방지하기 위해서 공개키 인증과 메시지 인증코드 교환으로 무결성을 확보하였다. 또한 권한별 테이블의 컬럼 접근통제를 확장하기 위해서 데이터 마스킹 기법을 구현하였다.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2009.05a
• /
• pp.467-470
• /
• 2009

CAN communication developed for communication between electric control devices in vehicle, was recently applied to automatic braking devices, and can also be applied to field bus for production automation. Recently, field bus is introduced in engine control, etc. for large ship. In this paper, cabin access control system can be implemented, based on CAN communication. The cabin access control system based on CAN communication consists of access control server, embedded system based on ARM9, and micro-controller built-in CAN controller. The access control server can be able to manage overall access control system by accessing with manager. And embedded system adopted ARM9 processor transmits access information of RFID reader controller connected with CAN networks to server, also performs access control. The embedded system can carry CAN frames to server, so it can be used as gateway.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.21 no.4
• /
• pp.101-114
• /
• 2011

As it seems like critical information leakages have been increasing due to industrial espionage and malicious internal users, the importance of introducing audit and log security technology is growing every now and then. In this paper, we suggest the session logging system for the company's internal control to meet the SOX legislation level, by monitoring and analyzing users behaviors connecting to the business-critical Operating System. The system proposed in this paper aims to monitor the user's illegal activities in the Operating System, and to present the clear evidence of purpose of those activities by detailed logs. For this purpose, we modified Operating System by adding multiple services suggested in this paper. These services utilize interfaces provided by the existing Operating System and add functions to control access and get logs. The system saves and manages session logs of users or administrators connected to the server with centralized log storage. And the system supports session log searching and lookup features required by SOX legislation for the company's internal controls with the level of computer forensics and logging technology.

• The Transactions of the Korean Institute of Power Electronics
• /
• v.16 no.1
• /
• pp.58-63
• /
• 2011

This paper presents a development of a fire control system with an intelligent judgment algorithm of hit or not. The presented algorithm analyzes an impact energy and impact signals according to impact materials. And the detected signals are used to judge the correct hit or not. Furthermore, Zigbee wireless communication technology is applied in the developed fire control system. The wireless communication technology can supply a simple installation of the practical system and free from ageing of communication wire. The presented system is verified in the practical fire test, and the results show the effectiveness of the development system.

• Journal of Intelligence and Information Systems
• /
• v.18 no.1
• /
• pp.71-90
• /
• 2012

Although it has been studied for a long time in various disciplines, most of control theories remain being developed by analyzing relatively simple tasks. Even recent research on control of information systems development explains only a small part of control phenomena observed in the real world projects. This research focuses on identifying and analyzing the concepts and structures in order to make them useful for understanding and explaining control of information systems development comprehensively This investigation utilizes the complementary relationship between views on control from organizational and economic perspectives. A conceptual framework developed by integrating previous research on control allows us to analyze the development of information systems for control purposes. The results of discussion about control mechanisms and network can be used as guidelines for designing control systems in real projects. Analysis of control networks shows that control of development projects requires quite complex networks intertwining a variety of controllers and controlees. The results of this research are expected to contribute to correcting the unbalanced status of IS research which has emphasized too heavily on planning and implementation, and deepening and widening our understanding about controlling development projects. Practitioners can use the results as guidelines for designing control mechanisms and networks, and get alerted by them about the agency risks inherent in outsourced developments.

• Venture DIGEST
• /
• s.39
• /
• pp.13-13
• /
• 2003

일반적으로 하나의 프로젝트가 종결되는 경우 관련파일에는 계약서, 최초 총예정원가계획서, 수정계획서, 회의록, 통신문, 검토보고서, 최종보고서 등 일련의 문서들이 포함되어 있다. 이때 비로소 진행률매출을 인식하기 위한 내부통제 절차가 적절하다고 판단될 수 있으며 회사가 인식한 진행률매출액의 자의성을 배제할 수 있는 것이다

• Journal of Scientific & Technological Knowledge Infrastructure
• /
• s.11
• /
• pp.76-87
• /
• 2002

이러한 평가는 북한의 경제 현실에서 오는 각종 인프라의 취약성, 체제유지와 보안상의 여러 가지 비합리적인 통제 구조와 환경들, 바세나르조약 등 국제적인 제재 조치 등 국내외적으로 복합적인 문제에서 야기되고 있는 것이다. 이러한 북한 인터넷 현황과 여러 문제점에 관한 논의는 먼저, 북한이 일본, 중국 등 해외에 서버를 설치하고 운영하고 있는 북한의 홈페이지를 직접 살펴본 후에 검토하는 것이 도움이 될 것이다.

• Journal of Internet Computing and Services
• /
• v.7 no.3
• /
• pp.93-105
• /
• 2006

The instant messenger is not only a wonderful tool for individuals. It is also a great tool which provides real-time dialogue and file transfers for individuals via the Internet and improves an enterprise productivity. However, it has many security risks that may have significant impact in corprate environments. This paper provides an overview of the security risks of the instant messenger with a risk analysis method and the controls that can be used to make it secure. It's hard to eliminate the instant messenger from enterprise environments because of its benefits. If we cannot avoid using it, we must make it secure and reap the full benefits of it.

• Journal of Digital Convergence
• /
• v.20 no.3
• /
• pp.35-40
• /
• 2022

With the advent of the internet age and the outbreak of COVID-19, many companies have embraced online trade. However, due to the way the cyber economy works, the number of companies engaged in financial fraud by falsifying their transaction amounts and customer numbers has been gradually increasing. The purpose of this study is to analyze financial fraud of companies in the Internet era and to present solutions. Therefore, this study analyzed the financial fraud behavior of Luckin Coffee in China as an example and studied the causes and countermeasures of financial fraud. As a result, it was found that the cause of financial fraud lies in the opacity of cash flows from online transactions. The recommendations proposed by this study is to improve internal control systems in companies, develop risk management system, and establish comprehensive external supervision system

• Journal of KIISE:Databases
• /
• v.36 no.5
• /
• pp.352-365
• /
• 2009

Recently, data access control policies have not been applied for authorized or unauthorized persons properly and information leakage incidents have occurred due to database security vulnerabilities. In the traditional database access control methods, administrators grant permissions for accessing database objects to users. However, these methods couldn't be applied for diverse access control policies to the database. In addition, another database security method which uses data encryption is difficult to utilize data indexing. Thus, this paper proposes an enhanced database access control system via a packet analysis method between client and database server in network to apply diverse security policies. The proposed security system can be applied the applications with access control policies related to specific factors such as date, time, SQL string, the number of result data and etc. And it also assures integrity via a public key certificate and MAC (Message Authentication Code) to prevent modification of user information and query sentences.