• Title/Summary/Keyword: Certification of information Security Services

Search Result 70, Processing Time 0.028 seconds

Extended 3-Party Mutual Authentication Protocols for the Virtual Home Environment in Next Generation Mobile Networks (차세대 이동통신 네트워크의 Virtual Home Environment 구조에 적용 가능한 3자간 상호 인증 프로토콜)

  • Jeong, Jong-Min;Lee, Goo-Yeon;Lee, Yong
    • Journal of the Institute of Electronics Engineers of Korea TC
    • /
    • v.40 no.4
    • /
    • pp.22-29
    • /
    • 2003
  • In the virtual home environment (VHE), which was proposed to offer global roaming and personal service environment portability, user's profiles and service logics are conveyed from home network to visited network to provide services at the visited network. Because user's profiles and service logics may contain confidential information, some procedures for mutual authentication among entities for offering confidence are needed. For these issues, we propose and analyze three 3-Party mutual authentication Protocols adaptable to the VHE in 3G ; password based mutual authentication protocol, mutual authentication protocol with CHAP and key exchange and mutual authentication protocol with trusted third party.

A Study on ISMS-P Controls for Hyper Scale Cloud (하이퍼 스케일 클라우드에 적합한 정보보호 및 개인정보보호 관리체계 인증 통제항목 연구)

  • Yong-Nyuo Shin
    • The Journal of the Institute of Internet, Broadcasting and Communication
    • /
    • v.23 no.3
    • /
    • pp.19-26
    • /
    • 2023
  • Critical information infrastructure designations for cloud service providers continue to spread around the world as energy, financial services, health, telecommunications, and transportation sectors move to the cloud. In addition, in the case of Ukraine, the removal of restrictions on the use of cloud for national critical facilities and the rapid transition of critical data to the cloud enabled the country to effectively respond to cyberattacks targeting Russian infrastructure. In Korea, the ISMS-P is operated to implement a systematic and comprehensive information protection management system and to improve the level of information protection and personal information protection management in organizations. Control items considering the cloud environment have been modified and added to the audit of companies. However, due to the different technical levels of clouds between domestic and global, it is not easy to obtain information on the findings of cloud providers such as Microsoft for the training of domestic certification auditors on hyperscale scale. Therefore, this paper analyzes findings in hyperscale clouds and suggests ways to improve cloud-specific control items by considering the compatibility of hyperscale environments with ISO/IEC 27001 and SOC(System and Organization Control) security international standards.

A Study on Security Risk according to the activation of Bio-Authentication Technology (바이오 인증 기술의 활성화에 따른 보안 위험성에 관한 연구)

  • Jeon, Jeong Hoon
    • Convergence Security Journal
    • /
    • v.16 no.5
    • /
    • pp.57-63
    • /
    • 2016
  • In recent years, there is growing interest in 'Fin-tech' in the domestic and international financial sector. And a variety of services in such a situation has emerged. To ensure the safety of from hacking attacks, many new technologies have been developed. These leading technology is the Bio-authentication method that you consider applying to the financial sector. Bio authentication is using biometric information. Also it is known that can cope the threat of fabrication and modifying attacks with shared and stored. However, Recently, When you look at hacking incidents of biometric data(560 million cases) in the United States Office of Personnel Management and advent of the fingerprints counterfeit technology, We can be known that should be reconsidered about the safety of bio-certification. Especially, it should be provided with a response measures for the problem of embezzlement that biometric information already been leaked. Thereby In this paper, by investigating biometric technologies and practices applied and of the vulnerability factor in many industries, it expected to be utilized in the prepared threats countermeasures in accordance with the application of the biometric authentication technology in a future.

Review of the suitability to introduce new identity verification means in South Korea : Focused on Block Chain and FIDO (우리나라의 본인확인수단에 관한 신규 인증수단의 도입 적합성 검토 : Block Chain과 FIDO를 중심으로)

  • Shin, Young-Jin
    • Journal of Convergence for Information Technology
    • /
    • v.8 no.5
    • /
    • pp.85-93
    • /
    • 2018
  • This study investigates the suitability of the blockchain and FIDO among non-face-to-face authentication means in order to secure diversity of identfication means operated in South Korea. In order to do this, the study selected and analyzed seven conformance criteria (universality, persistence, uniqueness, convenience, security, applicability, and economics), and the results were appropriate. Accordingly, in order to apply the blockchain and FIDO as the identification means, the related regulations and notices should be revised to improve the identification procedure. In addition, differentiated certification standards should be established for each service field to apply various authentication means as well as existing identification means, and the authentication means should be continuously developed and linked with the service. In the future, the identification means will bring security of the information circulation environment in the IoT, so it should be implemented in a variety of services by supporting application of identification means.

