• Information and Communications Magazine
• /
• v.25 no.1
• /
• pp.44-51
• /
• 2008

국가사회기반구조의 중추신경계 역할을 수행하는 정보통신 인프라를 기반으로 개인의 사이버생활 일상화, 디지털경제로의 전환, 전자정부 구축이 가속화되고 있다. 또한 네트워크 통합과 정보통신 서비스의 융합 등을 통한 제2의 디지털 혁명으로 유비쿼터스사회가 도래하고 있다. 그러나 이와 더불어 정보보호 환경은 개별 시스템, 네트워크 보호에서 서비스와 이용자 보호로 그 중심이 급격히 옮겨져 그 범위가 크게 확대되고 있으며, 웜 바이러스와 해킹 기능의 결합으로 복합화(Blended), 악성화된 사이버공격이 증가하고 있다. 또한 그 전파경로가 이메일은 물론 PC의 공유폴더, P2P, 웹 등으로 확대됨으로써 피해범위는 유선단말에서 무선단말과 방송단말 등으로 확장되고 있다. 이처럼 시간과 장소에 상관없이 지식정보를 자유롭게 이용함으로써 편리하고 쾌적한 정보이용 환경을 누리게 하는 유비쿼터스 사회는, 그러나 동시에 예측 불가능한 위험이 곳곳에 산재한 '고도화된 정보위험사회'로의 진입을 의미한다. 이에 따라 새로운 위협이 상존하는 유비쿼터스 환경 하에서 안심하고 신뢰할 수 있는 새로운 정보보호 정책방향의 설정과 대응전략이 필요함은 주지의 사실이라고 할 수 있다. 이에 본고에서는 유비쿼터스 사회에서 나타나는 새로운 도전과 신규위협에 대해 살펴보고, 정보보호 3대 핵심 추진 방향을 비롯한 향후 대응전략과 이를 통한 안전한 미래 사회의 청사진을 제시하도록 한다.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2019.07a
• /
• pp.121-122
• /
• 2019

본 논문에서는 웹쉘을 탐지하기 위한 방법 중 하나로 슬라이딩윈도우 기반 머신러닝을 활용하는 방안을 제안하고자 한다. 웹 공격에 많이 활용되는 웹쉘의 탐지를 위하여 제안하는 슬라이딩윈도우 기반의 탐지 기법은 시간이 지남에 따라 발전해가는 웹쉘 탐지 우회 기술에 대응하여 보다 정확한 탐지를 제공하는 기술이며, 이를 기반으로 웹쉘의 다양한 변종 또한 탐지할 수 있다. 본제안의 경우 코드의 부분별 위험도를 측정 및 제공하여 보다 효과적으로 대응할 수 있을 것으로 전망된다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2011.11a
• /
• pp.613-616
• /
• 2011

Nowadays Web Services are one of the most rapidly developed technologies and have become platform for e-ecommerce as well as B2B model. Therefore, when Web Services use SOAP as a protocol for communication, their security should be considered. However, those SOAP messages are prone to XML attacks that can create a foundation for typical faults and make it vulnerable to use. Unfortunately, recent researches established that solutions to deal with these problems have several limitations. In this paper, we explore attacks on SOAP messages and also provide confidentiality and integrity solutions. It is a tolerant scheme which is able to automatically detect and fix typical faults occurred in SOAP messages to combat with the security threats in order to improve its reliability.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.38B no.5
• /
• pp.394-400
• /
• 2013

WoT (Web of Things) was proposed to realize intelligent thing to thing communications using WEB standard technology. It is difficult to adapt security protocols suited for existing Internet communications into WoT directly because WoT includes LLN(Low-power, Lossy Network) and resource constrained sensor devices. Recently, IETF standard group propose to use DTLS protocol for supporting security services in WoT environments. However, DTLS protocol is not an efficient solution for supporting end to end security in WoT since it introduces complex handshaking procedures and high communication overheads. We, therefore, divide WoT environment into two areas- one is DTLS enabled area and the other is an area using lightweight security scheme in order to improve them. Then we propose a mutual authentication scheme and a session key distribution scheme for the second area. The proposed system utilizes a smart device as a mobile gateway and WoT proxy. In the proposed authentication scheme, we modify the ISO 9798 standard to reduce both communication overhead and computing time of cryptographic primitives. In addition, our scheme is able to defend against replay attacks, spoofing attacks, select plaintext/ciphertext attacks, and DoS attacks, etc.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.14 no.3
• /
• pp.1428-1438
• /
• 2013

Services take place in Internet environment, a formation of the trust relationship between user and service provider for services. Different authentication schemes such as using Certificate of Public Key Infrastructure authentication and using ID/PW for a simple user authentication have been proposed for trust relationship. In addition, in the case of electronic financial transactions, transaction integrity and non-repudiation features are provided. These services are provided in Internet environment, use various measures to ensure service safety. However, it was difficult to prevent attacks using existing security technology because of emergence of MITB attack that manipulate the memory area of the Web browser and social engineering attacks such as phishing/pharming, requires application of new security technologies became. In this paper, we propose a concept of smart secure-pad, and utilize it safely formed a trust relationship between user and service provider, a model has been proposed to ensure safety of data transmission. Proposed model's security evaluation results show security against to MITB attack and phishing/pharming that can't be prevent attack using existing security technology. In addition, service provider can easily apply the model in safe environment can provide Internet service using provided representative services applying the proposed model.

