• Convergence Security Journal
• /
• v.19 no.1
• /
• pp.49-60
• /
• 2019

Medical record is part of the personal information that values the dignity and value of an individual, and can lead to serious social prejudice and disadvantage to an individual when it is breached illegally. In addition, the medical record has been highly threatened because its value is relatively high, and external threats are continuing. In this paper, we propose a medical record sharing framework that guarantees patient's privacy based on blockchain using ciphertext policy-based attribute based proxy re-encryption scheme. The proposed framework first uses the blockchain technology to ensure the integrity and transparency of medical records, and uses the stealth address to build the unlinkability between physician and patient. Besides, the ciphertext policy attribute-based proxy re-encryption scheme is used to enable fine-grained access control, and it is possible to share information in emergency situations without patient's agreement.

• Convergence Security Journal
• /
• v.19 no.5
• /
• pp.55-61
• /
• 2019

This paper studied security measures to protect the SCADA network from the increasingly sophisticated threats. Currently, SCADA system security uses methods that are almost like regular IT security systems. While there may be some common security techniques, security techniques are needed only for SCADA systems that are different from typical IT systems. Therefore, this paper will explore the security techniques currently used in SCADA systems, and the problems that arise when the current security techniques are used will be identified through the damage cases resulting from attacks in SCADA systems. Finally, as a new solution to ensure the availability and integrity required for current SCADA systems, we proposed linking Blockchain and SCADA systems.

• Convergence Security Journal
• /
• v.24 no.3
• /
• pp.51-57
• /
• 2024

Cryptocurrency service providers and virtual asset operators, built on blockchain technology, face transaction risks such as cyber threats, wallet theft by internal personnel, theft of customers' private keys, and fraudulent cryptocurrency transfer signatures. To ensure secure operations against these threats, their security is validated through the ISMS-P certification. This study to analyze the risks presented in ISO TR 23576, which is specialized for cryptocurrency service providers and operators, in addition to the ISMS-P certification they obtain. The study will focus on the detailed inspection items of ISMS-P and ISO TR 23576 for cryptocurrency service providers and assess their importance. Based on this analysis, the study proposes an internal security control process for cryptocurrency service providers to address the top-priority risks, enabling practitioners to perform security control tasks more efficiently.

• Journal of Digital Convergence
• /
• v.19 no.6
• /
• pp.239-250
• /
• 2021

When considering the introduction of a new technology, it is important to accurately grasp and selectively apply the technical characteristics related to the technology in order to fully utilize the advantages of the technology. In this study, the technical characteristics of high relative importance were analyzed in order to increase the efficiency of new application of blockchain technology by companies. The technical characteristics of the blockchain identified through previous research were reclassified from the perspective of the system hierarchy, and sub-factors of the technical characteristics were derived. In addition, a questionnaire survey on the relative importance of technical characteristics was conducted for internal experts and SI experts using the Analytical Hierarchy Process (AHP) technique. As a result of the analysis, respondents evaluated data protection as the most important factor in the threat of hacking related to security. In addition, it was different that the comparison results of the importance of the technical characteristics between the experts in the company and the SI experts and the priority of the technical characteristics between the expert groups by industry. It is expected that the results of this study will be usefully utilized when using blockchain technology in enterprises in line with the upcoming changes of the 4th industrial revolution. An empirical analysis of the internal and external factors required for adoption of blockchain technology by industry and the effect of technology introduction will be a meaningful study.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.6
• /
• pp.947-960
• /
• 2023

In Korea, traditional paper promissory notes are currently undergoing a transformation, being gradually replaced by electronic notes. This transformation is being steered under the Korea Financial Telecommunications Institute, a trusted authority. However, existing electronic systems have security vulnerabilities, including the risk of hacking and internal errors within the institute. To this end, we have defined a novel anonymous electronic promissory note system based on blockchain. We have constructed a concrete protocol and conducted security analysis of our protocol. Note that, in our protocol, every note information is committed so that the note remains undisclosed until the point of payment. Once the note information becomes public on the blockchain, it enables the detection of illicit activities, such as money laundering and tax evasion. Furthermore, our protocol incorporates a feature of split endorsement, which is a crucial functionality permitted by the Korean electronic note system. Consequently, our proposed protocol is suitable for practical applications in financial transactions.

