• Convergence Security Journal
• /
• v.24 no.3
• /
• pp.3-11
• /
• 2024

Information security is crucial not only for protecting against external cyber-attacks but also for identifying and blocking internal data leakage risks in advance. To this end, many companies and institutions implement digital rights management(DRM) document security solutions, which encrypt files to prevent content access if leaked, and data loss prevention(DLP) solutions, which control devices such as USB ports on computing equipment to prevent data leaks. At a time when efforts to prevent internal data leaks are crucial, there is a growing need for control policies such as device control and the identification of information assets in standalone network environments, which could otherwise fall into unmanaged domains. In this study, we propose a Generation-Distribution-Application model for device control policies that are uniquely applied to standalone information assets that are not connected to internal networks. To achieve this, we developed an authentication technique linked with the asset management system, where information assets are automatically registered upon acquisition. This system allows for precise identification of information assets and enables flexible device control, and we have designed and implemented a system based on these principles.

• Convergence Security Journal
• /
• v.17 no.1
• /
• pp.101-109
• /
• 2017

The Internet of things is a system that connects and communicates all sorts of things such as people, objects, and data. It's to create and share information by its own each other. It can be used to enhance the function of private security and has brought about innovative development of private security. The Internet of things is a system that allows devices connected to the Internet to communicate independently of people-objects, objects-objects connected to the Internet. That and can be used in many industries, especially in the private security sector, its value is high. The use of the Internet of things to private security sector can reinforce security zones with always-on surveillance systems, also be enhanced by its own preparedness and response to the situation. However, this study will discusse the application and development of private security in the Internet of things. The practical application of the virtual space is an immediate task and it is also an essential factor in securing security.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.19 no.3
• /
• pp.153-162
• /
• 2009

When a private information security incident occurs, the people who own the information are not acknowledged about their information leakage until those affairs appear in public media. This research aims at developing a mobile alarm system for acknowledging suspicious events to the information owners. The mobile alarm system was designed considering the limited user interface of mobile terminal and concept of "personal information leakage message tree" is deployed. The message tree contains every possible situation about personal information leakage and the leaves of the tree has several choices that the information owner can select. This message tree concept enables each information owner to manager his or her information leakage situation by just pushing a few buttons of mobile device. The contribution of this paper is in design of a comprehensive alarm message tree and development of mobile alarm system containing the message tree concept.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.14 no.6
• /
• pp.1323-1330
• /
• 2010

The amount of acoustic data gathered from the acoustic data gathering system is increased dramatically as the acoustic data gathering system become various and highly effective. It is needed to transmit this acoustic data to analysis environment for precise analysis. In this gathering/analysis system, it is also needed the stable transmitting as well as highly perfect security. But the existing system using the conveying method needs a lot of time. In case of using networks, the low speed networking vulnerable in the stable transmitting and the information security is impossible to materialize. In this paper, I would like to propose a transmitting and management system sending a massive gathering acoustic data in the unsecurity and low speed networking environment. The implemented system is to transmit the acoustic data safely in low speed networking environment and secure the acoustic data from various threats.

• Journal of Korean Society of Water and Wastewater
• /
• v.33 no.5
• /
• pp.329-339
• /
• 2019

Recently, the advancement of information and communication technology(ICT) is expanding the connectivity through Internet of Things(IoT), and the media of connection is also expanding from wire/cable transmission to broadband wireless communication, which has significantly improved mobility. This hyperconnectivity has become a key element of the fourth industrial revolution, whereas the supervisory control network of purification plants in korea is operated as a communication network separated from the outside, thereby lagging in terms of connectivity. This is considered the best way to ensure security, and thus there is hardly any consideration of establishing alternatives to operate an efficient and stable communication network. Moreover, security for management of a commercialized communication network and network management solution may be accompanied by immense costs, making it more difficult to make new attempts. Therefore, to improve the conditions for the current supervisory control network of purification plants, this study developed a industrial security L2 switch that supports modbus TCP(Transmission Control Protocol) communication and encryption function of the transmission section. As a result, the communication security performance improved significantly, and the cost for implementing the network management system using Historical Trend and information of HMI(Human Machine Interface) could be reduced by approximately KRW 200 million. The results of this study may be applied to systems for gas, electricity and social safety nets that are infrastructure communication networks that are similar to purification plants.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.11 no.4
• /
• pp.3-14
• /
• 2001

