• Convergence Security Journal
• /
• v.7 no.4
• /
• pp.83-91
• /
• 2007

Information security is a critical issue for network centric warfare(NCW). This paper provides a information security governance index for NCW, which is a result of the research through a group decision making process. The purpose of the research is to intended to help military organization's planners determine the degree to which they have implemented an information systems governance framework at the strategic and tactical level within their organization.

• The Journal of Korean Institute of Next Generation Computing
• /
• v.13 no.2
• /
• pp.7-17
• /
• 2017

In this paper, we propose the TPS (TPM-enhanced Privacy Protection System) which is an automated privacy protection system enhanced with a TPM (Trusted Platform Module). The TPS detects documents including personal information by periodic scanning the disk of clients at regular intervals and encrypts them. Hence, system manages the encrypted documents in the server. In particular, the security of TPS was greatly enhanced by limiting the access of documents including the personal information with regard to the client in an abnormal state through the TPM-based platform verification mechanism of the client system. In addition, we proposed and implemented a VTF (Virtual Trusted File) interface to provide users with the almost identical user interface as general document access even though documents containing personal information are encrypted and stored on the remote server. Consequently, the TPS automates the compliance of the personal information protection acts without additional users' interventions.

• Convergence Security Journal
• /
• v.18 no.5_1
• /
• pp.83-92
• /
• 2018

The GDPR implemented since 25 May 2018 is common to all EU Member States and is legally binding. It is also important and legally valuable in that it takes into account the latest trends related to privacy protection. The purpose of this study is to propose a comprehensive review and improvement direction of the personal information protection laws in South Korea through a comparative analysis of EU GDPR and privacy related laws in South Korea. As a result of this study, the differences between the GDPR and privacy related laws in South Korea are Definition of personal sensitive information, Right to data portability, Data protection officer, Transfers of personal data to third countries, Supervisory authority, and Punishment, etc. The differences in these regulations were necessary to protect the rights and interests of data subjects and to properly handle personal information of personal information controllers. Therefore, based on the results of the comparative analysis of this study and suggestions on improvement direction of the law related to personal information protection, it is expected that it will contribute to the overall inspection and improvement of the law related to personal information protection in South Korea.

• Convergence Security Journal
• /
• v.10 no.3
• /
• pp.15-22
• /
• 2010

Information security is a critical issue for network centric warfare(NCW). This paper provides defense information security guidelines for NCW, especially for ubiquitous network computing environment. For this purpose, this paper identified changes of battle aspect of tactical level and characteristics of information threats, and finally, the research suggested several information security guidelines for NCW. This paper is to intended to help military organization's planners determine practical and implemental plans in the near future.

• Review of KIISC
• /
• v.29 no.5
• /
• pp.51-61
• /
• 2019

보안은 5G 이동통신 네트워크의 성공적인 정착을 위한 필요충분조건이다. 5G 보안의 중요한 표준으로 3GPP (3rd Generation Partnership Project)의 보안 담당 워킹그룹인 SA3는 3GPP 5G 보안구조를 제시하였다. 특히, 3GPP 5G 보안구조는 Extensible Authentication Protocol (EAP) 인증 프레임워크를 채택함으로써 이기종의 다양한 인증 기법과 자격증명을 용이하게 포용할 수 있는 유연성을 갖추었다. 서비스 융합 네트워크를 지향하는 5G의 비전을 고려할 때, EAP 인증 프레임워크는 보안측면에 있어서 매우 중요한 전략이라고 볼 수 있다. 따라서, 본 논문에서는 3GPP 5G 보안구조를 위한 EAP 인증 프레임워크를 고찰한다. 이를 위해, 1차 인증을 위한 EAP 기반의 인증 프로토콜 EAP-AKA'을 면밀히 검토하면서 1차 인증에서의 EAP 인증 프레임워크 적용방안을 분석한다. 아울러, 2차 인증을 위한 EAP 인증 프레임워크의 적용과 네트워크 슬라이싱 (Network Slicing)과의 연동을 살펴본다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2024.05a
• /
• pp.381-382
• /
• 2024

