• Journal of Information Processing Systems
• /
• v.7 no.1
• /
• pp.111-120
• /
• 2011

The concept of Smart-Homes is becoming more and more popular. It is anticipated that Radio Frequency IDentification (RFID) technology will play a major role in such environments. We can find many previously proposed schemes that focus solely on: authentication between the RFID tags and readers, and user privacy protection from malicious readers. There has also been much talk of a very popular RFID application: a refrigerator/bookshelf that can scan and list out the details of its items on its display screen. Realizing such an application is not as straight forward as it seems to be, especially in securely deploying such RFID-based applications in a smart home environment. Therefore this paper describes some of the RFID-based applications that are applicable to smart home environments. We then identify their related privacy and security threats and security requirements and also propose a secure approach, where RFID-tagged consumer items, RFID-reader enabled appliances (e.g., refrigerators), and RFID-based applications would securely interact among one another. At the moment our approach is just a conceptual idea, but it sheds light on very important security issues related to RFID-based applications that are beneficial for consumers.

• Industrial Engineering and Management Systems
• /
• v.9 no.2
• /
• pp.141-156
• /
• 2010

Despite all attempts to prevent fraud, it continues to be a major threat to industry and government. Traditionally, organizations have focused on fraud prevention rather than detection, to combat fraud. In this paper we present a role mining inspired approach to represent user behaviour in Enterprise Resource Planning (ERP) systems, primarily aimed at detecting opportunities to commit fraud or potentially suspicious activities. We have adapted an approach which uses set theory to create transaction profiles based on analysis of user activity records. Based on these transaction profiles, we propose a set of (1) anomaly types to detect potentially suspicious user behaviour, and (2) scenarios to identify inadequate segregation of duties in an ERP environment. In addition, we present two algorithms to construct a directed acyclic graph to represent relationships between transaction profiles. Experiments were conducted using a real dataset obtained from a teaching environment and a demonstration dataset, both using SAP R/3, presently the predominant ERP system. The results of this empirical research demonstrate the effectiveness of the proposed approach.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.21 no.6
• /
• pp.83-99
• /
• 2011

OTP (One Time Password) is widely used for protecting accounts on Internet banking, portal services and online game services in Korea. OTP is very strong method for enforcing account security but there are several ways for exploiting vulnerabilities caused by implementation errors. These attacks can work because of the weakness from OTP enabled system's vulnerabilities, not for OTP's algorithm itself. In this paper, we present the known attack scenarios such as MITM (Man-in-the-Middle) attack and various reverse engineering techniques; also, we show the test result of the attacks and countermeasures for these attacks.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.11 no.1
• /
• pp.43-54
• /
• 2001

In this paper we study the use of polyinstantiation for spatial data, for the purpose of solving cover in topology channel in multilevel secure spatial database systems. Spatial database system with topological structure has a number of spatial analysis function using spatial data and neighbored one\`s each other. But. it has problems that information flow is occurred by topological relationship in spatial database systems. Geographic Information System(CIS) must be needed mandatory access control because there ,are many information flow through positioning information And topological relationship between spatial objects. Moreover, most GIS applications also graphe user interface(GUI). In addressing these problems, we design the MLS/SRDM(Multi Level Security/Spatial Relational Data Model) and propose polyinstantiation for spatial data for solving information flow that occurred by toplogical relationship of spatial data.

• The Journal of the Convergence on Culture Technology
• /
• v.9 no.3
• /
• pp.183-192
• /
• 2023

Digital transformation is taking place rapidly around the world. As the development of digital technology becomes very fast, more information is expected to be digitized. Therefore, the possibility of cyber threats is increasing in transmitting and storing sensitive information such as personal and financial information online. In this paper, we compared and analyzed information security textbooks for elementary and secondary school students in China, where the recent development of artificial intelligence and digital transformation are rapidly occurring. After we collected related textbooks, textbooks suitable for analysis were selected. Then, we analyzed the external and internal systems of the textbooks separately. As a result of the external system analysis, all the textbook covers were properly produced, but the quality difference was significant among textbooks. In the case of textbooks for elementary school students, the excellence of layout and content placement was noticed. On the other hand, due to the internal system analysis, various contents were not included evenly when looking at the learning contents based on the "information society responsibility" learning goals presented in China. Through this paper, we hope to provide implications for information security-related education and textbook development research.

