• Proceedings of the Korean Society of Computer Information Conference
• /
• 2019.01a
• /
• pp.361-363
• /
• 2019

인터넷환경에서 금융회사는 홈페이지 사용자의 신원확인, 부인방지 등의 목적으로 공개키 기반구조(PKI: Public Key Infrastructure) 환경의 공인인증서를 홈페이지 로그인, 전자금융거래 등의 업무에 적용하고 있다. 사용자의 공인인증서를 이용하여 생성된 전자서명이 악성코드 감염 등으로 인하여 유출 시 사용자가 과거에 서명했던 전자서명이 재사용(로그인, 전자금융거래 등)될 수 있는 취약점이 존재하기에 인터넷 상에서의 전자서명 재사용에 대한 원인, 방지 절차 및 방법을 제안 하고자 한다.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2009.10a
• /
• pp.892-895
• /
• 2009

Medical records must be well protected because they are needed to care for the health of patients. For that reason, user authentication and medical data encryption are essential for the security of both wired and wireless Healthcare Information Systems (HIS). The main focus of this paper is on the analysis of the numerous possible attacks and the countermeasures to overcome these attacks in Mobile Healthcare Environment (MHE) with an appropriate security protocols. To draw a conclusion, this will propose why a healthcare architecture should establish a multi-layered defense against the risks.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2010.11a
• /
• pp.1177-1179
• /
• 2010

RFID는 태그가 부착된 사물의 정보를 무선통신을 통해 인식하는 기술로써 바코드를 대체하는 등 다양한 영역으로 응용 범위가 확대되고 있다. 따라서 각 응용에 필요한 보안 문제도 중요시 되고 있다. 본 논문에서는 지금까지 RFID시스템의 보안 취약성을 해결하기 위해 제안된 많은 인증 프로토콜들 중 한국정보통신기술협회에서 제정한 잠정표준인 "수동형 RFID 보안태그와 리더의 인증 및 데이터 보호 프로토콜"에 대하여 프라이버시 침해, 위치추적, 비동기화 공격 가능 및 전방향 안전성을 만족하지 못하는 등의 보안 취약점이 있음을 보이고, 이에 대한 분석을 하였다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.26 no.4
• /
• pp.857-869
• /
• 2016

It is a well-known fact that password based authentication system has been threatened for crucial data leakage through monitoring key log. Recently, to prevent this type of attack using keystroke logging, virtual onscreen keyboards are widely used as one of the solutions. The virtual keyboards, however, also have some crucial vulnerabilities and the major weak point is that important information, such as password, can be exposed by tracking the trajectory of the mouse cursor. Thus, in this paper, we discuss the vulnerabilities of the onscreen keyboard, and present hypothetical attack scenario and a method to crack passwords. Finally to evaluate the performance of the proposed scheme, we demonstrate an example experiment which includes attacking and cracking by utilizing password dictionary and analyze the result.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.23 no.5
• /
• pp.803-813
• /
• 2013

As the developments of smart devices and social network services, the amount of data has been exploding. The world is facing Big data era. For these reasons, the Big data processing technology which is a new technology that can handle such data has attracted much attention. One of the most representative technologies is Hadoop. Hadoop Distributed File System(HDFS) designed to run on commercial Linux server is an open source framework and can store many terabytes of data. The initial version of Hadoop did not consider security because it only focused on efficient Big data processing. As the number of users rapidly increases, a lot of sensitive data including personal information were stored on HDFS. So Hadoop announced a new version that introduces Kerberos and token system in 2009. However, this system is vulnerable to the replay attack, impersonation attack and other attacks. In this paper, we analyze these vulnerabilities of HDFS security and propose a new protocol which complements these vulnerabilities and maintains the performance of Hadoop.

• KIPS Transactions on Computer and Communication Systems
• /
• v.7 no.3
• /
• pp.73-80
• /
• 2018

Due to the popularity of smartphones and the simplification of financial services, the number of mobile financial services is increasing. However, the security keypads developed for existing financial services are susceptible to probability analysis attacks and have security vulnerabilities. In this paper, we propose and implement a security keypad based on dual touch. Prior to the proposal, we examined the existing types of security keypads used in the mobile banking and mobile payment systems of Korean mobile financial businesses and analyzed the vulnerabilities. In addition, we compared the security of the proposed dual touch keypad as well as existing keypads using the authentication framework and the existing keypad attack types (Brute Force Attack, Smudge Attack, Key Logging Attack, and Shoulder Surfing Attack, Joseph Bonneau). Based on the results, we can confirm that the proposed security keypad with dual touch presented in this paper shows a high level of security. The security keypad with dual touch can provide more secure financial services, and it can be applied to other mobile services to enhance their security.

