• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.41 no.1
• /
• pp.101-103
• /
• 2016

We propose a HTTP cookie-based identification of the public keys of Web sites for the case of failure to validate certificates. The proposed scheme effectively protects users from the phishing attacks of inducing them to access bogus sites. It incurs little performance overhead on the browser and the server of Web sites. It requires to implement the input processing of user credentials and the encryption and verification of cookie values, though.

• Review of KIISC
• /
• v.27 no.2
• /
• pp.41-45
• /
• 2017

전력망과 IT의 융합으로 구현되는 스마트그리드가 IT 보안의 위협을 갖게 됨에 따라 스마트그리드에서의 안전한 통신을 보장하기 위한 수단 중 하나로 스마트그리드 기기 인증 운영 시스템을 운영한다. 이는 스마트그리드에서 운영되는 기기에 대한 인증서 발급, 등록, 관리 및 검증 서비스를 제공하여 기기인증서를 기반으로 신뢰성 높은 네트워크 환경을 구축한다. 본 논문에서는 스마트그리드 환경 하에서 동작하는 다양한 기기들이 신뢰성이 높은 네트워크 환경구축을 통해 안전한 통신이 가능하도록 지원하는 PKI 기반 기기 보안인증 운영시스템의 구현 결과를 설명하고, 제안된 시스템의 신뢰성, 현장적용성 검증을 위한 실증 테스트베드 구축 및 실증실험에 따른 결과를 제시한다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2012.04a
• /
• pp.661-664
• /
• 2012

스마트폰 사용이 급증하고 있는 현재, 안드로이드 OS 기반 스마트폰 점유율이 가장 큰 상승세를 보이고 있다. 하지만 안드로이드 OS는 자가-서명 인증서(self-signed certificate)로 애플리케이션을 검증하여, 많은 보안상의 취약점을 내재하고 있다. 자가-서명 인증서의 검증 취약점을 이용하여, 악의적인 공격자는 기존 정상 애플리케이션에 악성코드를 삽입, 리패키징(Repackaging) 하여 마켓에 유포할 수 있다. 이러한 문제를 해결하기 위해서, 본 논문에서는 안드로이드 애플리케이션의 서명 파일을 이용한 애플리케이션 리패키징 여부를 탐지하는 기술을 설계 및 구현한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.13 no.4
• /
• pp.71-84
• /
• 2003

Self-certified public keys need not be accompanied with a separate certificate to be authenticated by other users because the public keys are computed by both the authority and the user. At this point, verifiable self-certified public keys are proposed that can determine which is wrong signatures or public keys if public keys are used in signature scheme and then verification of signatures does not succeed. To verify these public keys, key generation center's public key trusted by users is required. If all users trust same key generation center, public keys can be verified simply. But among users in different domains, rusty relationship between two key generation centers must be accomplished. In this paper we propose inter-domain verifiable self-certified public keys that can be verified without certificate between users under key generation centers whose trusty relationship is accomplished. Also we present the execution of signature and key distribution between users under key generation centers use different public key parameters.

• Journal of Internet of Things and Convergence
• /
• v.1 no.1
• /
• pp.39-44
• /
• 2015

Organization is increasing the authorizing process to use public certificate and bio information. Certificate, has evolved to be able to parallel distributes the bio authentication and portable bio-authentication device. Authentication using an individual's PC and smart devices continue to generalize, while convenience for authentication is increased by comparison Study on cooperation with the security at the network level's a weak situation. If ask authentication method through the cooperation of the public certificate and bio information work with current network access control, there is a possibility to develop a more powerful security policy. by cooperation weaknesses against vulnerable personal authentication techniques on security token in a reliable and secure personal authentication techniques, such as bio-recognition, Bio Information for identification and to prevent exposing a methodology suggest to validate whether or not to carry out in this paper. In addition, organize the scenario that can work with the 802.1x network authentication method, and presented a proposal aimed at realization.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.16 no.5
• /
• pp.47-57
• /
• 2006

Mobile Ad-hoc networks have various implementation constraints such as infrastructure-free, no trusted authority, node mobility, and the limited power and small memory of mobile device. And just like wired networks, various security issues such as authentication, confidentiality, integrity, non-repudiation, access control, availability and so on have been arisen in mobile Ad-hoc networks. But we focus on authentication of these security issues because it is quitely affected by the characteristics of networks. In this paper, we propose the authentication protocol that can limit the size of certificate repository as $log_2N$ and assures to make a trusted certificate path from one node to another, adopting the concept of Hamming distance. Particularly, our protocol can construct a trusted certificate path in spite of decreasing or increasing the number of nodes in mobile Ad-hoc network.

