• Journal of the Korea Society of Computer and Information
• /
• v.28 no.5
• /
• pp.67-74
• /
• 2023

In this paper, we analyze the authentication protocol for DRM proposed by Hussain et al. in 2022, and present an improved solution. Hussain et al. argued that their authentication protocol guarantees man-in-the-middle attack, replay attacks, and mutual authentication. However, as a result of analyzing Hussain et al.'s authentication protocol in this paper, Hussain et al.'s authentication protocol still has an insider attack problem, a problem with Yu et al.'s authentication protocol that they pointed out. For this reason, when an inside attacker acquires information on a mobile device, a user impersonation attack was also possible. In addition, there were problems with the user's lack of ID format verification and the problem of the secret key mismatch of the digital contents between the server and the user. Therefore, this paper proposes an improved solution to solve these problems. As a result of analysis in this paper, the improved solution is safe from various attacks such as smart card attack, insider attack, and password guessing attack and can safely authenticate users of DRM.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2019.01a
• /
• pp.115-118
• /
• 2019

무선 센서 네트워크(Wireless Sensor Network)는 낮은 배터리, 짧은 통신거리 등의 제한된 센서들의 성능에 기인하여 내부자공격(insider attacks)에 취약한 것으로 알려져 있는데, 내부자 공격에 대응하기 위한 대표저인 방법으로 노드들의 행위 관찰하여 신뢰도를 평가하고 낮은 신뢰도를 갖는 노드들을 제거하는 신뢰메커니즘(Trust Mechanism: TM)이 있다. TM은 평가노드 자신의 직접관찰 정보뿐만 아니라 이웃노드의 간접관찰 정보를 함께 고려하도록 발전되어 왔는데, False-Praise 공격은 의도적으로 거짓 관찰 정보를 평가노드에게 제공하여 TM의 신뢰도 평가 프로세스의 신뢰성을 훼손하는 지능적 공격이다. 본 논문에서는 False-Praise 공격에 대응을 위한 합의 알고리즘을 기반의 개선된 TM 제안하고, 실험을 통해 제안 체계의 성능과 효과를 검증한다.

• Journal of the Korea Society of Computer and Information
• /
• v.29 no.6
• /
• pp.53-60
• /
• 2024

In this paper, we analyze the authentication scheme of Hwang et al. proposed in 2023 and propose a new authentication scheme that improves its problems. Hwang et al. claimed that their authentication scheme was practical and secure, but as a result of analysis in this paper, it is possible to attack the password/ID guessing attack and session key disclosure attack due to insider attack and stolen smart card attack. In addition, Hwang et al.'s authentication scheme, which provides user anonymity, does not provide user untraceability due to its unstable design. The proposed authentication scheme, which improves these problems, not only provides user untraceability, but also is secure for stolen smart card attack, insider attack, session key disclosure attack, and replay attack. In addition, except for one fuzzy extraction operation, it shows the same complexity or very similar one as related authentication schemes. Therefore, the proposed authentication scheme can be said to be an authentication scheme with safety and practicality.

• Proceedings of the Korean Information Science Society Conference
• /
• 2010.06d
• /
• pp.16-20
• /
• 2010

최근 급격히 발전하는 RFID(Radio Frequency Identification)나 USN(Ubiquitous Sensor Network)과 같은 무선환경은 태그(tag)와 리더(reader)간에 라디오 주파수를 이용하여 통신한다. 이러한 통신은 그 특성상 주파수 범위내의 다른 태그나 리더들 또한 이들의 통신내용을 들을 수 있다. 따라서 이렇게 도청된 정보는 악의적인 사용자에 의해 여러 가지 보안 공격을 야기할 수 있다. 반면 이러한 형태의 공격에 대해 대부분의 보안프로토콜은 외부의 공격에 주목하는 반면, 같은 알고리즘으로 통신하는 내부자의 공격, 특히 참여(entry)객체의 프라이버시정보는 이러한 프로토콜에서 보호되기 어렵다. 따라서 본 논문에서는 무선환경에서 최근 이슈가 되고 있는 불룸필터(bloom filter)를 이용하여 개인의 프라이버시 정보를 효과적으로 보호할 수 있는 기법을 제안하고 불룸필터를 확장 적용해서 그 성능을 개선하여 좀 더 효율적인 프라이버시 보호 기법을 설계하고자한다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2016.10a
• /
• pp.288-289
• /
• 2016

