• Proceedings of the Korean Information Science Society Conference
• /
• 2003.10a
• /
• pp.694-696
• /
• 2003

우리 생활은 컴퓨터와 인터넷의 발달로 많이 편리해 졌고 향상되었다. 그러나 예전엔 중요하게 생각하지 않았던 보안이라는 문제가 발생되었다. 그 해결책으로 많은 침입 탐지 시스템이 개발되었다. 본 논문에서는 주요 디렉토리 및 파일의 접근을 감시하며 중요한 정보가 외부로 유출되는 것을 막고 시스템을 보호하는 SIDPS를 제안한다. 이 시스템은 특정 패턴을 이용한 기존의 방식과는 다른“센서 파일/데이터”를 이용한다. 또한 LKM방식을 이용해 실행하도록 함으로서 손쉬운 설치 및 성능향상이 가능하도록 하였다.

• Digital Contents
• /
• no.3 s.58
• /
• pp.87-91
• /
• 1998

클라이언트/서버 개발에 있어 단일 서버용 솔루션만 다루던 과거와 달리 이제는 인터넷은 물론 다중 네트웍 운영체제 및 다중 플랫폼을 이용해 네트웍 중심의 분산 애플리케이션을 구축하고 있다. 따라서 애플리케이션이나 데이터베이스 서버, 디바이스, 파일 등의 네트웍 접속이 가능한 자원의 위치를 알아내고, 이를 활용하는 것이 다수의 시스템을 다루는 데 있어 매우 중요한 사안이 되고 있다. 더욱이 자원들을 해커로부터 보호하기 위한 보안 문제를 비롯, 사용자들이 원하는 각각의 자원에 대한 세부사항을 제공하는 일 또한 선결 과제라 할 수 있다.

• Review of KIISC
• /
• v.8 no.3
• /
• pp.59-69
• /
• 1998

전자상거래 분야에의 PKI의 성공적인 도입은 기술적 문제의 해결 뿐만 아니라 법 제도적인 불확실성을 어떻게 해결하느냐에 크게 좌우된다 우리나라의 전자 서명 관련 법제화가 전자상거래 활동이나 전자적 방법의 활성화가 안전하게 발전적인 방향으로 나아가고자 하는 취지에서 세계 주요 나라의 PKI동향을 고찰하여 본다. PKI의 설계는 정부 국가 기관 등의 공공 섹터나 전자상거래 등 산업계 등의 적용 분야에 따라 각기 다른 인증 정책과 인증 책임의 한계 등 적절한 고려 사항을 충족하여야 한다. 이러한 관점에서 미국, 캐나다, 유럽, 호주 등 세계 주요 국가 활동을 소개하고 특히 비교적 잘 구현된 사례로 전자 카드 지불 수단인SET 아카텍처와 미 연방 정부의 PKI의 최근 사례를 소개하였다. 대규모의 공개키 시스템을 실현하는데 가장 중요한 두 가지 문제는 어떻게 적절한 인증 경로를 찾느냐하는 문제와 찾고 난 다음 어떻게 검증하느냐 하는 문제이다. 경로 찾기는 디렉토리 서비스 등 필요한 정보 Retrieval 서비스만 주어진다면 자동화 될 수 있다. 경로 확인은 주의 깊게 정확한 알고리듬을 따라야 하며 또한 안전하게 구현되어야 한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.1 no.1
• /
• pp.3-15
• /
• 1991

in 1984 Shamir proposed the concept of ID(identity)-based cryptosystem and digital signature scheme wich does not require any public file for storing the user' s public keys. In this paper, the concept of the ID-based cryptosystem based on discrete logarithm problem using the conven-tional public-key cryptosystems is described, and the implementation method of the ID-based cryptosystem is also presented. The new digital signaturw schme based on the ID-based crypto-system is proposed and possible atacks are considered and analyzed for the security of digital signature scheme. The proposed ID-based schemes are particularrly useful for smart card and personal identification card application.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.13 no.4
• /
• pp.99-107
• /
• 2003

