• Journal of Korea Multimedia Society
• /
• v.8 no.11
• /
• pp.1520-1530
• /
• 2005

As XML is recognized as a prevalent standard for document representation and exchange in the Internet, the need for security of XML becomes very important issue. Until now researches on XML security have been focused on confidentiality or integrity like encryption and digital signature technology. But, as XML data becomes more massive and complicated, it requires managerial security that decided access permit or deny by the authority oi user who is using the XML data. Thus it requires models and mechanisms enabling the specification and enforcement of access control policies for XML documents. In this paper, we suggest the new access control model and mechanism that separate XML documents by access level, assign roles to each user by applying Role Based Access Control (RBAC) and perform access control to specific documents by encrypting each section with roles. The method, we suggested, has an advantage that it does not need to update the whole keys used in encryption process by updating only the relations between appropriate secure layers.

• The Journal of the Korea Contents Association
• /
• v.20 no.7
• /
• pp.618-628
• /
• 2020

The purpose of this paper is to propose a new security orchestration service model by combining various security solutions that have been introduced and operated individually as a basis for cyber security framework. At present, in order to respond to various and intelligent cyber attacks, various single security devices and SIEM and AI solutions that integrate and manage them have been built. In addition, a cyber security framework and a security control center were opened for systematic prevention and response. However, due to the document-oriented cybersecurity framework and limited security personnel, the reality is that it is difficult to escape from the control form of fragmentary infringement response of important detection events of TMS / IPS. To improve these problems, based on the model of this paper, select the targets to be protected through work characteristics and vulnerable asset identification, and then collect logs with SIEM. Based on asset information, we established proactive methods and three detection strategies through threat information. AI and SIEM are used to quickly determine whether an attack has occurred, and an automatic blocking function is linked to the firewall and IPS. In addition, through the automatic learning of TMS / IPS detection events through machine learning supervised learning, we improved the efficiency of control work and established a threat hunting work system centered on big data analysis through machine learning unsupervised learning results.

• 제어로봇시스템학회:학술대회논문집
• /
• 2004.08a
• /
• pp.1350-1354
• /
• 2004

This paper proposes a simple but practically useful model for preventing fraud of users called "ERBAC03". The new model consists of qualified mandatory and discretionary features for roles and locations, including the assignment of permissions for the appropriate roles and the assignment of roles for the appropriate locations. Moreover, a static separation of duty (SSoD) principle is applied to the new model for integrity requirements of security systems. The paper also explores some extensions of ERBAC03 including the new model using the SSoD concept from some experiments. The experimental results prove the efficiency improvement of the proposed model that can make benefits for large enterprises.

• Journal of KIISE:Databases
• /
• v.35 no.1
• /
• pp.29-43
• /
• 2008

Although RDF ontologies might be expressed in XML tree model, existing methods for protection of XML documents are not suitable for securing RDF ontologies. The graph style and inference feature of RDF demands a new security model development. Driven by this goal, this paper proposes a new query-oriented model for the RDF ontology access control. The proposed model rewrites a user query using a three-layered ontology view. The proposal resolves the problem that the existing approaches should generate inference models depending on inference rules. Accessible ontology concepts and instances which a user can visit are defined as ontology views, and the inference view defined for controling an inference query enables a controlled inference capability for the user. This paper defines the three-layered view and describes algorithms for query rewriting according to the views. An implemented prototype with its system architecture is shown. Finally, the experiment and comparative evaluation result of the proposal and the previous approach is described.

• Convergence Security Journal
• /
• v.5 no.1
• /
• pp.1-9
• /
• 2005

XML is the most common tool for data processing and data transmission in web applications. Policies are extensively used in all online business solutions and it is recognized that abinary decision such as 'yes/no' for access requests is not enough. In this paper, a method is developed to convert policy rules with provisions and obligations in logic formula formats into XML formats. The primary purpose is to enable security policy programmers to write flexible authorization policies in XML and to implement them easily. General syntaxes are defined to specify information for users, objects and actions in XML formats and an XML DTD is developed to specify authorization rules with these three components. To support various security features such as data transcoding and non-repudiation depending on data in addition to access control based on authorization policies, studies for specifying them in XML policy rules will be performed in the future.