Open RAN(Radio Access Network)을 선도적으로 연구하고 있는 O-RAN Alliance에서는 Open RAN의 E2 인터페이스에서 발생 가능한 보안 위협 중 하나로 MitM(Man-in-the-Middle) 공격을 명시하였다. 그러나 이에 대응하기 위한 보안 요구사항으로는 3계층 보안 프로토콜인 IPsec 사용을 명시하고 있으며, 2계층 공격인 ARP(Address Resolution Protocol) 스푸핑에 대한 요구사항은 명시하고 있지 않다. 따라서 본 논문에서는 MitM 공격 중 하나인 ARP 스푸핑으로부터 E2 인터페이스를 보호하기 위해, Near-RT RIC의 ARP 테이블에서 E2 인터페이스로 연결되는 장비에 대한 MAC 주소를 정적으로 설정할 수 있는 xApp을 제안한다.

• Review of KIISC
• /
• v.31 no.1
• /
• pp.51-56
• /
• 2021

암호화 알고리즘은 수학적 안전성 확보가 중요하기 때문에 이론적인 측면에서의 정보 유출은 불가능에 가깝도록 설계된다. 하지만 암호화 알고리즘을 수행하는 컴퓨터 상에서 발생하는 부가적인 정보를 수집 및 분석하게 될 경우 안전한 암호화 알고리즘을 사용한 경우라 할지라도 비밀 정보가 쉽게 유출될 수 있는 가능성을 가지고 있다. 많은 부가적인 정보 중에서도 보다 직관적인 정보에 해당하는 시간 정보는 암호화 해킹 분야에서 많이 활용되고 있다. 본 고에서는 시간 정보를 활용한 부채널 공격기법에 대해 확인해 보며 이를 방어하기 위한 일정시간 암호화 구현 기법 동향에 대해 확인해 보도록 한다.

• Convergence Security Journal
• /
• v.18 no.2
• /
• pp.3-10
• /
• 2018

The existing smart grid, which is centered on the power grid, is rapidly spreading to new energy and renewable energy such as heat and gas, which are expressed as smart energy. Smart Energy interacts with electric energy and is connected to wired / wireless network based on IoT sensor based on energy analysis using AI to rapidly expand ecosystem with various energy carriers and customers. However, smart energy based on IoT is lacking in technological and institutional preparation for security compared to efforts to activate the market according to the interests of government and business operators. In this study, we will present Smart Energy 's privacy policy in terms of value system(CPND) of convergence ICT.

• Convergence Security Journal
• /
• v.13 no.1
• /
• pp.31-36
• /
• 2013

The personal information protection act has been enacted from 2011 for the protection of public and private privacy. Since the application area of the law is so broad, there is a limit to covers everything in the financial field. In this paper, I'll discuss an impact and problem by the personal information protection act. and propose some new task to build an efficient personal information protection governance on financial sector.

• Convergence Security Journal
• /
• v.19 no.1
• /
• pp.31-40
• /
• 2019

Today, information security (INFOSEC) as a discipline is gaining more and more importance according to the emergence and extension of the cyberspace. Originated from Joint Doctrine for Information Operation (Joint Pub 3-13) by the U.S. Department of Defense, 'information assurance (IA)' is the concept widely used in the relevant field. Grown from the practice of information security, it encompasses broader and more proactive protection that includes countermeasures and repair, security management throughout an information system (IS)'s life-cycle, and trustworthiness of an IS in the process of risk analysis. In Korea, many industry professionals tend to misunderstand IA, remaining unaware of the conceptual differences between IA and INFOSEC. On this account, the current study attempted to provide a combined definition of IA by reviewing relevant literature. This study showed the validity of the wordings used in the proposed definition phrase by phrase.