• Proceedings of the KAIS Fall Conference
• /
• 2003.11a
• /
• pp.155-162
• /
• 2003

Today's network consists of a large number of routers and servers running a variety of applications. Policy-based network provides a means by which the management process can be simplified and largely automated. In this paper we build a foundation of policy-based network modeling and simulation environment. The procedure and structure for the induction of policy rules from vulnerabilities stored in SVDB (Simulation based Vulnerability Data Base) are developed. The structure also transforms the policy rules into PCIM (Policy Core Information Model). The effect on a particular policy can be tested and analyzed through the simulation with the PCIMs and SVDB.

• Journal of Digital Contents Society
• /
• v.1 no.1
• /
• pp.23-37
• /
• 2000

EDI is basically the concept of computer-to-computer exchange of messages relating to various types of activities or business areas, such as banking, trade, medicine, publishing, etc. Therefore, security, reliability and special functionality will be implicit requirements of EDI systems. We will design access control model to content security of these requirements. Access controls in information systems are responsible for ensuring that all direct access to the entities occur exclusively according to the access modes and rules fixed by security policies. On this paper, security policies for access control model are presented from the viewpoints of identity-based, rule-based, role-based policy. We give a design of access control model for secure EDI service based on the derived access control rules and operations to enforce the defined security policies. The proposed access control model provides integrity, confidentiality and a flow control of EDI messages.

• Journal of Korea Multimedia Society
• /
• v.13 no.1
• /
• pp.133-142
• /
• 2010

As the ubiquitous technology has penetrated into almost every aspect of modern life, the research of the security technology to solve the weakness of security in the ubiquitous environment is received much attention. Because, however, today's security systems are usually based on the fixed rules, many security systems can not handle diverse situations in the ubiquitous environment appropriately. Although many existing researches on context aware security service are based on ACL (Access Control List) or RBAC (Role Based Access Control), they have an overhead in the management of security policy and can not manipulate unexpected situations. Therefore, in this paper, we propose a context-aware security service providing multiple authentications and authorization from a security level which is decided dynamically in a context-aware environment using FCM (Fuzzy C-Means) clustering algorithm and Fuzzy Decision Tree. We show proposed model can solve typical conflict problems of RBAC system due to the fixed rules and improve overhead problem in the security policy management. We expect to apply the proposed model to the various applications using contextual information of the user such as healthcare system, rescue systems, and so on.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.19 no.2
• /
• pp.39-46
• /
• 2023

The rise in popularity of cloud services has brought about a heightened concern for security in the field of cloud computing. As a response, governments have implemented CSAP(Cloud Security Assurance Program) to ensure the security of these services. However, despite such measures, the emergence of various security vulnerabilities persists, resulting in incidents related to cloud security breaches. To address this, the utilization of Common Vulnerabilities and Exposures (CVE) has been proposed as a means to facilitate the sharing of vulnerability information across different domains. Nevertheless, the unique characteristics of cloud services present challenges in assigning CVE IDs to the diverse range of vulnerabilities within the cloud environment. In this study, we analyzed how CVE can be effectively employed to enhance cloud security. The assignment of a CVE ID is contingent upon the fulfillment of three rules in the Counting Decision and five rules in the Inclusion Decision. Notably, the third rule in the Inclusion Decision, INC3, clashes with the nature of cloud services, resulting in obstacles in assigning CVE IDs to various cloud vulnerabilities. To tackle this issue, we suggest the appointment of designated individuals who would be responsible for overseeing specific areas of cloud services, thereby enabling the issuance of CVE IDs. This proposed approach aims to overcome the challenges associated with the unique characteristics of cloud services and ensure the seamless sharing of vulnerability information. Information sharing regarding vulnerabilities is crucial in the field of security, and by incorporating cloud vulnerabilities into the CVE system, this method can contribute to enhancing the security of cloud services.

• THE INTERNATIONAL COMMERCE & LAW REVIEW
• /
• v.49
• /
• pp.3-41
• /
• 2011

In this article, the author have studied on main revisions and some recommendations of the Incoterms(R) 2010. Main revisions are as belows. 1. Two new Incoterms rules -DAT and DAP- have replaced the Incoterms 2000 rules DAF, DES, DEQ and DDU. 2. New classification of the Incoterms(R) 2010 are adopted. First class is Rules for any mode or modes of transport(EXW, FCA, CPT, CIP, DAT, DAP and DDP belong to this class.) and second class is rules for sea and inland waterway transport(FAS, FOB, CFR and CIF belong to this class.). 3. Incoterms(R) 2010 rules formally recognizes that they are available for application to both international and domestic sale contracts. 4. The Guidance Notes and Introduction are not part of the actual Incoterms(R) 2010 rules. 5. Under the FOB, CFR and CIF, all mention of the ship's rail as the point of delivery has been omitted in preference for the goods being delivered when they are "on board" the vessel. 6. Incoterms(R) 2010 rules include the obligation to 'procure goods shipped' as an alternative to the obligation to ship goods in the relevant Incoterms rules. 7. Incoterms(R) 2010 rules give electronic means of communication the same effect as paper communication. 8. Incoterms(R) 2010 rules have allocated obligations between the buyer and seller to obtain or to render assistance in obtaining security-related clearances. such as chain-of custody information. Some recommendations are as belows. 1. The parties must incorporate the Incoterms(R) 2010 rules into their contract of sale. 2. The parties must choose the appropriate Incoterms(R) 2010 rules. 3. Specify the place or port as precisely as possible in their contract of sale. 4. Remember that Incoterms(R) 2010 rules do not give the parties a complete contract of sale. 5. Incoterms(R) 2010 rules do not prohibit alteration of Incoterms rule, but there are dangers in so doings. In order to avoid any unwelcome surprises, the parties would need to make the intended effect of such alterations extremely clear in their contract.

