• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.26 no.7
• /
• pp.1047-1059
• /
• 2022

With the development of cloud computing technology, container technology that provides services based on a virtual environment is also developing. Container orchestration technology is a key element for cloud services, and it has become an important core technology for building, deploying, and testing large-scale containers with automation. Originally designed by Google and now managed by the Linux Foundation, Kubernetes is one of the container orchestrations and has become the de facto standard. However, despite the increasing use of Kubernetes in container orchestration, the number of incidents due to security vulnerabilities is also increasing. Therefore, in this paper, we study the vulnerabilities of Kubernetes and propose a security policy that can consider security from the initial development or design stage through threat analysis. In particular, we intend to present a specific security guide by classifying security threats by applying STRIDE threat modeling.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2024.05a
• /
• pp.118-119
• /
• 2024

클라우드 환경에서 컨테이너 사용이 증가하면서 컨테이너 보안의 중요성이 부각되고 있다. 그리고, 이를 위해 다양한 리눅스 보안 프레임워크를 활용한 연구가 활발하게 진행되고 있으며, 특히 LSM-BPF 기술이 기존의 보안 프레임워크 한계를 극복할 수 있는 해법으로 주목받고 있다. 그러나 LSM-BPF 를 활용할 때 발생할 수 있는 시스템 성능 변화에 대한 연구는 아직 미흡한 상태이다. 따라서, 본 논문에서는 LSM-BPF 기반의 보안 솔루션을 모의 구현하고 이를 벤치마크하여 시스템 성능 변화를 측정 및 분석을 진행하였다. 컨테이너 환경에서의 실험 결과, 평균적으로 시스템 성능이 6.6% 감소하는 것을 확인하였다. 하지만, 보안 정책 개수가 증가하여도 추가적인 성능 저하는 발생하지 않음 역시 확인하였다.

• Journal of Digital Convergence
• /
• v.9 no.6
• /
• pp.187-196
• /
• 2011

This study found the power analysis and increase plan of Smart work industry out. We did the internet survey with 117 experts of Smart work and analyzed International competitive power and Smart work marketability. The results was as follows: First, Experts recognized the growth about Cloud computing industry so that they were most high. Second, The thing which the earning of Smart work industry is high appeared a Security industry, Cloud computing industry, and Mobile office industry etc sequence. Third, The Smart work industry which an international technique power level is high appeared in a Smart e-learning industry, Mobile office industry, and Security industry etc sequence. Lastly, An Smart work industry which the concentration supports in the government dimension Security industry, Cloud computing industry, Smart work user SW industry, and Smart e-learning industry etc sequence. This research products will use for there even though it prepares a concentration support industry in the government dimension an activation policy.

• Journal of Convergence for Information Technology
• /
• v.9 no.9
• /
• pp.27-32
• /
• 2019

Along with the growth of u-Healthcare, we propose a security enhancement based on network separation for CloudHIS with for handling healthcare information to cope with cyber attack. To protect against all security threats and to establish clear data security policies, we apply desktop computing servers to cloud computing services for CloudHIS. Use two PCs with a hypervisor architecture to apply physical network isolation and select the network using KVM switched controller. The other is a logical network separation using one PC with two OSs, but the network is divided through virtualization. Physical network separation is the physical connection of a PC to each network to block the access path from both the Internet and the business network. The proposed system is an independent desktop used to access an intranet or the Internet through server virtualization technology on a user's physical desktop computer. We can implement an adaptive solution to prevent hacking by configuring the CloudHIS, a cloud system that handles medical hospital information, through network separation for handling security enhancement.

• Journal of Digital Convergence
• /
• v.19 no.8
• /
• pp.11-20
• /
• 2021

Due to the Covid-19 Pandemic, the world is facing the most serious crisis since the Great Depression, and is facing a new paradigm of the Untact era. Korea has also announced various policies and legal systems, including the 'Korean version of the New Deal', but it is conflicting between the use of information and the protection of information. In this paper, we derive thresholds by analyzing policies, statutes and technologies in the public cloud. Based on this, we propose to introduce the "Building a Nationwide Public Virtual Machine" as a key task to secure the next-generation national growth engine so that all citizens can use digital services in a secure and reliable environment with equal access to information. Through this, all citizens can use various digital new technology services only with low-priced and low-specification terminals, and by establishing a dedicated center for information protection, we want to respond to rapidly increasing security threats. It also points out that the domestic cloud-related legal system only emphasizes the use of information while overlooking the importance of security, and suggests the right direction for the legal system to move forward.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.6
• /
• pp.961-973
• /
• 2023

