• Journal of Digital Convergence
• /
• v.12 no.2
• /
• pp.513-518
• /
• 2014

According to the development of IT technology, various new technologies are being produced. As the complexity of the information system like using the network and convergence devices is increasing, threat and vulnerability against various security problems are increasing even though new IT services provide the convenience of users' accessibility to services. In order to secure the safety of information system, the weakness is being removed through the information protection vulnerability analysis starting from information and communication service construction stage and the system is being prepared for pre-inspection activities about whether the information protection measures were established and applied. In this paper, introduction and current status of each country about advanced check-up systems in the information system are to be identified. Progress direction about the advanced pre-inspection system which is driven by Korea Internet Security Agency and its activation plan to secure the safety are to be suggested.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.4
• /
• pp.827-838
• /
• 2018

Since 2014, ease of regulations on financial institutions expanded the mobile payment market based on simple authentication, and this resulted in the emergence of various simple payment services. Although several security solutions have been used to mitigate possible security threats to payment applications, there are vulnerabilities which can still be found due to the structure in which the security solution is applied to the payment service. In this paper, we analyze the payment application and security solution from the process perspective, and prove through experimentation that verification functions of security solutions can be bypassed without detailed analysis of each security function, but by simply manipulating the verification result value. Finally, we propose methods to mitigate the bypass method presented in this paper from three different perspectives, and thereby contribute to the improvement of security level of the payment service.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.23 no.6
• /
• pp.1247-1257
• /
• 2013

The security vulnerabilities of cloud storage virtualization environments are different from those of the existing computer system and are difficult to be protected in the existing computer system environment. Therefore we need some technical measures to address this issue. First of all, the technology used in cloud storage virtualization environment needs to be thoroughly analyzed, and also, we should understand those security requirements of various stakeholders in the view of cloud storage service and perform the research on security guidelines of the research security requirements. In this paper, we propose security requirements based on layers and roles of cloud storage virtualization. The proposed security requirements can be a basement for development of solution of cloud storage virtualization security.

• Journal of Software Assessment and Valuation
• /
• v.15 no.2
• /
• pp.121-128
• /
• 2019

Computing systems have various vulnerabilities to cyber attacks. In particular, various cyber attacks that are intelligent in the information society have caused serious social problems and economic losses. Traditional security systems are based on misuse-based technology, which requires the continuous updating of new attack patterns and the real-time analysis of vast amounts of data generated by numerous security devices in order to accurately detect. However, traditional security systems are unable to respond through detection and analysis in real time, which can delay the recognition of intrusions and cause a lot of damage. Therefore, there is a need for a new security system that can quickly detect, analyze, and predict the ever-increasing cyber security threats based on machine learning and big data analysis models. In this paper, we present a IDS model that combines machine learning and big data technology.

• Convergence Security Journal
• /
• v.20 no.2
• /
• pp.29-35
• /
• 2020

The cyber attacks targeting the systems of national and public organizations in the front line of cyber security have been advanced, and the number of cyber attacks has been on the constant rise. In this circumstance, it is necessary to develop the security evaluation technology to prevent cyber attacks to the systems of national and public organizations. Most of the studies of the vulnerability analysis on the information systems of national and public organizations almost focus on automation. In actual security inspection, it is hard to automate some parts. In terms of security policies for threats, many different plans have been designed and applied in the managerial, physical, and technical fields, giving particular answers no matter how they are subjective or situational. These tendencies can be standardized in OCIL(Open Checklist Interactive Language), and partial automation can be achieved. Therefore, this study tries to implement XML Converter in order for OCIL based security level evaluation with typical evaluation questions.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.11 no.6
• /
• pp.303-310
• /
• 2011

Recently, many user authentication schemes using smart cards have been proposed to improve the security weaknesses in user authentication process. In 2009, Wang et al. proposed a more effective and secure dynamic ID-based remote user authentication scheme to improve the security weakness of Das et al.'s scheme, and asserted that the improved scheme is secure against independent of password in authentication phase and provides mutual authentication between the user and the remote server. However, in this paper, we analyze the security of Wang et al. scheme and demonstrate that Wang et al.'s scheme is vulnerable to the man-in-the-middle attack and the off-line password guessing attack. In addition, we show that Wang et al. scheme also fails to provide mutual authentication. Accordingly, we propose an improved scheme to overcome these security weakness even if the secrete information stored in the smart card is revealed. Our proposed scheme can withstand the user impersonation attack, the server masquerading attack and off-line password guessing attack. Furthermore, this improved scheme provides the mutual authentication and is more effective than Wang et al.'s scheme in term of the computational complexities.

