• Journal of KIISE:Information Networking
• /
• v.30 no.5
• /
• pp.604-613
• /
• 2003

Network Address Translation-Protocol Translation(NAT-PT) is an IPv4/IPv6 translation mechanism, as defined in RFC2766, allowing IPv6-only devices to communicate with IPv4-only devices and vice versa. But NAT-PT has the restriction that applies to IPv4 NAT where NAT-PT does not provide end-to-end security, which is a major goal of IPSec. Therefore it cannot support security services such as confidentiality, authentication, and integrity. In this paper, we propose secure NAT-PT(SNAT-PT) and the corresponding secure host architecture to support IPSec security service. And also tunneling scheme using dummy IP header is presented to show the valid operation of end-to-end IPSec protocol on the proposed architectures.

• Proceedings of the Korean Information Science Society Conference
• /
• 2012.06c
• /
• pp.239-241
• /
• 2012

우리 군은 미래전을 대비하기 위해 각종 전술 응용정보체계의 막힘없는 전송과 통신망간 연동 요구를 충족시키고 미래 전장을 주도할 통신체계 구축을 목표로 전술정보통신체계(TICN) 개발을 추진 중이다. Ad-hoc 네트워크 기술을 사용하는 전술정보통신체계의 부체계인 전투무선체계는 전장 환경에서 운영되는 특수성으로 인해 기존의 전통적인 플랫한 Ad-hoc 네트워크와는 차별화된 계층형 Ad-hoc 네트워크 구조를 가진다. 또한 Ad-hoc 네트워크를 운용하는 환경이 보안성이 극도로 요구되는 전장 환경임을 고려할 때 군 작전의 성공적인 목표 달성을 위한 보안대책은 반드시 필요하다. 특히 전장상황 하에서 유통될 각종 민감 정보들에 대한 기밀성, 무결성 등을 보장하기 위해 정당한 권한을 가진 노드들만이 네트워크에 참여할 수 있는 보안 매커니즘이 적용되어야 하며, 이를 위해선 효율적인 키 관리 기법을 적용해야 한다. 본 논문에서는 비밀키, 노드위치, 해시인증 등의 정보를 이용한 3단계 인증절차 적용으로 Ad-hoc 네트워크 참여 노드의 인증을 강화하고, 통신환경에 따라 3가지 비밀키를 구분 사용하여 계층형 Ad-hoc 네트워크 구조에서 기밀성 보장을 강화하기 위한 키 관리 기법을 제안한다.

• KIPS Transactions on Computer and Communication Systems
• /
• v.2 no.12
• /
• pp.569-576
• /
• 2013

Cloud computing has been receiving increasing attention recently. Despite this attention, security is the main problem that still needs to be addressed for cloud computing. In general, a cloud computing environment protects data by using distributed servers for data storage. When the amount of data is too high, however, different pieces of a secret key (if used) may be divided among hundreds of distributed servers. Thus, the management of a distributed server may be very difficult simply in terms of its authentication, encryption, and decryption processes, which incur vast overheads. In this paper, we proposed a efficiently data storage and recovery scheme using XOR and RAID in Hadoop environment.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.6
• /
• pp.1427-1437
• /
• 2018

While biometric authentication system has been in general use, research is ongoing to apply biometric data to public key infrastructure. It is a significant task to generate a cryptographic key from biometrics in setting up a public key of Bio-PKI. Methods for generating the key by quantization of feature vector can cause data loss and degrade the performance of key extraction. In this paper, we suggest a new method for generating a cryptographic key from classification results of biometric data using multiple classifying models. Our proposal does not cause data loss of feature vector so it showed better performance in key extraction. Also, it uses the multiple models to generate key blocks which produce sufficient length of the key.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.7 no.2
• /
• pp.11-18
• /
• 1997

Chaum and Heyst first proposed group signature which is based on the undeniable signature. So, a receiver of the signature can't verify a group signature without cooperation of the signer and, in case of dispute later on, he can't reveal the identity of the signer without help of the group members. Park et. al. proposed an id-based group signature with self-authentication, in which the receiver of the signature reveals the identity of the signer without help of the group members. However, the proposed scheme has two problem : 1) the receiver can't identify the signer, since every keys of the group members hold the identification procedure. 2) By collusion of the group members, new secret key for a group signature can be computed and the secret key of the trusted center can be revealed.

