• The Journal of the Korea Contents Association
• /
• v.21 no.6
• /
• pp.51-61
• /
• 2021

In the era of the 4th industrial revolution symbolized by the Internet of Things, big data and artificial intelligence, various embedded devices are increasing exponentially. These devices have communication functions despite their low specifications, so the possibility of personal information leakage is increasing, and security threats are also increasing. Embedded devices can have security issues at most levels, from hardware to services over the network. In addition, it is difficult to apply general security techniques because it has characteristics of resource constraints such as low specifications and low power, and the related technology has not been standardized. In this study, we present vulnerabilities and possible problems and considerations in applying SDN to embedded devices in consideration of structural characteristics and real-world discovered cases. This study presents vulnerabilities and possible problems and considerations when applying SDN to embedded devices. From a hardware perspective, we consider the problems of Wi-Fi chips and Bluetooth, the problems of open flow implementation, SDN controllers, and examples of structural properties. SDN separates the data plane and the control plane, and provides a standardized interface between the two, enabling efficient communication control. It can respond to the security limitations of existing network technologies that are difficult to respond to rapid changes.

• Convergence Security Journal
• /
• v.20 no.4
• /
• pp.169-176
• /
• 2020

Recently, the era in which various services using smart devices are used is sometimes referred to as the so-called "smart era". Among these, Smart Home Service' have not only brought about significant changes in the residential environment and culture, but are evolving very rapidly. and The 'Smart Home Service' provides more convenient services to users through communication between various electronic products in general homes, and has a bright future in the future. In particular,'Smart Home Service' provides various services combined based on IoT(Internet of Things) technology and wired/wireless communication in connection between various devices. However, such a "smart home service" inherits the security vulnerabilities of the underlying technologies such as the Internet of Things and wired and wireless communication technologies, and accidents that lead to the leakage of personal information and invasion of privacy continue to occur. So, it is necessary to prepare a countermeasure and prevention against the weak factors of the underlying technologies. Therefore, this paper is expected to be used as basic data for future application technology development and countermeasure technology by examining various security vulnerability factors of 'Smart Home Service'.

• Convergence Security Journal
• /
• v.22 no.2
• /
• pp.59-66
• /
• 2022

Recently, smart home technology has been developed with a great response due to the convenience of home automation. Smart home technology provides various services by connecting various Internet of Things (IoT) and sensors to a home network through wired/wireless networks. In addition, the smart home service easily and conveniently controls lighting, energy, environment, and door cameras through a wall pad. However, while it has become a social issue due to the recent hacking accident of wall pads, personal information leakage and privacy infringement are expected. Accordingly, it is necessary to prepare preventive and countermeasures against security vulnerability factors of wall pads. Therefore, this study expects that it can be used as basic data for future smart home application and response technology development by examining the weak causes and countermeasures related to wall pads.

• Convergence Security Journal
• /
• v.23 no.3
• /
• pp.29-36
• /
• 2023

With the recent surge in exposure to fake advertising phishing sites in search engines, the damage caused by poor search quality and personal information leakage is increasing. In particular, the seriousness of the problem is worsening faster as the possibility of automating the creation of advertising phishing sites through tools such as ChatGPT increases. In this paper, the source code of fake advertising phishing sites was statically analyzed to derive structural commonalities, and among them, a detection crawler that filters sites step by step based on foreign domains and redirection was developed to confirm that fake advertising posts were finally detected. In addition, we demonstrate the need for new guide lines by verifying that the redirection page of fake advertising sites is divided into three types and returns different sites according to each situation. Furthermore, we propose new detection guidelines for fake advertising phishing sites that cannot be detected by existing detection methods.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.31 no.1
• /
• pp.31-49
• /
• 2021

IoT devices refer to embedded devices that can communicate with networks. Since there are various types of IoT devices and they are widely used around us, in the event of an attack, damages such as personal information leakage can occur depending on the type of device. While the security team analyzes IoT devices, they should target firmware as well as software interfaces since IoT devices are operated by both of them. However, the problem is that it is not easy to extract and analyze firmware and that it is not easy to manage product quality at a certain level even if the same target is analyzed according to the analyst's expertise within the security team. Therefore, in this paper, we intend to establish a vulnerability analysis process for the firmware of IoT devices and present available tools for each step. Besides, we organized the process from firmware acquisition to analysis of IoT devices produced by various commercial manufacturers, and we wanted to prove their validity by applying it directly to drone analysis by various manufacturers.

• Information Systems Review
• /
• v.23 no.3
• /
• pp.97-125
• /
• 2021

Blockchain is a core technology to solve personal information leakage and data management issues, which are limitations of existing Genomic Sequencing services. Due to continuous cost reduction and deregulation, the market size of Genomic Sequencing has been increasing, also the potential of services is expected to increase when Blockchain's security and connectivity are combined. We created our research model by combining the Technology Acceptance Model (TAM) and the Innovation Resistance Theory also analyzed the factors affecting the acceptance intention and innovation resistance of the Blockchain Based Genomic Sequencing Information Platform. A survey was conducted on 150 potential users of Blockchain and Genomic Sequencing services. The analysis was conducted by setting the four Blockchain variables: Security, transparency, availability, and diversity). Also, we set the Perceived Usefulness, Perceived risk, and Perceived Complexity for Technology Acceptance and Innovation Resistance variables and analyzed the effect of the characteristics of the Blockchain on acceptance intention and innovation resistance through these variables. Through this analysis, key variables that need to be considered important to reduce resistance and increase acceptance intention could be identified. This study presents innovation factors that should be considered in companies preparing a new Blockchain Based Genomic Sequencing Information Platform.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.19 no.4
• /
• pp.125-135
• /
• 2009

