• Journal of the Korea Convergence Society
• /
• v.8 no.2
• /
• pp.9-14
• /
• 2017

A fingerprint is unique to each person and can be represented as a digital form. As the fingerprint is the part of human body, fingerprint recognition is much more easy to use and secure rather than using password or resident card for user authentication. In addition, as the newly released smart phones have built-in camera and fingerprint sensors, the demand for biometric authentication is increasing rapidly. But, the drawback is that the fingerprint can be counterfeited easily and if it's exposed to the hacker, it cannot be reused. Thus, the original fingerprint template should be transformed for registration and authentication purposes. Existing transformation functions use passcode to transform the original template to the cancelable form. Additional module is needed to input the passcode, so it requires more cost and lowers the usability. In this paper, we propose biometric authentication scheme that is economic and easy to use. The proposed scheme is consisted of cancelable biometric template creation, registration and user authentication protocols, and can control several security levels by configuring the number of fingerprints and scan times. We also analyzed that our scheme is secure against the brute-force attack and the active attacks.

• Review of KIISC
• /
• v.15 no.6
• /
• pp.41-45
• /
• 2005

다양한 온라인 서비스의 보급으로 인해 안정적인 보안수준을 제공하면서 사용이 편리한 사용자 인증 시스템의 필요성이 대두되었다. 사용자 인증 수단으로 많이 사용되던 개인장치나 비밀번호 등추 분실 가능성 및 도용의 위험이 있어 보안이 중요한 환경에서는 사용상의 제약이 따른다. 그러므로 바이오메트릭 정보를 이용한 사용자 인증에 대한 관심이 꾸준히 증가하고 이에 따라 바이오메트릭스 기술의 발전으로 적용이 되고 있으나, 바이오메트릭 정보는 비밀번호와 같이 사용자가 임의로 변경할 수 없으므로 외부로 유출된다면 심각한 문제가 발생할 수 있다는 문제가 있다. 그러므로 본 고에서는 이러한 문제를 해결할 수 있는 바이오메트릭 정보의 취득, 저장 및 인증을 스마트카드에서 처리하는 기술에 대하여 설명하고 이의 활용 현황에 대하여 소개한다.

• Journal of Internet Computing and Services
• /
• v.17 no.4
• /
• pp.79-86
• /
• 2016

Under the influence of software security-enhanced development guidelines announced in 2012, secure coding practices become widely applicable in developing information systems aiming to enhance security capabilities. Although continuous enhancement activities for code security is important, management issues for code security have been less addressed in the guidelines. This paper analyses limitation of secure coding practices from the viewpoint of quality management. In particular this paper suggests structures and the use of software metrics from coding to maintenance phases so that it can be of help in the future by extending the use of security metrics.

• Journal of the Korea Convergence Society
• /
• v.1 no.1
• /
• pp.93-100
• /
• 2010

Diverse kind of attack using the vulnerability of user authentication on Internet service is announced recently. Especially, security accidents on the Internet banking service and Internet telephony service(SIP) are increased rapidly. Attack skills are also evolved into intelligent mechanism. Therefore, more enhanced authentication mechanism is required on existing Internet banking and telephone services for preventing those kinds of attacks using personal identity information such as biometric data. In this research, the proposed B-OTP mechanism can be used to enhance security on a user authentication procedure by combining biometric data with existing OTP mechanism. As a result, the security on internet banking and Internet telephone service will be more improved by using proposed B-OTP mechanism.

• Convergence Security Journal
• /
• v.16 no.6_2
• /
• pp.83-88
• /
• 2016

Over recent years there has been considerable growth in interest in the use of biometric systems for personal authentication. Biometrics is a field of technology which has been and is being used in the identification of individuals based on some physical attribute. By using biometrics, authentication is directly linked to the person, rather than their token or password. Biometric authentication is a type of system that relies on the unique biological characteristics of individuals to verify identity for secure access to electronic systems. In 2013, Althobati et al. proposed an efficient remote user authentication protocol using biometric information. However, we uncovered Althobati et al.'s protocol does not guarantee its main security goal of mutual authentication. We showed this by mounting threat of data integrity and bypassing the gateway node attack on Althobati et al.'s protocol. In this paper, we propose an improved scheme to overcome these security weaknesses by storing secret data in device. In addition, our proposed scheme should provide not only security, but also efficiency since sensors in WSN(Wireless Sensor Networks) operate with resource constraints such as limited power, computation, and storage space.

