• Journal of KIISE:Information Networking
• /
• v.32 no.4
• /
• pp.443-451
• /
• 2005

Stateful inspection devices must maintain flow information. These devices create the flow information also for network attack packets, and it can fatally inflate the dynamic memory allocation on stateful inspection devices under network attacks. The memory inflation leads to memory overflow and subsequent performance degradation. In this paper, we present a guideline to set the flow entry timeout for a stateful inspection device to remove harmful embryonic entries created by network attacks. Considering Transmission Control Protocol (TCP) if utilized by most of these attacks as well as legitimate traffic, we propose a parsimonious memory management guideline based on the design of the TCP and the analysis of real-life Internet traces. In particular, we demonstrate that for all practical purposes one should not reserve memory for an embryonic TCP connection with more than (R+T) seconds of inactivity where R=0, 3, 9 and $1\leqq{T}\leqq{2}$ depending on the load level.

• KIPS Transactions on Software and Data Engineering
• /
• v.4 no.9
• /
• pp.337-346
• /
• 2015

There is great need for efficient user rights management method to provide a flexible service on variety protocols, domains, applications of IoT environments. In this paper, we propose a IoT service platform with CapSG to provide efficient access control for IoT various services of the environment. CapSG uses a token including authentication and access rights to perform authentication and access control service entity providing services. In addition, the generated token for service management, delegation, revocation, and provides a function such as denied. Also, it provides functions such as generation, delegation, disposal and rejection for service token management. In this paper, it provides the flexibility and efficiency of the access control for various services require of the IoT because of it is available to access control specific domain service by using the token group for each domain and is designed to access control using specific service token of tokens group.

• Journal of Korea Society of Industrial Information Systems
• /
• v.12 no.1
• /
• pp.28-38
• /
• 2007

In this paper, we implement Microsoft COM software modules for elliptic curve cryptographic applications and analyze its performance. The implemented COM software modules support all elliptic curve key exchange protocols and elliptic curve digital signature algorithm in IEEE 1363 finite fields GF(p) and GF(2m). Since the implemented software modules intend to focus on a component-based software development method, and thus it have a higher productivity and take systematic characteristics to be open outward and to be standardized. Accordingly, it enable a software to be developed easier and faster rather than a method using C library. In addition it support the Microsoft COM interface, we can easily implement secure software applications based on elliptic curve cryptographic algorithms.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.11 no.12
• /
• pp.5049-5057
• /
• 2010

As communication technologies are developed and variety of services to mobile devices are provided, mobile users is rapidly increasing every year. However, mobile services running on wireless network environment are exposed to various security threats, such as illegal tampering, eavesdropping, and disguising identity. Accordingly, the secure mobile communications services to 3GPP were established that the standard for 3GPP-AKA specified authentication and key agreement. But in the standard, sequence number synchronization problem using false base station attack and privacy problem were discovered through related researches. In this paper, we propose an efficient authentication mechanism for enhanced privacy protection in the 3G network. We solve the sequence number synchronization existing 3GPP authentication scheme using timestamp and strengthen a privacy problem using secret token. In addition, the proposed scheme can improve the bandwidth consumption between serving network and home network and the problem of authentication data overhead for the serving network because it uses only one authentication vector.

• The KIPS Transactions:PartC
• /
• v.12C no.5 s.101
• /
• pp.617-622
• /
• 2005

Lately, the MANET research has focused on providing routing services with security and previous schemes have been proposed for detecting malicious nodes in a MANET. However, they still include some problems which malicious nodes cannot be found when they falsely report other nodes as malicious. Accordingly, we propose a novel and efficient scheme for detecting malicious nodes using report messages and a report table which is consisted of node ID both for suspecting and reporting when the malicious nodes behave normally during the route discovery, but the other hand they drop and modify packets, or falsely report other nodes as malicious during the data transmission. Our proposed scheme is applicable to not only DSR but aiso AODV. And we provide some simulation results of our proposed scheme by comparing general AODV with our proposed scheme. Simulation results show that our Proposed scheme outperforms general AODV in terms of average packet loss ratio and packet delivery ratio.

• The KIPS Transactions:PartC
• /
• v.15C no.5
• /
• pp.343-350
• /
• 2008

In ubiquitous environment, a user has been provided with service and mobility using various devices. The users' network can be divided into a home network (a user belongs to the network through an authentication server) and an external network (when a user moves or external authentication server is). Users can use a mobile device or a device at an external network. In this paper, when a user has access to a service in an external network with a mobile device, there is a skim that a service is securely provided by roaming private information (encryption key etc${\cdots}$) and a skim which gives access to a home network using a device in an external network. If you use these skims, roaming is provided in order that you can use a secure service in an external network.

• Journal of the Korea Convergence Society
• /
• v.8 no.8
• /
• pp.51-57
• /
• 2017

A wireless sensor network is composed of many resource constrained sensor nodes. These networks are attacked by malicious attacks like DDoS and routing attacks. In this paper, we propose the intrusion detection and prevention system using convergence of software-defined networking and security technology in wireless sensor networks. Our proposed scheme detects various intrusions in a central server by accumulating log messages of OpenFlow switch through SDN controller and prevents the intrusions by configuring OpenFlow switch. In order to validate our proposed scheme, we show it can detect and prevent some malicious attacks in wireless sensor networks.

• The Journal of the Korea institute of electronic communication sciences
• /
• v.15 no.5
• /
• pp.857-864
• /
• 2020

The multi-functional VoIP phone supports the Ethernet protocol in the TIPS(: Tactical IP Switch), which is one of the sub-systems of the tactical information and communication system (TICN). It provides secured voice / video calls in conjunction with VoIP exchanges and supports differential services such as multi-party calls and command functions. In this paper, improving methods have been proposed to reduce power supply defects in the field of multi-functional VoIP phones. The power supply part was improved by applying TVS of the output voltage inlet of the dedicated adapter of the multi-functional VoIP phone, TVS of the PoE module input, adding blocking diodes, and adding DC / DC converters behind the poly-switch. Also, functional and environmental tests were performed to verify the validity of the proposed methods.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.8 no.8
• /
• pp.1783-1789
• /
• 2004

It is evaluated that there is infinit capability of creating new e business using P2P program. but the research for the method to protect the copyright of digital contents is urgent even for development of the p2p service because the problem of copyright protection for digital contents is not solved. Though this article, it can be induced that reliable contents sharing use to a flow fund by secure settlement architecture, user authentication and contents encryption and then it as the problem of copyright fee is solved, it is able to discontinue which trouble with a creation work for copyright fee and protection it's once again as growth of p2p market, p2p protocal is will be grow into a important protocal of advanced network. In this article, When users send digital contants to each other in internet, we proposed the P2P DRM algorism to offer a security function which using the technology of copyright management to use a AES Algorithm based on PKI.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.22 no.5
• /
• pp.794-804
• /
• 2018

Various applications running in computers exchange information in the form of packets through the network. Most packets are formatted into UDP/IP or TCP/IP standard. Network management administrators of enterprises and organizations should be able to monitor and manage packets transmitted over the network for Internet traffic measurement & monitoring, network security, and so on. The goal of this paper is to analyze the performance of several algorithms which closely examine and analyze payloads in a DPI(Deep Packet Inspection) system. The main procedure of packet payload analysis is to quickly search for a specific pattern in a payload. In this paper, we introduce several algorithms which detect a specific pattern in payloads, analyze the performance of them from three perspectives, and suggest an application method suitable for requirements of a given DPI system.