• Proceedings of the Korea Information Processing Society Conference
• /
• 2013.05a
• /
• pp.560-563
• /
• 2013

최근 NFC가 탑재된 모바일 기기는 결제, 할인쿠폰, 사용자 인증 등 각종 기능을 제공하는 수단으로 활용되면서 NFC 모바일 서비스 시장이 급성장할 것으로 전망되고 있다. 하지만 현재 NFC 기반의 다양한 서비스들은 관련 보안 기술 및 연구가 부족한 실정이다. 그럼에도 불구하고 다양한 NFC 비즈니스 모델을 통한 이윤 창출에 바쁜 국내 업체들은 검증되지 않은 다양한 서비스들을 내놓으며 서비스 활성화에 열을 올리고 있다. 이에 따라 NFC 기반 서비스의 사용이 증가하는 만큼 다양한 보안상 위협요소에 대처하기 힘들 것으로 예상된다. 특히 NFC 간 통신을 위해 사용되는 NDEF 메시지는 이미 그 취약성이 드러나 최초 NDEF 메시지 전송 단계에서 데이터의 위 변조된 이루어지기 때문에 네트워크 통신 단계와 물리적 공간에 보안기술을 적용해 둔다 하더라고 원천적인 문제점의 해결책이 될 수 없다. 따라서 본 논문에서는 NDEF 메시지 상에서의 보안 위협에 대해 분석하고 표준 기술 구조를 고려하여 NDEF 레코드간의 조합을 통한 안전한 NDEF 메시지 전송 기법에 대해 제안한다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2020.05a
• /
• pp.180-183
• /
• 2020

물리적 정보를 이용해 암호 알고리즘의 비밀정보를 분석하는 부채널분석 분야에서도 딥러닝을 접목한 분석방법들이 활발히 제안되고 있다. 본 논문에서는 소비전력이 시간축상으로 흐트러지는 현상인 지터가 있는 파형을 신경망의 특성을 기반으로 효과적으로 분석하는 방법을 제안한다. 제안한 방법을 실험적으로 검증하기 위해 지터가 있는 AES-128 파형을 Convolutional Neural Network와 Multi-Layer Perceptron을 기반으로 분석한 결과 제안한 방법을 적용한 신경망은 모든 바이트 키 분석에 성공했으나, 이외의 신경망은 일부 혹은 모든 바이트 키 분석에 실패했다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2008.11a
• /
• pp.1024-1027
• /
• 2008

RFID는 자동 객체 식별 기술로써 유비쿼터스 환경과의 연결을 통해서 적용 범위가 더욱 확대되고 있다. 그러나 RFID 시스템은 전파를 이용하는 통신 구조와 낮은 태그 가격 제약으로 인해서 사용자의 프라이버시 문제와 악의적인 공격노출 등의 위험이 발생하고 있다. 이런 문제점들을 해결하기 위해 물리적인 방법과 암호학적인 접근 방법 등 많은 방법들이 제안되었다. 그 중에서 해시 체인 기법은 다른 방법과 비교하여 강력한 보안 수준을 제공하면서도 간단한 인증 과정이 장점이다. 그러나 재전송 공격과 스푸핑 공격에 취약한 문제점을 가지고 있다. 따라서 본 논문은 기존 해시 체인의 장점을 유지하면서 보안 취약성을 개선한 RFID 인증 프로토콜을 제안한다. 계산 효율성을 고려하여 최소한의 난수와 비트 연산(XOR)을 이용하여 보안 취약성을 개선한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.22 no.6
• /
• pp.1271-1282
• /
• 2012

Recently, security incidents occur continuously, resulting in the leakages of a large amount of the company's confidential and private information. For these reasons, the security technologies such as the authentication and the access control in order to prevent the information leakage are attracting attention. In particular, location-based authentication that utilizes the user's current location information which is used an authentication factor. And it provides more powerful authentication by controlling the users who attempt to access and blocks internal information leakage path. However, location information must be handled safely since it is the personal information. The location based authentication scheme proposed in this paper enhances the stability of the process location information compared with existing relevant location-based authentication protocol. Also it strengthens the end-user authentication by using one-time password. In addition, the proposed scheme provides authentication to prevent information leakage and employs the concept of the user's physical access control. Resultingly, the proposed scheme can provide higher security than the previous studies, while guarantee to low communication cost.

