• The KIPS Transactions:PartC
• /
• v.10C no.6
• /
• pp.763-768
• /
• 2003

In this paper, we propose a S/KEY based authentication protocol using smart cards to address the vulnerebilities of both the S/KEY authentication protocol and the secure one-time password protpcol which YEH, SHEN and HWANG proposed [1]. Because out protpcel is based on public key, it can authenticate the server and distribute a session key without any pre-shared secret. Also, it can prevent off-line dictionary attacks by using the randomly generated user is stored in the users smart card. More importantly, it can truly achieve the strength of the S/KEY scheme that no secret information need be stored on the server.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.29 no.5
• /
• pp.1167-1177
• /
• 2019

In this paper, the improved security operation model based on the vulnerability database is studied. The proposed model consists of information protection equipment, vulnerability database, and a dashboard that visualizes and provides the results of interworking with detected logs. The evaluation of the model is analyzed by setting up a simulated attack scenario in a virtual infrastructure. In contrast to the traditional method, it is possible to respond quickly to threats of attacks specific to the security vulnerabilities that the asset has, and to find redundancy between detection rules with a secure agent, thereby creating an optimal detection rule.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2023.05a
• /
• pp.206-208
• /
• 2023

비대면 활동 및 원격 작업 증가에 따라 문서 파일을 이용한 사이버 공격 빈도가 증가하고 있으며, 별도의 실행 파일 대신 문서 내의 기본적인 기능을 악용하는 문서 공격은 기존의 악성코드 탐지 메커니즘을 우회할 수 있기 때문에 큰 문제가 되고 있다. 이러한 문제에 대응하기 위한 여러 기술 중 CDR 기술은 악성 행위에 이용될 가능성이 있는 액티브 콘텐츠를 제거하거나 비활성화하여 사전에 악성코드로 탐지되지 않았던 파일에 대한 보안성을 제공하지만, 문서의 내용을 분석하고 안전하게 재조합하는 과정에서 오류가 발생하여 전달하고자 했던 내용을 제대로 표현할 수 없게 되거나, 파일을 사용할 수 없게 되는 문제가 발생할 수 있다. 본 논문에서는 파일을 후처리하는 방식으로만 CDR을 적용하는 것이 아니라, 확장 프로그램이나 가상 환경 등을 이용해 문서의 작성 단계에서부터 CDR 처리과정을 거치게 하는 방법을 제안하여 파일 손상이나 내용 누락 문제를 완화하고 사용자의 업무 효율을 높이는 동시에 강화된 보안성을 제공한다.

• Journal of the Korea Society of Computer and Information
• /
• v.29 no.5
• /
• pp.1-10
• /
• 2024

Attackers tend to use similar vulnerabilities when finding their next target IT assets. They also continuously search for new attack targets. Therefore, it is essential to find the potential targets of attackers in advance. Our method proposes a novel approach for efficient vulnerable asset management and zero-day response. In this paper, we propose the ability to detect the IT assets that are potentially infected by the recently discovered vulnerability based on clustering and similarity results. As the experiment results, 86% of all collected assets are clustered within the same clustering. In addition, as a result of conducting a similarity calculation experiment by randomly selecting vulnerable assets, assets using the same OS and service were listed.

• Journal of Service Research and Studies
• /
• v.5 no.2
• /
• pp.111-118
• /
• 2015

Although the development of mobile devices are made us a free life, they were displayed the subject of this financial crime and attacking forces in the other side. Among finance-related crime is become a serious crime that are targeting smartphones by SMS phishing, phishing, pharming, voice phishing etc. In particular, SMS phishing is increased according to phenomenon using the nature of a text message in the mobile. SMS phishing is become new crime due to the burden to the smartphone user. Their crime is also the advanced way from the existing fraud, such as making the malicious apps. Especially it generates loopholes in the law by a method such as using a foreign server. For safe from SMS phishing attacks, proactive pre-diagnosis is even more important rather than post responses. It is necessary to deploy blocking programs for detecting SMS phishing attacks in advance to do this. In this paper we are investigating the process of block types and block apps that are currently deployed and presenting the evaluation of the application of the detection block setting app.

