• 한국컴퓨터정보학회논문지
• /
• 제5권3호
• /
• pp.84-90
• /
• 2000

본 논문은 인터넷 환경에서 접근제어 요구 사항의 복잡한 문제를 해결하기 위한 접근제어 메커니즘의 설계 방안을 제시한다. 본 논문에서는 자원의 기밀성, 무결성 및 가용성의 공통적 목적을 달성하기 위한 접근제어 메커니즘을 제안하고, 신분-기반, 규칙-기반 및 직무-기반의 관점에서 각 관련된 정책과 규칙을 정의하였으며, 필요한 접근제어 오퍼레이션들을 구현하였다. 제안된 접근제어 메커니즘은 보안 레이블, 무결성 등급, 직무 및 소유권 등의 다단계 보안 정책을 기반으로 하여 자원에 대한 불법적인 접근을 방어 할 수 있다.

• 한국정보처리학회논문지
• /
• 제5권4호
• /
• pp.967-974
• /
• 1998

대부분의 침입차단시스템의 접근통제 기능은 전통적인 임의적 접근통제 기법을 적용하여 외부로 부터의 침입을 방지하고 있다. 이러한 전통적인 임의적 접근통제 기법은 다중등급의 네트워크에서 데이터의 중요도에 따라 정보 흐름을 안전하게 통제할 수 없다. 그러므로 다중등급 보안환경에서 활용될 침입차단시스템을 강제적 접근통제 기능을 제공하여야 한다. 본 논문에서는 다중등급 정보를 처리하기 위해 보안 레이블과 강제적 접근통제에 대한 보안 메커니즘 설계방법을 제시한다.

• 한국전자거래학회:학술대회논문집
• /
• 한국전자거래학회 2005년도 e-Biz World Conference 2005
• /
• pp.62-67
• /
• 2005

In traditional approach, enterprise-wide consistent security policy enforcement for applications is very difficult task. Therefore, industry is now moving towards new unified enterprise application security concept that consist of centralized authentication and authorization mechanism. The eXtensible Access Control Markup Language (XACML); an XML-based standard defined by OASIS, is most suitable choice which can support centralized, role based, context aware access control mechanism. It is designed to provide universal standard for writing authorization policies and access control request/response language for managing access to the resources. This paper includes a brief overview on XACML and discusses its benefits, limitations and a data flow process. We propose a new generic access control architecture that supports enterprise wide centralized application level access control mechanism using XACML. The other benefits which can be achieved through this architecture are, reduce adnministration cost and complexity, support of heterogeneous computing platforms, centralized monitoring system, automatic fail over, scalability and availability, open standard based solution and secure communication.

• 한국정보시스템학회지:정보시스템연구
• /
• 제14권3호
• /
• pp.1-8
• /
• 2005

This paper formally defines a role-driven security and access control model of a business process in order eventually to provide a theoretical basis for realizing the secured business process management systems. That is, we propose a graphical representation and formal description of the mechanism that generates a set of role-driven security and access control models from a business process modeled by the information control net(ICN) modeling methodology that is a typical business process modeling approach for defining and specifying business processes. Based upon the mechanism, we are able to design and accomplish a secured business process management system that provides an unified resource access control mechanism of the business process management engine domain's and the application domain's. Finally, we strongly believe that the secured access control policies from the role-driven security and access control model can be easily transformed into the RBAC(Role-based Access Control) model that is a standardized security technology for computer and communications systems of commercial and civilian government organizations.

• International Journal of Computer Science & Network Security
• /
• 제22권12호
• /
• pp.107-115
• /
• 2022

Recently, big data applications need another database different from the Relation database. NoSQL databases are used to save and handle massive amounts of data. NoSQL databases have many advantages over traditional databases like flexibility, efficiently processing data, scalability, and dynamic schemas. Most of the current applications are based on the web, and the size of data is in increasing. NoSQL databases are expected to be used on a more and large scale in the future. However, NoSQL suffers from many security issues, and one of them is access control. Many recent applications need Fine-Grained Access control (FGAC). The integration of the NoSQL databases with FGAC will increase their usability in various fields. It will offer customized data protection levels and enhance security in NoSQL databases. There are different NoSQL database models, and a document-based database is one type of them. In this research, we choose the CouchDB NoSQL document database and develop an access control mechanism that works at a fain-grained level. The proposed mechanism uses role-based access control of CouchDB and restricts read access to work at the document level. The experiment shows that our mechanism effectively works at the document level in CouchDB with good execution time.

