• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.32 no.7B
• /
• pp.438-447
• /
• 2007

In the Internet, an identity service must to obtain permission from a user to allow them to share data with requesting service. For that, the privacy policy, which reflects legal regulations and preferences made by the user, is needed. Also, the management interface that aids the user to make the privacy policy and the PDP system that makes admission control and policy decisions in response to a request from an entity wanting to access the personal information are needed. In this paper, the privacy controller system model handled under the internet Identity management system environment is proposed. The system has the easy interface of policy generation and the efficient policy decision process. The system applies and modifies to the XACML of OASIS group. We propose that the privacy policy is divided into the three policies, which are the user policy, the domain policy and the basic offering policy. To resolve the collision between the policies, we also propose the collision resolution policy.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.30 no.3
• /
• pp.503-512
• /
• 2020

The revisions to data privacy acts allows the disclosure of data after anonymizing personal information. Such anonymized data is expected to be useful in research and services, but there are high concerns about privacy breaches such as re-identifying of the individuals from the anonymized data. In this paper, we showed that identifying individuals from public data is not very difficult, and also raises questions about the reliability of the public data. We suggest that users understand the trade-offs between data disclosure and privacy protection so that they can use data securely under the revised data privacy acts.

• International Journal of Computer Science & Network Security
• /
• v.24 no.6
• /
• pp.153-160
• /
• 2024

Information technology plays an important role in healthcare. The cloud has several applications in the fields of education, social media and medicine. But the advantage of the cloud for medical reasons is very appropriate, especially given the large volume of data generated by healthcare organizations. As in increasingly health organizations adopting towards electronic health records in the cloud which can be accessed around the world for various health issues regarding references, healthcare educational research and etc. Cloud computing has many advantages, such as "flexibility, cost and energy savings, resource sharing and rapid deployment". However, despite the significant benefits of using the cloud computing for health IT, data security, privacy, reliability, integration and portability are some of the main challenges and obstacles for its implementation. Health data are highly confidential records that should not be made available to unauthorized persons to protect the security of patient information. In this paper, we discuss the privacy and security requirement of EHS as well as privacy and security issues of EHS and also focus on a comprehensive review of the current and existing literature on Electronic health that uses a variety of approaches and procedures to handle security and privacy issues. The strengths and weaknesses of some of these methods were mentioned. The significance of security issues in the cloud computing environment is a challenge.

• Journal of the HCI Society of Korea
• /
• v.7 no.1
• /
• pp.11-17
• /
• 2012

A number of context information is shared through social network service(SNS). Among them, we focused on the information which is rarely shared for various reasons. The result indicated that users prefer to avoid certain types of context information because of： 1)containing socially unacceptable content, 2)laking of desire for disclosure, and 3)potential risk of privacy. Concerning privacy concern, it was found that users developed their own management strategy to control context information rather than employing existing system features. Drawing on Communication Privacy Management(CPM) theory, we analyzed findings and suggested guidelines for system design.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.32 no.12B
• /
• pp.743-749
• /
• 2007

The problem of privacy is considered one of the main concerns to deploy RFID applications. In this paper, we propose methods to change a tag state and assign a master leader for the protection of privacy. By changing a tag state, we can limit the range for the information retrieval of the tag to all leaders or a specific leader (mater leader). Whenever the owner of a tag changes, with the master leader assignment method for the tag, we can make only the master leader get the information for the tag. With the proposed methods, it is expected that the privacy problems can be solved by preventing the private information of tags that persons have from being exposed by illegal leaders.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2010.11a
• /
• pp.1241-1244
• /
• 2010

인간의 가장 큰 욕구인 편의와 안전을 위해 우리의 곁에서 떨어질 수 없는 것이 차량이다. 그러므로 차량을 이용하면서 겪게 되는 안전과 편의 또한 떼어놓을 수 없는 문제 중에 하나다. 그 편의와 안전을 위해 VANET이 활발히 개발 중이다. VANET은 차량에서 사용되는 근거리/중거리 통신용 무선 프로토콜로써 차량 간 통신인 V2V, 차량과 네트워크 기반구조 간의 통신인 V2I를 지원하는 네트워크로써 다양한 서비스를 제공한다. 이에 학문적, 상업적으로 많은 관심을 받고 있다. 그러나 네트워크 기반의 기술인만큼 사용자의 프라이버시 침해가 큰 문제로 대두되고 있다. 이 중에서도 사용자의 익명성, 추적성, 객체인증에 관한 Location Privacy는 개발과정에서 큰 걸림돌이 되고 있다. 이에 본 논문에서는 VANET에서의 Location Privacy 보호에 대한 기술들의 개략적인 내용을 서술하고, 장단점을 분석하였다. Location Privacy 보호를 위한 기술에는 해쉬통합을 이용한 보호기술, MAC-체인을 이용한 보호기술, 그리고 세션 키 교환을 이용한 보호기술이 있다. 세 가지 기술 중에서 MAC-체인을 이용한 기술이 Location Privacy 보호에 가장 적합하다.

