• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.3
• /
• pp.527-535
• /
• 2023

To develop experts capable of responding to cyber security incidents, numerous institutions have established cyber training facilities to cultivate security professionals equipped with effective defense strategies. However, these challenges such as limited resources, scenario-based content development, and cost constraints. To address these issues, this paper proposes a virtual infrastructure variation generation framework. It provides customized, diverse IT infrastructure environments for each organization, allowing cyber defense trainers to accumulate a wide range of experiences. By leveraging Infrastructure-as-Code (IaC) containers and employing Word2Vec, a natural language processing model, mutable code elements are extracted and trained, enabling the generation of new code and presenting novel container environments.

• The Journal of the Korea Contents Association
• /
• v.17 no.7
• /
• pp.276-282
• /
• 2017

Password-based authentication is vulnerable because of its low cost and convenience, but it is still widely used. In order to increase the security of the password-based user authentication method, the password is changed frequently, and it is recommended to use a combination of numbers, alphabets and special characters when generating the password. However, it is difficult for users to remember passwords that are difficult to create and it is not easy to change passwords periodically. Therefore, in this paper, we implemented a user authentication system that does not require a password by using the USB memory that is commonly used. Authentication data used for authentication is protected by USB data stored in USB memory using USB device information to improve security. Also, the authentication data is one-time and reusable.Based on this, it is possible to have the same security as the password authentication system and the security level such as certificate or fingerprint recognition.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.32 no.2
• /
• pp.213-225
• /
• 2022

Containerization, a lightweight virtualization technology, enables agile deployments of enterprise-scale microservices in modern cloud environments. However, containerization also opens a new window for adversaries who aim to disrupt the cloud environments. Since microservices are composed of multiple containers connected through a virtual network, a single compromised container can carry out network-level attacks to hijack its neighboring containers. While existing solutions protect containers against such attacks by using network access controls, they still have severe limitations in terms of performance. More specifically, they significantly degrade network performance when processing packet payloads for L7 access controls (e.g., HTTP). To address this problem, we present BPFast, an eBPF/XDP-based payload inspection system for containers. BPFast inspects headers and payloads of packets at a kernel-level without any user-level components. We evaluate a prototype of BPFast on a Kubernetes environment. Our results show that BPFast outperforms state-of-the-art solutions by up to 7x in network latency and throughput.

• Convergence Security Journal
• /
• v.19 no.3
• /
• pp.21-28
• /
• 2019

As the number of websites managed by organizations or organizations increases, so does the number of web application servers and containers. In checking the status of the web service of the web application server and the container, it is very difficult for the person to check the status of the web service after accessing the physical server at the remote site through the terminal or using other accessible software It. Previous research on crawler-related research is hard to find any reference to the processing of data from crawling. Data loss occurs when the crawler accesses the database and stores the data. In this paper, we propose a method to store the inspection data according to crawl - based web application server management without losing data.

• Proceedings of the Korean Institute of Navigation and Port Research Conference
• /
• 2023.11a
• /
• pp.230-231
• /
• 2023

This study proposes a deep reinforcement learning-based algorithm to automatically generate a ship's passage plan. First, Busan Port and Gwangyang Port were selected as target areas, and a container ship with a draft of 16m was designated as the target vessel. The experimental results showed that the ship's passage plan generated using deep reinforcement learning was more efficient than the Q-learning-based algorithm used in previous research. This algorithm presents a method to generate a ship's passage plan automatically and can contribute to improving maritime safety and efficiency.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.25 no.10
• /
• pp.1397-1402
• /
• 2021

The overlay2 file system is one of the union file systems that mounts multiple directories into one. The source directory used for this overlay2 file system mount has a characteristic that it operates independently of the write-able layer after mounting, so it is often used for container platforms for application delivery. However, the overlay2 file system has a security vulnerability that the write-able layer is also modified when file in the source directory is modified. In this study, I proposed the overlay2 file system protection technology to remove the security vulnerabilities of the overlay2 file system. As a result of empirically implementing the proposed overlay2 file system protection technology and verifying the function, the protection technology proposed in this study was verified to be effective. However, since the method proposed in this study is a passive protection method, a follow-up study is needed to automatically protect it at the operating system level.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.4
• /
• pp.661-670
• /
• 2023