A Web server makes use of the HTTP(Hyper Text Transfer Protocol) to communicate with a client. The HTTP is a stateless protocol; the server does not maintain any state information for ongoing interactions with the client. Therefore, the HTTP inevitably requires additional overhead as repeating data key-in to user for continuing communications. This overhead in Web environment can be resolved by the cookie technologies. However, the cookie is usually unsecured due to the clear-text to transfer on the network and to store in the file. That is, information in the cookie is easy to exposure, copy, and even change. In this paper, we propose a secure cookie mechanism appropriate to Web environment, and then present a design and implement of secure Web system based on the scheme. The Web system can be used to any web environment. It also provides some security services, such as confidentiality, authentication, integrity.

• Journal of the Korea Society of Computer and Information
• /
• v.19 no.10
• /
• pp.117-124
• /
• 2014

Software Development Security is defined as a sequential procedure such as deleting potential security vulnerability for secure software development, designing or implementing various functions with considering security, and so on. In this paper, we research on domestic or international hacking cases that could damage us mentally or financially. Seventy five percent of Web-site attacks abuses weak points of application programs, or software. We also research on major issues related to software development security with these demerits. And then, we propose public and private laws, regulations, or systems and give some examples with detailed descriptions.

• Journal of Information Processing Systems
• /
• v.12 no.4
• /
• pp.688-710
• /
• 2016

Our approach permits to capitalize the expert's knowledge as business rules by using an agent-based platform. The objective of our approach is to allow experts to manage the daily evolutions of business domains without having to use a technician, and to allow them to be implied, and to participate in the development of the application to accomplish the daily tasks of their work. Therefore, the manipulation of an expert's knowledge generates the need for information security and other associated technologies. The notion of cryptography has emerged as a basic concept in business rules modeling. The purpose of this paper is to present a cryptographic algorithm based approach to integrate the security aspect in business rules modeling. We propose integrating an agent-based approach in the framework. This solution utilizes a security agent with domain ontology. This agent applies an encryption/decryption algorithm to allow for the confidentiality, authenticity, and integrity of the most important rules. To increase the security of these rules, we used hybrid cryptography in order to take advantage of symmetric and asymmetric algorithms. We performed some experiments to find the best encryption algorithm, which provides improvement in terms of response time, space memory, and security.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.12 no.9
• /
• pp.4560-4575
• /
• 2018

Since smartphone contains various personal data, security is one of the important aspects in smartphone technologies. Up to now, various authentication techniques have been proposed to protect smartphones. The pattern lock on the Android system is one of the most widely used authentication methods for low-cost devices but it is known to be vulnerable to smudge attack or shoulder surfing attack. LG's smartphone uses its own technique, which is called "Knock Code." The knock code completes the authentication by touching the user defined area in turn on the screen. In this paper, we propose the new, enhanced version of knock code by adding the sliding operation and by using flexible area recognition. We conducted security analysis, which shows that under the same password size, the search space is overwhelmingly larger than the original algorithm. Also, by using the sliding operation, the proposed scheme shows resilience against smudge attacks. We implemented the prototype of our scheme. Experimental results show that compared with the original Knock Code and Android pattern lock, our scheme is more convenient while providing better security.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.13 no.6
• /
• pp.3280-3298
• /
• 2019

Vehicular ad-hoc networks (VANETs) have become increasingly significant in intelligent transportation systems, they play a great role in improving traffic safety and efficiency. In the deployment of intelligent VANETs, intelligent vehicles can efficiently exchange important or urgent traffic information and make driving decisions. Meanwhile, secure data communication and vehicle's identity privacy have been highlighted. To cope with these security issues, in this paper, we construct an efficient anonymous authentication scheme with secure communication in intelligent VANETs. Combing the ElGamal encryption technique with a modified Schnorr signature technique, the proposed scheme provides secure anonymous authentication process for encrypted message in the vehicle-to-infrastructure communication model, and achieves identity privacy, forward security, and reply attack resistance simultaneously. Moreover, except the trusted authority (TA), any outside entity cannot trace the real identity of an intelligent vehicle. The proposed scheme is designed on an identity-based system, which can remove the costs of establishing public key infrastructure (PKI) and certificates management. Compared with existing authentication schemes, the proposed scheme is much more practical in intelligent VANETs.