With the changes in the modern computing landscape, securing containerized workloads and addressing the complexities of container networking have become critical issues. In particular, the complexity of network policy settings and the lack of cloud security architecture cause various security issues. This paper focuses on the importance of network security and efficiency in containerized environments, and analyzes the security features and performance of various container network interface plugins. In particular, the features and functions of Cilium, Calico, Weave Net, and Kube-router were compared and evaluated, and the Layer 3/4 and Layer 7 network policies and performance features provided by each plugin were analyzed. We found that Cilium and Calico provide a wide range of security features, including Layer 7 protocols, while Weave Net and Kube-router focus on Layer 3/4. We also found a decrease in throughput when applying Layer 3/4 policies and an increase in latency due to complex processing when applying Layer 7 policies. Through this analysis, we expect to improve our understanding of network policy and security configuration and contribute to building a safer and more efficient container networking environment in the future.

• Journal of Convergence for Information Technology
• /
• v.10 no.10
• /
• pp.32-39
• /
• 2020

In the large-scale infrastructure of cloud environment, illegal access rights are frequently caused by sharing applications and devices, so in order to actively respond to such attacks, a strengthened access control system is required to prepare for each situation. We proposed an entity attribute-based access control(EABAC) model based on security level and relation concept. This model has enhanced access control characteristics that give integrity and confidentiality to subjects and objects, and can provide different services to the same role. It has flexibility in authority management by assigning roles and rights to contexts, which are relations and context related to services. In addition, we have shown application cases of this model in multi service environment such as university.

• Journal of Digital Convergence
• /
• v.11 no.12
• /
• pp.467-477
• /
• 2013

The cloud computing has propagated rapidly and thus there is growing interest on the introduction of cloud services in the public institution. Accordingly, domestic public institution are adoption of cloud computing impose and devise a plan. In addition, more specifically, is building a cloud computing system in the public institution. However, solutions to various security threats(e.g., availability invasion of storage, access by unauthorized attacker, data downloaded from uncertain identifier, decrease the reliability of cloud data centers and so on) is required. For the introduction and revitalize of cloud services in the public institution. Therefore, in this paper, we propose a public key based secure data management scheme for the cloud data centers in public institution. Thus, the use of cloud computing in the public institutions, the only authorized users have access to the data center. And setting for importance and level of difficulty of public data management enables by systematic, secure, and efficient. Thus, cloud services for public institution to improve the overall security and convenience.

• Journal of Digital Convergence
• /
• v.12 no.1
• /
• pp.405-414
• /
• 2014

It is very important to IT users that the Cloud service provides dynamic extension of IT resources and cost-saving. However, the reliability for Cloud service hinders utilizing Cloud service actively. Existing studies on assessment program for Cloud Service are executed by extracting information security assessment articles and adding features of cloud services by referencing ISO/IEC 27001:2005. This paper will review the recently released ISO/IEC 27001:2013 for the addition, reduction, and changing of articles for Controls and Control objectives. Comparative analysis for the Controls of ISO/IEC 27001:2013 with those of CSA CCMv.3, FedRAMP which is an assessment program for Cloud service will suggest Control Objects of Information Security Management System for related Cloud service. The suggestion of Controls will be an important reference index for the security policy of companies which manage the information security management system based on Cloud service.

• Convergence Security Journal
• /
• v.13 no.1
• /
• pp.37-43
• /
• 2013

In 2010, the Ministry of National Defense decided to build a MegaCenter including the cloud computing technology by 2014, as part of the '2012 Information Service Plan', which is now underway. The Cloud computing system environment should be designed applying cloud computing technology and policy for an efficient infrastructure that many IT resources are available in the data center as a concentrated form. That is, the system should be designed in such a way that clouding services will be efficiently provided to meet the needs of users and there will not be unnecessary waste of resources. However, in order to build an optimal system, it should be possible to predict the service performance and the resource availability at the initial phase of system design. In this paper, using the CloudAnalyst simulator to predict availability of the K-defence cloud computing system service, conducts cloud modeling and analysis of the 'Facebook', one of the most famous social network service applications with most users in the world. An Optimal K-Defense cloud computing design model is proposed through simulation results.