Development of Career Management System with Rewarding Policy Considering the Ethereum Blockchain Performance (이더리움 블록체인의 성능을 고려한 보상정책을 갖는 이력관리 시스템 개발)

  • Jung-Min Hong;Ye-Jin Kim;Yu-Jeong Kim;Hye-Jeong Park;Eun-Seong Kang;Hyung-Jong Kim
    • Journal of the Korea Society for Simulation
    • /
    • v.32 no.4
    • /
    • pp.59-67
    • /
    • 2023
  • Private blockchains can apply enhanced security policies that allow only authorized users to participate in the blockchain network. In addition, when used in a career management system where the validity of an individual's career is important, it has the suitable characteristics in terms of information integrity. However, due to the excessive performance requirements of blockchain technology, identifying performance characteristics through simulation can be helpful in stable operation of the system. This paper presents research results that utilized performance evaluation results while constructing a career management system based on the Ethereum blockchain. The service not only serves as a portfolio that records personal career development activities, certification acquisition, and award results, but also provides a community function for career planning to strengthen employment competitiveness. In addition, we present how a compensation policy can be executed to encourage users to participate in career development through community activities. In particular, an appropriate compensation policy was derived by reviewing changes in performance characteristics in accordance with the transaction volume on Geth nodes.

A Study on the Practice Model for Practical Education for Health and Medical Information Management (보건의료정보관리 실습교육을 위한 실습모델 연구)

  • Choi, Joon-Young
    • Journal of the Health Care and Life Science
    • /
    • v.8 no.2
    • /
    • pp.83-93
    • /
    • 2020
  • In this study, a practical model for health information management education using the EMR education system at universities for nurturing health care information managers was studied. Currently, there is no practical training course for health care information management in the standards for evaluation and certification of health care information management education introduced to strengthen the job competency of health care information managers. Accordingly, the program was constructed so that the practice program suggested as an educational environment in the Health and Medical Information Management Education Evaluation and Certification Manual can be practiced in the EMR education system. In addition, a practical model that can be performed according to the on-site practice guidelines for health and medical information management for each program was studied. Using the health care information management education EMR system, master data management, patient registration, doctor prescription, medical cost calculation, health insurance claim management, form management, discharge registration, cancer registration, unrecorded management, health care data management, health care statistics, A practice model was studied so that practice on information protection/security management can be performed. It will be possible to play a role as a health care information management expert by raising the quality level of health care information management education through systematic and standardized health care information management practice courses at universities. Accordingly, it is necessary to cultivate health care information management experts who develop and manage medical services based on medical data analysis through practical training of health care information managers.

Medical Information Dynamic Access System in Smart Mobile Environments (스마트 모바일 환경에서 의료정보 동적접근 시스템)

  • Jeong, Chang Won;Kim, Woo Hong;Yoon, Kwon Ha;Joo, Su Chong
    • Journal of Internet Computing and Services
    • /
    • v.16 no.1
    • /
    • pp.47-55
    • /
    • 2015
  • Recently, the environment of a hospital information system is a trend to combine various SMART technologies. Accordingly, various smart devices, such as a smart phone, Tablet PC is utilized in the medical information system. Also, these environments consist of various applications executing on heterogeneous sensors, devices, systems and networks. In these hospital information system environment, applying a security service by traditional access control method cause a problems. Most of the existing security system uses the access control list structure. It is only permitted access defined by an access control matrix such as client name, service object method name. The major problem with the static approach cannot quickly adapt to changed situations. Hence, we needs to new security mechanisms which provides more flexible and can be easily adapted to various environments with very different security requirements. In addition, for addressing the changing of service medical treatment of the patient, the researching is needed. In this paper, we suggest a dynamic approach to medical information systems in smart mobile environments. We focus on how to access medical information systems according to dynamic access control methods based on the existence of the hospital's information system environments. The physical environments consist of a mobile x-ray imaging devices, dedicated mobile/general smart devices, PACS, EMR server and authorization server. The software environment was developed based on the .Net Framework for synchronization and monitoring services based on mobile X-ray imaging equipment Windows7 OS. And dedicated a smart device application, we implemented a dynamic access services through JSP and Java SDK is based on the Android OS. PACS and mobile X-ray image devices in hospital, medical information between the dedicated smart devices are based on the DICOM medical image standard information. In addition, EMR information is based on H7. In order to providing dynamic access control service, we classify the context of the patients according to conditions of bio-information such as oxygen saturation, heart rate, BP and body temperature etc. It shows event trace diagrams which divided into two parts like general situation, emergency situation. And, we designed the dynamic approach of the medical care information by authentication method. The authentication Information are contained ID/PWD, the roles, position and working hours, emergency certification codes for emergency patients. General situations of dynamic access control method may have access to medical information by the value of the authentication information. In the case of an emergency, was to have access to medical information by an emergency code, without the authentication information. And, we constructed the medical information integration database scheme that is consist medical information, patient, medical staff and medical image information according to medical information standards.y Finally, we show the usefulness of the dynamic access application service based on the smart devices for execution results of the proposed system according to patient contexts such as general and emergency situation. Especially, the proposed systems are providing effective medical information services with smart devices in emergency situation by dynamic access control methods. As results, we expect the proposed systems to be useful for u-hospital information systems and services.

