• The Journal of the Korea institute of electronic communication sciences
• /
• v.17 no.4
• /
• pp.695-702
• /
• 2022

Smart railway system, which has been actively studied in recent years, is entering the intelligent stage beyond the automation stage based on ICT (Information & Communication Technology) such as communication technology and information technology. ICT technology used in smart railways is generally supported by various information protection technologies as it is vulnerable to information infringement. As a means of high-speed/mass transportation, it is essential to devise an information protection plan for ICT technology that forms the basis for smartening the railway system. Therefore, this paper presents the necessity of step-by-step information protection that measures for smart railway communication by examining potential risk factors of smart railway communication base and considering information protection factors that can respond to them.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.31 no.5
• /
• pp.889-899
• /
• 2021

This paper proposes a reliable data sharing scheme on the internet of vehicles (IoV) by utilizing blockchain technology for constructing a decentralized system approach. In our model, to maintain the credibility of the information messages sent by the vehicles to the system, we propose a reputation rating mechanism, in which neighboring vehicles validate every received information message. Furthermore, we incorporate an incentive mechanism based on smart contracts, so that vehicles will get certain rewards from the system when they share correct traffic information messages. We simulated the IoV network using a discrete event simulator to analyze network performance, whereas the incentive model is designed by leveraging the smart contract available in the Ethereum platform.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.24 no.1
• /
• pp.97-106
• /
• 2014

CCTV(Closed Circuit television) is one of the widely used physical security technologies and video acquisition device installed at specific point with various purposes. Recently, as the CCTV capabilities improve, facial recognition from the information collected from CCTV video is under development. However, in case these technologies are exploited, concerns on major privacy infringement are high. Especially, a computer connected to a particular space images taken by the camera in real time over the Internet has emerged to show information services. In the privacy law, safety measures which is related with biometric template are notified. Accordingly, in this paper, for the protection of privacy video information in the video surveillance system, the technical and managerial requirements for video information security are suggested.

• Journal of Information Processing Systems
• /
• v.11 no.2
• /
• pp.229-238
• /
• 2015

Web shells are programs that are written for a specific purpose in Web scripting languages, such as PHP, ASP, ASP.NET, JSP, PERL-CGI, etc. Web shells provide a means to communicate with the server's operating system via the interpreter of the web scripting languages. Hence, web shells can execute OS specific commands over HTTP. Usually, web attacks by malicious users are made by uploading one of these web shells to compromise the target web servers. Though there have been several approaches to detect such malicious web shells, no standard dataset has been built to compare various web shell detection techniques. In this paper, we present a collection of web shell files, WebSHArk 1.0, as a standard dataset for current and future studies in malicious web shell detection. To provide baseline results for future studies and for the improvement of current tools, we also present some benchmark results by scanning the WebSHArk dataset directory with three web shell scanning tools that are publicly available on the Internet. The WebSHArk 1.0 dataset is only available upon request via email to one of the authors, due to security and legal issues.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2018.01a
• /
• pp.179-182
• /
• 2018

최근 여기어때, 인터파크 등 전자상거래 기업을 대상으로 발생한 개인정보 해킹사고 사례를 보면, 사람의 취약점을 노리는 지능화지속위협(APT) 공격과 알려진 해킹 기술이 복합적으로 이루어지고 있다. 해킹사고가 발생한 기관은 한국인터넷진흥원(KISA) 정보보호관리체계(ISMS) 의무대상 기관으로써 정보보호관리체계를 유지 관리하고 있었다. 그럼에도 불구하고 대형의 개인정보 유출사고가 발생한 주요 원인은 정보보호관리체계가 적용되지 않았던 정보시스템과 인력을 대상으로 해킹이 이루어졌기 때문이다. 해킹 위협의 변화에 따라 전자상거래 보안 수준도 변화해야 하는데, 개인정보보호 관련 규제 준수도 전자상거래 기업에서는 힘든 상황이다. 고객의 개인정보 유출 사고는 일반인을 매출 기반으로 서비스하고 있는 전자상거래 기업에서는 치명적이다. 안전한 전자상거래 플랫폼 기반에서 고객에게 서비스를 제공하기 위해서는 무엇보다도 중요 자산인 고객의 개인정보보호를 위해 역량을 집중해야 한다. 한정된 예산과 자원으로 안전한 서비스를 제공하기 위해서는 기존에 구축된 정보보호관리체계를 기반으로 IT보안감사체계를 전사적으로 확대하여 지속적으로 모니터링 할 필요가 있다. 이에 본 연구에서는 최신 사이버 보안 위협 동향과 전자상거래 기업 대상으로 발생한 최근 개인정보유출사고 사례를 분석을 통해 시사점을 도출하여 전자상거래 개인정보 보호를 위한 IT보안감사체계를 제시하였다.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.15 no.8
• /
• pp.2827-2848
• /
• 2021

