• Journal of the Korea Society of Computer and Information
• /
• v.28 no.10
• /
• pp.93-101
• /
• 2023

In this paper, as a result of analyzing the TMIS authentication protocol using ECC and biometric information proposed by Chen-Chen in 2023, there were security problems such as user impersonation attack, man-in-the-middle attack, and user anonymity. Therefore, this paper proposes an improved authentication protocol that provides user anonymity to solve these problems. As a result of analyzing the security of the protocol proposed in this paper, it was analyzed to be secure for various attacks such as offline password guessing attack, user impersonation attack, smart-card loss attack, insider attack, perfect forward attack. It has also been shown to provided user privacy by guaranteeing user anonymity and untraceability, which must be guaranteed in TMIS. In addition, there was no significant increase in computational complexity, so the efficiency of execution time was achieved. Therefore, the proposed protocol in this paper is a suitable user authentication protocol for TMIS.

• The Journal of the Korea Contents Association
• /
• v.9 no.1
• /
• pp.115-122
• /
• 2009

In this paper, we proposed scheme that we use a difference of timestamp in time in Ubiquitous environments as we use the Diffie-Hellman method that OTP was applied to when it deliver a key between nodes, and can detect a malicious node at these papers. Existing methods attempted the malicious node detection in the ways that used correct synchronization or directed antenna in time. We propose an intermediate malicious node detection way at these papers without an directed antenna addition or the Trusted Third Party (TTP) as we apply the OTP which used timestamp to a Diffie-Hellman method, and we verify safety regarding this. A way to propose at these papers is easily the way how application is possible in Ubiquitous environment.

• Journal of the Korea Society of Computer and Information
• /
• v.15 no.3
• /
• pp.91-97
• /
• 2010

Recently Hu-Niu-Yang proposed the user authentication scheme to improve Liu et al's scheme. But the Hu-Niu-Yang's scheme has not been satisfied security requirements considering in the user authentication scheme using the password based smart card. In this paper, we proved that Hu-Niu-Yang's scheme is vulnerable to the off-line password guessing attack in case that the attacker steals the user's smart card and extracts the information in the smart card. Also, the improved user authentication scheme solving the security vulnerability was introduced, thus preventing the attacks, such as password guessing attack, forgery attack impersonation attack, and replay attack. For preventing those attacks, the our proposed scheme need more hash functions and exclusive-OR operations than Hu-Niu-Yang's scheme.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.36 no.3C
• /
• pp.133-139
• /
• 2011

Nowadays, it is considered as an important task to protect digital contents from illegal use and reproduction. In many cases, there are secure servers to authenticate the allowed users and the user authentication process is performed by communication between the servers and users. However, if the number of users and contents are increased, the servers should treat a large amount of authentication loads and the authentication cost will be considerably increased. Moreover, this scheme is not adequate for some players in which only a limited function of communication is deployed. In order to solve this problem, this paper proposes an authentication method which can certificate both the digital contents and players, and prevent illegal reproduction without the certification server. The proposed scheme is secure in the replay attack, the man in the middle attack, and data substitution attack.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.31 no.4C
• /
• pp.451-457
• /
• 2006

A peer-to-peer(P2P) network is inherently vulnerable to malicious attacks from participating peers because of its open, flat, and autonomous nature. This paper addresses the problem of effectively defending from active attacks of malicious peers at bootstrapping phase and at online phase, respectively. We propose a secure membership handling protocol to protect the assignment of ID related things to a newly joining peer with the aid of a trusted entity in the network. The trusted entities are only consulted when new peers are joining and are otherwise uninvolved in the actions of the P2P networks. For the attacks in online phase, we present a novel message structure applied to each message transmitted on the P2P overlay. It facilitates the detection of message alteration, replay attack and a message with wrong information. Taken together, the proposed techniques deter malicious peers from cheating and encourage good peers to obey the protocol of the network. The techniques assume a basic P2P overlay network model, which is generic enough to encompass a large class of well-known P2P networks, either unstructured or not.

