• Journal of the Korea Society of Computer and Information
• /
• v.26 no.9
• /
• pp.89-96
• /
• 2021

In this paper, we analyzed that the user authentication scheme for TMIS(Telecare Medicine Information System) proposed by Al-Saggaf et al. In 2019, Al-Saggaf et al. proposed authentication scheme using biometric information, Al-Saggaf et al. claimed that their authentication scheme provides high security against various attacks along with very low computational cost. However in this paper after analyzing Al-Saggaf et al's authentication scheme, the Al-Saggaf et al's one are missing random number s from the DB to calculate the identity of the user from the server, and there is a design error in the authentication scheme due to the lack of delivery method. Al-Saggaf et al also claimed that their authentication scheme were safe against a variety of attacks, but were vulnerable to password guessing attack using login request messages and smart cards, session key exposure and insider attack. An attacker could also use a password to decrypt the stored user's biometric information by encrypting the DB with a password. Exposure of biometric information is a very serious breach of the user's privacy, which could allow an attacker to succeed in the user impersonation. Furthermore, Al-Saggaf et al's authentication schemes are vulnerable to identity guessing attack, which, unlike what they claimed, do not provide significant user anonymity in TMIS.

• The Journal of the Korea Contents Association
• /
• v.21 no.10
• /
• pp.59-66
• /
• 2021

In this paper, an improved integrated security control procedure is newly proposed by applying artificial intelligence technology to integrated security control and unifying the existing security control and AI security control response procedures. Current cyber security control is highly dependent on the level of human ability. In other words, it is practically unreasonable to analyze various logs generated by people from different types of equipment and analyze and process all of the security events that are rapidly increasing. And, the signature-based security equipment that detects by matching a string and a pattern has insufficient functions to accurately detect advanced and advanced cyberattacks such as APT (Advanced Persistent Threat). As one way to solve these pending problems, the artificial intelligence technology of supervised and unsupervised learning is applied to the detection and analysis of cyber attacks, and through this, the analysis of logs and events that occur innumerable times is automated and intelligent through this. The level of response has been raised in the overall aspect by making it possible to predict and block the continuous occurrence of cyberattacks. And after applying AI security control technology, an improved integrated security control service model was newly proposed by integrating and solving the problem of overlapping detection of AI and SIEM into a unified breach response process(procedure).

• The Korean Society of Law and Medicine
• /
• v.22 no.2
• /
• pp.49-79
• /
• 2021

Due to defendant's wrongful act by implant surgery, plaintiff has been suffered serious damages to his face and teeth, and pain caused by establishing implanted teeth. Jeonju Appellate Court sentenced to pay future medical expenses and alimony to the plaintiff in compensation for breach of duty or torts. The ruling is designed to relieve the burden of proof because it is extremely difficult for non-experts to determine whether dentists violated their 'duty of care' or whether there was a causal relationship between damages to medial treatment. It was judged that if symptoms that contributed to the patient's significant outcome occurred during or after surgery, such symptoms could be presumed to have been caused by medical negligence if indirect facts were proven to be other than medical negligence. Originally, the shifting of burden of proof in Germany, has already been developed in medical malpractice case since 1940s. In order to guarantee the patients' right, §630h German Civil Code (BGB) - presumption of negligence in the realization of controllable risk- has been also legislated. BGH (Bundesgerichtshof) has been interested in ensuring that the principle of equality between patients and doctors. So, in this study, we wanted to refer to German precedent cases to analyzing Korean medical malpractice lawsuit. In particular, the decision could be significant in that it approaches closer to allows the shifting burden of proof in drastically growing dental malpractice cases. This is clearly confirmed in the judgment of the dentist's "fault" that "if indirect facts about the symptom or occurrence are proven to be cause other than medical negligence, such symptoms can be presumed to be due to medical negligence."

• The Korean Society of Law and Medicine
• /
• v.23 no.4
• /
• pp.3-28
• /
• 2022

Recently, the targets and clauses of negotiation between 'National Health Insurance Service (NHIS)' and Pharmaceutical companies has been expanded. Due to newly adopted 'Quality management clause', 'Compulsory supply maintenance clause' and 'Penalty for breach of contract clause', not only 'Ministry of Health and Wellfare (MOHW)'s 'drug listing' and 'Price cap' announcement, but also 'negotiation between NHIS and pharmaceutical companies' can be a legal sanction to the suppliers. Once secretary of MOHW order NHIS to negotiate with pharmaceutical company, NHIS notify this order to the company and enter into the negotiation. 'The order' exists in the public domain between the government (MOHW) and public institutions (NHIS) and does not constrain the legal rights of companies (Therefore companies cannot pile a lawsuit about the order). However, 'the notice' or 'negotiation' is an act which has a counterpart, can be a target of administrative litigation if the company get some disadvantages from the talks. Negotiations can be divided into four types according to "the target (whether it is listed on the insurance benefit list)" and "the purpose (whether the target is price or conditional)." In particular, negotiations on listed drugs, whose goal is to set unfavorable conditions for companies, can be illegal if there is no price. So we need to consider compensation for the company as an incentive to negotiate.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2009.11a
• /
• pp.595-596
• /
• 2009