• Journal of Platform Technology
• /
• v.11 no.1
• /
• pp.23-37
• /
• 2023

As the importance of R&D increases amid the paradigm of technology hegemony competition, countries around the world are increasing investment in R&D, at the same time, making effrots to portect R&D. Centering to technology-leading countries, such as Korea, the United States and Japan, they reorganize research security regulations to protect national R&D; however, the burden of compliance for researcher and research institutes is still high. Korea enacted the National R&D Innovation Act and the Enforcement Decree of the same Act to establish an integrated and systematic research security support system, but research institutes and researchers still lack understanding and practice of research security. In order to strengthen researcher's research security compliance, this study organized information requirements for each security management area through domestic and foreign research security laws and prior research analysis, and designed research security information requirements items centered on researchers. The designed information requirements are meaningful in that they were designed by considering both the management area and the stage of R&D, focusing on researchers performing R&D in the field. Based on the designed information requirements items, it is expected that systematic security management will be possible at the research site, which will ease the security burden of researchers and improve research security compliance at the research and development site.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.13 no.2
• /
• pp.81-89
• /
• 2003

With the rapid development of information and communication technology, online dissemination increases rapidly. So, It becomes more important to protect information. Recently the authentication system using public key infrastructure (PKI) is being utilized as an information protection infrastructure for electronic business transactions. And the smartcard system makes the most use of such an infrastructure. But because the certification based on the current PKI provides oかy basic user certification information, the use has to be limited in various application services that need the identification and authorization information as well as face-to-face information of the user. In order to protect a system from various kinds backings and related treats, we have proposed angular and private key multiplexing for prevention of smartcard forgery and alteration based on a photopolymer cryptosystem. When smartcard becomes prone to forgery and alteration, we should be able to verify it. Also, our parer proposes a new authentication system using multi authentication based on PKI. The smartcard has an excellent advantage in security and moving.

• The KIPS Transactions:PartC
• /
• v.10C no.7
• /
• pp.929-936
• /
• 2003

We Propose the Suity Cryptography File System to encrypt or decrypt a plaintext or an encrypted tort by using the dynamic linking mechanism In the Linux kernel. The dynamic linking mechanism gives the flexibility of the kernel without changing the kernel. The Sorority Cryptography File System uses the blowfish algorithm to encrypt or decrypt a data. To overcome the overhead of the key server, I use key generating algorithm which is installed in the same Security Cryptography File System. The Security Cryptography file System is fitted into the Linux system.

• Convergence Security Journal
• /
• v.19 no.2
• /
• pp.59-72
• /
• 2019

In this day and age physical and cyber boundaries have converged due to the development of new technologies, such as the Internet of Things (IoT) and the Cyber Physical System (CPS). As the relationship between physical system and cyber technology strengthens, more diverse and complex forms of risk emerge. As a result, it is becoming difficult for single organization or government to fully handle this situation alone and cooperation based on information sharing and the strengthening of active defense systems are needed. Shifting to a system in which information suitable for various entities can be shared and automatically responded to is also necessary. Therefore, this study tries to find improvements for the current system of threat information collecting and sharing that can actively and practically maintain cyber defense posture, focusing particularly on the structuring of information sharing platforms. To achieve our objective, we use a risk communication theory from the safety field and propose a new platform by combining an action-oriented security process model.

• The Journal of the Korea Contents Association
• /
• v.21 no.1
• /
• pp.531-540
• /
• 2021

As cyber attacks and crimes increase exponentially and hacking attacks become more intelligent and advanced, hacking attack methods and routes are evolving unpredictably and in real time. In order to reinforce the enemy's responsiveness, this study aims to propose a method for developing an artificial intelligence-based security control platform by building a next-generation security system using artificial intelligence to respond by self-learning, monitoring abnormal signs and blocking attacks.The artificial intelligence-based security control platform should be developed as the basis for data collection, data analysis, next-generation security system operation, and security system management. Big data base and control system, data collection step through external threat information, data analysis step of pre-processing and formalizing the collected data to perform positive/false detection and abnormal behavior analysis through deep learning-based algorithm, and analyzed data Through the operation of a security system of prevention, control, response, analysis, and organic circulation structure, the next generation security system to increase the scope and speed of handling new threats and to reinforce the identification of normal and abnormal behaviors, and management of the security threat response system, Harmful IP management, detection policy management, security business legal system management. Through this, we are trying to find a way to comprehensively analyze vast amounts of data and to respond preemptively in a short time.