• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.13 no.11
• /
• pp.5653-5672
• /
• 2019

In cloud computing era, an increasing number of resource-constrained users outsource their data to cloud servers. Due to the untrustworthiness of cloud servers, it is important to ensure the integrity of outsourced data. However, most of existing solutions still have challenging issues needing to be addressed, such as the identity privacy protection of users, the traceability of users, the supporting of dynamic user operations, and the publicity of auditing. In order to tackle these issues simultaneously, in this paper, we propose a traceable dynamic public auditing scheme with identity privacy preserving for cloud storage. In the proposed scheme, a single user, including a group manager, is unable to know the signer's identity. Furthermore, our scheme realizes traceability based on a secret sharing mechanism and supports dynamic user operations. Based on the security and efficiency analysis, it is shown that our scheme is secure and efficient.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.13 no.6
• /
• pp.141-148
• /
• 2003

The self-healing key distribution scheme with revocation capability proposed by Staddon et al. enables a dynamic group of users to establish a group key over an unreliable network, and has the ability to revoke users from and add users to the group while being resistant to collusion attacks. In such a protocol, if some packet gets lost, users ale still capable of recovering the group key using the received packets without requesting additional transmission from the group manager. In this scheme, the storage overhead at each group member is O($m^2$1og p) and the broadcast message size of a group manager is O( ((m$t^2$+mt)log p), where m is the number of sessions, t is the maximum number of colluding group members, and p is a prime number that is large enough to accommodate a cryptographic key. In this paper we describe the more efficient self-healing key distribution scheme with revocation capability, which achieves the same goal with O(mlog p) storage overhead and O(($t^2$+mt)log p) communication overhead. We can reduce storage overhead at each group member and the broadcast message size of the group manager without adding additional computations at user's end and group manager's end.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.21 no.1
• /
• pp.177-186
• /
• 2011

Mobile services which are applied PC performance and mobile characteristics are increased with spread of the smartphone. Recently, mobile cloud service is getting the spotlight as a solution of mobile service problems that mobile device is lack of memory, computing power and storage and mobile services are subordinate to a particular mobile device platform. However, mobile cloud service has more potential security threats by the threat inheritance of mobile service, wireless network and cloud computing service. Therefore, security threats of mobile cloud service has to be removed in order to deploy secure mobile cloud services and user and manager should be able to respond appropriately in the event of threat. In this paper, We define mobile cloud service threats by threat analysis of mobile device, wireless network and cloud computing and we propose mobile cloud service countermeasures in order to respond mobile cloud service threats and threat scenarios in order to respond and predict to potential mobile cloud service threats.

• The Journal of the Korea institute of electronic communication sciences
• /
• v.13 no.6
• /
• pp.1155-1160
• /
• 2018

Presently in 2018, the security market is requiring progressive development and innovation in the area of security on account of new changes and technologies. This means the rapid and prompt development of the service platforms and service-based information systems. Here, this study is going to examine the process of operating a number of services and obtaining security, not the criteria for selecting particular service in online environment where the various services exist. Within a series of flows to protect the manager's authority about the platforms operated by information systems, and to provide and destroy services, this author limits the entire service platforms of the optimized balance module into four categories maximum for the security of the area apt for illegal invasion and access, and the proper area. Also, about the area with limited security, this researcher again applies subordinate security policy and technology respectively. This author here will suggest a method to provide and to extend safety and security for the information system and also propose the process of applying it as well.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2004.05b
• /
• pp.412-415
• /
• 2004

As computers and networks become popular, corporation or country organization composes security network including various kinds information protection system to protect informations and resources from internet and is operating system and network. But current firewall and IDS(Intrusion Detection System) of the network level suffers from many vulnerabilities in internal computing informations and resources. In this paper, we design of ICMP-based Traceback System using a ICMP Traceback Message for efficiently traceback without change structure of routers. ICMP-based Traceback System. Create of ICMP message is managed by “Traceback Agent” mirroring port for router. Victim's systems that are received the message store it and “Traceback Manager” is detect a attack(like a DDoS). Using a information of this message starting a traceback and detecting a source of attacker, so response a attack.

