• Proceedings of the Korea Information Processing Society Conference
• /
• 2000.10a
• /
• pp.789-792
• /
• 2000

차세대 이동통신 시스템의 이용자와 네트워크간 이용자 익명성을 보장하고, 이용자와 네트워크가 상대 실체를 안전하게 상호 인증할 수 있는 공개키 암호 방식에 기반한 개선된 인증 및 키합의 프로토콜을 제안한다. 이 프로토콜은 이용자와 네트워크는 이용자의 고유신분과 세션별로 변하는 랜덤수를 입력으로 하여 임시신분 정보를 생성 및 상호 공유하고, 네트워크는 초기에 이용자의 신분을 확인하며, 임시신분 정보는 이용자와 네트워크가 상호 선택한 랜덤 수에 따라 세션별로 갱신되므로 무선 접속 구간 상에 익명성을 보장하고 기존의 방식에 비교하여 보다 강화된 안전성을 보장한다.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2010.07a
• /
• pp.269-272
• /
• 2010

개인 프라이버시 보호에 대한 관심이 증가하면서 원격 시스템에서 사용자 익명성을 제공하는 스마트카드 기반 인증 프로토콜에 대한 연구가 활발하게 진행되고 있다. 최근의 인증 프로토콜은 사용자 익명성을 제공하는 기법과 더불어 악의적인 사용자를 추적할 수 있는 연구로 발전되고 있다. Kim은 사용자의 익명성을 보장하면서 악의적인 사용자를 감지하여 추적 가능한 인증 프로토콜을 제안하였고 Choi는 Kim의 논문의 익명성 문제를 제기하고 이를 개선한 새로운 프로토콜을 제안하였다. 본 논문에서는 Choi 프로토콜의 계산 오류와 이력 추적 가능 문제점을 제기하고, 이러한 문제점을 해결하는 새로운 프로토콜을 제안하고, 안전성과 효율성을 분석한다.

• Journal of Communications and Networks
• /
• v.15 no.2
• /
• pp.153-163
• /
• 2013

In recent years, more and more researches have been focusing on trust management of vehicle ad-hoc networks (VANETs) for improving the safety of vehicles. However, in these researches, little attention has been paid to the location privacy due to the natural conflict between trust and anonymity, which is the basic protection of privacy. Although traffic safety remains the most crucial issue in VANETs, location privacy can be just as important for drivers, and neither can be ignored. In this paper, we propose a beacon-based trust management system, called BTM, that aims to thwart internal attackers from sending false messages in privacy-enhanced VANETs. To evaluate the reliability and performance of the proposed system, we conducted a set of simulations under alteration attacks, bogus message attacks, and message suppression attacks. The simulation results show that the proposed system is highly resilient to adversarial attacks, whether it is under a fixed silent period or random silent period location privacy-enhancement scheme.

• Proceedings of the Korean Information Science Society Conference
• /
• 2002.10c
• /
• pp.496-498
• /
• 2002

최근 이동통신 사용자수의 증가로 각 통신사업자들은 이동 네트워크가 더욱 원활하게 동작할 수 있도록 인프라를 향상시키고, 업그레이드하고, 고도화시키는데 많은 노력을 기울이고 있다. 그러나 이러한 노력들에 비해 이동통신 사업자나 흑은 서비스 제공자들로부터 사용자의 위치정보나 이동내역정보 등과 같은 개인 프라이버시를 보호하는데 필요한 노력은 아직 미비한 실정이다. 현재까지 TP(Temporary Pseudonym) [3,4]등과 같은 사용자의 프라이버시를 보호하기 위한 여러 연구들[6,7]이 이루어지고 있으나 차세대 멀티미디어 이동통신환경에 적용하기에는 몇 가지 문제점들이 있다. 따라서 본 논문에서는 이러한 문제점들을 개선한 새로운 익명 시스템을 제안하고, 아울러 제안한 시스템의 시뮬레이션을 통하여 그 성능을 검증해보고자 한다.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.17 no.4
• /
• pp.95-102
• /
• 2021