• Journal of Digital Convergence
• /
• v.11 no.12
• /
• pp.495-505
• /
• 2013

This study aims to evaluate the effects of aromatherapy and a foot reflex massage program on the cognition, anxiety, aggressive behavior, and wandering behavior of elderly with dementia. The research design was a non-equivalent control group, quasi-experimental study where 43 subjects were divided into two groups. Aromatherapy and foot reflex massage was administered to the experimental group (N=21), and no treatment was administered to the control group (N=22). The data was analyzed using the ${\chi}^2$-test, t-test, while the repeated measures of ANOVA were utilized with the SPSS/Win 18.0 program. The experimental group did not show significant differences in cognitive function; however, it showed significant differences in anxiety, aggressive behavior, and wandering behavior in relation to the control group. Thus this research suggests aromatherapy and a foot reflex massage program as nursing intervention to improve the quality of life of elderly with dementia.

• Journal of Advanced Navigation Technology
• /
• v.12 no.3
• /
• pp.245-254
• /
• 2008

If the broadcast message is sent, first of all, the privileged users will decode the session key by using his or her personal key, which the user got previously. The user willget the digital information through this session key. As shown above, the user will obtain messages or session keys using the keys transmitted from a broadcaster, which process requires effective ways for the broadcaster to generate and distribute keys. In addition, when a user wants to withdraw or sign up, an effective process to renew a key is required. It is also necessary to chase and check users' malicious activities or attacking others. This paper presents a method called Traitor Tracing to solve all these problems. Traitor tracing can check attackers and trace them. It also utilizes a proactive way for each user to have effective renewal cycle to generate keys.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.25 no.4
• /
• pp.739-747
• /
• 2015

Masking technique that is most widely known as countermeasure against power analysis attack prevents leakage for sensitive information during the implementations of cryptography algorithm. it have been studied extensively until now applied on block cipher algorithms. Masking countermeasure have been applied to international standard SEED algorithm. Masked SEED algorithm proposed by Cho et al, not only protects against first order power analysis attacks but also efficient by reducing the execution of Arithmetic to Boolean converting function. In this paper, we analyze the vulnerability of Cho's algorithm against first order power analysis attacks. We targeted additional pre-computation to improve the efficiency in order to recover the random mask value being exploited in first order power analysis attacks. We describe weakness by considering both theoretical and practical aspects and are expecting to apply on every device equipped with cho's algorithm using the proposed attack method.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.13 no.1
• /
• pp.81-86
• /
• 2009

Almost all network systems provide an authentication mechanism based on user ID and password. In such system, it is easy to obtain the user password using a sniffer program with illegal eavesdropping. The one-time password and challenge-response method are useful authentication schemes that protect the user passwords against eavesdropping. In client/server environments, the one-time password scheme using time is especially useful because it solves the synchronization problem. In this paper, we propose a new identification scheme One Pass Identification. The security of Password base System is based on the square root problem, and Password base System is secure against the well known attacks including pre-play attack, off-line dictionary attack and server comprise. A number of pass of Password base System is one, and Password base System processes the password and does not need the key. We think that Password base System is excellent for the consuming time to verify the prover.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.9 no.3
• /
• pp.627-632
• /
• 2005

Almost all network systems provide an authentication mechanism based on user ID and password. In such system, it is easy to obtain the user password using a sniffer program with illegal eavesdropping. The one-time password and challenge-response method are useful authentication schemes that protect the user passwords against eavesdropping. In client/ server environments, the one-time password scheme using time is especially useful because it solves the synchronization problem. It is the stability that is based on Square Root problem, and we would like to suggest OPI(One Pass Identification), enhancing the stability for all of the well-known attacks by now including Free-playing attack, off-line Literal attack, Server and so on. OPI does not need to create the special key to read the password. OPI is very excellent in identifying the approved person within a very short time.