• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.21 no.4
• /
• pp.101-114
• /
• 2011

As it seems like critical information leakages have been increasing due to industrial espionage and malicious internal users, the importance of introducing audit and log security technology is growing every now and then. In this paper, we suggest the session logging system for the company's internal control to meet the SOX legislation level, by monitoring and analyzing users behaviors connecting to the business-critical Operating System. The system proposed in this paper aims to monitor the user's illegal activities in the Operating System, and to present the clear evidence of purpose of those activities by detailed logs. For this purpose, we modified Operating System by adding multiple services suggested in this paper. These services utilize interfaces provided by the existing Operating System and add functions to control access and get logs. The system saves and manages session logs of users or administrators connected to the server with centralized log storage. And the system supports session log searching and lookup features required by SOX legislation for the company's internal controls with the level of computer forensics and logging technology.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.22 no.3
• /
• pp.525-536
• /
• 2012

This paper proposes methods of securing Smart Grid system against various types of cyber threats by separating AMI networks from the public network, the Internet, and providing an AMI specific authentication framework. Due to the fact that thousands and millions of AMI devices to be deployed would be directly or indirectly connected to the public network without any authentication procedures for access control, currently being developed AMI architectures could be widely exposed to considerable number of penetrating attacks. Furthermore, there have not been a sufficient number of researches on authentication frameworks with basis on the specific circumstances of AMI networking that should support varied authentication protocols among security associations and AMI linking devices. This work makes a proposal of isolating smart meters from HAN devices and the Internet and integrating network/application level authentication frameworks with an EAP-based authentication architecture. These approaches are beneficial to deploy AMI with security and efficiency.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.20 no.2
• /
• pp.15-21
• /
• 2010

The user authentication using fingerprint information not only provides the convenience but also high security. However, the fingerprint information for user authentication can cause serious problems when it has been compromised. It cannot change like passwords, because the user only has ten fingers on two hands. Recently, there is an increasing research of the fuzzy fingerprint vault system to protect fingerprint information. The research on the problem of fingerprint alignment using geometric hashing technique carried out. This paper proposes the hardware architecture fuzzy fingerprint vault system based on geometric hashing. The proposed architecture consists of software and hardware module. The hardware module has charge of matching between enrollment hash table and verification hash table. Based on the experimental results, the execution time of the proposed system with 36 real minutiae is 0.2 second when 100 chaff minutiae, 0.53 second when 400 chaff minutiae.

• The Journal of the Convergence on Culture Technology
• /
• v.8 no.2
• /
• pp.373-377
• /
• 2022

Wireless sensor networks are being used in various fields. Wireless sensor networks are applied in many areas, such as security, military detection, environmental management, industrial control, and home automation. There is a problem about the limit of energy that the sensor network basically has. In this paper, we propose the LEACH-CCBD (Low Energy Adaptive Clustering hierarchy - Centrailized with Cluster and Basestation Distance) algorithm that uses energy efficiently by improving network transmission based on LEACH-C among the representative routing protocols. The LEACH-CCBD algorithm is a method of assigning a cluster head to a cluster head by comparing the sum of the distance from the member node to the cluster distance and the distance from the cluster node to the base station with respect to the membership of the member nodes in the cluster when configuring the cluster. The proposed LEACH-CCBD used Matlab simulation to confirm the performance results for each protocol. As a result of the experiment, as the lifetime of the network increased, it was shown to be superior to the LEACH and LEACH-C algorithms.

• Journal of the Korea Society of Computer and Information
• /
• v.27 no.2
• /
• pp.107-114
• /
• 2022

Delegation is a powerful mechanism that allocates access rights to users to provide flexible and dynamic access control decisions. It is also particularly useful in a distributed environment. Among the representative delegation models, the RBDM0 and RDM2000 models are role delegation as the user to user delegation. However, In RBAC, the concept of inheritance of the role class is not well harmonized with the management rules of the actual corporate organization. In this paper, we propose an Adding Attributes on Permission-Based Delegation Model (ABDM) that guarantees the permanence of delegated permissions. It does not violate the separation of duty and security principle of least privilege. ABDM based on RBAC model, supports both the role to role and user to user delegation with an attribute. whenever the delegator wants the permission can be withdrawn, and A delegator can give permission to a delegatee.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.22 no.1
• /
• pp.163-170
• /
• 2022

This paper introduces a method of extracting facial features due to unrefined inputs in real life and improving the problem of not guaranteeing the ideal performance and speed of the object recognition model through a storage algorithm through weight summation. Many facial recognition processes ensure accuracy in ideal situations, but the problem of not being able to cope with numerous biases that can occur in real life is drawing attention, which may soon lead to serious problems in the face recognition process closely related to security. This paper presents a method of quickly and accurately recognizing faces in real time by comparing feature points extracted as input with a small number of feature points that are not overfit to multiple biases, using that various variables such as picture composition eventually take an average form.

