• Review of KIISC
• /
• v.8 no.3
• /
• pp.105-114
• /
• 1998

최근 정보 보안 및 전자 상거래 관련된 영역에서 cdrtificate(인증), certificate authirity(인증기관) 및 Public key Infrastructure(공개키 기반 구조) 등에 대한 관심이 고조되고 있다. 이러한 기술은 보안의 기본 요소인 인증 (authentication), 기밀성(confidentiality), 무결성(Integrity)및 부인봉쇄(non-repudiation)등의 기능을 커다란 규모의 시스템에 적용할 수 있는 거의 유일한 solution이 될 것이 확실하다. 이 자료에서는 CA(Certificate Authority)관련 기술 자체에 대한 자세한 설명보다는 개념적인 차원에서의 소개와 적용 영역 및 적용 model에 대해 소개하였다.

• Information and Communications Magazine
• /
• v.34 no.3
• /
• pp.29-36
• /
• 2017

모바일 결제, 스마트 뱅킹 등 우리 생활의 일상적인 금융 업무에서 차별화된 편의성을 제공하기 시작한 핀테크 서비스는 사람들의 높은 관심을 받고 빠르게 확산되고 있다. 고도화된 해킹, 정보 유출 등 보안사고가 빈번하게 발생하고 있는 현재의 ICT 서비스 환경에서도 전자금융 서비스가 보안 이외에 소비자의 이용 편의에 관심을 갖고 서비스할 수 있도록 지원한 대표적인 보안 기술은 글로벌 표준으로 자리잡은 FIDO 인증 기술이다. FIDO는 지문, 홍채, 정맥 등 높은 보안성과 편의성을 갖춘 다양한 인증 수단을 지원하여 패스워드와 같은 기존 인증 수단을 빠르게 대체하고 있는 중이다. 본고에서는 현재 상용화 적용되어 보편적인 인증플랫폼으로 자리잡기 시작한 FIDO의 추가적인 인증 요소로서 활용되어 보안을 좀 더 강화할 수 있는 상황인지 기반 인증 기술에 대해 소개하고자 한다. 본 고에서 소개되는 상황인지 기반 인증 기술은 사용자의 고유한 행동적 특징과 환경적 특징을 기계학습 기법을 통해 분석하여 사용자 본인여부를 확인할 수 있는 기술로 사용자에게 명시적인 인증 절차를 요구하지 않아 이용 불편 없이 기존 서비스에 쉽게 적용될 수 있고, 타인이 위조하기 어려운 행동 및 환경적 특징을 활용하는 장점을 갖고 있어 향후 핀테크 서비스의 보안을 한단계 끌어 올려줄 기술로 활용이 기대된다.

• Convergence Security Journal
• /
• v.11 no.3
• /
• pp.91-98
• /
• 2011

Medical information system based on ad hoc network designed for general information systems and information networks have different security requirements. Malicious code infiltration and security features are performed on same medical information network architecture along the route. Security domain of medical information systems is the ground of penetration and defense performed over the network architecture and it is also the traffic handling areas separated by a concept of differentiated group. Ad hoc-based medical information systems in the network security domain, set some standards about what should be the methodology of this study. In this paper, medical information system network configuration, the determining factor based on the security domain, the structure selection criteria and blocking positionings are presented according to the traffic route configuration. If you apply this methodology designed to increase security, efficiency can be possible. Health information systems in accordance with the security domain areas requires differentiated protection needs of the security mechanism that is proposed by this study.

• Convergence Security Journal
• /
• v.11 no.3
• /
• pp.39-46
• /
• 2011

Smart environment of health information technology, u-Healthcare architecture, ad-hoc networking and wireless communications environment are major factors that increase vulnerability of u-healthcare information systems. Traffic domain is the concept of network route that identifies the u-Healthcare information systems area as the traffic passing and security technologies application. The criterion of division is an area requiring the application of security technology. u-Healthcare information system domains are derived from the intranet section. the public switched network infrastructure, and networking sectors. Domains of health information systems are separated by domain vulnerability reason. In this study, domain-specific security vulnerability assessment system based on the USN in u-Healthcare system is derived. The model used in this study suggests how to establish more effective measurement USN-based health information network security vulnerability which has been vague until now.

