• Journal of the Korea Society of Computer and Information
• /
• v.15 no.1
• /
• pp.139-147
• /
• 2010

A remote user authentication scheme is a two-party protocol whereby an authentication server in a distributed system confirms the identity of a remote individual logging on to the server over an untrusted, open network. In 2005, Liao et al. proposed a remote user authentication scheme using a smart card, in which users can be authenticated anonymously. Recently, Yoon et al. have discovered some security flaws in Liao et al.'s authentication scheme and proposed an improved version of this scheme to fix the security flaws. In this article, we review the improved authentication scheme by Yoon et al. and provide a security analysis on the scheme. Our analysis shows that Yoon et al.'s scheme does not guarantee not only any kind of authentication, either server-to-user authentication or user-to-server authentication but also password security. The contribution of the current work is to demonstrate these by mounting two attacks, a server impersonation attack and a user impersonation attack, and an off-line dictionary attack on Yoon et al.'s scheme. In addition, we propose the enhanced authentication scheme that eliminates the security vulnerabilities of Yoon et al.'s scheme.

• Convergence Security Journal
• /
• v.21 no.3
• /
• pp.25-30
• /
• 2021

Due to the current COVID-19 pandemic, companies and institutions are introducing virtual desktop technology, one of the logical network separation technologies, to establish a safe working environment in a situation where remote work is provided. With the introduction of virtual desktop technology, companies and institutions can operate the network separation environment more safely and effectively, and can access the business network quickly and safely to increase work efficiency and productivity. However, when introducing virtual desktop technology, there is a cost problem of high-spec server, storage, and license, and it is necessary to supplement in terms of operation and management. As a countermeasure to this, companies and institutions are shifting to cloud computing-based technology, virtual desktop service (DaaS, Desktop as a Service). However, in the virtual desktop service, which is a cloud computing-based technology, the shared responsibility model is responsible for user access control and data security. In this paper, based on the shared responsibility model in the virtual desktop service environment, we propose a cloud-based hardware security module (Cloud HSM) and edge-DRM proxy as an improvement method for user access control and data security.

• Convergence Security Journal
• /
• v.22 no.3
• /
• pp.101-110
• /
• 2022

As the cases of using artificial intelligence in various fields increase, attempts to solve various issues through artificial intelligence in the intrusion detection field are also increasing. However, the black box basis, which cannot explain or trace the reasons for the predicted results through machine learning, presents difficulties for security professionals who must use it. To solve this problem, research on explainable AI(XAI), which helps interpret and understand decisions in machine learning, is increasing in various fields. Therefore, in this paper, we propose an explanatory AI to enhance the reliability of machine learning-based intrusion detection prediction results. First, the intrusion detection model is implemented through XGBoost, and the description of the model is implemented using SHAP. And it provides reliability for security experts to make decisions by comparing and analyzing the existing feature importance and the results using SHAP. For this experiment, PKDD2007 dataset was used, and the association between existing feature importance and SHAP Value was analyzed, and it was verified that SHAP-based explainable AI was valid to give security experts the reliability of the prediction results of intrusion detection models.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.20 no.3
• /
• pp.558-564
• /
• 2016

The network interference gives positive and negative effects to security and QoS simultaneously by disturbing the decoding of receiver and eavesdropper. The transmission of artificial noise enables to indirectly control these contradicting effects. This paper proposed the secrecy enhancement technique via artificial noise with protected zones of transmitter and receiver and investigated its gain by using stochastic geometry. For given arbitrary artificial noise power ratio, we first analyzed connection outage probability and secrecy outage probability for four different scenarios (separated, overlapped, included secrecy protected zones- type A, B) according to distance and size of protected zones of the transmitter and receiver. We then derive the secrecy transmission rate and find the optimal artificial noise power ratio to maximize it. Finally, with numerical examples, we investigate the effects of the system parameters such as size of protected zones of transmitter and receiver on the optimal artificial noise power ratio.

• Convergence Security Journal
• /
• v.15 no.4
• /
• pp.43-55
• /
• 2015

The effective cyber capability assessment methodology does not exist, it's difficult to check the current state of the our country's cyber capabilities and to establish cyber capability enhancement plan based on the result of assessment. The cyber capability assessment is necessary in order to determine the current level of the country, establish policy directions and provide the basis for effective budgeting. But assessment of national cyber capability is multi-criteria decision makink problem. In this paper develops an assessment model based on the AHP and TOPSIS. AHP is used to determine weight of the criteria and TOPSIS method is used to obtain final ranking. We also introduce the result of four major nations cyber capability assessment using the proposed methodology. The experiment used the virtual experimental data. And the result show that the proposed methodology can expand the number of criteria and alternatives for assessment and provide more sophisticated mathematical base for objective assessment comparing methodology using AHP only.