정보화의 발전에 비례하여 정보보호의 중요성도 높아지고 있다. 최근까지 정보보호에 대한 관심과 주요 연구의 흐름은 기술적인 보호조치(예: 암호화, 접근제어, 방화벽 등)와 관리적 관점의 행동연구였다. 최근에 들어서야 국내외적으로 정보보호 투자효과에 대한 연구가 활성화되기 시작했다. 정보보호 투자효과에 대한 계량적 산정이 필요한 이유는 정보보호의 중요성을 정확하게 인식할 수 있어 적정규모의 예산을 책정하고 효율적으로 예산을 투입할 수 있는 기초를 마련할 수 있기 때문이다. 정보보호 투자효과를 측정하기 위한 선행연구로 보안사고의 피해규모를 산정하는 연구가 필수적이다. 보안사고의 피해규모는 가시적 손실(피해복구, 생산성 저하, 손해배상 등)과, 비가시적 손실(고객 충성도 저하, 회사의 브랜드 이미지 하락 등) 규모의 합으로 구성된다. 그 동안 가시적 손실규모 측정에 관한 연구는 상대적으로 많았으나, 비가시적 손실규모 측정에 관한 연구는 상대적으로 미흡하였던 것이 사실이다. 이는 현실적으로 비가시적 손실규모를 측정할 수 있는 접근방법을 고안해내는 것이 어려웠기 때문이다. 이로 인해 막연히 비가시적 손실규모가 가시적 손실규모에 비해 대단히 클 것이라고 짐작해 올 수 밖에 없었다. 본 논문에서는 보안사고의 비가시적 손실규모를 측정하기 위해 대규모 개인정보 보안 사고가 발생한 기업의 매출액 증가율을 경쟁기업과 분석하는 연구방법을 제안한다. 매출액은 영업이익 및 순이익과는 달리 회사 내부적인 회계방침에 의해 규모의 조절이 불가능한 재무요소이면서 회사가 고객 충성도 저하와 회사의 브랜드 이미지 하락으로 인해 받게 되는 영향을 가장 정확하게 반영하는 재무요소이기도 하다. 연구방법에 따라 2008년 대규모 개인정보 보안사고가 발생한 국내기업을 선정하고 그 경쟁사와 매출액 변화추이를 비교 분석하였다. 분석결과 보안사고가 발생한 기업의 평균 매출액 증가율이 경쟁사 평균 매출액 증가율 보다 0.0225% 높다는 사실을 발견했다. 이 결과는 국내의 보안 사고가 기업 가치에 미치는 비가시적 영향이 거의 없거나 또는 발생하더라도 그 영향력이 미미하여 가격정책 및 광고 홍보를 통해 충분히 극복할 수 있다는 점을 대변한다. 본 논문의 결과는 역설적으로 국내 보안사고의 피해규모를 측정하는데 있어 가시적 손실규모의 정확한 측정이 무엇보다 중요함을 의미한다.

• Korea Trade Review
• /
• v.42 no.1
• /
• pp.69-97
• /
• 2017

This study purpose to examine the importer's risks that may arise from origin investigation by Customs authorities. We have drawn the important factors affecting the application of FTA preferential tariffs and divided the stages from the conclusion of the contract for the importer to the undergoing origin investigation. In addition, we demonstrate empirically that the risks that arise in areas where importers are difficult to control exist. As a management method of the uncontrollable risk from the importer, we have provided the methods that the seller stipulated the seller's responsibility in the trade contract, prepared for situations in which no one was responsible, and formulated a friendly and cooperative supply chain. Even if the seller's liability is clarified in the contract for sale, the risk of the investigation into the origin of the imported goods is not completely eliminated. This is because, under the current agreement and system, there is no way for the customs authority of the contracting party of the FTA to claim compensation for damages incurred by importers due to breach of agreement such as not returning the result of the origin verification. Importers are subject to customs duties, but there may actually be situations in which no one is responsible for them.

• Convergence Security Journal
• /
• v.22 no.1
• /
• pp.93-98
• /
• 2022

Information service technology continues to develop, and information service continues to expand based on the IT convergence trend. The premeter-based security model chosen by many organizations can increase the effectiveness of security technologies. However, in the premeter-based security model, it is very difficult to deny security threats that occur from within. To solve this problem, a zero trust model has been proposed. The zero trust model requires authentication for user and terminal environments, device security environment verification, and real-time monitoring and control functions. The operating environment of the information service may vary. Information security management should be able to response effectively when security threats occur in various systems at the same time. In this study, we proposed a security policy distribution system in the object reference method that can effectively distribute security policies to many systems. It was confirmed that the object reference type security policy distribution system proposed in this study can support all of the operating environments of the system constituting the information service. Since the policy distribution performance was confirmed to be similar to that of other security systems, it was verified that it was sufficiently effective. However, since this study assumed that the security threat target was predefined, additional research is needed on the identification method of the breach target for each security threat.

