• Proceedings of the Korean Information Science Society Conference
• /
• 2001.04a
• /
• pp.781-783
• /
• 2001

최근 정보가전과 홈네트워크산업이 급속히 발전됨에 따라 가정이 하나의 네트워크망을 형성하고 있다. 이에 홈네트워크에서도 보안의 필요성을 인식하게 되었으며, 유해사이트 차단은 필수가 되었다. 이러한 사이트 차단을 위해 기존의 유닉스, 리눅스는 lib9pcap 라이브러리 윈도우즈는 NDIS의 API를 이용한 응용계층에서의 패킷 필터링방법을 지원한다. 하지만 이와 같은 방법은 가정의 시스템 성능과 지속적으로 추가되는 홈서버의 기능으로 인해 시스템에 많은 부하를 발생시킨다. 본 논문은 이러한 부하를 최소화하기 위해 시스템 성능이 좋은 커널 모듈을 이용한 패킷 필터링 방법을 제시하고 이를 활용한 유해사이트 차단 시스템의 구현 예를 보인다.

• Proceedings of the Korean Information Science Society Conference
• /
• 2003.04d
• /
• pp.139-141
• /
• 2003

PC의 주변장지를 사용하기 위한 운영체제의 디바이스 드라이버의 구현은 하드웨어에 대한 정확한 명세가 없으면, 많은 노력과 비용이 요구된다. 현재 대부분의 PC 주변장치를 생산하는 업체는 리눅스를 위해서 별도의 디바이스 드라이버와 사용자 인터페이스 프로그램을 제공하고 있지 않다. 본 논문에서는 윈도우 운영체제에서 사용하기 위해 만들어진 MP3 Player의 디바이스 드라이버 및 사용자 프로그램이 윈도우 상에서 작동되는 내부적인 과정을 분석하고 리눅스의 proc 파일 시스템을 이용하여 하드웨어의 명세 및 프로토콜을 조사하였다. 그리고 여기에서 얻은 장치의 정보를 리눅스를 위만 디바이스 드라이버 린 사용자 프로그램의 구현에 응용하여, 리눅스 환경에서 적은 비용과 시간을 들여 디바이스 드라이버를 개발하는 방법을 제안한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.2
• /
• pp.319-323
• /
• 2023

In intra-process isolation, file descriptors work as another attack vector from the memory corruption attacks. The attacker can read or write by corrupting file descriptors so they can escape the isolation. In this paper, we propose new lightweight capability-based access control system on file descriptor using ARM's hardware extension, PA(Pointer Authentication). Our system was implemented on Linux kernel module, only shows 5% overhead to control the access on the file descriptor.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2022.11a
• /
• pp.295-296
• /
• 2022

작물을 경작 해충과 질병은 오랫동안 주요 관심사였다. 농업에서 병해충을 탐지하기 위해 전통적인 방법을 사용하는 것은 더 이상 높은 효율성을 제공하지 않는다. 오늘날 과학과 인공 지능의 폭발적인 발달로 인해 농업분야의 연구원들은 병해충을 탐지하기 위해 딥 러닝을 적용하고 있다. 최근에 다양한 분야의 문제들을 해결하기 위해 수많은 모델들이 발표되었지만, 많은 병해충 진단 딥러닝을 사용한 방법들은 하드웨어 리소스를 낭비하고 실제 농장에서 사용하기 어렵다. 따라서 본 논문에서는 작물의 병해충을 분류하기 위해 Select Kernel Attention(SK Attention)을 Channel Attention Module 로 변경하여 Decoupling-and-Attention network (DANet)을 하드웨어 리소스 사용을 최소화한다.

• JSTS:Journal of Semiconductor Technology and Science
• /
• v.15 no.1
• /
• pp.48-59
• /
• 2015

In recent years, there are increasing threats of rootkits that undermine the integrity of a system by manipulating OS kernel. To cope with the rootkits, in Vigilare, the snoop-based monitoring which snoops the memory traffics of the host system was proposed. Although the previous work shows its detection capability and negligible performance loss, the problem is that the proposed design is not acceptable in recent commodity mobile application processors (APs) which have become de facto the standard computing platforms of smart devices. To mend this problem and adopt the idea of snoop-based monitoring in commercial products, in this paper, we propose a snoop-based monitor design called S-Mon, which is designed for the AP platforms. In designing S-Mon, we especially consider two design constraints in the APs which were not addressed in Vigilare; the unified memory model and the crossbar switch interconnect. Taking into account those, we derive a more realistic architecture for the snoop-based monitoring and a new hardware module, called the region controller, is also proposed. In our experiments on a simulation framework modeling a productionquality device, it is shown that our S-Mon can detect the rootkit attacks while the runtime overhead is also negligible.