With the emergence of serverless computing paradigm and the innovations of cloud technology, the structure of backend server infrastructure has evolved from on-premises to container-based serverless computing. However, an access control on the server still heavily relies on the traditional SSH protocol, which poses limitations in terms of security and scalability. This hampers user convenience and productivity in managing server infrastructure. A web shell is an interface that allows easy access to servers and execution of commands from any device with a web browser. While hackers often use it to exploit vulnerabilities in servers, we pay attention to the high portability of web shell technology for server management. This study proposes a novel proxy-based server management framework utilizing web shell technology. Our evaluation demonstrates that the proposed framework addresses the drawbacks of SSH without additional overhead, and efficiently operates large-scale infrastructures in diverse computing environments.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2024.05a
• /
• pp.118-119
• /
• 2024

클라우드 환경에서 컨테이너 사용이 증가하면서 컨테이너 보안의 중요성이 부각되고 있다. 그리고, 이를 위해 다양한 리눅스 보안 프레임워크를 활용한 연구가 활발하게 진행되고 있으며, 특히 LSM-BPF 기술이 기존의 보안 프레임워크 한계를 극복할 수 있는 해법으로 주목받고 있다. 그러나 LSM-BPF 를 활용할 때 발생할 수 있는 시스템 성능 변화에 대한 연구는 아직 미흡한 상태이다. 따라서, 본 논문에서는 LSM-BPF 기반의 보안 솔루션을 모의 구현하고 이를 벤치마크하여 시스템 성능 변화를 측정 및 분석을 진행하였다. 컨테이너 환경에서의 실험 결과, 평균적으로 시스템 성능이 6.6% 감소하는 것을 확인하였다. 하지만, 보안 정책 개수가 증가하여도 추가적인 성능 저하는 발생하지 않음 역시 확인하였다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2024.05a
• /
• pp.108-111
• /
• 2024

클라우드 사용이 보편화 되고 확대됨에 따라, 서비스를 유연하게 확장 및 축소하여 신속하게 시장의 수요에 대응할 수 있는 PaaS(Platform-as-a-Service) 형태의 서비스가 많은 기업에서 각광받고 있다. 그리고 이러한 PaaS 형 서비스의 핵심이 되는 기술인 컨테이너(Container)와 컨테이너 관리를 효율화 해주는 쿠버네티스(Kubernetes)가 실질적인 표준으로 사용되고 있다. 이때 쿠버네티스 기반의 환경에서 서비스 어플리케이션은 다양한 구성사례가 존재하나, DB 는 아직 안정성 및 데이터 정합성 등을 이유로 베어메탈(Baremetal)이나 VM(Virtual Machine)을 기반으로 구성하고 있는 상황이다. 그러나, 인프라 구성 및 운영에 있어서도 파드(Pod) 형태의 DB 구성은 베어메탈 및 VM 대비 장점이 존재한다고 생각하여 본 실험을 수행하였다. 본 논문에서는 서비스 응답시간 및 자원 사용의 효율성 측면에서 VM 기반의 DB 와 쿠버네티스 파드 기반의 DB 에 각각 트래픽을 발생시켜서 비교한 결과와 시사점을 제시한다.

• Journal of the Korea Society of Computer and Information
• /
• v.25 no.10
• /
• pp.77-86
• /
• 2020

In this paper, we propose a technique for blockchain service replication and recovery using kubernetes(BR2K) that robustly executes blockchain services based on replication and supports systematic recovery in case of the service failure. Blockchain services are being developed and applied in various fields such as administration, finance, and medical systems based on the features of blockchain, such as decentralization, high security, and data integrity. In such areas where service continuity is important, it is necessary to provide robustness for execution of blockchain services, and a recovery plan for service failure is also required. To this end, BR2K provides an execution replication technique that systematically supports the sustainable execution of blockchain application services. Also, it introduces a robust container registry based on the blockchain service registry, systematically supporting the recovery of service failures by using it. In addition, Truffle, a blockchain service development framework, is extended to utilize the Kubernetes container management tool, and BR2K provides a technique for rapidly deploying blockchain services using the extended framwork.