• The Korean Journal of Applied Statistics
• /
• v.34 no.3
• /
• pp.449-460
• /
• 2021

ASVspoof 2017 deals with detection of replay attacks and aims to classify real human voices and fake voices. The spoofed voice refers to the voice that reproduces the original voice by different types of microphones and speakers. data augmentation research on image data has been actively conducted, and several studies have been conducted to attempt data augmentation on voice. However, there are not many attempts to augment data for voice replay attacks, so this paper explores how audio modification through data augmentation techniques affects the detection of replay attacks. A total of 7 data augmentation techniques were applied, and among them, dynamic value change (DVC) and pitch techniques helped improve performance. DVC and pitch showed an improvement of about 8% of the base model EER, and DVC in particular showed noticeable improvement in accuracy in some environments among 57 replay configurations. The greatest increase was achieved in RC53, and DVC led to an approximately 45% improvement in base model accuracy. The high-end recording and playback devices that were previously difficult to detect were well identified. Based on this study, we found that the DVC and pitch data augmentation techniques are helpful in improving performance in the voice spoofing detection problem.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2000.10a
• /
• pp.825-828
• /
• 2000

본 논문은 IETF에서 레이블 스위치를 제어하기 위하여 표준화가 진행 중인 GSMP 프로토콜에 보안 서비스를 추가하여 네트워크에서 가능한 공격이나 위협과 같은 보안 문제에 대한 해결책을 검토하고 있다. GSMP 프로토콜의 Adjacency 메시지를 통하여 스위치와 컨트롤러사이에 동기화 설정과정에 보안서비스를 위한 정보요소를 추가하여 GSMP 프로토콜에서 메시지 인증, 기밀성, 무결성 보안 서비스를 제공한다. 인증 서비스를 제공하여 메시지에 대한 정당성을 검증중하고 기밀성과 무결성 서비스를 제공하여 메시지의 변조나 재생과 같은 공격을 막을 수 있을 것이다.

• Proceedings of the Korean Information Science Society Conference
• /
• 2006.06c
• /
• pp.292-294
• /
• 2006

상용 응용 소프트웨어들은 주요 정보 및 알고리즘들을 내포하고 있어, 악의적인 역공학자들에 의해 특정 소프트웨어를 decompile하여 자료구조 및 제어 흐름을 분석하려는 공격이 이루어 지고 있다. 본 논문에서는 MS 윈도우 XP 상의 Visual C++ (MFC 포함) 프로그램을 역공학 공격으로부터 보호하기 위한 데이터 obfuscator를 구현하고 그 성능을 평가한다. 구현한 obfuscator는 C++ 소스코드를 입력 받아 3가지의 데이터 obfuscation 알고리즘을 적용한 후, 이를 다시 소스코드로 재생성하는 도구로 큰 성능저하 없이 구현 가능함을 알 수 있다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2022.11a
• /
• pp.246-248
• /
• 2022

최근 블록체인 기술이 발달함에 따라 사이버 범죄자의 공격 대상이 되고 있다. 특히, 암호화폐가 등장하게 되면서 화폐를 관리하는 전자지갑의 보안이 중요해지고 있다. 전자지갑은 내부에 저장된 개인 키를 통해 네트워크에 트랜잭션을 요청하게 되고 사용자 인증을 위해 중앙 기관에 검증을 요청한다. 이때, 전자지갑은 서드파티 취약점에 영향을 받아 공격 대상이 될 수 있다. 따라서, 본 연구에서는 블록체인 환경에서 서드파티 의한 위협으로부터 전자지갑을 보호하는 메커니즘 연구를 진행했다.

• Proceedings of the Korea Society for Industrial Systems Conference
• /
• 2009.05a
• /
• pp.32-36
• /
• 2009

본 논문에서는 DCT영역에서 반복적 이진위상컴퓨터형성홀로그램을 이용한 디지털 영상 워터마킹 기술을 제안하였다. 워터마크로 주로 사용되는 랜덤 시퀸스 또는 로고와 같은 은닉영상 대신 은닉영상을 손실없이 재생할 수 있는 이진위상컴퓨터형성홀로그램을 생성하고, 이를 반복적으로 표현해서 워터마크로 사용한다. 그리고 이 워터마크를 호스트영상의 DCT 계수에 적절한 규칙을 통해 가중치를 부여하여 삽입한 후, IDCT한다. 워터마크의 추출은 워터마킹된 영상과 호스트영상을 DCT하고, 삽입시 적용한 규칙을 통해서 수행한다. 그리고 추출된 워터마크의 역푸리에 변환과 호스트영상에 삽입하기전의 워터마크를 역푸리에 변환하여 재생한 은닉영상과의 상관을 취함으로써 워터마크의 존재여부를 검증한다. 제안한 방법은 워터마크 삽입/추출시 반복되는 홀로그램정보를 활용하고, 이진 값으로 구성되어 있으므로 기존의 어떠한 워터마킹 기술보다 외부 공격에 견실한 특징을 가지고 있으며, 컴퓨터 시뮬레이션을 통해 그 성능을 확인하였다.