• The Journal of Information Systems
• /
• v.26 no.1
• /
• pp.53-73
• /
• 2017

Frequent outbreak of intrusion of private information is occurring recently not only at portal sites but also in electronic information service of public agencies. Due to these intrusions, it is observed that the citizens tend to avoid providing their private information even to the service for public agencies. Therefore, the object of this research can be explained as demonstrating the influence of the intention of provision for private information to foster the selectronic information ervice of the public agencies. In order to achieve this, this research intends to demonstrate how the experience of the intrusion of the private information affects the concern about the privacy and how the information factor from the public electronic information service has influence on the reliability toward the public. The results showed that the experience of intrusion of privacy, awareness of the danger of privacy, and the sense protection of the information from the manager at public agencies have direct influence on the concern of privacy. Meanwhile, it has been verified that the awareness of information protection of a manager, the systemicity of information protection, and the surveillance and punishment of information protection have influence on the reliability of public agencies.

• Asia pacific journal of information systems
• /
• v.22 no.1
• /
• pp.53-77
• /
• 2012

Financial firms, especially large scaled firms such as KB bank, NH bank, Samsung Card, Hana SK Card, Hyundai Capital, Shinhan Card, etc. should be securely dealing with the personal financial information. Indeed, people have tended to believe that those big financial companies are relatively safer in terms of information security than typical small and medium sized firms in other industries. However, the recent incidents of personal information privacy invasion showed that this may not be true. Financial firms have increased the investment of information protection and security, and they are trying to prevent the information privacy invasion accidents by doing all the necessary efforts. This paper studies how effectively a financial firm will be able to avoid personal financial information privacy invasion that may be deliberately caused by internal staffs. Although there are several literatures relating to information security, to our knowledge, this is the first study to focus on the behavior of internal staffs. The big financial firms are doing variety of information security activities to protect personal information. This study is to confirm what types of such activities actually work well. The primary research model of this paper is based on Theory of Planned Behavior (TPB) that describes the rational choice of human behavior. Also, a variety of activities to protect the personal information of financial firms, especially credit card companies with the most customer information, were modeled by the four-step process Security Action Cycle (SAC) that Straub and Welke (1998) claimed. Through this proposed conceptual research model, we study whether information security activities of each step could suppress personal information abuse. Also, by measuring the morality of internal staffs, we checked whether the act of information privacy invasion caused by internal staff is in fact a serious criminal behavior or just a kind of unethical behavior. In addition, we also checked whether there was the cognition difference of the moral level between internal staffs and the customers. Research subjects were customer call center operators in one of the big credit card company. We have used multiple regression analysis. Our results showed that the punishment of the remedy activities, among the firm's information security activities, had the most obvious effects of preventing the information abuse (or privacy invasion) by internal staff. Somewhat effective tools were the prevention activities that limited the physical accessibility of non-authorities to the system of customers' personal information database. Some examples of the prevention activities are to make the procedure of access rights complex and to enhance security instrument. We also found that 'the unnecessary information searches out of work' as the behavior of information abuse occurred frequently by internal staffs. They perceived these behaviors somewhat minor criminal or just unethical action rather than a serious criminal behavior. Also, there existed the big cognition difference of the moral level between internal staffs and the public (customers). Based on the findings of our research, we should expect that this paper help practically to prevent privacy invasion and to protect personal information properly by raising the effectiveness of information security activities of finance firms. Also, we expect that our suggestions can be utilized to effectively improve personnel management and to cope with internal security threats in the overall information security management system.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2014.10a
• /
• pp.131-134
• /
• 2014

The Internet allows firms to serve customers more effectively than ever before. In the B2C context, we examine the interrelationships among information privacy concerns, e-trust, and e-loyalty. The authors extend prior research by incorporating constructs of information privacy concerns into a more holistic conceptual framework. This study answers three research questions: Will the three components of information privacy concerns have a significant effect on e-loyalty through e-trust?, Does e-trust mediate e-loyalty?, Finally, do switching costs have a moderation effect between e-trust and e-loyalty?, The authors examine data from customers who have booked hotel accommodations online. The results support our hypotheses and confirm both the mediation role of e-trust and the moderation role of switching costs. Conceptually, this study provides an empirical validation of information privacy concerns, e-trust, and loyalty linkage. On the managerial level, this research provides insights into critical drivers of loyalty in the emerging online marketplace.

• ETRI Journal
• /
• v.35 no.3
• /
• pp.501-511
• /
• 2013

Protecting privacy is an important goal in designing location-based services. Service providers want to verify legitimate users and allow permitted users to enjoy their services. Users, however, want to preserve their privacy and prevent tracking. In this paper, a new framework providing users with more privacy and anonymity in both the authentication process and the querying process is proposed. Unlike the designs proposed in previous works, our framework benefits from a combination of three important techniques: k-anonymity, timed fuzzy logic, and a one-way hash function. Modifying and adapting these existing schemes provides us with a simpler, less complex, yet more mature solution. During authentication, the one-way hash function provides users with more privacy by using fingerprints of users' identities. To provide anonymous authentication, the concept of confidence level is adopted with timed fuzzy logic. Regarding location privacy, spatial k-anonymity prevents the users' locations from being tracked. The experiment results and analysis show that our framework can strengthen the protection of anonymity and privacy of users by incurring a minimal implementation cost and can improve functionality.