• International Journal of Computer Science & Network Security
• /
• v.24 no.2
• /
• pp.158-168
• /
• 2024

There is hardly any person in modern times who has not taken soft drinks instead of drinking water. The rate of people taking soft drinks being surprisingly high, researchers around the world have cautioned from time to time that these drinks lead to weight gain, raise the risk of non-communicable diseases and so on. Therefore, in this work an image-based tool is developed to monitor the nutritional information of soft drinks by using deep convolutional neural network with transfer learning. At first, visual saliency, mean shift segmentation, thresholding and noise reduction technique, collectively known as 'pre-processing' are adopted to extract the location of drinks region. After removing backgrounds and segment out only the desired area from image, we impose Discrete Wavelength Transform (DWT) based resolution enhancement technique is applied to improve the quality of image. After that, transfer learning model is employed for the classification of drinks. Finally, nutrition value of each drink is estimated using Bag-of-Feature (BoF) based classification and Euclidean distance-based ratio calculation technique. To achieve this, a dataset is built with ten most consumed soft drinks in Bangladesh. These images were collected from imageNet dataset as well as internet and proposed method confirms that it has the ability to detect and recognize different types of drinks with an accuracy of 98.51%.

• The Journal of Society for e-Business Studies
• /
• v.17 no.4
• /
• pp.57-68
• /
• 2012

As the functions and technology of IT security solution has been diversified and complicated, it is necessary to make the functions standardized. The common criteria (CC) evaluation and certification scheme was introduced with this background in 2000. For over 10 years after the introduction of CC evaluation and certification scheme, many security solution vendors have developed functions following the security functional requirement in CC. Most of CC evaluators and developers think that CC has helped to enhance the security of the solution. So, it is a right time to prove the affirmative effects of CC in quantity. In this research, we compare two cases, the security status of the solution before and after the experience of CC evaluation, and analyze the results. We made the questionnaire for the domestic solutions vendors. We show that CC has made positive effects on the security of the solution quantitatively using statistical analysis. This research is meaningful security enhancement of domestic security solutions.

• Korean Security Journal
• /
• no.56
• /
• pp.83-105
• /
• 2018

Special security guards play the role to safely operate and manage nuclear power plants from unintended internal and external threats. Physical fitness management of special security guards is one of the most important factors for improving and maintaining the level of physical protection. Thus, the purpose of this study is to analyze the physical fitness factor and physical fitness level required for mission accomplishment through job analysis of special security guards. The special security guards of Nuclear Power Plant in Korea were performing 7 jobs, 26 duties, 159 tasks. In order to accomplish theses tasks, the following physical fitness were required: muscle strength and muscle endurance of the hand, upper limb, lower limb and core, quickness, agility and Cardio function. The duties that require a lot of physical fitness were in the order of conducting arrest and self-defense, conducting unarmed defensive tactics, demonstrating proficiency with semiautomatic rifle, using protective equipment, performing emergency plan and defensive strategy, etc. The results of this study are expected to provide basic data necessary for establishing guidelines for fitness qualification and training of special security guards in the future and contribute to enhancement of physical protection of nuclear power plants.

• Journal of Advanced Navigation Technology
• /
• v.17 no.1
• /
• pp.24-32
• /
• 2013

Authentication is one of the necessary elements in the network environment. Many researches have detected security vulnerabilities to the existing authentication mechanisms and suggested secure mutual authentication protocols by resolving these vulnerabilities. The representative ones of them are SPMA(Strong Pass Mutual Authentication) and I-SPMA(Improved Strong Password Mutual Authentication). However, these protocols cause a critical problem when the shared secret information is de-synchronized between the server and the client. This paper proposes a revised protocol to resolve the de-synchronization problem. Based on a security assessment on the proposed protocol, we consider the proposed protocol is safer than the previous ones and possible to effectively make a user authentication system mre secure.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.11 no.5
• /
• pp.131-137
• /
• 2011

Recently Lin et al. proposed a simple remote user authentication scheme using smart cards. But the proposed scheme has not satisfied security requirements which should be considered in the user authentication scheme using the password based smart card. In this paper, we show that Lin et al.'s scheme is insecure against off-line password guessing attack. In their scheme, any legal user's password may be derived from the password guessing when his/her smart card is stolen and the secret information is leaked from the smart card by an attacker. Accordingly, we demonstrate the vulnerability of their scheme and present an enhancement to resolve such security weakness. Our proposed scheme can withstand various possible attacks including password guessing attack. Furthermore, this improved scheme can provide mutual authentication to improve the security robustness. Performance evaluation shows that the proposed scheme is relatively more effective than Lin et al.'s scheme.