• Convergence Security Journal
• /
• v.18 no.1
• /
• pp.3-11
• /
• 2018

The emerging field of Science of Security (SoS) is a new paradigm that emerged in the field of security as a research field that applied the scientific approach to cyber security. It is a direction to study the formal model and automation field to secure the security of such a network environment in the present that dynamic change of complex, large scale network environment and a lot of protocol and mechanism environment exists. Therefore, this study analyzes the latest cyber security research trends such as SoS and examines the research trends of advanced countries to examine a new approach to cyber security development direction in Korea. We also analyze the current state of domestic scientific research on the scientific security research methods for various cyber security paradigms and present directions for revitalizing domestic cyber security.

• Journal of Digital Convergence
• /
• v.15 no.6
• /
• pp.219-227
• /
• 2017

Network access control should be able to effectively block security threats to the IT infrastructure, such as unauthorized access of unauthorized users and terminals, and illegal access of employees to internal servers. From this perspective, it is necessary to build metrics based on relevant standards to ensure that security is being met. Therefore, it is necessary to organize the method for security evaluation of NAC according to the related standards. Therefore, this study builds a model that combines the security evaluation part of ISO / IEC 15408 (CC: Common Criteria) and ISO 25000 series to develop security metric of network access control system. For this purpose, we analyzed the quality requirements of the network access control system and developed the convergence evaluation metric for security of the two international standards. It can be applied to standardization of evaluation method for network access control system in the future by constructing evaluation model of security quality level of network access control system.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.4
• /
• pp.699-707
• /
• 2023

DevSecOps is a concept that adds security procedures to the operational procedures of DevOps to respond to the short development and operation cycle. Multi-step vulnerability scanning process should be considered to provide reliable security while supporting rapid development and deployment cycle in DevSecOps. Many open-source vulnerability scanning tools available can be used for each stage of scanning, but there are difficulties in evaluating the security level and identifying the importance of information in integrated operation due to the various functions supported by the tools and different security results. This paper proposes an integrated security metric design plan for scurity results and the combination of open-source scanning tools that can be used in security stage when building the open-source based DevSecOps system.

• Review of KIISC
• /
• v.18 no.4
• /
• pp.54-60
• /
• 2008

바이오인식기술을 이용하는 개인인증을 수행하는 바이오인식 시스템으로 구성되어 물리적 접근제어, 인터넷 접근제어, 전자여권 등 다양한 장소에서 신원확인의 수단으로 이용되어지고 있다. 바이오인식 시스템은 다양한 장소에서 사용되므로, 바이오정보획득, 처리, 정합 등을 수행하는 시스템이 분리되어 구축된다. 이때 각 시스템 및 시스템에서 사용/전달되어지는 정보의 변환, 도용, 훼손에 대한 보호 및 시스템에서 비인가자의 불법적인 원격침입 가능성이 발생한다. 이와같은 공격의 취약성을 방지하기 위하여 텔레바이오메트릭 시스템에 대한 보호절차를 구성하였다. 개인인증을 위하여 생체정보를 수집하거나, 이용하는데 있어서 준수하여야 하는 바이오정보보호에 대한 중요사항을 제시하고, 안전한 이용환경을 제공하기 위하여 네트워크상에서 시스템이 수행될 때 발생하는 공격 취약점을 정의하였으며, 이를 보호하기 위한 가이드라인을 구성하였다. 텔레바이오인식 시스템보호 절차에서 제시하는 가이드라인은 바이오정보 보호 정책 개발방법, 위험분석, 바이오인식 시스템 운영 및 기술 개발시에 활용할수 있다. 본고는 현재 ITU-T SG17 Q.8(Telebiometrics)에서 KISA가 추진하여 년내에 X.tpp로 제정이 예상되는 국제표준을 상세히 설명하고 있으며, 이는 곧 바이오인식 시스템을 이용한 작은규모의 물리적 접근 제어 시스템으로부터 국가적 규모의 바이오인증 시스템까지 응용가능한 텔레바이오인식 시스템 전반에 적극 활용할 수 있다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.4
• /
• pp.1021-1030
• /
• 2018

Nowadays, the ubiquitous environment that can utilize the computer everywhere is being formed. As the environment changes, services develop and manage systems and databases that can manage customer information to provide better services to customers through Information Technology. The system that most services maintain is a way of putting and managing customer information on the server. In this paper, we first find the problem in terms of security and convenience. After that, we propose a solution that improves the problem through blockchain technology and biometric authentication.