• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.21 no.1
• /
• pp.15-26
• /
• 2011

The development of IT technology and information communication networks activated to online financial transactions; the users were able to get a variety of financial services. However, unlike the positive effect that occurred on 7 July 2009 DDoS(Distribute Denial of Service) attacks, such as damaging to the user, which was caused negative effects. Authentication technology(OTP) is used to online financial transaction, which should be reviewed to safety with various points because the unpredictable attacks can bypass the authentication procedure such as phishing sites, which is occurred. Thus, this paper proposes mobile OTP(One Time Password) Mechanism, which is based on PKI to improve the safety of OTP authentication. The proposed Mechanism is operated based on PKI; the secret is transmitted safely through signatures and public key encryption of the user and the authentication server. The users do not input in the web site, but the generated OTP is directly transmitted to the authentication server. Therefore, it is improvement of the availability of the user and the resolved problem is exposed from the citibank phishing site(USA) in 2006.

• Journal of Convergence for Information Technology
• /
• v.12 no.4
• /
• pp.103-110
• /
• 2022

Online transactions are more familiar in various fields due to the development of the ICT and the increase in trading platforms. In particular, the amount of transactions is increasing due to the increase in used transaction platforms and users, and reliability is very important due to the nature of used transactions. Among them, the used car market is very active because automobiles are operated over a long period of time. However, used car transactions are a representative market to which information asymmetry is applied. In this paper presents a DID-based transaction model that guarantees reliability to solve problems with false advertisements and false sales in used car transactions. In the used car transaction model, sellers only register data issued by the issuing agency to prevent false sales at the time of initial sales registration. It is authenticated with DID Auth in the issuance process, it is safe from attacks such as sniping and middleman attacks. In the presented transaction model, integrity is verified with VP's Proof item to increase reliability and solve information asymmetry. Also, through direct transactions between buyers and sellers, there is no third-party intervention, which has the effect of reducing fees.

• KIPS Transactions on Computer and Communication Systems
• /
• v.12 no.3
• /
• pp.111-118
• /
• 2023

Cyber attacks are increasing worldwide, and attacks on personal privacy such as CCTV and IP camera hacking are also increasing. If you search for IP camera hacking methods in spaces such as YouTube, SNS, and the dark web, you can easily get data and hacking programs are also on sale. If you use an IP camera that has vulnerabilities used by hacking programs, you easily get hacked even if you change your password regularly or use a complex password including special characters, uppercase and lowercase letters, and numbers. Although news and media have raised concerns about the security of IP cameras and suggested measures to prevent damage, hacking incidents continue to occur. In order to prevent such hacking damage, it is necessary to identify the cause of the hacking incident and take concrete measures. First, we analyzed weak account settings and web server vulnerabilities of IP cameras, which are the causes of IP camera hacking, and suggested solutions. In addition, as a specific countermeasure against hacking, it is proposed to add a function to receive a notification when an IP camera is connected and a function to save the connection history. If there is such a function, the fact of damage can be recognized immediately, and important data can be left in arresting criminals. Therefore, in this paper, we propose a method to increase the safety from hacking by using the connection notification function and logging function of the IP camera.

