• ETRI Journal
• /
• v.33 no.5
• /
• pp.826-829
• /
• 2011

Distributed systems particularly suffer from Sybil attacks, where a malicious user creates numerous bogus nodes to influence the functions of the system. In this letter, we propose a Bloom filter-based scheme, SybilBF, to fight against Sybil attacks. A Bloom filter presents a set of Sybil nodes according to historical behavior, which can be disseminated to at least n (e-1)/e honest nodes. Our evaluation shows that SybilBF outperforms state of the art mechanisms improving SybilLimit by a factor of (1/e)${\gamma}$ at least.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2014.10a
• /
• pp.215-216
• /
• 2014

This paper emphasizes the control of access and authorization based on the roles and the data using activities of users as task performers. Also, it requires to gain the necessary approval in advance for important tasks such as mass inquiry and change on important information to influence the very existence of the whole organization.

• Journal of the Korea Society of Computer and Information
• /
• v.24 no.1
• /
• pp.145-149
• /
• 2019

Various supplementary authentication methods are used to supplement user authentication and authorization provided by existing password verification online1. In recent years, authentication and authorization methods using user attribute information have been studied and utilized in various services. User attribute information can be divided into static information and dynamic information. The existing methods focus on research to identify users using dynamic information or to generate challenge questions for user reauthentication. Static information such as a user's home address, school, company, etc. is associated with dynamic information such as location information. We propose a method to verify user attribute information by using the association between two attribute information. For this purpose, the static information of the user is verified by using the user's location record which is dynamic information. The experiment of this paper collects the dynamic information of the actual user and extracts the static information to verify the user attributes. And we implemented the user attribute information authentication system using the proposal verification method and evaluated the utility based on applicability, convenience, and security.

• Review of KIISC
• /
• v.33 no.4
• /
• pp.47-55
• /
• 2023

자동차 산업에서 전자제어장치 (Electronic Controller Unit, ECU)를 활용한 혁신으로 운전자들은 안전하고 편리한 운전경험을 누리고 있다. 그러나 이와 동시에, 차량 내부 ECU 간의 통신을 지원하는 CAN (Controller Area Network)을 대상으로 한 악의적인 침입과 사이버 공격의 위협 역시 증가하고 있다. 이러한 문제에 대응하기 위해 많은 연구가 진행 중이며, 특히 자동차 침입 탐지 시스템 (Intrusion Detection System, IDS)의 발전이 주목받고 있다. 그러나 대부분의 IDS는 주로 공격을 탐지하는 데 집중되어 있으며, 실제 악의적인 메시지를 전송한 ECU를 정확히 식별하는 데에는 한계점이 있다. 악의적인 ECU를 식별하는 기술은 공격 ECU를 격리시키거나 펌웨어 업데이트 등의 보안 패치를 적용하는데 필수적인 기술이다. 본 고에서는 현재까지 제안된 CAN에서의 악의적인 ECU를 식별하기 위한 기술들에 대해 살펴보고, 비교 분석 및 한계점에 대해 분석하고자 한다.

• Annual Conference of KIPS
• /
• 2011.11a
• /
• pp.531-534
• /
• 2011

본 연구의 목적은 차세대 MEAP 환경에서의 보안 평가 모델을 제시하는 것이다. 기업용 애플리케이션 개발환경은 PES 및 MEAP을 거쳐 완벽한 OSMP구현을 위한 HTML5 환경으로 발전하고 있다. 이와 더불어 보안의 위협도 증대되고 있으나, HTML5 환경에서의 보안에 대한 연구는 미흡한 실정이다. 이러한 문제에 대비하기 위해서는 기존 개발환경의 보안 특징을 살펴볼 필요가 있다. 본 연구에서는 보안위협요소를 Back-End System, Client, Developer, OS 4가지로 도출한 후, 이에 해당하는 보안 위협 문제들을 살펴보고 보안 평가 모델을 제시하였다. 본 모델은 단계별 보안이슈를 포함하고 있으며, 향후 HTML5 시대에 논의될 보안 이슈의 방향성을 제시한다는데 그 의미가 있다. 따라서 본 연구는 기업형 하이브리드 애플리케이션 개발을 준비하는 기업 및 연구자에게 시사점을 제공할 것으로 기대된다.