• Korean Security Journal
• /
• no.39
• /
• pp.269-294
• /
• 2014

Korea is concerned with information security industry due to recent leak-out private information of 3 card companies. Executives are aware of damage from breach of security such as personal data spill, is more dangerous than any other financial risks. The information security industry, which was limited in physical security and network security formerly, is evolving into convergence security of public and facility security industry. The field of interest has also been changed into security of smart phone and intelligence image recently, from firewall or Anti-virus. The convergence security is originally about access control of facility, but recently its demand has been increased mostly by public institutions and major companies. The scope of the industry also varies from finance, education, distribution, national defense, medical care to automobile industry. The market of convergence security has been expanded and new various products and services of security of intelligent vehicle, 'U' healthcare, finance, smart grid and key industries are also developed. It is required to create and enhance of new curriculum and cultivate human resources for the development of knowledge information security industry. Raising standard of education and security consciousness of the nation is also necessary to strengthen the global competitiveness.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.15 no.6
• /
• pp.1320-1326
• /
• 2011

National institutions on the importance of information security is being recognized, information security laws are being discussed in Congress 3.4 DDoS incident and Nonghyup hacking, etc. However, National Assembly Secretariat when the results of the Information Security Consulting has been assessed very low 61.2 points, evaluation of hardware and software in secure areas were vulnerable. This paper, the legislative support agencies National Assembly and National Assembly Secretariat on the network and computer systems, and managerial, technical and physical security elements are analyzed for the status. And network should have the legislative support agencies and system for the physical network separation, DDoS attack response, Virus attack response, hacking attacks response, and Cyber Emergency Response Team/Coordination Center for Cyber infringing design and research through the confidentiality, integrity, availability, access control, authentication and security analysis is based on the evaluation criteria. Through this study, the legislative support agencies to strengthen the security of data and security laws enacted to provide the basis for.

• Journal of Digital Convergence
• /
• v.10 no.3
• /
• pp.113-119
• /
• 2012

Even though the rapid development of IT technique accelerates informationization for quality improvement of university, security measures are needed for security problems because the major information related to academic affairs is centered on academic database. In this paper, we research and analyze the actual condition of database security of domestic university to develop process model that can consistently keep and improve the security of academic database which is the most important data in university. Also, considering the situation that a lot of universities can't use database security product, we propose details that implement the most important key part like confidentiality with the function that DBMS provides only.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.29 no.3
• /
• pp.657-673
• /
• 2019

As various IT and OT systems such as Electronic Chart Display and Information System and Automatic Identification System are used for ships, security elements that take into account even the ship's construction and navigation environment are required. However, cyber security research on the ship and shipbuilding ICT equipment industries is still lacking, and there is a lack of systematic methodologies through threat modeling. In this paper, the Data Flow Diagram was established in consideration of stakeholders approaching the ship system. Based on the Attack Library, which collects the security vulnerabilities and cases of ship systems, STRIDE methodologies and threat modeling using the Attack Tree are designed to identify possible threats from ships and to present ship cyber security measures.

• Review of KIISC
• /
• v.33 no.4
• /
• pp.95-102
• /
• 2023

IMT-2030(6G)은 IMT-2020(5G)에 비교하여 많은 서비스와 기능들이 추가되고 있다. IMT-2030(6G) 요소기술 개발은 산업계에서 매우 빠르게 진행되고 있으며, 이러한 기술을 기반으로 표준개발이 ITU-R WP 5D, 3GPP 등 여러 기구에서 동시다발적으로 진행이 되고 있다. Open RAN은 시점으로는 5G 이후에 출현한 기술이지만 5G를 기반으로 실현이 가능함을 산업계에서는 보여주고 있다. 이러한 기술들을 구분 짓고 체계화 하는 것이 표준기구의 역할이라고 할 수 있다. ITU-R WP 5D 제44차 회의(2023년 6월)에서 이번 회기(2020-2023)를 종료하며 완성한 IMT Framework 문서의 내용을 기반으로 AI와 정보보호가 융합한 지능형 보안관제의 필요성, 구조와 기능에 대하여 살펴본다.

• Information and Communications Magazine
• /
• v.34 no.3
• /
• pp.74-79
• /
• 2017

사물인터넷(Internet of Things, IoT) 기술의 발전에 따라 서비스 또한 다양해지고 있으며 실제 삶 속에 스며들어가고 있다. 이러한 사물인터넷 기술은 산업체에게 새로운 시장 창출의 기회를 제공하고 있고 사용자에게는 더욱 스마트한 삶을 영위할 수 있도록 해준다. 그러나 빠르게 증가하면서 연결되는 사물들에 보안 기술이 안전하게 적용되지 않을 경우 새로운 위협 요소가 된다. 본고에서는 미흡한 보안 설정으로 인해 야기되는 IoT 장치에 대한 보안 공격 동향과 이에 대응하기 위해 제안되는 안전한 초기 설정 방법들에 대해 알아본다.