• Strategy21
• /
• s.40
• /
• pp.216-234
• /
• 2016

본 논문은 자위권 사용과 군사력 사용 간의 관계를 분석하고 이를 한반도 서해에서의 한국과 북한 간 해상긴장 상황에 적용시킨 이슈를 다룬다. 국가가 행사하는 자위권(self-defense: 自衛權)은 기본적으로 전쟁 방지를 위한 기본적 원칙이다. 그러나 이는 군사력 사용(Use of Forces: 軍事力 使用) 또는 무력행사(武力行事)이라는 측면에서 칼의 양날과 같은 결과를 낳는다. 즉 자위권 행사로 전쟁의 확산을 방지하는 반면에 자위권 행사로 상대방에 대한 적성(敵性)을 인정해 주는 경우이다. 반면 북한의 군사도발은 전방향적이며, 1953년 한반도 정전협정 위반이다. 1953년 정전협정 체결 이후 양국은 서해 북방한계선(NLL)에서의 군사적 충돌을 거쳤으며, 이는 과연 한국이 자위권 차원에서의 방어태세와 군사력 사용 측면에서의 대응태세 간에 괴리가 존재하고 있다는 것으로 나타나고 있다. 당연히 피해를 받는 곳은 한국이며, 이는 서해 북방한계선에서의 남북한 해군 간 대결국면에서 나타나고 있다. 이에 본 논문은 자위권을 국가 차원 행사하는 수준과 작전에 투입된 현장 작전 지휘관 차원에서 행사하는 수준으로 구분하여 다룬다. 서해 북방한계선 부근 수역에서의 북한의 해상 군사도발에 대해 현장 작전 지휘관이 행사하는 자위권은 대한민국 정부 차원에서의 자위권 행사와는 다르면, 이 문제를 국제법을 중심으로 분석하기에는 너무나 많은 제한점이 있다. 현행 국제법상 국가 자위권 문제는 군사력을 동반하는 문제로서 그 행사요건이 매우 애매모호하고 까다롭다. 그러나 현장 작전지휘관의 자위권 행사는 단호해야 하며, 이는 군사력 운용으로 나타나야 한다. 실제 서해에서의 남북한 대결국면에서의 대한민국 해군의 자위권 행사는 정전협정에 의거 제한되고 있으며, 이는 2010년 북한의 천안함 침몰과 연평도 폭격도발 시 대한 민국 해군과 해병대의 대응에서 증명되었다. 현재 대한민국 국방부는 현장 작전 지휘관에서 소위 '선제적 자위권 행사' 부여 필요성에 대한 논의를 진행 중으로 알려져 있다. 이에 따라 선제적 자위권 행사를 위한 조치들을 제도화하는 움직임을 보이고 있다. 예를 들면 2013년 발표된 대한민국 합참과 유엔사령부/한미 연합사령부/주한미군사령부 북한 군사 도발에 대한 대응계획(ROK JCS and UNC/CFC/USFK Counter-Provocation Plan)이 이를 간접적으로 증명하고 있다. 선제적 자위권은 행사에 있어 몇 가지 원칙을 요구하고 있으며, 이에 대한 합법성 문제는 아직 해결되고 있지 않다. 따라서 이 문제와 북한 군사도발 시에 대한 대한민국의 선제적 자위권 행사 간 연관성 문제를 어떻게 해석할 수 있는가에 대한 연구가 필요한 실정이다. 평시 군사력 사용에 따른 무력행사의 적법성은 그 인정이 대단히 어려운 것이 현실이며, 이에 따라 북한의 군사도발에 대한 가장 효율적 방안이 선제적 자위권이라면, 이에 대한 법적 대응이 무엇인가에 대한 제도적 근거를 필요로 할 것이다.

• Journal of the Institute of Electronics Engineers of Korea CI
• /
• v.49 no.2
• /
• pp.123-133
• /
• 2012

This paper discuss about DNA watermarking using coding DNA sequence (CDS) for the authentication, the privacy protection, or the prevention of illegal copy and mutation of DNA sequence and propose a DNA watermarking scheme with the mutation robustness and the animo acid preservation. The proposed scheme selects a number of codons at the regular singularity in coding regions for the embedding target and embeds the watermark for watermarked codons and original codons to be transcribed to the same amino acids. DNA base sequence is the string of 4 characters, {A,G,C,T} ({A,G,C,U} in RNA). We design the codon coding table suitable to watermarking signal processing and transform the codon sequence to integer numerical sequence by this table and re-transform this sequence to floating numerical sequence of circular angle. A codon consists of a consecutive of three bases and 64 codons are transcribed to one from 20 amino acids. We substitute the angle of selected codon to one among the angle range with the same animo acid, which is determined by the watermark bit and the angle difference of adjacent codons. From in silico experiment by using HEXA and ANG sequences, we verified that the proposed scheme is more robust to silent and missense mutations than the conventional scheme and preserve the amino acids of the watermarked codons.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.24 no.1
• /
• pp.31-40
• /
• 2014