• Journal of Convergence for Information Technology
• /
• v.11 no.11
• /
• pp.66-74
• /
• 2021

With the development of the Internet, user authentication technology that proves me online is improving. Existing ID methods pose a threat of personal information leakage if the service provider manages personal information and security is weak, and the information subject is to the service provider. In this study, as online identification technology develops, we propose a DID-based self-authentication model to prevent the threat of leakage of personal information from a centralized format and strengthen sovereignty. The proposed model allows users to directly manage personal information and strengthen their sovereignty over information topics through VC issued by the issuing agency. As a research method, a self-authentication model that guarantees security and integrity is presented using a decentralized identifier method based on distributed ledger technology, and the security of the attack method is analyzed. Because it authenticates through DID Auth using public key encryption algorithms, it is safe from sniffing, man in the middle attack, and the proposed model can replace real identity card.

• Smart Media Journal
• /
• v.11 no.10
• /
• pp.76-88
• /
• 2022

Personal information leakage is very harmful as it can lead to additional attacks using leaked information as well as privacy invasion, and it is primarily caused by hacking server databases of institutions that collect and store personal information. We propose a scheme that allows a service-requesting user to authorize a secure delegated transfer of his personal information to the service provider via a reliable authority and enables only the two parties of the service to retrieve the provided information stored on a blockchain ensuring data confidentiality. It thus eliminates the necessity of storing customer information in the service provider's own database. As a result, the service provider can serve customers without requiring membership registration or storing personal information in the database, so that information leakage through the server database can be completely blocked. In addition, the scheme is free from the risk of information leakage and subsequent attacks through smartphones because it does not require a user's smartphone to store any authentication credential or personal information of its owner.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.19 no.2
• /
• pp.103-109
• /
• 2019

Due to the development of ICT technology, the IoT environment for connecting objects in the vicinity to networks and utilizing information about objects in various fields is getting attention, and security threats are also increasing. In order to solve the increasing security problem in IoT environment, we are studying methods that use certificate, encryption, hash calculation and block chain in the private sector. However, the security authentication method which overcomes the performance gap between devices and has compatibility with various devices It has not been proposed yet. In this paper, we propose an authentication method that can achieve wide compatibility by minimizing the influence of IoT device environment.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.14 no.4
• /
• pp.47-56
• /
• 2018

We analyzed security threats and suggested countermeasures about the block chain technologies which has emerged as a core technology of the fourth industrial revolution. We know that increasing the security leads to slow down program processing rate in the block chain systems. The block chain system which is currently an early stage of technological development, to become an economic and social infrastructure, development of technology and active policy implementation will be necessary. We studied on the security threats and countermeasures of the Bit Coin based on block chain. Further research should be undertaken on the possibility that future studies could have a real adverse effect on the integrity of the data.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2022.11a
• /
• pp.266-268
• /
• 2022

최근 블록체인 기술이 부상하면서 이를 이용한 암호화폐가 범죄의 대상이 되고 있다. 특히 피싱 스캠은 이더리움 사이버 범죄의 과반수 이상을 차지하며 주요 보안 위협원으로 여겨지고 있다. 따라서 효과적인 피싱 스캠 탐지 방법이 시급하다. 그러나 전체 노드에서 라벨링된 피싱 주소의 부족으로 인한 데이터 불균형으로 인하여 지도학습에 충분한 데이터 제공이 어려운 상황이다. 이를 해결하기 위해 본 논문에서는 이더리움 트랜잭션 네트워크를 고려한 효율적인 네트워크 임베딩 기법인 trans2vec 과 준지도 학습 모델 tri-training 을 함께 사용하여 라벨링된 데이터뿐만 아니라 라벨링되지 않은 데이터도 최대한 활용하는 피싱 스캠 탐지 방법을 제안한다.