• Annual Conference of KIPS
• /
• 2010.11a
• /
• pp.1293-1296
• /
• 2010

오늘날 기존의 전력망에 IT가 융합되어 전력 공급자와 송배전 컨트롤러 사이에 정보 교환이 가능한 스마트그리드가 부각되고 있다. 스마트그리드 환경은 전력 공급자와 송배전 컨트롤러 사이의 정보 교환의 빈도가 높고, 정보 교환이 실시간으로 이루어 져야하는 특성을 가진다. 이러한 정보 교환이 주어진 시간 내에 정확하게 이루어지지 않거나 정보 교환 중에 공격자로 인해 악의적 변경이 일어나는 경우 대규모 정전이나 전력의 공급에 막대한 영향을 미치게 된다. 따라서 송신자 인증과 정보 교환 중에 정보의 악의적 변경이 이루어지지 않았다는 정보의 무결성 인증이 이루어 져야 하며, 이를 임계시간 이내에 처리할 수 있는 인증 프로토콜이 요구된다. 본 논문에서는 이러한 요구조건을 만족시키기 위해 타임-크리티컬(time-critical)한 특성을 가지면서 메세지 인증 기능을 제공하는 TV-HORS 멀티캐스트 인증 기법을 스마트그리드 시나리오에 적용하고, 이에 따른 문제점을 제시한 후, 이에 대한 해결책을 제시한다. 제안하는 방법은 키입력(keyed) 해쉬함수를 이용해 기존 TV-HORS 기법이 가지는 키 저장 문제를 효율적으로 해결한다.

• Annual Conference of KIPS
• /
• 2011.04a
• /
• pp.844-847
• /
• 2011

Wireless mesh network (WMN) is a type of mobile ad-hoc network consists of wireless router, mobile clients and gateway which connects the network with the Internet. To provide security in the network it is required to encrypt the message sent among the communicating nodes in such way so that only legitimate user can retrieve the original data. Several security mechanisms have been proposed so far to enhance the security of WMN. However, there still exists a need for a comprehensive mechanism to prevent attacks in data communication. Considering the characteristic of mesh network, in this paper we proposed a public key cryptography based security architecture to establish a secure key agreement among communicating nodes in mesh network. The proposed security architecture consists of two major sections: client data protection and network data protection. Client data protection deals with the mutual authentication between the client and the access router and provide client to access router encryption for data confidentiality using standard IEEE 802.11i protocol. On the other hand, network data protection ensures encrypted routing and data transfer in the multi hop backbone network. For the network data protection, we used the pre-distributed public key to form a secure backbone infrastructure.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.12 no.12
• /
• pp.2293-2300
• /
• 2008

In ad-hoc sensor network, AODV routing information is disclosed to other nodes because AODV protocol doesn't have any security mechanisms. The problem of AODV is that an attacker can falsify the routing information in RREQ packet. If an attacker broadcasts the falsified packet, other nodes will update routing table based on the falsified one so that the path passing through the attacker itself can be considered as a shortest path. In this paper, we design the routing-information-spoofing attack such as falsifying source sequence number and hop count fields in RREQ packet. And we suggest an efficient scheme for detecting the attackers and isolating those nodes from the network without extra security modules. The proposed scheme doesn't employ cryptographic algorithm and authentication to reduce network overhead. We used NS-2 simulation to evaluate the network performance. And we analyzed the simulation results on three cases such as an existing normal AODV, AODV under the attack and proposed AODV. Simulation results using NS2 show that the AODV using proposed scheme can protect the routing-information-spoofing attack and the total n umber of received packets for destination node is almost same as the existing norm at AODV.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.17 no.2
• /
• pp.125-137
• /
• 2007

This paper proposes a new scheme to provide the location privacy of sources in Wireless Sensor Networks (WSNs). Because the geographical location of a source sensor reveals contextual information on an 'event' in WSN, anonymizing the source location is an important issue. Despite abundant research efforts, however, about data confidentiality and authentication in WSN, privacy issues have not been researched well so far. Moreover, many schemes providing the anonymity of communication parties in Internet and Ad-hoc networks are not appropriate for WSN environments where sensors are very resource limited and messages are forwarded in a hop-by-hop manner through wireless channel. In this paper, we first categorize the type of eavesdroppers for WSN as Global Eavesdropper and Compromising Eavesdropper. Then we propose a novel scheme which provides the anonymity of a source according to the types of eavesdroppers. Furthermore, we analyze the degree of anonymity of WSN using the entropy-based modeling method. As a result, we show that the proposed scheme improves the degree of anonymity compared to a method without any provision of anonymity and also show that the transmission range plays a key role to hide the location of source sensors.

• Journal of the Korea Convergence Society
• /
• v.7 no.5
• /
• pp.29-34
• /
• 2016

Recently, with the development of high-tech industry, the use of the drones in various aspects of daily life is rapidly advancing. With technical and functional advancements, drones have an advantage of being easy to be utilized in the areas of use according to various lifestyles. In addition, through the diversification of the drone service converged with image processing medium such as camera and CCTV, an automated security system that can replace humans is expected to be introduced. By designing these unmanned security technology, a new convergence security drone service techniques that can strengthen the previous drone application technology will be proposed. In the proposed techniques, a biometric authentication technology will be designed as additional authentication methods that can determine the safety incorporated with security by selecting the search and areas of an object focusing on the objects in the initial windows and search windows through OpenCV technology and CAM-Shift algorithm which are an object tracking algorithm. Through such, a highly efficient security drone convergence service model will be proposed for performing unmanned security by using the drones that can continuously increase the analysis of technology on the mobility and real-time image processing.