• Proceedings of the Korean Society of Disaster Information Conference
• /
• 2022.10a
• /
• pp.331-332
• /
• 2022

현행 기계경비지도사는 기계경비업체 수에 비해 과도하게 많은 자격취득자가 배출되어 자격제도의 효과성에 대한 평가가 요구된다. 신규 자격취득자는 높아진 진입장벽으로 기계경비업체로 진출하기 어렵고, 활동 중인 기계경비지도사 또한 경비원을 지도·감독 및 교육하는 직무를 수행하기 어려운 실정이다. 이 연구에서는 효과성이 소멸하고 있는 기계경비지도사의 폐지 및 통합경비지도사로의 개편과 함께 경비지도사 자격시험에 기계경비 관련 과목을 필수과목으로 지정하는 방안 등을 제안한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.21 no.1
• /
• pp.65-75
• /
• 2011

Power Line Communication (PLC) is a system for carrying data on a conductor used for electric power transmission. Recently, PLC has received much attention due to connection efficiency and possibility of extension. It can be used for not only alternative communication, in which communication line is not sufficient, but also for communication between home appliances. Korea Electronic Power Cooperation (KEPCO) is constructing the system, which automatically collects values of power consumption of every household. Due to the randomness and complicated physical characteristics of PLC protocol (KS X4600-1), it has been believed that the current PLC is secure in the sense that it is hard that an attacker guesses or modifies the value of power consumption. However, we show that the randomness of the protocol is closely related to state of the communication line and thus anyone can easily guess the randomness by checking the state of the communication line. In order to analyze the security of PLC, we study the protocol in detail and show some vulnerability. In addition, we suggest that PLC needs more secure protocol on higher layers. We expect that the study of PLC help in designing more secure protocol as well.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.7 no.4
• /
• pp.635-641
• /
• 2006

On the wireless-communication between Electronic Tag of RFID system and Reader, there are some existing problems with weaknesses of security such as spoofing, replay, traffic analysis, position tracking, etc., in the established hash-lock related algorithm. This paper has presented the comparison and analysis of the established hash-lock related algorithm for privacy and in order to make up for this, also suggested a new security authentication algorithm based on hash which has an authentication protocol and creates hash function by using random numbers received from the reader on real-time and every session. The algorithm suggested is able to make RFID wireless authentication system offer a several of usefulness and it has an advantage to reduce the amount of calculations compared to established algorithm. It also uses just the tags needed among a lot of tags around which are expected later and it is expected to reduce a responsibility of the server by ending unnecessary tags' action with time based.

• Journal of the Institute of Electronics Engineers of Korea TE
• /
• v.37 no.3
• /
• pp.72-78
• /
• 2000

In this study, we propose a model verification algorithm based on DCT and neural network for ATM security system. We construct database about facial images after capturing thirty persons facial images in the same lumination and distance. To simulate model verification, we capture four learning images and test images per a man. After detecting edge in facial images, we detect a characteristic area of square shape using edge distribution in facial images. Characteristic area contains eye bows, eyes, nose, mouth and cheek. We extract characteristic vectors to calculate diagonally coefficients sum after obtaining DCT coefficients about characteristic area. Characteristic vectors is normalized between +1 and -1, and then used for input vectors of neural networks. Not considering passwords, simulations results showed 100% verification rate when facial images were learned and 92% verification rate when facial images weren't learned. But considering passwords, the proposed algorithm showed 100% verification rate in case of two simulations.

• The Journal of Korea Institute of Information, Electronics, and Communication Technology
• /
• v.9 no.1
• /
• pp.15-23
• /
• 2016

As various IoT devices appear recently, Cloud Services such as DropBox, Amazon S3, Microsoft Azure Storage, etc are widely use for data sharing across the devices. Although, cryptographic algorithms like AES is prevalently used for data security, there is no mechanisms to allow selectively and flexibly use wider spectrum of lightweight cryptographic algorithms such as LEA, SEED, ARIA. With this, IoT devices with lower computation power and limited battery life will suffer from overly expensive workload and cryptographic operations are slower than what is enough. In this paper, we designed and implemented a CloudGate that allows client programs of those cloud services to flexibly select a cryptographic algorithms depending on the required security level. By selectively using LEA lightweight algorithms, we could achieve the cryptographic operations could be maximum 1.8 faster and more efficient than using AES.