• Journal of Convergence for Information Technology
• /
• v.9 no.1
• /
• pp.86-91
• /
• 2019

Block chains began by recognizing the danger of centralized control of financial systems after the 2008 financial crisis. From the beginning of 2008, blockchain has been developing a lot of attention and technology, starting with a tremendous innovation called cryptographic destruction based on technology, a block chain called Bitcoin. However, the vulnerability has also been discovered over time and the damage has been repeated. But in the fourth industry of the 21st century, many advances and technologies based on them are expected to emerge. Therefore, this paper proposes new analytical transaction protocols for vulnerabilities in cryptographic currency transactions. The proposed transaction protocol is a way to authenticate once again at the end of the transaction and the transaction is concluded with this authentication. It presents countermeasures by adding security elements between users to the transaction process rather than internal security to transaction vulnerabilities.

• Journal of the Korean Society for information Management
• /
• v.19 no.1
• /
• pp.23-46
• /
• 2002

With explosively increasing digital contents, library and Information center should have a new role between knowledge providers and knowledge users as information brokering organization. Electronic transaction system should be required for performing this brokering service since economic value is added to information and knowledge in information society. The developments and changes around library are keeping up with increasing building digital library and digitalizing printed sources. With the rapidly changing circumstances, the Internet is currently witnessing an explosive growth. By serving as a virtual information resource. the Internet can dramatically change the way business is conducted and Information is provided. However because of features o( the Internet like openness and information sharing, it has fundamental vulnerabilities in security issues. For Instance, disclosure of private information and line eavesdropping such as password, banking account, transaction data on network and so on are primary obstruction factors to activation of digital contents delivery on network. For high network security and authentication, this paper looks at smart card technologies and proposes multi-authentication protocol based on smart card on open network, implements and analyzes it.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.20 no.1
• /
• pp.63-72
• /
• 2010

RFID is one of useful identification technology in ubiquitous environments which can be a replacement of bar code. RFID is basically consisted of tag, reader, which is for perception of the tag, and back-end-database for saving the information of tags. Although the usage of mobile readers in cellular phone or PDA increases, related studies are not enough to be secure for practical environments. There are many factors for using mobile leaders, instead of static leaders. In mobile reader environments, before constructing the secure protocol, we must consider these problems: 1) easy to lose the mobile reader 2) hard to keep the connection with back-end-database because of communication obstacle, the limitation of communication range, and so on. To find the solution against those problems, Han et al. suggest RFID mutual authentication protocol without back-end-database environment. However Han et al.'s protocol is able to be traced tag location by using eavesdropping, spoofing, and replay attack. Passive tag based on low cost is required lots of communication unsuitably. Hence, we analyze some vulnerabilities of Han et al.'s protocol and suggest RFID mutual authentication protocol without online back-end-database in aspect of efficiency and security.

• Convergence Security Journal
• /
• v.24 no.1
• /
• pp.51-57
• /
• 2024

Although industrial control systems (ICSs) recently keep evolving with the introduction of Industrial IoT converging information technology (IT) and operational technology (OT), it also leads to a variety of threats and vulnerabilities, which was not experienced in the past ICS with no connection to the external network. Since various control command messages are sent to field devices of the ICS for the purpose of monitoring and controlling the operational processes, it is required to guarantee the message integrity as well as control center authentication. In case of the conventional message integrity codes and signature schemes based on symmetric keys and public keys, respectively, they are not suitable considering the asymmetry between the control center and field devices. Especially, compromised node attacks can be mounted against the symmetric-key-based schemes. In this paper, we propose message authentication scheme based on double hash chains constructed from cryptographic hash function without introducing other primitives, and then propose extension scheme using Merkle tree for multiple uses of the double hash chains. It is shown that the proposed scheme is much more efficient in computational complexity than other conventional schemes.