• Proceedings of the KAIS Fall Conference
• /
• 2011.05a
• /
• pp.239-242
• /
• 2011

기존 CCTV는 대부분 방범을 목적으로 많이 쓰인다. 이러한 CCTV는 과거엔 대부분 아날로그 방식이었으나 CCTV에 IP를 부여하고 Network화가 되면서 CCTV가 웹상의 위협에 노출이 되었다. CCTV영상이란 사생활 관련 영상이며 이러한 영상이 불특정 다수에 노출되어 있다는 건 충분히 민감한 문제라 할 수 있다. 본 논문에서는 CCTV의 네트워크화로 인해 발생한 취약점을 분석 및 보안하였다. 또한 CCTV영상 유출을 미연에 방지하기 위한 RTSP 사용자 인증 프로토콜을 제안한다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2018.10a
• /
• pp.181-184
• /
• 2018

최근 주목 받고 있는 소프트웨어 정의 네트워크(SDN: Software-Defined Networks)는 기존 네트워크 운용의 비효율성과 복잡성을 근본적으로 해결하기 위해 등장한 개방형 네트워크 인프라이다. SDN 시스템이 점차 상용화, 개방화 되는 시점에서, 내재되어있는 보안적 위협을 줄이기 위하여 효율적이고 자동화된 취약점 탐지의 필요성이 대두되고 있다. 본 논문에서는 자동화된 소프트웨어 테스트 기법 중 하나인 퍼즈테스팅이 SDN에 적용되어야 할 이유를 살펴보고자 한다. 또한, 기존에 관련된 연구의 분석을 통해 현재 학계의 연구동향을 파악하고 앞으로의 연구 방향성을 제시한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.24 no.2
• /
• pp.295-310
• /
• 2014

DCS (Distributed Control System), the main control system of power plants, is an automated system for enhancing operational efficiency by monitoring, tuning and real-time operation. DCS is becoming more intelligent and open systems as Information technology are evolving. In addition, there are a large amount of investment to enable proactive facility management, maintenance and risk management through the predictive diagnostics. However, new upcoming weaponized malware, such as Stuxnet designed for disrupting industrial control system(ICS), become new threat to the main control system of the power plant. Even though these systems are not connected with any other outside network. The main control systems used in the power plant usually have been used for more than 10 years. Also, this system requires the extremely high availability (rapid recovery and low failure frequency). Therefore, installing updates including security patches is not easy. Even more, in some cases, installing security updates can break the warranty by the vendor's policy. If DCS is exposed a potential vulnerability, serious concerns are to be expected. In this paper, we conduct the penetration test by using NESSUS, a general-purpose vulnerability scanner under the simulated environment configured with the Ovation version 1.5. From this result, we suggest a log analysis method to detect the security infringement and react the incident effectively.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.20 no.3
• /
• pp.121-134
• /
• 2010

With the help of various Layer 2 triggers, Fast Handover for Mobile IPv6 (FMIPv6) considerably reduces the latency and the signaling messages incurred by the handover. Obviously, if not secured, the protocol is exposed to various security threats and attacks. In order to protect FMIPv6, several security protocols have been proposed. To our best knowledge, there is lack of analysis and comparison study on them though the security in FMIPv6 is recognized to be important. Motivated by this, we provide an overview of the security protocols for FMIPv6, followed by the comparison analysis on them. Also, the security threats and requirements are outlined before the protocols are explored. The comparison analysis result shows that the protocol presented by You, Sakurai and Hori is more secure than others while not resulting in high computation overhead. Finally, we introduce Proxy MIPv6 and its fast handover enhancements, then emphasizing the need for a proper security mechanism for them as a future work.