• International Journal of Computer Science & Network Security
• /
• 제21권9호
• /
• pp.1-10
• /
• 2021

The Internet of things (IoT) is the main advancement in data processing and communication technologies. In IoT, intelligent devices play an exciting role in wireless communication. Although, sensor nodes are low-cost devices for communication and data gathering. However, sensor nodes are more vulnerable to different security threats because these nodes have continuous access to the internet. Therefore, the multiparty security credential-based key generation mechanism provides effective security against several attacks. The key generation-based methods are implemented at sensor nodes, edge nodes, and also at server nodes for secure communication. The main challenging issue in a collaborative key generation scheme is the extensive multiplication. When the number of parties increased the multiplications are more complex. Thus, the computational cost of batch key and multiparty key-based schemes is high. This paper presents a Secure Multipart Key Distribution scheme (SMKD) that provides secure communication among the nodes by generating a multiparty secure key for communication. In this paper, we provide node authentication and session key generation mechanism among mobile nodes, head nodes, and trusted servers. We analyzed the achievements of the SMKD scheme against SPPDA, PPDAS, and PFDA schemes. Thus, the simulation environment is established by employing an NS 2. Simulation results prove that the performance of SMKD is better in terms of communication cost, computational cost, and energy consumption.

• International Journal of Computer Science & Network Security
• /
• 제23권12호
• /
• pp.81-90
• /
• 2023

Cloud computing is an emerging business model popularized during the last few years by the IT industry. Providing "Everything as a Service" has shifted many organizations to choose cloud-based services. However, some companies still fear shifting their data to the cloud due to issues related to the security and privacy. The paper suggests a novel Trust based Mutual Authentication Mechanism using Secret P-box based Mutual Authentication Mechanism (TbMAM-SPb) on the criticality of information. It uses a particular passcodes from one of the secret P-box to act as challenge to one party. The response is another passcode from other P-box. The mechanism is designed in a way that the response given by a party to a challenge is itself a new challenge for the other party. Access to data is provided after ensuring certain number of correct challenge-responses. The complexity can be dynamically updated on basis of criticality of the information and trust factor between the two parties. The communication is encrypted and time-stamped to avoid interceptions and reuse. Overall, it is good authentication mechanism without the use of expensive devices and participation of a trusted third party.

• 정보보호학회논문지
• /
• 제17권6호
• /
• pp.143-148
• /
• 2007

DDoS 공격과 같이 전송량이 폭주하는 상황에서는 방화벽이 정상적으로 로고를 기록하지 못하는 취약점이 발생한다. 이와 같은 로그의 누수 현상은 방화벽이 패킷을 정상적으로 필터링 했는지 여부를 알 수 없게 하며, 침해사고 대응의 가장 기초적인 자료가 되는 방화벽 로그에 대한 신뢰성을 심각하게 위협한다. 또한 통신망의 속도가 높아질수록 이와 같은 현상이 보다 잦은 빈도와 대량으로 발생한다. 따라서 단순히 방화벽 시스템의 하드웨어를 강화하여 해결하는 방법은 방화벽의 대중화와 상충되므로 바람직하지 않다. 본 논문에서는 국내 대부분의 방화벽의 모태가 되는 iptable의 로그 누수현상을 실험을 통해 입증함으로서 기존의 방화벽 로그 처리 방식에 개선이 필요함을 보인다.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제12권1호
• /
• pp.523-549
• /
• 2018

The increasing number of subscribers and demand of multiplicity of services has turned Multi-Server Authentication (MSA) into an integral part of remote authentication paradigm. MSA not only offers an efficient mode to register the users by engaging a trusted third party (Registration Centre), but also a cost-effective architecture for service procurement, onwards. Recently, Lu et al.'s scheme demonstrated that Mishra et al.'s scheme is unguarded to perfect forward secrecy compromise, server masquerading, and forgery attacks, and presented a better scheme. However, we discovered that Lu et al.'s scheme is still susceptible to malicious insider attack and non-compliant to perfect forward secrecy. This study presents a critical review on Lu et al.'s scheme and then proposes a secure multi-server authentication scheme. The security properties of contributed work are validated with automated Proverif tool and proved under formal security analysis.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제11권1호
• /
• pp.1-17
• /
• 2017

Mobile Cloud Computing has become a promising computing platform. It moves users' data to the centralized large data centers for users' mobile devices to conveniently access. Since the data storage service may not be fully trusted, many public verification algorithms are proposed to check the data integrity. However, these algorithms hardly consider the huge computational burden for the verifiers with resource-constrained mobile devices to execute the verification tasks. We propose an energy-efficient algorithm for assigning verification tasks (EEAVT) to optimize the energy consumption and assign the verification tasks by elastic and customizable ways. The algorithm prioritizes verification tasks according to the expected finish time of the verification, and assigns the number of checked blocks referring to devices' residual energy and available operation time. Theoretical analysis and experiment evaluation show that our algorithm not only shortens the verification finish time, but also decreases energy consumption, thus improving the efficiency and reliability of the verification.

• ETRI Journal
• /
• 제34권1호
• /
• pp.55-65
• /
• 2012

E-voting is expected to offer prominent advantages over traditional voting methods. Advantages include faster tallying, greater accuracy, prevention of void ballots, and lower cost. However, many experts express concerns about the potential for large-scale fraud. Recently, many paper based end-to-end (E2E) voter verifiable systems providing individual verifiability and universal verifiability have been proposed. These systems, unlike previous voting systems, are used in polling booths and without access to trusted computing devices at the time of voting. In this paper, we propose a practical and secure E2E voter verifiable system using a paper receipt based on cryptographic technologies.