Mobile Crowdsourcing (MCS) has become an emerging paradigm evolved from crowdsourcing by employing advanced features of mobile devices such as smartphones to perform more complicated, especially spatial tasks. One of the key procedures in MCS is to collect answers from mobile users (workers), which may face several security issues. First, authentication is required to ensure that answers are from authorized workers. In addition, MCS tasks are usually location-dependent, so the collected answers could disclose workers' location privacy, which may discourage workers to participate in the tasks. Finally, the overhead occurred by authentication and privacy protection should be minimized since mobile devices are resource-constrained. Considering all the above concerns, in this paper, we propose a lightweight and privacy-preserving answer collection scheme for MCS. In the proposed scheme, we achieve anonymous authentication based on traceable ring signature, which provides authentication, anonymity, as well as traceability by enabling malicious workers tracing. In order to balance user location privacy and data availability, we propose a new concept named current location privacy, which means the location of the worker cannot be disclosed to anyone until a specified time. Since the leakage of current location will seriously threaten workers' personal safety, causing such as absence or presence disclosure attacks, it is necessary to pay attention to the current location privacy of workers in MCS. We encrypt the collected answers based on timed-release encryption, ensuring the secure transmission and high availability of data, as well as preserving the current location privacy of workers. Finally, we analyze the security and performance of the proposed scheme. The experimental results show that the computation costs of a worker depend on the number of ring signature members, which indicates the flexibility for a worker to choose an appropriate size of the group under considerations of privacy and efficiency.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.29 no.4
• /
• pp.753-773
• /
• 2019

CV(Connected Vehicle) technology provides safety-related services and user convenience-related services to vehicle. Safety-related services can cause privacy problem by continuously transmitting vehicle information to nearby vehicles or base stations. Therefore, safety-related services should provide vehicle anonymity for privacy protection. However, if convenience-related services such as payment services fail to provide vehicle anonymity, driver information related to safety-related services may also be leaked. In this paper, we design a payment protocol based on ECQV(Elliptic Curve Qu-Vanstone) impicit certificate and group signature that provides BU-anonymity and traceability. The proposed payment protocol makes it impossible to track vehicles from payment transactions history by separating roles of payment system components. Moreover, we define the security requirements that the vehicle payment protocol must satisfy and show that the protocol satisfies the requirements.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.16 no.6
• /
• pp.37-46
• /
• 2006

It is known to be hard to apply cryptographic one-way functions to the recognition system using bio-information directly. As one of the solutions about that problem there is a permutation transformation scheme. However, they did not show my algorithmic behavior or any performance analysis of the transformation by experiment. In this paper, by showing the recognition ratio of the transformed scheme by experiment, we prove that that scheme is sound. Also, we adopt their transformation to LDA(Linear Discriminant Analysis) to show the experimental results. In the negative side, we introduce a new type of attack against the permutation transformation schemes. finally, we briefly mention a generalization of the permutation transformation for countermeasure of the attack at the end of this paper.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.20 no.5
• /
• pp.59-67
• /
• 2010

In the paper, we proposed an IM-ACM(Insider Misuse-Access Control Model) for preventing illegal information leakage by insider who exploits his legal rights in the ubiquitous computing environment. The IM-ACM can monitor whether insider uses data rightly using misuse monitor add to CA-TRBAC(Context Aware-Task Role Based Access Control) which permits access authorization according to user role, context role, task and entity's security attributes. It is difficult to prevent information leakage by insider because of access to legal rights, a wealth of knowledge about the system. The IM-ACM can prevent the information flow between objects which have the different security levels using context role and security attributes and prevent an insider misuse by misuse monitor which comparing an insider actual processing behavior to an insider possible work process pattern drawing on the current defined profile of insider's process.

• Journal of Korean Society of Industrial and Systems Engineering
• /
• v.28 no.4
• /
• pp.109-115
• /
• 2005

In the study, Methods for operating measures in equipment security to find out dangerousness timely in the system and to need for the prevention and measures. The method for analyzing and reconstructing the causes of accident of equipment in site, and try to save the information of site in real-time and to analyze the state of equipment to look for the factors of accidents. By this analysis, one plan for efficiency of production, Equipment Fault Diagnosis Management and security is integrating and building module of using the Fuzzy Inference based on fuzzy theory. The case study is applied to the industrial electric motors that are necessarily used to all manufacturing equipment. Using the sensor for temperature is attached to gain the site information in real time and to design the hardware module for signal processing. In software, realize the system supervising and automatically saving to management data base by the algorithm based in fuzzy theory from the existing manual input system