• Information Systems Review
• /
• v.20 no.1
• /
• pp.159-177
• /
• 2018

With an extensive proliferation of information and communication technology, the volume and amount of digital information collected and utilized on the Internet have been increasing rapidly. Also on the rapid rise are side effects such as unintended breach of accumulated personal information and consequent invasion of personal privacy. Informational self-determination is rarely practiced, despite various states' legal efforts to redress data subjects' damage. Personal health information, in particular, is a subcategory of personal information where informational self-determination is hardly practiced enough. The observation is contrasted with the socio-economic inconvenience that may follow due to its sensitive nature containing individuals' physical and health conditions. This research, therefore, reviews factors of self-determination on personal health information while referring to the protection motivation theory (PMT), the long-time framework to understand personal information protection. Empirical analysis of 200 data surveyed reveals threat-appraisal (perceived vulnerability and perceived severity of threats) and coping-appraisal (perceived response effectiveness), in addition to individual levels of concern regarding provided personal health information, influence self-determination to protect personal health information. The research proposes theoretical findings and practical suggestions along with reference for future research topics.

• Informatization Policy
• /
• v.31 no.2
• /
• pp.82-104
• /
• 2024

Smart home services are growing rapidly as the development of the Internet of Things (IoT) opens the era of the so-called "Connected Living." Although personal information leaks through smart home cameras are increasing, however, users-while concerned-tend to take passive measures to protect their personal information. This study theoretically explained and verified how to design effective software update notification messages for smart home cameras to ensure that users comply with the recommended security behavior (i.e., update installation). In a survey experiment participated in by 120 actual users, the effectiveness of both emotional appeals (i.e., security breach warning images for fear appeals) and rational appeals (i.e., loss-framed messages emphasizing the negative consequences of not installing the updates) were confirmed. The results of this study provide theoretical interpretations and practical guidelines on the message design features that are effective for threat appraisals (i.e., severity, vulnerability) of smart home camera users and their protection motivation.

• THE INTERNATIONAL COMMERCE & LAW REVIEW
• /
• v.38
• /
• pp.181-226
• /
• 2008

The purpose of this paper is to describe the settling procedures of the investor-state disputes in the FTA Investment Chapter, and to research on the international arbitration system for the settlement of the investor-state disputes under the ICSID Convention and UNCITRAL Arbitration Rules. The UNCTAD reports that the cumulative number of arbitration cases for the investor-state dispute settlement is 290 cases by March 2008. 182 cases of them have been brought before the ICSID, and 80 cases of them have been submitted under the UNCITRAL Arbitration Rules. The ICSID reports that the cumulative 263 cases of investor-state dispute settlement have been brought before the ICSID by March 2008. 136 cases of them have been concluded, but 127 cases of them have been pending up to now. The Chapter 11 Section B of the Korea-U.S. FTA provides for the Investor_State Dispute Settlement. Under the provisions of Section B, the claimant may submit to arbitration a claim that the respondent has breached and obligation under Section A, an investment authorization or an investment agreement and that the claimant has incurred loss or damage by reason of that breach. Provided that six months have elapsed since the events giving rise to the claim, a claimant may submit a claim referred to under the ICSID Convention and the ICSID Rules of Procedure for Arbitration Proceedings; under the ICSID Additional Facility Rules; or under the UNCITRAL Arbitration Rules. The ICSID Convention provides for the jurisdiction of the ICSID(Chapter 2), arbitration(Chapter 3), and replacement and disqualification of arbitrators(Chapter 5) as follows. The jurisdiction of the ICSID shall extend to any legal dispute arising directly out of an investment, between a Contracting State and a national of another Contracting State, which the parties to the dispute consent in writing to submit to the ICSID. Any Contracting State or any national of a Contracting State wishing to institute arbitration proceedings shall address a request to that effect in writing to the Secretary General who shall send a copy of the request to the other party. The tribunal shall consist of a sole arbitrator or any uneven number of arbitrators appointed as the parties shall agree. The tribunal shall be the judge of its own competence. The tribunal shall decide a dispute in accordance with such rules of law as may be agreed by the parties. Any arbitration proceeding shall be conducted in accordance with the provisions of the Convention Section 3 and in accordance with the Arbitration Rules in effect on the date on which the parties consented to arbitration. The award of the tribunal shall be in writing and shall be signed by members of the tribunal who voted for it. The award shall deal with every question submitted to the tribunal, and shall state the reason upon which it is based. Either party may request annulment of the award by an application in writing addressed to the Secretary General on one or more of the grounds under Article 52 of the ICSID Convention. The award shall be binding on the parties and shall not be subject to any appeal or to any other remedy except those provided for in this Convention. Each Contracting State shall recognize an award rendered pursuant to this convention as binding and enforce the pecuniary obligations imposed by that award within its territories as if it were a final judgment of a court in that State. In conclusion, there may be some issues on the international arbitration for the settlement of the investor-state disputes: for example, abuse of litigation, lack of an appeals process, and problem of transparency. Therefore, there have been active discussions to address such issues by the ICSID and UNCITRAL up to now.