• Journal of the Korea Society of Computer and Information
• /
• v.10 no.5 s.37
• /
• pp.161-170
• /
• 2005

The Certificate Revocation List(CRL) or the Online Certificate Status Protocol(OCSP)has been used to validate certificates. However, the CRL cannot validate certificates in realtime because of the Time-Gap problem and the OCSP server overloads in a large scale secure system. In addition, the client cannot access a wired LAN until the client has been authenticated by the authentication server on the IEEE 802. 1x framework. Therefore, the client cannot validate the authentication server's certificate using a certificate validation server. Thus, the client cannot authenticate the authentication server in realtime. To solve these problems this paper designed a secure system that can protect the content of communications and authenticate users in realtime on a wireless LAN The designed certificate validation protocol was proved that the stability and efficiency of the system was very high, the result of the validation had the presence, the speed of the validation was not affected by the system scale, the number of authorities user must trust was reduced to one, and the overload of the validation server was Protected. And the designed user authentication and key exchange protocols were Proved that the mutual authentication was possible in realtime and the fact of the authentication could be authorized by the CA because of using the authorized certificates.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.10 no.11
• /
• pp.1996-2001
• /
• 2006

Open System Authentication Method, Shared Key Method, Mac Based Authentication Method are very hard to use in wireless network that needs security. So now, many researches have been performed about 802.1x and user authentication method applying PKI. but certificate verification protocol has been used abolished list called CRL since it's first usage of PKI, there were still has a problem about distribution point. This paper applied CVS to use CA direct not to use CRL and OSCP server in order to improve this problems. Also It suggested the system that can make authentication steps more shorter using authentication server and Mutual authentication system by public certificate(small size/low speed wireless terminal can access to wireless network fast and safely)

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.14 no.5
• /
• pp.11-21
• /
• 2004

To authorize IPSec-VPN Client in Client-to-Gateway type of the IPSec-VPN system, it can be normally used with ID/Password verification method or the implicit authorization method that regards implicitly IPSec-VPN gateway as authorized one in case that the IPSec-VPN client is authenticated. However, it is necessary for the Client-to-Gateway type of the IPSec-VPN system to have a more effective user authorization mechanism because the ID/Password verification method is not easy to transfer the ID/Password information and the implicit authorization method has the vulnerability of security. This paper proposes an effective user authorization mechanism using an attribute certificate and designs a user authorization engine. In addition, it is implemented in this study. The user authorization mechanism for the IPSec-VPN system proposed in this study is easy to implement the existing IPSec-VPN system. Moreover, it has merit to guarantee the interoperability with other IPSec-VPN systems. Furthermore, the user authorization engine designed and implemented in this paper will provide not only DAC(Discretional Access Control) and RBAC(Role-Based Access Control) using an attribute certificate, but also the function of SSO(Single-Sign-On).

• Proceedings of the Korean Information Science Society Conference
• /
• 2003.04a
• /
• pp.344-346
• /
• 2003

본 논문은 기존의 RSA 일방향 가산기롤 이용한 인증된 딕셔너리［l］에 대한 개선된 방법을 제안한다. 제안된 새로운 방법은 신뢰할 수 있는 정보 제공자와 신뢰할 수 없는 디렉토리 그리고 사용자로 이루어진 그룹에서 정보 제공자가 디렉토리를 통해 제공하는 정보에 대해서 디렉토리는 검증된 정보만을 사용자에게 제공할 수 있도록 해주며 이러한 일련의 과정에서 일어나는 정보의 업데이트나 질의 그리고 검증이 효율적으로 이루어 질수 있도록 개선하였다. 이러한 연구는 PKI(Public Key Infratructure)환경하에서의 폐기된 인증서 목록의 관리나 인터넷상에서 제3자가 발표한 정보의 무결성을 입증하는데도 응용될 수 있다.