• Annual Conference of KIPS
• /
• 2014.11a
• /
• pp.540-543
• /
• 2014

수많은 데이터를 사용하는 기업 및 기관들은 전용 데이터베이스를 구축하여 모든 정보들을 저장, 관리하고 있다. 개인정보를 포함하여 비인가된 중요 정보들이 저장되어있음에도 불구하고 대부분의 경우 데이터베이스에 대한 보안적용이 되어있지 않거나 아주 미비한 상태이다. 보안사고의 대부분이 데이터베이스에 저장된 중요 정보가 유출되는 점을 보았을 때 데이터베이스 자체에 대한 보안시스템을 구축하여 예방하는 것이 보안사고의 피해를 막을 수 있는 가장 핵심적인 방법이라 할 수 있다. 이에 본 연구에서는 네트워크 패킷을 모니터링하여 데이터베이스의 성능에 영향을 미치지 않고 보안기능을 수행할 수 있는 Sniffing 을 이용한 방안을 제안한다. 제안 보안시스템은 별도의 하드웨어에서 기능을 수행하며 운영 중인 데이터베이스에 서비스의 중단 없이 보안시스템을 구축할 수 있도록 하였다. Sniffing 방식에서 접근제어 기능을 수행 할 수 있도록 알고리즘 설계를 하였으며 감사 로그를 기록할 때 가장 많은 부분을 차지하는 SQL 에 대해 MD5 해시함수를 적용하여 해당 로그에 대한 데이터크기를 크게 줄일 수 있었다. 운영중인 데이터베이스 환경에 영향을 주지 않으면서 높은 수준의 감사성능을 제공하고 다양한 보안 정책을 간단하게 적용할 수 있도록 구현하였으므로 데이터베이스에 저장된 중요정보의 유출을 예방하고, 보안사고가 일어났을 때 추적 및 증거자료로 활용할 수 있을 것이다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.13 no.4
• /
• pp.3-11
• /
• 2003

It is very important to detect and remove original sources of various attacks through networks. One of the effective method to detect the sources is traceback systems. In this paper, we design and implement an agent-based traceback system that does not require the reaction of routers and administrators and does not need numerous log data. In the design, we introduce a traceback server and traceback agents in each network Using sniffing and spoofing, the server transmits a packet with a specific message. The agents detect the packet and provide the information for the server to trace back the original source.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2007.10a
• /
• pp.917-920
• /
• 2007

In this paper, we designed the authentication system for home network service and applied it to actual sensor nodes. SNEP protocol of SPINS provides confidentiality of data and authentication. We achieved authentication key, encryption and decryption applied RCS encryption algorithm of SNEP. In addition, we used pair-wise key pre-distribution for prevention of authentication sniffing in wireless sensor network. The experiment environment consists of a base station receiving data and sensor nodes sending data. Each sensor nodes sends both the data and encrypted authentication key to the base station. The experiences had shown that the malfunction doesn't happen in communication among other groups. And we confirmed in tests that the system is secure when a sensor having malicious propose is added.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.22 no.2
• /
• pp.259-266
• /
• 2012

Malicious rogue AP has been used for variety attacks such as packet sniffing and Man-In-The-Middle Attack. It is used for the purpose of data leakage via 3G network within companies, and the unauthorized AP could be a reason of security incidents even though it is not intended. In this paper, we propose the method for detecting unauthorized access point over 3G networks throughout the RTT (Round Trip Time) value for classification. Through the experiments, we show that the method can classify the AP which is installed by normal way and the AP over 3G networks successfully.

• The KIPS Transactions:PartC
• /
• v.18C no.3
• /
• pp.187-194
• /
• 2011

IEEE 802.11 wireless LAN has become the center of attention for one of the most dominant wireless networking technologies nowadays. In densely deployed wireless LANs, mobile stations are exposed to a number of AP, thus it is needed to select the best AP to associate with. The most common approach is to select the AP with the highest received signal strength. However it does not consider traffic load imposed to each AP so that it may cause the poor network performance. Therefore, in this paper, we propose a throughput estimation scheme for neighboring APs by sniffing the traffic within 802.11 networks. We devise a tool, named "VirtFrame", which is to estimate the station's capable throughput from neighbor APs based on the channel access time by virtually combining the sniffed frames. Simulation results show that our proposed scheme well matches that there exists correlation between the channel access time and the actual throughput of the APs.

