• The KIPS Transactions:PartC
• /
• v.11C no.1
• /
• pp.31-38
• /
• 2004

In mobile agent environments, migration of an agent occurs continuously due to the mobility of agents. So cascaded delegation can occur among places for delegating the privilege to execute the agent. Because the existing delegation scheme considers only the delegation between two places that participate in migration of an agent, it does not support secure cascaded delegation. In this paper, we propose a cascaded delegation scheme that provides agents with secure cascaded delegation in mobile agent environments. Depending on the trust-relationship among places, the proposed scheme achieves the goal by nesting each delegation token or by nesting only initial token signed by creator of the agent within the signed part of the next immediate delegation token. And we prove that the proposed scheme is secure against the attack of replaying a message and the attack of substituting a delegation token.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.29 no.1C
• /
• pp.25-34
• /
• 2004

In mobile agent environments, cascaded delegations among places occur frequently due to the mobility of agents. Cascaded delegation in mobile agent environments can be defined as the process whereby the delegated place delegates the rights of the delegating place further. The representative study for delegation in mobile agent environments is Berkovits et al.'s study. Their study only defines the messages that is sent between the place executing the agent and the place where the agent migrates. Because their study considers only the delegation between two places which participate in migration of an agent, it is inadequate in the situation that the cascaded delegation is necessary. In other words, the relationships among the messages sent from and to places is necessary. However, their study does not exist the relationships. In this paper, we propose a delegation scheme that provides agents with secure cascaded delegation. The proposed scheme achieves the goal by nesting each delegation token within the signed part of the next immediate delegation token. We prove that the proposed scheme is secure against the attack of replaying a message and of substituting a delegation token.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.30 no.6
• /
• pp.1103-1113
• /
• 2020

Hospitals store and manage personal and health information through the electronic medical record (EMR). However, vulnerabilities and threats are increasing with the provision of various services for information sharing in hospitals. Therefore, in this paper, we propose a model to prevent personal information leakage due to the transmission of patient information in EMR. A method for granting permission to securely receive and transmit patient information from hospitals where patient medical records are stored is proposed using OAuth authorization tokens. A protocol was proposed to enable secure information delivery by applying and delivering the record access restrictions desired by the patient to the OAuth Token. OAuth Delegation Token can be delivered by writing the authority, scope, and time of destruction to view patient information.This prevents the illegal collection of patient information and prevents the leakage of personal information that may occur during the delivery process.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2003.05c
• /
• pp.2241-2244
• /
• 2003

이동 에이전트 환경에서는 에이전트의 이동성으로 인하여 에이전트의 이주(migration)가 연속적으로 발생할 수 있다. 이에 따라 에이전트를 실행할 권한을 위임(delegation)하기 위해 플레이스(place)간에 연속위임(cascaded delegation)이 발생할 수 있다. 기존의 연구는 에이전트 이주에 관련한 두 플레이스만을 위임의 대상으로 고려하기 때문에 연속 위임을 위한 기법으로는 부적절하다. 본 연구에서는 이동 에이전트 환경에서 연속 위임을 안전하게 수행하는 연속 위임 구현 기법을 제안한다. 제안 기법은 플레이스간의 신뢰관계에 따라 각 위임토큰(delegation token)을 다음에 생성되는 위임토큰에 내포시킨 후 서명하는 방법과 에이전트의 송신자에 의해 서명된 초기 토큰(initial token)만을 내포시킨 후 서명하는 방법을 나눠서 사용한다. 또한 본 제안 기법이 메시지 재연에 의한 공격과 위임토큰 치환 공격에 안전함을 증명한다.

• The Journal of Korea Institute of Information, Electronics, and Communication Technology
• /
• v.10 no.4
• /
• pp.340-349
• /
• 2017

This paper is proposed Hadoop security protocol to protect a reply attack and impersonation attack. The proposed hadoop security protocol is consists of user authentication module, public key based data node authentication module, name node authentication module, and data node authentication module. The user authentication module is issued the temporary access ID from TGS after verifing user's identification on Authentication Server. The public key based data node authentication module generates secret key between name node and data node, and generates OTKL(One-Time Key List) using Hash-chain. The name node authentication module verifies user's identification using user's temporary access ID, and issues DT(Delegation Token) and BAT(Block Access Token) to user. The data node authentication module sends the encrypted data block to user after verifing user's identification using OwerID of BAT. Therefore the proposed hadoop security protocol dose not only prepare the exposure of data node's secret key by using OTKL, timestamp, owerID but also detect the reply attack and impersonation attack. Also, it enhances the data access of data node, and enforces data security by sending the encrypted data.

• KIPS Transactions on Software and Data Engineering
• /
• v.4 no.9
• /
• pp.337-346
• /
• 2015

There is great need for efficient user rights management method to provide a flexible service on variety protocols, domains, applications of IoT environments. In this paper, we propose a IoT service platform with CapSG to provide efficient access control for IoT various services of the environment. CapSG uses a token including authentication and access rights to perform authentication and access control service entity providing services. In addition, the generated token for service management, delegation, revocation, and provides a function such as denied. Also, it provides functions such as generation, delegation, disposal and rejection for service token management. In this paper, it provides the flexibility and efficiency of the access control for various services require of the IoT because of it is available to access control specific domain service by using the token group for each domain and is designed to access control using specific service token of tokens group.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.25 no.2
• /
• pp.439-448
• /
• 2015

IoT (Internet of Things) propels current networked communities into a advanced hyper-connected society/world where uniquely identifiable embedded computing devices are associated with the existing internet infrastructure. Therefore, the IoT services go beyond mere M2M (Machine-to-Machine communications) and should be able to empower users with more flexible communication capabilities over protocols, domains, and applications. In addition, The access control in IoT need a differentiated methods from the traditional access control to increase a security and dependability. In this paper, we describe implementation and design of the capability token based system for secure access control in IoT environments. In the proposed system, Authorities are symbolized into concepts of the capability tokens, and the access control systems manage the tokens, creation, (re)delegation and revocation. The proposed system is expected to decrease the process time of access control by using capability tokens.