Logs from various security system can reveal the attack trials for accessing private data without authorization. The logs can be a kind of confidence deriving factors that a certain IP address is involved in the trial. This paper presents a rule-based expert system for derivation of privacy violation confidence using various security systems. Generally, security manager analyzes and synthesizes the log information from various security systems about a certain IP address to find the relevance with privacy violation cases. The security managers' knowledge handling various log information can be transformed into rules for automation of the log analysis and synthesis. Especially, the coverage of log analysis for personal information leakage is not too broad when we compare with the analysis of various intrusion trials. Thus, the number of rules that we should author is relatively small. In this paper, we have derived correlation among logs from IDS, Firewall and Webserver in the view point of privacy protection and implemented a rule-based expert system based on the derived correlation. Consequently, we defined a method for calculating the score which represents the relevance between IP address and privacy violation. The UI(User Interface) expert system has a capability of managing the rule set such as insertion, deletion and update.

• Korean Security Journal
• /
• no.2
• /
• pp.99-123
• /
• 1999

Internet related crimes are a crime which is inter-related with high specialization ${\cdot}$ technicality ${\cdot}$ leakage of information ${\cdot}$ intellectual-offence and deviant behavior. Without the accurate countermeasure, we can't achieve the desired end. So we should find out multilateral and general measure. Always crimes go in advance of the measure, so the counter measures against, computer crime can not be final. Nevertheless, we can't be careless in making the measure, but we should always consider a counter measure. 1995. 12. 29. our country revised criminal law and consolidated direct provisions, especially on the computer-hacking. But, inspite of the revision, especially on the computer-hacking. But, inspite of the revision, we have many problems'. So, first of all, through the positive and empirical study, we should revise criminal law and computer crime related provisions systematically. As the aspects and techniques of internet related crimes are always changing with the development of computer technology, there will be many problems with principle of legality, when we apply the existing abstract provisions to the new crime. We can not be lazy in studying the emerging internet related crimes and taking concrete shape of the provision. And it will be a big help to that desirable to import the foreign provision without consideration of our reality. Without the positive and empirical study on internet related crimes, sometimes important crime will be out of reach of the punishment. Due to these day's development of computer and technology of communication, the personal computers are widely supplied and especially PC communication and exchange of the informations became the most important function. With the advent of internet, new aspects of crimes are appearing. Up to now, the fraud by using the computer or the interference in the execution of duty by the illegal operation of computer was the leading aspects of computer crime, but nowadays with the advent of internet, database crime or network crime like the computer hacking became the important aspects of internet related crimes. These new aspects of internet related crimes are defusing into domains of traditional crimes. Nevertheless to follow and punish the acts on the internet is not technically easy, and as it is emerging international shape, to settle it by international law is not that easy. Harmful acts in the information-oriented society are very diverse in kinds and aspects, and it is difficult to enumerate. The point is that among the new acts in the information-oriented society we should decide which acts are to be punished and which acts are not to be punished. It is needless to say that the criminal law should be the last resort. But owing to the characters of the characteristics of the information-oriented society, when the traditional standards can be applied, the question of what is the basis and how it can be applied in a concrete way is not settled. And if it cannot be applied, how can we make new standard is also an unsettled question.

• The Journal of The Korea Institute of Intelligent Transport Systems
• /
• v.21 no.2
• /
• pp.116-131
• /
• 2022

With the recent progress of the 4th industrial revolution, the logistics industry is also making efforts to introduce smart logistics, and various attempts are being made to spread logistics informatization, which is the core of smart logistics. Among these, blockchain technology is considered as a technology that will contribute to the spread of logistics informatization and is being applied to various fields. Accordingly, in this study, to discuss the applicability of blockchain technology to the logistics industry, the characteristics of blockchain technology were defined, related cases were reviewed, and a survey was conducted on the possibility of application in the industry. Blockchain technology can be defined as having the characteristics of economic feasibility, speed, transparency in terms of work efficiency, and scalability, decentralization (decentralization), reliability (security) in terms of added value creation. It was confirmed that many are being introduced in the fields of distribution, finance, personal information, and public services. As a result of the survey on the logistics industry, it was confirmed that the level of informatization of the logistics industry had entered the stage of generating profits by using information, but the industry was passive in sharing and utilizing information due to concerns about information leakage. Nevertheless, the awareness and expectation of the need for informatization is high, and it is expected that the informatization of the logistics industry and realizing smart logistics based on it will advance one step further with the introduction of blockchain technology in the future.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.20 no.5
• /
• pp.550-558
• /
• 2019

As the scale of the Internet of Things (IoT) environment grows and develops day by day, the information collected and shared through IoT devices becomes increasingly diverse and more common. However, because IoT devices have limitations on computing power and a low power capacity due to their miniaturized size, it is difficult to apply security technologies like encryption and authentication that have been directly applied in the previous Internet environment, making the IoT vulnerable to security threats. Because of this weakness, important information that needs to be delivered safely and accurately is exposed to the threat of malicious exploitation, such as data forgery, data leakage, and infringement of personal information. In order to overcome this threat, various security studies are being actively conducted to compensate for the weaknesses in IoT environment devices. In particular, since various devices interact, and share and communicate information collected in the IoT environment, each device should be able to communicate with reliability. With regard to this, various studies have been carried out on techniques for device authentication. This study examines the limitations and problems of the authentication techniques that have been studied thus far, and proposes technologies that can certify IoT devices for safe communication between reliable devices in the Internet environment.