In this paper we propose an international cross certification model using cross certificate. We propose a new model by analyzing and solving current problems of the National PKI. We recommend a certificate profile, design a directory schema, and propose a method to access PSE(personal security environment) using PKCS＃11, which gives the expansibility and convenience. Finally, we propose a certificate path verification method using RFC 3280 and show how to get the certificate chain by using the trust anchor. This model is recommended to the detailed level of specification for the interoperability of each country's PKI.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.25 no.10
• /
• pp.1397-1402
• /
• 2021

The overlay2 file system is one of the union file systems that mounts multiple directories into one. The source directory used for this overlay2 file system mount has a characteristic that it operates independently of the write-able layer after mounting, so it is often used for container platforms for application delivery. However, the overlay2 file system has a security vulnerability that the write-able layer is also modified when file in the source directory is modified. In this study, I proposed the overlay2 file system protection technology to remove the security vulnerabilities of the overlay2 file system. As a result of empirically implementing the proposed overlay2 file system protection technology and verifying the function, the protection technology proposed in this study was verified to be effective. However, since the method proposed in this study is a passive protection method, a follow-up study is needed to automatically protect it at the operating system level.

• The Journal of the Korea Contents Association
• /
• v.19 no.5
• /
• pp.417-425
• /
• 2019

Storage snapshot technology allows to preserve data at a specific point in time, and recover and access data at a desired point in time. It is an essential technology for storage protection application. Existing snapshot methods have some problems in that they dependent on storage hardware vendor, file system or virtual block device. In this paper, we propose a new snapshot method for solving the problems and creating snapshots on-line. The proposed snapshot method uses a method of extracting the log records of update operations at the virtual file system layer to enable the snapshot method to operate independently on file systems, virtual block devices, and storage hardwares. In addition, the proposed snapshot mehod creates and manages snapshots for directories and files without interruption to the storage service. Finally, through experiments we measure the snapshot creation time and the performance degradation caused by the snapshot.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.15 no.3
• /
• pp.53-64
• /
• 2005

In this paper, proposes Kerberos certification mechanism that improve certification service of PKINIT base that announce in IETF CAT Working Croup. Also proposed Authentication Mechanism for reusability of Ticket that after Ticket's Lifetime is ended, message exchange that Local Client receives Remote Server's service. Since my suggestion to regional services are not described in Kerberos, authentication between regions can be performed via PKINIT(Public Key Cryptography for Initial Authentication) presented by IETF(Internet Engineering Task Force) CAT working group. The new protocol is better than the authentication mechanism proposed by IETF CAT Working group in terms of communication complexity and mechanism according to simplified Ticket issue processing.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.10 no.4
• /
• pp.47-57
• /
• 2000

This paper proposes efficient anonymous fingerprinting with improved automatic identification of redistributors in electronic commerce of digital contents. The proposed scheme by Domingos in Eletronic Letters is inefficient in electronic commerce, because of pass numbers in registration protocol and exponential computations in identification protocol. Our scheme is reduced 2-pass in registraton protocol and is required only 1 time exponential computation than his in identification protocol. According to electronic commerce of digital contents used in ordinary life, our schemes values are increased.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.12 no.2
• /
• pp.123-133
• /
• 2002

In Network Environment, Kerberos certification mechanism to require Kerberos server in other area unconditionally belief. Also, Kerberos server in cooperation area must be share server of other area and secret key. To solve these two problems, this paper proposed safe security mechanism of doing to ably IETF CAT's PKINIT/PKCROSS a1gorithm with Public Key Infrastructure and use Directory System and service between realms do trust and prove each Kerberos trust center base. Also, Although Kerberos server of each area must be foreknowing each server's secret key and public key, Obtain through Trust center and acquire each area's public key and common symmetric key, Application server excluded process that must register key in Key Distribution Center.