• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제11권1호
• /
• pp.466-483
• /
• 2017

Zen Cart is an open-source online store management system. It is used all over the world because of its stability and safety. Today, Zen Cart's session security mechanism is mainly used to verify user agents and check IP addresses. However, the security in verifying the user agent is lower and checking the IP address can affect the user's experience. This paper, which is based on the idea of session protection as proposed by Ben Adida, takes advantage of the HTML5's sessionStorage property to store the shared keys that are used in HMAC-SHA256 encryption. Moreover, the request path, current timestamp, and parameter are encrypted by using HMAC-SHA256 in the client. The client then submits the result to the web server as per request. Finally, the web server recalculates the HMAC-SHA256 value to validate the request by comparing it with the submitted value. In this way, the Zen Cart's open-source system is reinforced. Owing to the security and integrity of the HMAC-SHA256 algorithm, it can effectively protect the session security. Analysis and experimental results show that this mechanism can effectively protect the session security of Zen Cart without affecting the original performance.

• 한국정보통신학회논문지
• /
• 제19권5호
• /
• pp.1117-1124
• /
• 2015

본 논문은 BYOD(Bring Your Own Device)를 포함한 모바일 웹 환경을 위한 웹 세션 관리 시스템에 대해서 기술한다. 이 시스템은 보안이 강화된 세션 토큰으로 운영되며, 고유 식별자, time stamp, 암호 알고리즘으로 구성된다. 시스템에서 고유 식발자는 BYOD를 포함한 모바일 환경에서 보안을 위하여 각 단말기를 구분한다. 시스템에서 time stamp는 BYOD를 포함한 모바일 환경에서 보안을 위하여 세션 유효성을 판단한다. 시스템에서 암호 알고리즘은 세션 토큰의 내부 정보를 보호한다. 본 논문은 시뮬레이션 기법을 사용해서 모바일 웹 상에서 세션 관리 시스템의 보안성을 분석한다. 제시된 방법은 기존 방법에 비하여 BYOD 환경의 모바일 웹 보안에 있어서 더 적합하다.

• Journal of information and communication convergence engineering
• /
• 제3권2호
• /
• pp.93-95
• /
• 2005

In order to create security session, security keys are preconfigured between communication objects. For this purpose, Handshake Protocol exists. The pre-master secret key that is used in this process needs to interpreted by a server to create master secret key, whose process requires a big calculation, resulting in deteriorating system's transmission performance. Therefore, it is helpful in increasing transmission speed to reuse secret keys rather than to create them at every connection.

• International journal of advanced smart convergence
• /
• 제10권4호
• /
• pp.22-29
• /
• 2021

For web application vulnerability diagnosis, from the development stage to the operation stage, it is possible to stably operate the web only when there is a policy that is commonly applied to each task through diagnosis of vulnerabilities, removal of vulnerabilities, and rapid recovery from web page damage. KISA presents 28 evaluation items for technical vulnerability analysis of major information and communication infrastructure. In this paper, we diagnose the vulnerabilities in the automobile goods shopping mall website and suggest security measures according to the vulnerabilities. As a result of diagnosing 28 items, major vulnerabilities were found in three items: cross-site scripting, cross-site request tampering, and insufficient session expiration. Cookie values were exposed on the bulletin board, and personal information was exposed in the parameter values related to passwords when personal information was edited. Also, since the session end time is not set, it was confirmed that session reuse is always possible. By suggesting security measures according to these vulnerabilities, the discovered security threats were eliminated, and it was possible to prevent breaches in web applications and secure the stability of web services.

• 한국정보통신학회:학술대회논문집
• /
• 한국정보통신학회 2014년도 추계학술대회
• /
• pp.387-389
• /
• 2014

스마트 단말기의 대중화로 모바일을 통한 업무 처리가 선호되고 있다. 모바일 기기를 통한 인터넷 접속 비율도 2012년 9월 기준으로 PC 대비 30%에 이르고 있다. 모바일 시대에 나타나는 사이버 보안 위협의 특징은 기존의 인터넷에서 발생되는 보안 위협이 모바일 환경에서도 그대로 재현된다는 점이다. 웹 애플리케이션 보안 연구 기관인 OWASP (The Open Web Application Security Project)가 경고하는 세션 관리의 취약점은 앞으로 모바일 환경에서도 대비해야 하는 이슈이다. 하지만 모바일과 데스크탑 컴퓨터의 세션 관리 환경은 크게 다르다. 본 학술지는 모바일 환경에 맞게 개선된 세션 관리 방식을 제안한다.

• 정보보호학회논문지
• /
• 제18권3호
• /
• pp.3-8
• /
• 2008

세션상태 정보(session-state information)가 안전하지 않은 메모리에 저장되거나 또는 랜덤 난수 생성기 (random number generator)가 공격자에 의해 제어된다면 특정 세션에만 사용되는 난수 값과 같은 임시적인 데이터(ephemeral data)는 쉽게 노출될 수 있다. 본 논문에서는 Bresson과 그 외의 그룹 키 교환 스킴을 개선한Nam과 그 외의 그룹 키 교환 스킴이 세션상태 정보노출 공격에 안전하지 않음을 보인다. 그리고 이러한 안전성의 결함을 보완한 개선된 스킴을 제안한다.

• 한국정보과학회:학술대회논문집
• /
• 한국정보과학회 2003년도 봄 학술발표논문집 Vol.30 No.1 (A)
• /
• pp.518-520
• /
• 2003

This paper proposes a new session key agreement scheme which is based on Station-to-station protocol, or STS shortly. We extend key agreement model of STS, to take into account smart cards. Besides, we modify STS to withstand message replaying attack. Security analysis shows our scheme is still secure.

• International Journal of Internet, Broadcasting and Communication
• /
• 제8권3호
• /
• pp.50-57
• /
• 2016

In 2013, Li et al. proposed an improved smart card-based remote user password authentication scheme, and claimed that their scheme not only overcomes security weaknesses of the Chen et al.'s scheme but also is a more user friendly scheme compared with other schemes. In this paper, we analyze the security of Li et al.'s authentication scheme and we show that Li et al.'s authentication scheme is still insecure against the various attacks, such as the off-line password guessing attack, the forgery attack, and the session key generation attack etc. Also, we propose an improved scheme that can resist these security drawbacks of Li et al.'s authentication, even if the secret information stored in the smart card is revealed. As a result of security analysis, the improved scheme is relatively more secure against several attacks than other related schemes in terms of the security.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제10권12호
• /
• pp.5596-5615
• /
• 2016

Security is one of the major challenges in the Wireless Sensor Networks (WSNs). WSNs are more vulnerable to adversarial activities. All cryptographic security services indirectly depend on key management. Symmetric key management is the best key establishment process for WSNs due to the resource constraints of the sensors. In this paper, we proposed dynamic session key establishment scheme based on randomly generated nonce value and sensor node identity, in which each sensor node is equipped with session key on expire basis. The proposed scheme is compare with five popular existing key management systems. Our scheme is simulated in OMNET++ with MixiM and presented experimental results. The analytical study and experimental results show the superiority of the proposed scheme over the existing schemes in terms of energy, storage, resilience and communication overhead.

• 대한전자공학회:학술대회논문집
• /
• 대한전자공학회 2003년도 통신소사이어티 추계학술대회논문집
• /
• pp.129-132
• /
• 2003

This paper proposes a performance analysis model of security sowers. Performance analysis of security server reflects both the session and data traffic load. The proposed model is the bases of estimating the maximum response time and minimum queue size of a security server comprising a session association processor whose throughput is 1000 connection/s.