• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.19 no.1
• /
• pp.81-92
• /
• 2009

Recently, there is a drastic increase in users interested in real-time multimedia services in the WLAN environment, as the demand of IEEE 802.11 WLAN-based services increases. However, the handoff delay based on 802.11i security policy is not acceptable for the seamless real-time multimedia services provided to MS frequently moving in the WLAN environment, and there is a possibility of DoS attacks against session key derivation process and handoff mechanism. In this paper, a secure and efficient handoff mechanism in the centralized WLAN environment is introduced to solve the security problems. The 4-way Handshake for both mutual authentication and session key derivation is replaced by the 2-way Reassociation process.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.7 no.2
• /
• pp.107-122
• /
• 1997

Most of the currently used electronic mail system has the threat of security such as illegal leak of message, forgery, uncertain identity, denial of sending and receiving, and so forth. The security for this system is not satisfied yet, thus we explore these problems. In this thesis, we implement the security services for internet mail system which cover the weakness for traditional mail system. This system provides not only security services which PEM and PGP provides (i.e message confidentiality, message integrity, originator authentication, non-repudiation of origin), but also message replay prevention. and non-denial of recipient using certification of contents. In addition, this system increases security of the digital signature by signing with signature block formatting on the creation of it. And it increases security of the digital enveloping by encrypting with encryption block formatting of message encryption key.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.16 no.5
• /
• pp.3-13
• /
• 2006

As computing devices become ubiquitous and increasingly mobile, it becomes obvious that a synchronous and direct peer-to-peer communication model is not sufficient in distributed computing environment. Using an indirect event service instead of other traditional communication model has an advantage of decreasing the coupling of applications in a distributed environment and removing the need for many static dependencies. In this paper, we design and implement the secure event service for providing secure ubiquitous computing environment. The Secure Event Service implemented enables users to perform content-based event retrieval, and supports only eligible event comsumer and event producer can publish and receive events through the secure event service. SPKI/SDSI certificate is used for supporting authentication and authorization in the secure event service. In order to provide a content-based event retrieval, an asynchronous communication between event producers and consumers, and a disconnectedness support for mobile devices, we modify and expand the Javaspace package.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.22 no.3
• /
• pp.473-483
• /
• 2012

To achieve an entire end-to-end security, the classical authentication setting such that all participants have a same password is not practical since a password is not a common secret but a personal secret depending on an individual. Thus, an efficient client to client different password-based authenticated key agreement protocol (for short, EC2C-PAKA) has been suggested in the cross-realm setting. Very recently, however, a security weakness of the EC2C-PAKA protocol has been analyzed by Feng and Xu. They have claimed that the EC2C-PAKA protocol is insecure against a password impersonation attack. They also have presented an improved version of the EC2C-PAKA protocol. In this paper, we demonstrate that their claim on the insecurity of EC2C-PAKA protocol against a password impersonation attack is not valid. We show that the EC2C-PAKA protocol is still secure against the password impersonation attack. In addition, ironically, we show that the improved protocol by Feng and Xu is insecure against an impersonation attack such that a server holding password of Alice in realm A can impersonate Bob in realm B. We also discuss a countermeasure to prevent the attack.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.20 no.6
• /
• pp.111-125
• /
• 2010

There is a growing interest in "smart grid" technology, especially after the government recently announced "low-carbon green-growth industry" project. A smart grid uses "smart meters", which can be deployed in any power-consuming places like homes and factories. It has been shown that smart meters have several security weaknesses. There is, however, no protection profile available for smart meters, which means that safety with using them is not guaranteed at all. This paper analyzes vulnerabilities of smart meters and the relevant attack methods, thereby deriving the security functions and requirements for smart meters. Finally, we propose a protection profile based on Common Criterion v3.l for smart meters.

• Journal of the Korean Society for Aeronautical & Space Sciences
• /
• v.50 no.5
• /
• pp.359-365
• /
• 2022

Air-to-ground missile(AGM), which can be operated by being mounted on the outside of the aircraft, is capable of precision strikes, ensuring high survivability. Helicopter, which is one of the AGM operating platforms, is reported to experience a lightning strike once between 1000 and 20000 flight hours in average. When the lightning strikes the helicopter fuselage, lightning transient signal can be induced to internal and external electronic equipment cables through the skin of the helicopter. If the transient signal exceeding the criteria to electrically initiated device(EID) related to the explosive in the AGM can affect the safety of the helicopter by a warhead explosion, etc. In this paper, we suggest an indirect lightning test method to prove the safety of AGM on helicopter, and present the indirect lightning test results.

• Journal of the Korea Society of Computer and Information
• /
• v.27 no.7
• /
• pp.57-64
• /
• 2022

In this paper, the definition and overview of digital health care that has emerged recently, core technology, and We would like to propose a plan to establish a next-generation information protection system that can protect digital healthcare devices and data from cyber attacks. Various vulnerabilities exist for digital healthcare devices and data, and cyber attacks are possible for those vulnerabilities. Through an attack on digital health care devices and information and communication networks, it can directly adversely affect human life and health, Since digital healthcare data contains sensitive and personal information, it is essential to safely protect it from cyber attacks. In the case of this proposal, for continuous safe management of data and cyber attacks on equipment and communication networks for digital health devices, It is expected to be able to respond more effectively and continuously through the establishment of the next-generation information protection system.

• Journal of the Korean Society for Aeronautical & Space Sciences
• /
• v.49 no.6
• /
• pp.473-480
• /
• 2021

In this paper, We analyze and present improvements to problems in software quality through Static Analysis for Open Source, which is widely used as the Flight Controller software for small unmanned aerial vehicle drones. MISRA coding rules, which are widely applied based on software quality, have been selected. Static analysis tools were used by LDRA tools certified international tools used in all industries, including automobiles, railways, nuclear power and healthcare, as well as aviation. We have identified some safety-threatening problems across the quality of the software, such as structure of open source modules, analysis of usage data, compliance with coding rules, and quality indicators (complexity and testability), and have presented improvements.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.32 no.2
• /
• pp.255-266
• /
• 2022

Messenger applications applied end-to-end encryption on their own to prevent message exposure to servers. Standardization of a group messaging protocol called Message Layer Security (MLS) with end-to-end encryption is being discussed for secure and efficient message communication. This paper performs safety checks based on the operation process and security requirements of MLS. Confidentiality to a middleman server, which is an essential security requirement in messenger communication, can be easily violated by a server administrator. We define a server administrator who is curious about the group's communication content as a curious admin and present an attack in which the admin obtains a group key from MLS. Reminds messenger application users that the server can view your communication content at any time. We discuss ways to authenticate between users without going through the server to prevent curious admin attacks.

• Journal of Platform Technology
• /
• v.10 no.4
• /
• pp.11-24
• /
• 2022

The tool for developing airborne software requires the same level of safety as airborne software because the tool whose output is part of the airborne software and thus could insert an error into the airborne software. This paper describes how to ensure the reliability of the tool output that becomes a part of the airborne software by validating of the input and output files of the tool when generating the ARINC 661 standard UA definition file and the CDS configuration file through the A661UAGEN tool of Hanwha Systems. We present the method to validate XML data structure and contents with an XML schema definition, which is an input of the A661UAGEN tool. And the method to validate the output binary data by using mask data for the corresponding data structure and valid value, which is the output of the A661UAGEN tool, was presented. As such, validation of the input and output of the tool improves the reliability of binary DFs and CDs integrated into the airborne software, allowing airborne software developers to utilize the tool to ensure safety in developing the OFP.