• Convergence Security Journal
• /
• v.19 no.4
• /
• pp.123-132
• /
• 2019

Rapid developments of IT technology has been creating new security threats. There have been more attacks to get patients' sensitive personal information, targeting medical institutions that are relatively insufficient to prevent and defend against such attacks. Although the government has required senior general hospitals to get the ISMS certification since 2016, such a requirement has been burdensome for small and medium-sized medical institutions. Therefore, this study was designed to draw measures to identify and improve the privacy status of the medical institution by dividing it into management, physical and cyber areas for small and medium-sized medical institutions. The results of this study showed that the government should provide financial support and managerial supervision for the improvement of personal information protection of small and medium-sized medical institutions. They also suggested that the government should also provide medical security specialists, continuous medical security education, disaster planning, reduction of medical information management regulations not suitable for small and medium sized institutions.

• Journal of the Korea Society of Computer and Information
• /
• v.15 no.9
• /
• pp.99-107
• /
• 2010

This paper showed that the integrated system to fortify security was much more efficient than the respective system through the analysis of problems from Firewall and IPS system in the existing security systems. The results of problem analysis revealed that there were the delay of processing time and lack of efficiency in the existing security systems. Accordingly, their performance was evaluated by using the separated Firewall, IPS system, and the integrated system. The result of evaluation shows that the integrated security system this paper suggested is five times faster than the existing one in terms of processing speed of response. This paper demonstrated the excellence of the proposed security system is also more than fivefold in session handling per second and six times process speeding in the CPU processing performance. In addition, several security policies are applied, and it provided a fact that it gave an excellent performance when it comes to protecting from harmful traffic attacks. In conclusion, this paper emphasized that fortifying the integrated security system was more efficient than fortifying the existing one considering in various respects such as cost, management, time, space and so on.

• Convergence Security Journal
• /
• v.3 no.2
• /
• pp.57-65
• /
• 2003

A protection profile is the required specification document by consumer groups to specify what security purpose they would like to have in their specialized products. A protection profile assumption is the document that specifies consumer environment in the physical, artificial, network perspective and the contents of intended usage which include usage limitation, the value of latent asset, and additional applications for a TOE (Target of Evaluation). In this paper, we compare the assumptions of the NSA IDS PP and the IDS PP for government.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2016.01a
• /
• pp.317-320
• /
• 2016

본 논문에서는 PC가 사용자를 구분하지 못하여 발생하는 보안 문제점과 개인이 PC를 관리하는 시간이 증가함에 따라 관리자가 미처 신경 쓰지 못하게 되는 보안 문제를 해결하고자 USB 저장 장치와 스마트폰을 이용한 사용자 PC인증 및 PC환경에서의 물리적 외부 접근 차단, 기업 차원이 아닌 개인 차원에서의 저 비용 보안 기술을 적용한 시스템을 구현하였다.

• Convergence Security Journal
• /
• v.11 no.6
• /
• pp.53-58
• /
• 2011

There is increasing use of common commercial operation system and standard PCs to control industrial production systems, and cyber security threat for industrial facilities have emerged as a serious problem. Now these network connected ICS(Industrial Control Systems) stand vulnerable to the same threats that the enterprise information systems have faced and they are exposed to malicious attacks. In particular Stuxnet is a computer worm targeting a specific industrial control system, such as a gas pipeline or power plant and in theory, being able to cause physical damage. In this paper we present an overview of the general configuration and cyber security threats of a SCADA and investigate the attack tree analysis to identify and assess security vulnerabilities in SCADA for the purpose of response to cyber attacks in advance.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.18 no.2
• /
• pp.49-54
• /
• 2018

In this paper, we study the secrecy outage probability when using cooperative diversity and jammer in a relay system based on decode-and-forward. MRC method is used in receiver and eavesdroppers to obtain cooperative diversity. To use the MRC technique, direct links between the sender and receiver, and between the sender and the eavesdropper are used, respectively. Jammers are used to generate intentional noise siganls to increase security capacity. Jammers generate intentional noise, degrading the channel quality of the eavesdropper and helping physical layer security be realized. The secrecy outage probability is used to evaluate security performance. Assume that the system is under the Rayleigh fading channel.