• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.2
• /
• pp.339-346
• /
• 2018

Ransomware is a malicious program that requires money by encrypting data. The damage to ransomware is increasing worldwide, and targeted attacks for corporations, public institutions and hospitals are increasing. As a ransomware is serviced and distributed, its various usually emerge. Therefore, the accurate analysis of ransomware can be a decryption solution not only for that ransomware but also for its variants. In this paper, we analyze a cryptographic elements and encryption process for Erebus found in June, 2017, and investigate its cryptographic vulnerability and memory analysis.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.11 no.8
• /
• pp.3005-3011
• /
• 2010

As soon as high-performanced smart phones is rapidly emerging in recent, its security problems come to the front. Especially in case of an open platform, it is easy to be a target of virus. Many security solution industries such as Symantec and Ahnlab are developing a mobile security system, but they have not yet a commercial product. We developed the effective security function of Android system based on SELinux to solve this problem, and verified its performance by applying the user applications developed to S3C6410 board.

• Journal of Information Processing Systems
• /
• v.12 no.4
• /
• pp.688-710
• /
• 2016

Our approach permits to capitalize the expert's knowledge as business rules by using an agent-based platform. The objective of our approach is to allow experts to manage the daily evolutions of business domains without having to use a technician, and to allow them to be implied, and to participate in the development of the application to accomplish the daily tasks of their work. Therefore, the manipulation of an expert's knowledge generates the need for information security and other associated technologies. The notion of cryptography has emerged as a basic concept in business rules modeling. The purpose of this paper is to present a cryptographic algorithm based approach to integrate the security aspect in business rules modeling. We propose integrating an agent-based approach in the framework. This solution utilizes a security agent with domain ontology. This agent applies an encryption/decryption algorithm to allow for the confidentiality, authenticity, and integrity of the most important rules. To increase the security of these rules, we used hybrid cryptography in order to take advantage of symmetric and asymmetric algorithms. We performed some experiments to find the best encryption algorithm, which provides improvement in terms of response time, space memory, and security.

• Journal of Digital Convergence
• /
• v.13 no.5
• /
• pp.251-257
• /
• 2015

Intrusion protection system is a security system that stop abnormal traffics through automatic activity by finding out attack signatures in network. Unlike firewall or intrusion detection system that defends passively, it is a solution that stop the intrusion before intrusion warning. The security performance of intrusion protection system is influenced by security auditability, user data protection, security athentication, etc., and performance is influenced by detection time, throughput, attack prevention performance, etc. In this paper, we constructed a convergence performance evaluation model about software product evaluation to construct the model for security performance evaluation of intrusion protection system based on CC(Common Criteria : ISO/IEC 15408) and ISO international standard about software product evaluation.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.13 no.4
• /
• pp.107-113
• /
• 2017

Open platform technology in the banking industry is anticipated to impact the market very positively together with the activation of Fin Tech services. The domestic environment of payment services has been rapidly changing into the mobiles and multiple new payment services have been introduced from a variety of vendors. However, the convenience of payment always causes worsening the security, and the accidents on the security have been continued to occur such as leakage of personal information, hacking and so on upon the expansion of the industry and the market size. This study aims to analyze the status of Fin Tech open platforms and various problems of the related standard technologies, and to suggest the possible solutions. Upon the analysis results, it was confirmed that multiple solutions were required to improve the main security protocols of open platforms and to process the security functions diversely. In conclusion, the results of this study will be helpful to determine the direction of the solution on the security issues in the open platform environment of the current industry.

• Journal of Information Processing Systems
• /
• v.13 no.6
• /
• pp.1613-1627
• /
• 2017

The concept of the Internet of Things (IoT) enables physical objects or things to be virtually accessible for both consuming and providing services. Undue access from irresponsible activities becomes an interesting issue to address. Maintenance of data integrity and privacy of objects is important from the perspective of security. Privacy can be achieved through various techniques: password authentication, cryptography, and the use of mathematical models to assess the level of security of other objects. Individual methods like these are less effective in increasing the security aspect. Comprehensive security schemes such as the use of frameworks are considered better, regardless of the framework model used, whether centralized, semi-centralized, or distributed ones. In this paper, we propose a new semi-centralized security framework that aims to improve privacy in IoT using the parameters of trust and reputation. A new algorithm to elect a reputation coordinator, i.e., ConTrust Manager is proposed in this framework. This framework allows each object to determine other objects that are considered trusted before the communication process is implemented. Evaluation of the proposed framework was done through simulation, which shows that the framework can be used as an alternative solution for improving security in the IoT.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.12 no.12
• /
• pp.6139-6160
• /
• 2018