최근 사물인터넷(Internet of Things)의 발달로 인해 사물과 사물간의 통신을 이용해 사용자가 어느 곳에서나 집 또는 사무실 등의 장소의 정보를 얻을 수 있게 되었다. 하지만 IoT기기들을 스마트빌딩에 활용하는데 있어서 내부에서 공격이 발생했을 경우에 효과적으로 방어할 수 있는 방어체계가 갖추어져 있지 않아 위험하다는 점이 존재한다. 따라서 본 논문에서는 IoT 네트워크를 구축한 스마트빌딩에서 내부 사용자 접근에 대한 누적 정보를 바탕으로 스마트빌딩 내부에서 발생할 수 있는 불법적인 내부자 공격에 대하여 스마트빌딩을 안전하게 운영할 수 있는 내부자 패턴 모니터링 시스템을 제안한다.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.12 no.3
• /
• pp.1356-1366
• /
• 2011

The TPM(Trusted Platform Module) is a hardware chip to support a trusted computing environment. A rightful user needs a command authorization process in order to use principal TPM commands. To get command authorization from TPM chip, the user should perform the OIAP(Object-Independent Authorization Protocol) or OSAP(Object-Specific Authorization Protocol). Recently, Chen and Ryan alerted the vulnerability of insider attack on TPM command authorization protocol in multi-user environment and presented a countermeasure protocol SKAP(Session Key Authorization Protocol). In this paper, we simulated the possibility of insider attack on OSAP authorization protocol in real PC environment adopted a TPM chip. Furthermore, we proposed a novel countermeasure to defeat this insider attack and improve SKAP's disadvantages such as change of command suructures and need of symmetric key encryption algorithm. Our proposed protocol can prevent from insider attack by modifying of only OSAP command structure and adding of RSA encryption on user and decryption on TPM.

• Journal of the Korea Society of Computer and Information
• /
• v.18 no.2
• /
• pp.87-94
• /
• 2013

In this paper, we analyse the weaknesses of authentication scheme preserving user anonymity proposed by Khan et al in 2011 and we propose a new authentication schemes preserving user anonymity that improved these weaknesses. Khan et al's authentication scheme is vulnerable to insider attack and doesn't provide user anonymity to the server. Also, this scheme is still a weakness of wrong password input by mistake in spite of proposing the password change phase. In this paper, we will show that Khan et al's scheme is vulnerable to the stolen smart card attack and the strong server/user masquerade attack. The proposed authentication scheme propose the improved user anonymity, which can provide more secure privacy to user by improving these weaknesses.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.10 no.3
• /
• pp.572-578
• /
• 2009

Bindu et al. pointed out that Chein et al. scheme is insecure insider attack and man-in-middle attack. And then they proposed new one. In the paper, However, Bindu et al's scheme also have some problems; It is strong masquerading server/user attack and restricted reply attack. Hence we proposed improved scheme. finally, we completely had evaluated the one's security on strong masquerading server/user attack, Insider attack, Restricted attack, Stolen-verifier attack and forward secrecy. In this paper, although proposed scheme includes more operation than Bindu et al. scheme, our scheme overcomes problems of Bindu et al. scheme by the operation that is light as not to influence on modern computing technology.

• Journal of Advanced Navigation Technology
• /
• v.27 no.1
• /
• pp.16-22
• /
• 2023

Terrorists have been attacking in the vulnerable points of aviation sector with the diverse methods of attacks. Recently, Vulnerability is increasing because the Modus Operandi of Terrorism is carried out by exploitation of people in the form of employee working in aviation sector whose role provides them with privileged access to secured locations, secured items or security sensitive information. Furthermore, cases of insider threat are rising across the world with the phenomenon of personal radicalization through internet and social network service. The government of ROK must respond to insider threat could exploit to acts of unlawful interference and the security regulations should be established to prevent from insider threat in advance refer to the acts of unlawful interference carried out in foreign countries and the recommendations by USA, UK and ICAO.

• Journal of Internet Computing and Services
• /
• v.10 no.6
• /
• pp.229-239
• /
• 2009

To solve user authentication problem, many remote user authentication schemes using password and smart card at the same time have been proposed. Due to the increasing of interest in personal privacy, there were some recent researches to provide user anonymity. In 2004, Das et al. firstly proposed an authentication scheme that guarantees user anonymity using a dynamic ID. In 2005, Chien et al. pointed out that Das et al.'s scheme has a vulnerability for guaranteing user anonymity and proposed an improved scheme. However their authentication scheme was found some weaknesses about insider attack, DoS attack, and restricted replay attack. In this paper, we propose an enhanced scheme which can remove vulnerabilities of Chien et al.'s scheme. The proposed authentication protocol prevented insider attack by using user's Nonce value and removed the restricted replay attack by replacing time stamp with random number. Furthermore, we improved computational efficiency by eliminating the exponentiation operation.