• 정보보호학회논문지
• /
• 제29권3호
• /
• pp.579-588
• /
• 2019

산업제어시스템은 센서, 액추에이터 등의 다양한 물리적인 장치들로 구성된다. 과거에 미국에서 발생했던 상수도 시설 원격 접속 사고, 전력 제어시스템 감염 등 대규모 피해를 가져온 보안 사고는 산업제어시스템 접근 제어의 취약점으로 인해 발생했다. 물리적 장치에 대한 접근제어는 신뢰할 수 있는 시스템을 통해 이뤄져야한다. 그러나 폐쇄망으로 구성된 산업제어시스템 내부에 단일 접근 제어 시스템을 구축하는 것은 신뢰성을 보장받을 수 없다. 또 단일 접근제어 시스템은 장애나 사고 발생시 접근 제어 시스템이 작동 불가능해지므로 다른 접근 제어 방법이나 시스템이 필요하다. 본 논문에서는 신뢰성과 안정적인 운영을 제공하기 위해 운영 계층에 블록체인을 이용하고, 스마트 컨트랙트 배포를 통한 접근제어 메커니즘을 제안한다. 또한, 무결성, 기밀성보다 가용성이 우선시 되는 산업제어시스템을 고려하여 각 산업 환경에 맞게 소모할 컴퓨팅 자원을 설정할 수 있도록 신뢰 점수를 이용했다. 본 논문에서 제안하는 시스템은 기 제안된 블록체인 기반의 접근제어 시스템과 달리 현재 운영중인 산업제어시스템의 특성에 맞게 구성했다.

• 정보교육학회논문지
• /
• 제1권2호
• /
• pp.57-66
• /
• 1997

The primary purpose of security mechanisms in a computer systems is to control the access to information. There are two types of access control mechanisms to be used typically. One is discretionary access control(DAC) and another is mandatory access control(MAC). In this study an access control mechanism is introduced for secure access path in security system. The security policy of this access control is that no disclosure of information and no unauthorized modification of information. To make this access control correspond to security policy, we introduce three properties; read, write and create.

• Journal of Communications and Networks
• /
• 제13권6호
• /
• pp.639-654
• /
• 2011

In this paper, we present a channel access mechanism, referred to as the enhanced mesh coordinated channel access (eMCCA) mechanism, for IEEE 802.11s-based wireless mesh networks. The current draft of IEEE 802.11s includes an optional medium access control (MAC), denoted as MCCA, which is designed to provide collision-free and guaranteed channel access during reserved periods. However, the MCCA mechanism fails to achieve the desired goal in the presence of contending non-MCCA nodes; this is because non-MCCA nodes are not aware of MCCA reservations and have equal access opportunities during reserved periods. We first present a probabilistic analysis that reveals the extent to which the performance of MCCA may be affected by contending non-MCCA nodes. We then propose eMCCA, which allows MCCA-enabled nodes to enjoy collision-free and guaranteed channel access during reserved periods by means of prioritized and preemptive access mechanisms. Finally, we evaluate the performance of eMCCA through extensive simulations under different network scenarios. The simulation results indicate that eMCCA outperforms other mechanisms in terms of success rate, network throughput, end-to-end delay, packet-loss rate, and mesh coordinated channel access opportunity-utilization.

• 한국융합학회논문지
• /
• 제7권1호
• /
• pp.1-8
• /
• 2016

클라우드 컴퓨팅 환경은 가상화 기술을 이용하여 네트워크에 기반한 컴퓨터 자원, 소프트웨어, 인프라 등을 서로 공유하는 기능을 제공한다. 가상화는 기업의 서버 운영효율과 비용절감을 위해 매우 유용한 기술이지만 보안을 고려하지 않고 수행할 경우 새로운 보안 위협의 대상이 될 수 있다. 본 논문에서는 클라우드 시스템 환경에서 발생할 수 있는 다양한 문제점을 해결하는 클라우드 융합을 위한 MAC 기반 접근통제 메커니즘을 제안한다. 이 메커니즘은 접근통제 시스템 모니터의 상태규칙 집합, 보안특성 그리고 알고리즘으로 구성된다. 본 논문에서는 제안된 접근통제 메커니즘을 갖는 제어 시스템과 초기 보안 상태가 안전한 시스템임을 증명하였다. 본 메커니즘은 정책 모듈을 통해 접근통제 시스템들 간의 통제된 자원들이 서로 안전하게 공유되며 유지 관리되어질 수 있는 장점을 제공한다.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제11권11호
• /
• pp.5338-5359
• /
• 2017

In-band full-duplex (IBFD) wireless communication supports symmetric dual transmission between two nodes and asymmetric dual transmission among three nodes, which allows improved throughput for distributed IBFD wireless networks. However, inter-node interference (INI) can affect desired packet reception in the downlink of three-node topology. The current Half-duplex (HD) medium access control (MAC) mechanism RTS/CTS is unable to establish an asymmetric dual link and consequently to suppress INI. In this paper, we propose a medium access control mechanism for use in distributed IBFD wireless networks, FD-DMAC (Full-Duplex Distributed MAC). In this approach, communication nodes only require single channel access to establish symmetric or asymmetric dual link, and we fully consider the two transmission modes of asymmetric dual link. Through FD-DMAC medium access, the neighbors of communication nodes can clearly know network transmission status, which will provide other opportunities of asymmetric IBFD dual communication and solve hidden node problem. Additionally, we leverage FD-DMAC to transmit received power information. This approach can assist communication nodes to adjust transmit powers and suppress INI. Finally, we give a theoretical analysis of network performance using a discrete-time Markov model. The numerical results show that FD-DMAC achieves a significant improvement over RTS/CTS in terms of throughput and delay.