• Convergence Security Journal
• /
• v.23 no.2
• /
• pp.103-113
• /
• 2023

In recent years, Unmanned Aerial Vehicles (UAV) have been widely used in various industries. However, as the depend ence on UAV increases rapidly, concerns about the security and safety of UAV are growing. Currently, various vulnerabili ties such as stealing the control right of the UAV or the right to communicate with the UAV in the web application are being disclosed. However, there is a lack of research related to the security of UAV. Therefore, in this paper, a study was conducted to determine whether the packet data was normal or abnormal by collecting packet data of an unmanned aerial vehicle in a HITL(Hardware In The Loop) simulation environment similar to the real environment. In addition, this paper proposes a method for reducing computational cost in the modeling process and increasing the ease of data interpretation, a machine learning-based anomaly detection model that detects abnormal data by learning only normal data, and optimized hyperparameter values.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.22 no.1
• /
• pp.155-167
• /
• 2012

Cloud computing service is a next generation IT service which has pay-per-use billing model and supports elastically provisioning IT infra according to user demand. However it has many potential threats originating from outsourcing/supporting service structure that customers 'outsource' their own data and provider 'supports' infra, platform, application services, the complexity of applied technology, resource sharing and compliance with a law, etc. In activation of Cloud service, we need objective assessment standard to ensure safety and reliability which is one of the biggest obstacles to adopt cloud service. So far information security management system has been used as a security standard for a security management and IT operation within an organization. As for Cloud computing service it needs new security management and assessment different from those of the existing in-house IT environment. In this paper, to make a Information Security Management System considering cloud characteristics key components from threat management system are drawn and all control domain of existing information security management system as a control components are included. Especially we designed service security management to support service usage in an on-line self service environment and service contract and business status.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.27 no.2
• /
• pp.181-192
• /
• 2017

Internet of Things includes the whole process of collected information generated from a variety of objects, as well as analyzing and sharing it, and providing useful information services to people. This study seeks ways to improve security and safety in the areas of service security technology, ID management technology and service access control, all of which take place in the IoT environment. We have implemented the services that can design and issue C&C (Certificate and Capability) service token authentication, which is based on a public key, to improve the service security. In addition, we suggest LCRS (Left Child-Right Sibling) resource model management for the efficient control of resources when generating the resource services from the data collected from node devices. We also implemented an IoT services platform to manage URL security of the resource services and perform access control for services.

• Journal of Internet Computing and Services
• /
• v.17 no.5
• /
• pp.131-139
• /
• 2016

This paper presents a workflow validation method for data-intensive graphical workflow models using real-time workflow tracing mode on data-intensive workflow designer. In order to model and validate workflows, we try to divide as modes have editable mode and tracing mode on data-intensive workflow designer. We could design data-intensive workflow using drag and drop in editable-mode, otherwise we could not design but view and trace workflow model in tracing mode. We would like to focus on tracing-mode for workflow validation, and describe how to use workflow tracing on data-intensive workflow model designer. Especially, it is support data centered operation about control logics and exchange variables on workflow runtime for workflow tracing.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.5 no.1
• /
• pp.51-64
• /
• 1995

In distributed environments, the DB secure models have been being studied to include the multi-level mechanism which is effective to control access according to the level of the data value. These mechanisms have the problems. The first, it is impossible to maintain the global data which is protected in the multi-level mechanism. The second, the access and the relation of the data is not clear due to the access revocation between the local data and the global's. In this paper, we proposed the mechanism using shema. The mechanism doesn't have the access revocation, and provides the protection of the data and the control to the global data.