In Korea, the Public Key Infrastructure (PKI) has been introduced. For secure information transmission and identification, the electronic signature authorization system of a certificate-based is built, and then the service provide.The certificate is stored in location what users can easily access and copy. Thus, there is a risk that can be stolen by malware or web account hacking. In addition, private key passwords can be exposed by the logging tool, after keyboard security features are disabled. Each of these security weaknesses is a potential conduit for identity theft, property/asset theft, and theft of the actual certificates. The present study proposes a method to prevent the private key file access illegally. When a certificate is stored, the private key is encrypted by the dependent element of the device, and it is stored securely. If private key leakage occurs, the retrieved key could not be used on other devices.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.39B no.4
• /
• pp.200-206
• /
• 2014

Accountable Internet Protocol (AIP) is one of the future Internet architectures to provide accountability concept by using the self-certifying address that is derived by the public key of the host. In AIP, when a host sends a packet, a domain that is located between the source and the destination hosts discards the packet in order to verify the source IP address. Therefore, performance degradation can occur due to packet discard especially when there is asymmetric route. In this paper, we propose the improved AIP mechanism to verify the source IP address without discarding the packet by including the timestamp, public key value and the signature for protecting from forfeiting the source address. Security safety of the proposed mechanism is evaluated and the proposed mechanism can provide the more robust security as well as reducing the latency due to discarding packets.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.13 no.2
• /
• pp.842-848
• /
• 2012

In this paper, as a proper authentication method, we made it authenticate a user who has unauthorized device with using authorized device received from telecommunication company using QR code. We designed a better performance protocol which can authenticate mutually using safer and uncomplicated operations than existing user authentication system. Proposed user authentication system authenticates previously authorized mobile device without any information of client who is requesting to get access from outside, so we can basically prevent attack from hackers. In the future, we can possibly use it as user authentication method in common internet environment or we could study on user unique information instead of mobile device information.

• Journal of the Society of Disaster Information
• /
• v.14 no.1
• /
• pp.65-71
• /
• 2018

In this study, it is aimed to prevent the spread of pollutants in the event of a major disaster caused by CBRNE accidents and attacks and build up system to provide optimal transport environment for each patient condition By identifying characteristics of existing products and make them immediately applicable in the field. The purpose of this study is suggesting essential consideration in both functional and performance in the development of the isolation unit. As a result of the study, it suggests (1) basic function, (2) efficient field utilization, (3) isolation unit interface and combination of modules in development of isolation unit.

• Convergence Security Journal
• /
• v.6 no.1
• /
• pp.1-11
• /
• 2006

The exponential increase of malicious and criminal activities in cyber space is posing serious threat which could destabilize the foundation of modem information society. In particular, unexpected network paralysis or break-down created by the spread of malicious traffic could cause confusion and disorder in a nationwide scale, and unless effective countermeasures against such unexpected attacks are formulated in time, this could develop into a catastrophic condition. As a result, there has been vigorous effort and search to develop a functional state-level cyber-threat early-warning system however, the efforts have not yielded satisfying results or created plausible alternatives to date, due to the insufficiency of the existing system and technical difficulties. The existing cyber-threat forecasting and early-warning depend on the individual experience and ability of security manager whose decision is based on the limited security data collected from ESM (Enterprise Security Management) and TMS (Threat Management System). Consequently, this could result in a disastrous warning failure against a variety of unknown and unpredictable attacks. It is, therefore, the aim of this research to offer a conceptual design for "Knowledge-based Real-Time Cyber-Threat Early-Warning System" in order to counter increasinf threat of malicious and criminal activities in cyber suace, and promote further academic researches into developing a comprehensive real-time cyber-threat early-warning system to counter a variety of potential present and future cyber-attacks.