• Journal of Electrical Engineering and Technology
• /
• v.10 no.3
• /
• pp.1107-1113
• /
• 2015

Test temperature is an important factor affecting the measurement results of dielectric response of field power transformers. In order to better apply the polarization and depolarization current (PDC) to the condition monitoring of oil-paper insulation system in power transformers, the influences and elimination method of test temperature on PDC characteristic spectroscopy (PDC-CS) were investigated. Firstly, the experimental winding sample was measured by PDC method at different test temperatures, then the PDC-CS was obtained from the measurement results and its changing rules were discussed, which show that the PDC-CS appears a horizontal mobility with the rise of temperature. Based on the rules, the “time temperature shift technique” was introduced to eliminate the influence of test temperature. It is shown that the PDC-CS at different test temperatures can be converted to the same reference temperature coincident with each other.

• Convergence Security Journal
• /
• v.11 no.1
• /
• pp.57-69
• /
• 2011

Many heterogeneous Intrusion Detection Systems(IDSs) based in misuse detection technique including the self-developed IDS are now operating in Defense-ESM(Enterprise Security Management System). IDS based on misuse detection may have different capability in the intrusion detection process according to the frequency and quality of its signature update. This makes the integration and collaboration with other IDSs more difficult. In this paper, with the purpose of creating the proper foundation for integration and collaboration between heterogeneous IDSs being operated in Defense-ESM, we propose an effective mechanism that can enable one IDS to propagate its new detection rules to other IDSs and receive updated rules from others. We also prove the performance of rule exchange and application possibility to defense environment through the implementation and experiment.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.18 no.5
• /
• pp.17-23
• /
• 2018

The rapid development of mobile technology has increased the use of mobile devices, and the possibility of security incidents is also increasing. The leakage of information through photos is the most representative. Previous methods for preventing this are disadvantageous in that they can not take pictures for other purposes. In this paper, we design and implement a system to prevent information leakage through photos using object recognition and beacon. The system inspects pictures through object recognition based on deep learning and verifies whether security policies are violated. In addition, the location of the mobile device is identified through the beacon and the appropriate rules are applied. Web applications for administrator allow you to set rules for taking photos by location. As soon as a user takes a photo, they apply appropriate rules to the location to automatically detect photos that do not conform to security policies.

• THE INTERNATIONAL COMMERCE & LAW REVIEW
• /
• v.13
• /
• pp.69-81
• /
• 2000

Under the co-sponsorship of UNIDROIT and I.C.A.O., a preliminary draft Convention on International Interests in Mobile Equipment and a preliminary draft Protocol on Matters Specific to Aircraft Equipment has been prepared. The purpose of the Convention is to provide for the creation and effect of a new international interest in mobile equipment. The Convention's approach is quite novel in that it purports to create an international interest based upon the convention itself. The Convention is intended to be supplemented by Protocols, each of is intended to provide equipment-specific rules necessary to adapt the rules of the Convention to fit the special pattern of financing for different categories of equipment. To date, two sessions of governmental experts were held in Rome and Montreal. Korean delegations attended the two sessions. One of the members of the Korean delegation published a report on the first session. He expressed his objection to the so called self-help remedy contemplated by the current preliminary draft of the Convention which enables the holder of a security interest to repossess and dispose of the subject of the security interest by private sale rather than public auction on the occurrence of an event of default of the debtor. His view is based upon his understanding that under Korean law, the only remedy available to the holder of a security interest in mobile equipment, such as an airplane, is to apply to the competent court for a public auction. In my view, his understanding is not quite correct and is inconsistent with the current practice in Korea. Under Korean law, the parties' agreement for private sale is in principle valid unless there is an interested party who has acquired a security interest after the creation of the prior security interest or a creditor who has caused the subject of the security interest to be attached by a competent court. In this article, I discuss the current Korean law and practice relating to the enforcement of security interests by private sale in more detail.

• KIISE Transactions on Computing Practices
• /
• v.21 no.11
• /
• pp.721-726
• /
• 2015

This paper shows secure coding rules for PHP programs. Programmers should comply with these rules during development of their programs. The rules are crafted to restrain 28 weaknesses that are composed of 22 corresponding to reported CVEs of PHP, the children of CWE-661 for PHP, and the top 5 weaknesses according to OWASP. The rule set consists of 28 detailed rules under 14 categories. This paper also demonstrates through examples that programs complying with these rules can curb weaknesses. The rules can also serve as a guideline in developing analysis tools for security purposes.