For ease of use and access, web browsers are now being used to access and modify sensitive data and systems including critical control systems. Due to their computational capabilities and network connectivity, browsers are vulnerable to several types of attacks, even when fully updated. Browsers are also the main target of phishing attacks. Many browser attacks, including phishing, could be prevented or mitigated by using site-, user-, and device-specific security configurations. However, we discovered that all major browsers expose disparate security configuration procedures, option names, values, and semantics. This results in an extremely hard to secure web browsing ecosystem. We analyzed more than a 1000 browser security configuration options in three major browsers and found that only 13 configuration options had syntactic and semantic similarity, while 4 configuration options had semantic similarity, but not syntactic similarity. We: a) describe the results of our in-depth analysis of browser security configuration options; b) demonstrate the complexity of policy-based configuration of web browsers; c) describe a knowledge-based solution that would enable organizations to implement highly-granular and policy-level secure configurations for their information and operational technology browsing infrastructures at the enterprise scale; and d) argue for necessity of developing a common language and semantics for web browser configurations.

• International journal of advanced smart convergence
• /
• v.12 no.1
• /
• pp.41-52
• /
• 2023

The purpose of this study is to review the proposed solutions to the Blockchain trilemma put forward by various research scholars and to draw conclusions by comparing the findings of each study. We found that the models so far developed either compromise scalability, decentralization, or security. The first model compromises decentralization. By partially centralizing the network, transaction processing speed can be improved, but security strength is weakened. Examples of this include Algorand and EOS. Because Algorand randomly selects the node that decides the consensus, the security of Algorand is better than EOS, wherein a designated selector decides. The second model recognizes that scalability causes a delay in speed when transactions are included in a block, reducing the system's efficiency. Compromising scalability makes it possible to increase decentralization. Representative examples include Bitcoin and Ethereum. Bitcoin is more vital than Ethereum in terms of security, but in terms of scalability, Ethereum is superior to Bitcoin. In the third model, information is stored and managed through various procedures at the expense of security. The application case is to weaken security by applying a layer 1 or 2 solution that stores and reroutes information. The expected effect of this study is to provide a new perspective on the trilemma debate and to stimulate interest in continued research into the problem.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.17 no.6
• /
• pp.1600-1619
• /
• 2023

Organizations and other institutions have recently started using cloud service providers to store and share information in light of the Internet of Things (IoT). The major issues with this storage are preventing unauthorized access and data theft from outside parties. The Block chain based Security Sharing scheme with Data Access Control (BSSDAC) was implemented to improve access control and secure data transaction operations. The goal of this research is to strengthen Data Access Control (DAC) and security in IoT applications. To improve the security of personal data, cypher text-Policy Attribute-Based Encryption (CP-ABE) can be developed. The Aquila Optimization Algorithm (AOA) generates keys in the CP-ABE. DAC based on a block chain can be created to maintain the owner's security. The block chain based CP-ABE was developed to maintain secures data storage to sharing. With block chain technology, the data owner is enhancing data security and access management. Finally, a block chain-based solution can be used to secure data and restrict who has access to it. Performance of the suggested method is evaluated after it has been implemented in MATLAB. To compare the proposed method with current practices, Rivest-Shamir-Adleman (RSA) and Elliptic Curve Cryptography (ECC) are both used.

• Journal of Internet of Things and Convergence
• /
• v.5 no.2
• /
• pp.103-110
• /
• 2019

In this paper, we suggested how the Internet of Things (IoT) technology could be applied to an internet platform that is used for managing the customer's power grid efficiently. For an internet platform with efficient management, analysis is done by several sections; communication method, and its protocol, and also security element. From this analysis, with currently used sensors, we have presented a development method for the sensor to server data reliable communication solution and data management server with a security solution. Moreover, this paper suggests a communication module that could be used for a power grid management platform, protocol and security algorithm and also a way to build a server for managing those systems and modules.