• Journal of the Korea Computer Industry Society
• /
• v.5 no.3
• /
• pp.345-354
• /
• 2004

In these days, such services are popularized as E-commerce, E-government, multimedia services, and home networking applications. Most web traffics generated contemporarily basically use the Hyper Text Transfer Protocol(HTTP). Unfortunately, the HTTP is improper for these applications that comprise significant components of the web traffics. In this paper, we introduce a real-time contents compression architecture that maximizes the web service performance as well as reduces the response time. This architecture is built into the linux kernel-based web accelerating module. It guarantees not only the freshness of compressed contents but also the minimum time delay using an server-state adaptive algorithm, which can determine whether the server sends the compressed message considering the consumption of server resources when heavy requests reach the web server Also, We minimize the CPU overhead of the web server by exclusively implementing the compression kernel-thread. The testing results validates that this architecture saves the bandwidth of the web server and that elapsed time improvement is dramatic.

• The KIPS Transactions:PartC
• /
• v.11C no.6 s.95
• /
• pp.781-786
• /
• 2004

In these days, such services are popularized as E-commerce, E- government, multimedia services, and home networking applications. Most web traffics generated contemporarily basically use the Hyper Text Transfer Protocol(HTTP). Unfortunately, the HTTP is improper for these applications that comprise significant components of the web traffics. In this paper, we introduce a real-time contents compression architecture that maximizes the web service performance as well as reduces the response time. This architecture is built into the linux kernel-based web accelerating module. It guarantees not only the freshness of compressed contents but also the minimum time delay using an server-state adaptive algorithm, which can determine whether the server sends the compressed message considering the consumption of sewer resources when heavy requests reach the web server. Also, We minimize the CPU overhead of the web server by exclusively implementing the compression kernel-thread. The testing results validates that this architecture saves the bandwidth of the web server and that elapsed time improvement is dramatic.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.10 no.12
• /
• pp.5375-5400
• /
• 2016

IOMMU is a hardware unit that is indispensable for DMA. Besides address translation and remapping, it also provides I/O virtual address space isolation among devices and memory access control on DMA transactions. However, currently commodity virtualization platforms lack of IOMMU virtualization, so that the virtual machines are vulnerable to DMA security threats. Previous works focus only on DMA security problem of directly assigned devices. Moreover, these solutions either introduce significant overhead or require modifications on the guest OS to optimize performance, and none can achieve high I/O efficiency and good compatibility with the guest OS simultaneously, which are both necessary for production environments. However, for simulated virtual devices the DMA security problem also exists, and previous works cannot solve this problem. The reason behind that is IOMMU circuits on the host do not work for this kind of devices as DMA operations of which are simulated by memory copy of CPU. Motivated by the above observations, we propose an IOMMU para-virtualization solution called PVIOMMU, which provides general functionalities especially DMA security guarantees for both directly assigned devices and simulated devices. The prototype of PVIOMMU is implemented in Qemu/KVM based on the virtio framework and can be dynamically loaded into guest kernel as a module, As a result, modifying and rebuilding guest kernel are not required. In addition, the device model of Qemu is revised to implement DMA access control by separating the device simulator from the address space of the guest virtual machine. Experimental evaluations on three kinds of network devices including Intel I210 (1Gbps), simulated E1000 (1Gbps) and IB ConnectX-3 (40Gbps) show that, PVIOMMU introduces little overhead on DMA transactions, and in general the network I/O performance is close to that in the native KVM implementation without IOMMU virtualization.

• Journal of the Korea Society of Computer and Information
• /
• v.19 no.4
• /
• pp.35-41
• /
• 2014

In this paper, we proposed the implementation of software-based 2D BitBLT engine on the pSOS operating system and the operation of the BitBLT engine on patient monitoring device was verified. To verify the proposed method on the patient monitoring device, we designed prototype PCB board, and verified the operation. We designed the motherboard by using ARM9-based CPU. Because hardware-based BitBLT module was replaced with software-based one, CPU load problem was weighted. To solve this problem, w changed 400Mhz processor instead of 200Mhz processor. We implemented 2D BitBLT kernel module as a device driver which is one of the key elements of a graphics controller GUI in patient monitoring device.

• The KIPS Transactions:PartA
• /
• v.14A no.4
• /
• pp.235-244
• /
• 2007

Caching and prefetching policies have been used in most of computer systems to compensate speed differences between primary memory and secondary storage devices. In this paper, we design and implement a Flash Cache Core Module(FCCM) on the YAFFS which operates on a file system layer for NAND flash memory. The FCCM is independent of the underlying kernel in order to support its stability and compatibility. Also, we implement the Dirty-Last memory replacement technique considering the characteristics of flash memory, and the waiting queue for pages to be prefetched according to page hit. The FCCM reduced the number of I/Os and the amount of prefetched pages by maximum 55%(20% on average) and maximum 55%(24% on average), respectively, comparing with caching and prefetching policies of Linux.