• Journal of the Institute of Electronics Engineers of Korea CI
• /
• v.48 no.1
• /
• pp.133-140
• /
• 2011

Recently, Web applications, such as Stock Image and Image Library, are developed to provide the integrated management for user's images. Image hash techniques are used for the image registration, management and retrieval as the identifier and many researches have been performed to raise the hash performance. This paper proposes GLOCAL image hashing method utilizing the hierarchical histogram which based on histogram bin population method. So far, many researches have proven that image hashing techniques based on histogram are robust image processing and geometrical attack. We modified existing image hashing method developed by our research team. The main idea is that it makes more fluent hash string if we have histogram bin of specific length as shown in the body of paper. Finally, we can raise the magnitude of hash string within same context or feature and strengthen the robustness of hash.

• Convergence Security Journal
• /
• v.15 no.5
• /
• pp.87-95
• /
• 2015

Recently, The cloud computing technology is emerging as an important issue in the world, and In technology and services, has attracted much attention. Cloud services have evolved from simple forms to complex forms(using multiple mobile devices and communication services(Kakao talk, Facebook, etc.). In particular, as the cloud is especially facilitated the collection of user information, it can now be analyzed with the user's taste and preference. And many of the benefits of the cloud became increasingly closely with our lives. However, the positive aspects of cloud computing unlike the includes several vulnerabilities. For this reason, the Hacking techniques according to the evolution of a variety of attacks and damages is expected. Therefore, this paper will be analyzed through case studies of attack and vulnerability to the privacy threats factors of the cloud computing services. and In the future, this is expected to be utilized as a basis for the Privacy security and Response.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.34 no.4B
• /
• pp.377-386
• /
• 2009

IPTV technology for providing multimedia content with high-speed is the network which combines existing network, multimedia and internet technology etc. But internet, broadcasting and web technologies which is now being used is not optimized to IPTV because the security problem between user who gets content service through mobile units and content server is not guaranteed. This paper proposes user certification mechanism between mobile device and content server to receive the service which the user for the content chooses by mobile device safely. The proposed mechanism uses the random number which user creates and certification token for preventing illegal user who uses other's service that already paid. Also the proposed protocol encrypts the delicate data like user's information or profile using shared-key between java card attached on user's mobile device and grant sewer and then prevents reply attack which happens often in wireless section and man-in-the-middle attack by MAC.

• Journal of the Institute of Electronics and Information Engineers
• /
• v.50 no.3
• /
• pp.179-186
• /
• 2013

PACS is a medical system for digital medical images, and PACS expand to web-based service using public network, DICOM files should be protected from the man-in-the-middle attack because they have personal medical record. To solve the problem, we designed flexible secure transmission system using IPSec and adopted to a web-based three-dimensional medical image system. And next, we performed the performance evaluation changing integrity and encryption algorithm using DICOM volume dataset. At that time, combinations of the algorithm was 'DES-MD5', 'DES-SHA1', '3DES-MD5', and '3DES-SHA1, and the experiment was performed on our test-bed. In experimental result, the overall performance was affected by encryption algorithms than integrity algorithms, DES was approximately 50% of throughput degradation and 3DES was about to 65% of throughput degradation. Also when DICOM volume dataset was transmitted using secure transmission system, the network performance degradation had shown because of increased packet overhead. As a result, server and network performance degradation occurs for secure transmission system by ensuring the secure exchange of messages. Thus, if the secure transmission system adopted to the medical images that should be protected, it could solve server performance gradation and compose secure web PACS.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.36 no.9B
• /
• pp.1073-1081
• /
• 2011

An URL parameter can hold some information that is confidential or vulnerable to illegitimate tampering. We propose Link-E-Param(Link with Encrypted Parameters) to protect the whole URL parameter names as well as their values. Unlike other techniques concealing only some of the URL parameters, it will successfully discourage attacks based on URL analysis to steal secret information on the Web sites. We implement Link-E-Param in the form of a servlet filter to be deployed on any Java Web server by simply copying a jar file and setting a few configuration values. Thus it can be used for any existing Web application without modifying the application. It also supports numerous encryption algorithms to choose from. Experiments show that our implementation induces only 2~3% increase in user response time due to encryption and decryption, which is deemed acceptable.