• Journal of the Institute of Electronics Engineers of Korea TC
• /
• v.45 no.1
• /
• pp.14-26
• /
• 2008

IP over Ethernet technology widely used as Internet access uses the ARP(Address Resolution Protocol) that translates an ip address to the corresponding MAC address. recently, there are ARP security attacks that intentionally modify the IP address and its corresponding MAC address, utilizing various tools like "snoopspy". Since ARP attacks can redirect packets to different MAC address other than destination, attackers can eavesdrop packets, change their contents, or hijack the connection. Because the ARP attack is performed at data link layer, it can not be protected by security mechanisms such as Secure Shell(SSH) or Secure Sockets Layer(SSL). Thus, in this paper, we classify the ARP attack into downstream ARP spoofing attack and upstream ARP redirection attack, and propose a new security mechanism using DHCP information for acquisition of IP address. We propose a "DHCP snoop mechanism" or "DHCP sniffing/inspection mechanism" for ARP spoofing attack, and a "static binding mechanism" for ARP redirection attack. The proposed security mechanisms for ARP attacks can be widely used to reinforce the security of the next generation internet access networks including BcN.

• Annual Conference of KIPS
• /
• 2004.05a
• /
• pp.1083-1086
• /
• 2004

Switched Network는 Shared Network 에 비해서 스니핑에 안전하다. 하지만 비교우위일뿐 절대적으로 스니핑에 안전한 것은 아니다. 이미 Switched Network 상에서 스니핑을 할 수 있는 공격툴들이 많이 소개되어 있다. 본 논문에서는 Switched Network 상에서 ARP(Address Resolution Protocol) 스푸핑을 통한 ARP 캐시 오염을 통하여 스니핑이 가능한 시나리오를 기술한다. 이러한 시나리오를 탐지하기 위한 기존의 방법은 DHCP와 같은 동적인 환경이 포함된 경우 False Positive 를 자주 발생시키기 때문에 문제가 된다. 여기에서는 이러한 False Positive를 줄인 탐지 방법을 제시하고자 한다.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2021.05a
• /
• pp.434-437
• /
• 2021

Canopen over EtherCAT(CoE) is a Canopen protocol that operates based on EtherCAT in industrial sites. In order to analyze a CoE network system and a performance through packet sniffing and reversing, it is necessary to know Data Objects structure and changes of its value. However, since Data Objects in Canopen is dependent on the devices, there is a limitation by using an existing packet analysis program like a Wireshark. Therefore, we designed and developed a system that infers Data Objects structure and system configuration.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2016.05a
• /
• pp.348-351
• /
• 2016

Recently on IoT environment, there is necessary of protected network, which is only specific user can access it. Applying OAuth protocol on IoT, it can be easier to construct network authentication system, but it is hard to construct protected network authentication system. And there is weakness of OAuth protocol, which is easily attacked by sniffing Token by attacker. So, it is necessary to secondary authentication for OAuth. In ultimate IoT, the fog computing is essential. Fog computing is extension of cloud that enables networking not only in core system but also in edge system and communication node to node. Strength of fog computing is location awareness, support for mobility, and so on. If authentication in fog computing uses this strength, it can be more specialized in Fog Computing. So, in secondary Authentication, using Cyber-Physical-Social System will increase convenience of user than using existing authentication system, such as authentication certificate, id/password and group key, which is inconvenient for user. This study is about authentication based Cyber-Physical-Social System.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2008.05a
• /
• pp.616-619
• /
• 2008

In this paper, we design and implement the authentication system for home network service and applied it to actual sensor nodes. We achieved authentication key, encryption and decryption applied RC5 encryption algorithm of SNEP. In addition, we used pair-wise key pre-distribution for prevention of authentication sniffing in wireless sensor network. The experiment environment consists of a base station receiving data and sensor nodes sending data. Each sensor nodes sends both the data and encrypted authentication key to the base station. As a simulation environment, we assumed some what-if scenarios of security menaces in home network service. And we slightly altered the TOS_Msg construction of TinyOS. The experiences had shown that the malfunction doesn't happen in communication among other groups. And we confirmed in tests that the system is secure when a sensor having malicious propose is added.