• Journal of the Korea Safety Management & Science
• /
• v.8 no.6
• /
• pp.91-108
• /
• 2006

RFID/USN is important infrastructure of the ubiquitous society. And so, It is various and practical research is attempted. These two base technology have physical characteristic and complement relationship. Like this relationship is applied Following example that is system research which manages warehouse stocks and conditions. First, We adhere RFID Tag at the Pallet of the warehouse and do identification goods. And then, It grasps the environment state information of stocks with sensor module which has Zigbee wireless communication function. From like this process RFID Tag information and jop-control command of sensor node also it is exposed to air. Therefore, We control sensor node in USN/RFID environment through the mobile device. And system design for the security Apply of the process is main purpose of this paper's. We propose the condition and function of the mobile device to the secondary. And We define the relation of the sensor node with RFID to be arranged to a warehouse. Finally, This paper is designed to find a trade-off of the following viewpoints. First, We offer suitable sensor-control information to a actual manager. Second, We offer RFID tag security approach to control the action of the sensor. Third, It increases the survivability of sensor node form.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.16 no.2
• /
• pp.55-70
• /
• 2006

In this paper, we propose a new access control security architecture for supporting flexibility in Secure Operating Systems. By adding virtual access control system layer to the proposed security architecture, various access control models such as MAC, DAC, and RBAC can be applied to Secure Operating Systems easily. The proposed security architecture is designed to overcome the problem of Linux system's base access control system. A policy manager can compose various security models flexibly and apply them to Operating Systems dynamically. Also, the proposed architecture is composed of 3 modules such as access control enforcement, access control decision, and security control. And access control models are abstracted to hierarchy structure by virtual access control system. And, we present the notation of policy conflict and its resolution method by applying various access control model.

• Journal of the Korea Society of Computer and Information
• /
• v.11 no.1 s.39
• /
• pp.177-184
• /
• 2006

The sensors in a ubiquitous network are limited because of the low power and ultra light weight, so many studies have revolved around the sensor. This study improves the process of the registration and authorization and suggests a way to minimize discloser of privacy by using an alias. We introduce RA(Relay Agent) for the restrict function of sensor node, and improve anonymity for private information of each sensor node by assigning alias from SM(Service Manager) in procedure of registration and authentication. The privacy of sensor node is secure in procedure of registration, authentication, and communication between nodes. We could improve the level of security with the only partial increment of computation power of RA and SM without an increase in the amount of sensor nodes.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.15 no.10
• /
• pp.6158-6167
• /
• 2014

The aim of this study was to perform comparative analysis of the duties of 7 new roles of HIMs in Malaysian and Korean hospitals of a similar scale. A Malaysian general hospital with a scale of 272 hospital beds was chosen. The researcher visited a Malaysian hospital in person and interviewed the staff in charge over a 2 week period from July 22nd 2013 to August 2nd 2013. For domestic hospitals, 13 general hospitals with 270 hospital beds, similar to the Malaysian general hospital, were chosen. Phone interviews with the department recorded the duty recording work. Regarding 7 new roles of Health Information Manager (HIM), although the role as a Health information manager and Security Officer in Malaysian general hospital was not defined, 30.8% performed their role in Korean general hospitals. The classification of disease & procedure within the role of Clinical data specialist was performed by both countries, and while the tumor registry was done in a Malaysian general hospital, only 15.4% of Korean general hospitals were operating. The statistics of the discharged patients were not measured in the Malaysian general hospital but 76.9% of Korean general hospitals recorded these statistics. Although 22.1% of Korean general hospitals operated registration work of special disease, Malaysian general hospital not only had a total legal contagious disease registration, but also took charge of information registration of hospital births and deceased ones. Other than these, the Patient Information Coordinator, Data Quality Manager, Document and Repository Manager, Research and Decision Support Analyst roles were not done by either country. The new role of HIM is operated in a low percentage in Korean middle and small hospitals. Therefore, to clearly establish the role of HIM in Korea, and have middle and small hospitals to operate such a role, it is essential for the related association to give continuous education and provide support to clarify the role within the hospital working environment. It is desirable to benchmark Malaysian general hospital's registration work on special diseases and others, and expand the work to improve overall.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.18 no.3
• /
• pp.121-129
• /
• 2008

This paper presents vulnerability identification method based on meaning which is making use of the concept of atomic vulnerability. Also, we are making use of decomposition and specialization processes which were used in DEVS/SES to get identifiers. This vulnerability representation method is useful for managing and removing vulnerability in organized way. It is helpful to make a relation between vulnerability assessing and intrusion detection rules in lower level. The relation enables security manager to response more quickly and conveniently. Especially, this paper shows a mapping between Nessus plugins and Snort rules using meaning based vulnerability identification method and lists usages based on three goals that security officer keeps in mind about vulnerability. The contribution of this work is in suggestion of meaning based vulnerability identification method and showing the cases of its usage for the rule integration of vulnerability assessment and intrusion detection.