• KIPS Transactions on Computer and Communication Systems
• /
• v.4 no.3
• /
• pp.97-104
• /
• 2015

This paper will feature designs for security vulnerability based on MS-SQL Database and OLE connectivity by checking the MS-SQL database password policy, the user account password access attempts, a user without password, and password does not be changed for a period of time. This paper uses the MS-SQL database and C++ linkage in order to use the OLE DB function. The design module should judge presence or absence of security vulnerability by checking database password policy, the user account password access attempts, a user without password, password does not be changed for a period of time. The MS-SQL database password associated with a feature, judging from the many features allows you to check for security vulnerability. This paper strengthen the security of the MS-SQL database by taking the advantage of the proposed ability.

• Journal of the Korea Society for Simulation
• /
• v.17 no.3
• /
• pp.53-62
• /
• 2008

This paper proposes a new implementational model based on the security model of Oracle for Web ontology. Recently, several access control models using relational database security model for access control to Web ontology have been developing, and one of the most representative access control model is the RAC model. However, the RAC model is based on the standard security model, and thus it does not provide a implementational model for practical relational database management systems. In this paper, we propose an implementational model based on Oracle which is widely used and providing various security policies. This paper shows the implementation and experimental evaluation. Especially, the proposed model uses the VPD security model of Oracle and support high application and usability.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2011.04a
• /
• pp.990-992
• /
• 2011

In this paper, we introduce a new Tabu method to get K-anonymity character in database information privacy protection. We use the conception of lattice to form the solution space for K-anonymity Character and search the solution area in this solution space to achieve the best or best approach modification solution for the information in the database. We then compared the Tabu method with other traditional heuristic method and our method show a better solution in most of the cases.

• Journal of KIISE:Databases
• /
• v.35 no.2
• /
• pp.155-168
• /
• 2008

This paper proposes a relational security model-based RDF Web ontology access control model. The Semantic Web is recognized as a next generation Web and RDF is a Web ontology description language to realize the Semantic Web. Much effort has been on the RDF and most research has been focused on the editor, storage, and inference engine. However, little attention has been given to the security issue, which is one of the most important requirements for information systems. Even though several researches on the RDF ontology security have been proposed, they have overhead to load all relevant data to memory and neglect the situation that most ontology storages are being developed based on relational database. This paper proposes a novel RDF Web ontology security model based on relational database to resolve the issues. The proposed security model provides high practicality and usability, and also we can easily make it stable owing to the stability of the relational database security model.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.21 no.3
• /
• pp.143-154
• /
• 2011

SQLite is a small sized database engine largely used in embedded devices and local application software. The availability of portable devices, such as smartphones, has been extended over the recent years and has contributed to growing adaptation of SQLite. This implies a high likelihood of digital evidences acquired during forensic investigations to include SQLite database files. Where intentional deletion of sensitive data can be made by a suspect, forensic investigators need to recover deleted records in SQLite at the best possible. This study analyzes data management rules used by SQLite and the structure of deleted data in the system, and in turn suggests a recovery Tool of deleted data. Further, the study examines major SQLite suited software as it validates feasible possibility of deleted data recovery.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.24 no.4
• /
• pp.739-751
• /
• 2014

We are using our smartphone for our business as well as ours lives. Thus, user's privacy data and a company secret are stored at smartphone. By the way, the saved data on smartphone database can be exposed to a malicous attacker when a malicous app is installed in the smartphone or a user lose his/her smartphone because all data are stored as form of plaintext in the database. To prevent this disclosure of personal information, we need a database encryption method. However, if a database is encrypted, it causes of declining the performance. For example, when we search specific data in condition with encrypted database, we should decrypt all data stored in the database or search sequentially the data we want with accompanying overhead[1]. In this paper, we propose an efficient and searchable encryption method using variable length bloom filter under limited resource circumstances(e.g., a smartphone). We compare with existing searchable symmetric encryption. Also, we implemented the proposed method in android smartphone and evaluated the performance the proposed method. As a result through the implementation, We can confirm that our method has over a 50% improvement in the search speed compared to the simple search method about encrypted database and has over a 70% space saving compared to the method of fixed length bloom filter with the same false positive rate.

• Journal of the Korea Society of Computer and Information
• /
• v.19 no.12
• /
• pp.143-152
• /
• 2014

This paper introduces Database security to prevent the rapidly increasing issue of private information leakage. The Database security examined in the paper separates into DB access control area and DB encryption area which further leads the paper to analyze the factors of the two areas and suggest necessary elements for creating stable Database security. In addition, the paper examines previous DB security programs by areas and analyzes pros and cons from the tested result. The experiment indicated that while DB access control presents less degradation and reduced the need to modify the existing DBMS since the access control operates at the end point of the network, DB encryption presented strength in protecting the data from unauthorized access. On the other hand, DB access control is less useful in preventing the attack in advance which leaves the log to enable tracking afterward while DB encryption can only be operated by limited types of Database and causes degradation due to system load and shows higher percentage of failure when creating the system. This paper examines characteristics of Database security areas in order to be used as a reference for institutions or companies seeking stable Database security.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.9 no.8
• /
• pp.1834-1839
• /
• 2005

Database security is essential to protect their data in most organization such as hospitals, central or local governments, banks which manage the private, sensitive and important data. Because the duty of the department recently became more various and complicated, the changes of security requirement are needed more frequently. Therefore, easily changeable, flexible security policy and efficient security management with preserving the integrity of security policy are very important. In this paper, we implemented a flexible database security system in the specimen and clinical information management system of leukemic research center using IRH(Improved Role Hierarchy). Data is protected by MAC and we propose a flexible access control and effective administration by using the IRH that is an improved role hierarchy of RBAC. If security policy is needed for changes, this system can do it easily by simply modifying the IRH with the decentralized administration. The modified security policy can be applied flexibly after alteration because the security level of the subject is not fixed but can be derived automatically from the IRH when user connects the system.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.24 no.1
• /
• pp.123-134
• /
• 2014

As the data gets bigger recently, the demand for relational database management system (RDBMS) and NoSQL DBMS to process big data has been increased consistently. The digital forensic investigation method for RDBMS has been studied actively, but that for NoSQL DBMS, which is popularly used nowadays, has almost no research. This paper proposes the digital forensic investigation process and method for MongoDB, the most popularly used among NoSQL DBMS.

• Journal of the Korea Society of Computer and Information
• /
• v.6 no.2
• /
• pp.1-7
• /
• 2001

The database development is in need or transaction management composed of operations about data, efficiency database management and security of information data in necessity of as well as the new thinking about data security. When users approach data, transaction concurrency is controlled by the users security authentication and security level of data. So, existing secure algorithm occurred the problems which don't satisfy serializability of high level transaction which is delayed high level transaction repeatedly by the low level transaction, because existing secure algorithm is focused on the part which removes the security channel. Therefore this proposed algorithm which prevents waste of resource from the high level transaction reexecution and delay by stopping serializability offense problem by the increase of efficiency of concurrency control.