• 한국정보처리학회:학술대회논문집
• /
• 한국정보처리학회 2009년도 춘계학술발표대회
• /
• pp.1075-1078
• /
• 2009

Web 2.0 시대가 도래하면서부터 새로운 소프트웨어 배포 방식인 SaaS가 등장하였다. 보안 분야에서도 기존의 소프트웨어적인 보안 방식이 아닌 하드웨어적인 보안 방식을 위해 TPM이라는 보안 칩이 개발되었다. 본 논문에서는 TPM 칩을 사용하여 보다 신뢰적인 측면이 강조된 신뢰 컴퓨팅 기반 SaaS 모델을 설계하고, 설계된 모델의 가장 기본적인 기능인 로컬 PC 레벨의 PCR 값 인증 프로그램과 로컬 PC 레벨 어플리케이션 무결성 측정 프로그램을 구현하고 이를 평가한다.

• 한국정보처리학회:학술대회논문집
• /
• 한국정보처리학회 2008년도 추계학술발표대회
• /
• pp.1554-1558
• /
• 2008

현대의 서비스들은 점차 온라인화 되어가고 있으며, 특히 무선 통신의 발전은 따라 현대 사회인들에게 다양한 모바일 기기들을 사용하여 여러 서비스를 제공 받을 수 있도록 하였다. 하지만 모바일 단말기의 분실 및 불법적인 복제와 점차 증가하고 있는 모바일 악성코드로 인한 모바일 환경의 보안 위협은 기존의 소프트웨어 보안으로는 감당할 수 없게 되었다. 이에 안전한 모바일 환경을 위해 하드웨어 모듈 기반의 신뢰 컴퓨팅이 제안되었다. 이는 하드웨어 보안 모듈로 하여금 보안 시스템의 중추적인 역할을 하도록 하여 전체 보안 수준을 하드웨어 수준으로 높이는 장점을 가지고 있다. 하지만 이러한 하드웨어 기반의 보안 시스템에서는 사용자의 암호 및 단말기 이동에 따른 적절한 키의 백업과 복구 방안이 필요하다. 본 논문에서는 이러한 MTM기반의 모바일 신뢰 컴퓨팅에서의 키 백업에 대한 보안 요구사항과 메커니즘에 대한 분석을 제시한다.

• 인터넷정보학회논문지
• /
• 제9권2호
• /
• pp.51-59
• /
• 2008

e-business 환경 내 정보기술이 혁신적으로 발전하면서 기업들 사이에서는 고객정보 보유량이 기업의 핵심 경쟁력임을 인지하게 되었고, 이때 민감한 개인정보들까지도 무작위로 오남용.도용되면서 개인정보에 대한 적절한 대안이 절실히 필요한 실정이다. 본 논문에서는 e-business 환경 내 노출되어질 수 있는 개인정보 위험을 분석하고, 이를 해결하기 위해 신뢰를 기반으로 한 개인정보정책 모델(TPM-Trusted Privacy Policy Model)을 제시하였고, 정보보호 관점에서 4가지 주요 메커니즘(CAM, SPM, RBAC Controller, OCM)을 제안하였다. 이는 e-business 환경에서 개인정보 정책 및 절차를 기반으로 사용자별 권한부여를 통한 접근제어 및 통제가 가능하도록 분석 설계하였다. 또한 TPM 모델의 활용성을 제안하고자 실제 e-business 환경의 CRM(Customer Relationship Management)에 적용하여 보았다.

• 인터넷정보학회논문지
• /
• 제18권6호
• /
• pp.75-84
• /
• 2017

As there has been growing interests in PHR-based personalized health management project, various institutions recently explore safe methods of recording personal medical and health information. In particular, innovative medical solution can be realized when medical researchers and medical service institutes can generally get access to patient data. As EMR data is extremely sensitive, there has been no progress in clinical information exchange. Moreover, patients cannot get access to their own health data and exchange it with researchers or service institutions. It can be operated in terms of technology, yet policy environment are affected by state laws as well as Privacy and Security Policy. Blockchain technology-independent, in transaction, and under test-is introduced in the medical industry in order to settle these problems. In other words, medical organizations can grant preliminary approval on patient information exchange by using the safely encrypted and distributed Blockchain ledger and can be managed independently and completely by individuals. More apparently, medical researchers can gain access to information, thereby contributing to the scientific advance in rare diseases or minor groups in the world. In this paper, we focused on how to manage personal medical information and its protective use and proposes medical treatment exchange system for patients based on a permissioned Blockchain network for the safe PHR operation. Trusted Model for Sharing Medical Data (TMSMD), that is proposed model, is based on exchanging information as patients rely on hospitals as well as among hospitals. And introduce medical treatment exchange system for patients based on a permissioned Blockchain network. This system is a model that encrypts and records patients' medical information by using this permissioned Blockchain and further enhances the security due to its restricted counterfeit. This provides service to share medical information uploaded on the permissioned Blockchain to approved users through role-based access control. In addition, this paper presents methods with smart contracts if medical institutions request patient information complying with domestic laws by using the distributed Blockchain ledger and eventually granting preliminary approval for sharing information. This service will provide an independent information transaction and the Blockchain technology under test will be adopted in the medical industry.