• Annual Conference of KIPS
• /
• 2010.04a
• /
• pp.729-732
• /
• 2010

통신망의 발달로 다양한 인터넷 기반 기술들이 등장함에 따라 현재는 데이터뿐만 아닌 음성에 대한 부분도 IP 네트워크를 통해 전송하려는 움직임이 발판이 되어 VoIP(Voice Over Internet Protocol)라는 기술이 등장하였다. SIP(Session Initiation Protocol) 프로토콜 기반 VoIP 서비스는 통신 절감 효과가 큰 장점과 동시에 다양한 부가서비스를 제공하여 사용자 수가 급증하고 있다. VoIP 서비스는 호(Call)를 제어하기 위해 SIP 기반으로 구성이 되며, SIP 프로토콜은 IP 망을 이용하여 다양한 음성과 멀티미디어 서비스를 제공하게 되는데 IP 프로토콜에서 발생하는 인터넷 보안 취약점을 그대로 동반하기 때문에 DoS(Denial of Service) 및 DDoS(Distribute Denial of Service)에 취약한 성향을 가지고 있다. DDoS 공격은 단시간 내에 대량의 패킷을 타깃 호스트 또는 네트워크에 전송하여 네트워크 접속 및 서비스 기능을 정상적으로 작동하지 못하게 하거나 시스템의 고장을 유도하게 된다. 인터넷 기반 생활이 일상화 되어 있는 현 시점에서 안전한 네트워크 환경을 만들기 위해 DDoS 공격에 대한 대응 방안이 시급한 시점이다. DDoS 공격에 대한 탐지는 매우 어렵기 때문에 근본적인 대책 마련에 대한 연구가 필요하며, 정상적인 트래픽 및 악의적인 트래픽에 대한 탐지 시스템 개발이 절실히 요구되는 사항이다. 본 논문에서는 SIP 프로토콜 및 공격기법에 대해 조사하고, DoS와 DDoS 공격에 대한 특성 및 종류에 대해 조사하였으며, SIP를 이용한 VoIP 서비스에서 IP 분류와 메시지 중복 검열을 통한 DDoS 공격 탐지기법을 제안한다.

• The Journal of Korean Institute of Next Generation Computing
• /
• v.13 no.2
• /
• pp.7-17
• /
• 2017

In this paper, we propose the TPS (TPM-enhanced Privacy Protection System) which is an automated privacy protection system enhanced with a TPM (Trusted Platform Module). The TPS detects documents including personal information by periodic scanning the disk of clients at regular intervals and encrypts them. Hence, system manages the encrypted documents in the server. In particular, the security of TPS was greatly enhanced by limiting the access of documents including the personal information with regard to the client in an abnormal state through the TPM-based platform verification mechanism of the client system. In addition, we proposed and implemented a VTF (Virtual Trusted File) interface to provide users with the almost identical user interface as general document access even though documents containing personal information are encrypted and stored on the remote server. Consequently, the TPS automates the compliance of the personal information protection acts without additional users' interventions.

• Journal of the Korea Society of Computer and Information
• /
• v.28 no.11
• /
• pp.73-80
• /
• 2023

In this paper, a technology to protect important information from access in order to revitalize the cloud service market. A technology is proposed to solve the risk of leakage of important confidential and personal information stored in cloud systems, which is one of the various obstacles to the cloud service market. To protect important information, access control rights to cloud resources are granted to cloud service providers and general users. The system administrator has superuser authority to maintain and manage the system. Client computing services are managed by an external cloud service provider, and information is also stored in an external system. To protect important in-house information within the company, all users, it was designed to provide access authority with users including cloud service providers, only after they are authenticated. It is expected that the confidentiality of cloud computing resources and service reliability achieved through the proposed access control technology will contribute to revitalizing the cloud service market.

• Journal of the Korea Society of Computer and Information
• /
• v.28 no.12
• /
• pp.105-114
• /
• 2023

In this paper, we propose a deployment and operation scheme of UxNB network toward mobile IAB. By operating a UxNB network based on SDN(Software Defined Network), UxNBs are deployed in areas where mobile communication services are desired. After deploying UxNB in the service area, IAB can be set up to perform mobile communication services. For this purpose, this paper first proposes a UxNB Network Controller consisting of a UAV Controller and an SDN Controller, and proposes the necessary functions. Next, we present a scenario in which a UxNB network can be deployed and operated in detail step by step. We also discuss the location of the UxNB network controller, how to deliver control commands from the UAV controller to the UxNB, how to apply IAB for UxNB networks, optimization of UxNB networks, RLF(radio link failure) recovery in UxNB networks, and future research on security in UxNB networks. It is expected that the proposed UxNB Network Controller architecture and UxNB network deployment and operation will enable seamless integration of UxNB networks into Mobile IAB.