As social interest in the metaverse increases, various metaverse platforms and services are appearing, and various security issues are emerging accordingly. In particular, since all activities are performed in a variety of virtual spaces, and the metaverse utilizes sensing data using various hardware devices, more information is accumulated than other Internet services, and more damage can occur if information security is not guaranteed. Therefore, in this paper, we propose a metaverse security model that considers the major issues mentioned in previous papers and the necessary evaluation factors for the security functions required in the metaverse platform. As a result of performing the performance evaluation of the proposed model and the existing attribute information collection model, the proposed model can provide security functions such as anonymity and source authentication, which were not provided by the existing models.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.18 no.5
• /
• pp.195-199
• /
• 2008

We present an attack which forges a credential without the help of the credential issuer in the protocol designed by Nakazato, Wang and Yamamura at ASIAN 2007 The attack avoids using the credential issuer's private key by taking advantage of the property of bilinear pairing. Implication of this collusion attack by user and verifiers also discussed.

• Journal of Internet of Things and Convergence
• /
• v.8 no.5
• /
• pp.111-117
• /
• 2022

Anonymous networks are designed to protect information and communication by avoiding monitoring or tracking traffic. In recent years, however, cybercriminals have evaded law enforcement tracking by exploiting the characteristics of anonymous networks. In this paper, we investigate related research focusing on Tor, one of the anonymous networks. This paper introduces how Tor provides anonymity, and how tracing technologies can track users against Tor. In addition, we compare and analyze tracing techniques, and explain how a researcher can establish an experimental environment.

• Journal of Internet Computing and Services
• /
• v.18 no.5
• /
• pp.31-38
• /
• 2017

Recently with the rapid development of LBS (Location-based Services) technology, approaches of protecting user's location have gained tremendous attentions. For using LBS, users need to forward their real locations to LBS server. However, if the user sends his/her real location to LBS server, the server will have the all the information about user in LBS. Moreover, if the user opens it to LBS server for a long time, the trajectory of user may be released. In this paper, we propose GTC (Grid-based Trajectory Cloaking) method to address the privacy issue. Different from existing approaches, firstly the GTC method sets the predicting trajectory and divides the map into $2^n*2^n$ grid. After that we will generate cloaking regions according to user's desired privacy level. Finally the user sends them to LBS server randomly. The GTC method can make the cost of process less than sequential trajectory k-anonymity. Because of confusing the departure and destination, LBS server could not know the user's trajectory any more. Thus, we significantly improve the privacy level. evaluation results further verify the effectiveness and efficiency of our GTC method.

• Journal of the Korea Society of Computer and Information
• /
• v.26 no.9
• /
• pp.89-96
• /
• 2021

In this paper, we analyzed that the user authentication scheme for TMIS(Telecare Medicine Information System) proposed by Al-Saggaf et al. In 2019, Al-Saggaf et al. proposed authentication scheme using biometric information, Al-Saggaf et al. claimed that their authentication scheme provides high security against various attacks along with very low computational cost. However in this paper after analyzing Al-Saggaf et al's authentication scheme, the Al-Saggaf et al's one are missing random number s from the DB to calculate the identity of the user from the server, and there is a design error in the authentication scheme due to the lack of delivery method. Al-Saggaf et al also claimed that their authentication scheme were safe against a variety of attacks, but were vulnerable to password guessing attack using login request messages and smart cards, session key exposure and insider attack. An attacker could also use a password to decrypt the stored user's biometric information by encrypting the DB with a password. Exposure of biometric information is a very serious breach of the user's privacy, which could allow an attacker to succeed in the user impersonation. Furthermore, Al-Saggaf et al's authentication schemes are vulnerable to identity guessing attack, which, unlike what they claimed, do not provide significant user anonymity in TMIS.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.16 no.5
• /
• pp.59-66
• /
• 2006

A Certification Authority issues X.509 public key certificates to bind a public key to a subject. The subject is specified through one or more subject names in the 'subject' or 'subjectAltName' fields of a certificate. In reality, however, there are individuals that have the same or similar names. This ambiguity can be resolved by including a 'permanent identifier' in all certificates issued to the same subject, which is unique across multiple CAs. But, a person's unique identifier is regarded as a sensitive personal data. Such an identifier cannot simply be included as part of the subject field, since its disclosure may lead to misuse. We present a new method for secure and accurate user authentication through the PEPSI included in the standard certificate extension of a X.509 certificate. The PEPSI can be served not only for user authentication but also for the user anonymity without divulging personal information.