Development of EDI Model in the Port and Logistics Industries (항만물류산업에서 업체별 EDI 활성화 모형개발)

  • Shin, Chang-Hoon;Kim, Yul-Sung;Song, Jae-Young
    • Proceedings of the Korean Institute of Navigation and Port Research Conference
    • /
    • v.29 no.1
    • /
    • pp.369-375
    • /
    • 2005
  • The rapid growth of economy in china leads to concentrate throughput volume of World to North East Asia. Ports in North East Asia have to cope with rapid changes in environments. In order for a port to compete in the global market, it must provide proper productivity and promptly services of port. The system of information hold a key in port-logistic industries. Most ports make every effort to set up and operate the system of Information. Busan port already set up the system of port-logistic information such as Port-Mis, KROIS. But it is not activate yet because of problems of security and certification and so on. The purpose of this paper is to make Model which can activate the system of port-logistic information. In addition to, We suggest definite and feasible model by group and types of port-logistic industry.

  • PDF

A Design of Secure Communication for Device Management Based on IoT (사물인터넷 기반 디바이스 관리를 위한 안전한 통신 프로토콜 설계)

  • Park, Jung-Oh;Choi, Do-Hyeon;Hong, Chan-Ki
    • Journal of Convergence for Information Technology
    • /
    • v.10 no.11
    • /
    • pp.55-63
    • /
    • 2020
  • The IoT technology is a field that applies and converges the technologies in the existing industrial environment, instead of new technologies. The IoT technology is releasing various application services converged with other industries such as smart home, healthcare, construction, and automobile, and it is also possible to secure the work efficiency and convenience of users of IoT-based technologies. However, the security threats occurring in the IoT-based technology environment are succeeding to the vulnerability of the existing wireless network environment. And the occurrence of new and variant attacks in the combination with the ICT convergence environment, is causing damages. Thus, in the IoT technology-based environment, it would be necessary to have researches on the safe transmission of messages in the communication environment between user and device, and device and device. This thesis aims to design a safe communication protocol in the IoT-based technology environment. Regarding the suggested communication protocol, this thesis performed the safety analysis on the attack techniques occurring in the IoT technology-based environment. And through the performance evaluation of the existing PKI-based certificate issuance system and the suggested communication protocol, this thesis verified the high efficiency(about 23%) of communication procedure. Also, this thesis verified the reduced figure(about 65%) of the issued quantity of certificate compared to the existing issuance system and the certificate management technique.

Key-pair(Public key, Private key) conflict analysis using OpenSSL (OpenSSL을 이용한 키쌍(공개키·개인키) 충돌율 분석)

  • Lee, Kwang-Hyoung;Park, Jeong-Hyo;Jun, Moon-Seog
    • Journal of the Korea Academia-Industrial cooperation Society
    • /
    • v.15 no.8
    • /
    • pp.5294-5302
    • /
    • 2014
  • The development of public-key-based technique that enables a variety of services(E-government, e-banking, e-payment, etc.) evaluated as having complete safety. On the other hand, vulnerabilities(e.g, heartbleed bug, etc.) are constantly being discovered. In this paper, a public key infrastructure to verify the safety and reliability, the collision rate using OpenSSL key pair was analyzed. the experiment was performed using the following procedure. Openssl was used to create five private certification agencies, and each of the private certificate authority certificates to create 2 million, generating a total of 10 million by the certificate of the key pair conflicts analysis. The results revealed 35,000 in 1 million, 0.35% chance of a public key, a private key conflict occurred. This is sufficient in various fields(E-payment, Security Server, etc.). A future public-key-based technique to remove the threat of a random number generator, large minority issues, in-depth study of selection will be needed.