• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.10 no.6
• /
• pp.201-208
• /
• 2010

The classical iterated hash function is vulnerable to a multi-collision attack. Gauravaram et al. proposed 3C and 3C+ hash functions, in which an accumulation chain is added to usual Merkle-Damgard changing. Their goal is to design composition schemes resistant to generic attacks of Joux's type, but Joscak and Tuma have shown that 3C and 3C+ schemes are not better than Merkle-Damgard scheme in term of security against multi-collision attacks under some mild assumptions. In this dissertation, in order to increase security of 3C hash function, we proposed secure double pipe hash function which was effectively using XOR and XNOR operations per blocks of message. We seek to improve on the work of Lucks in a way. Proposed secure double pipe hash function takes resistance to multi-block collision, fixed point and pre-image attacks.

• Journal of Korea Multimedia Society
• /
• v.16 no.8
• /
• pp.954-961
• /
• 2013

To enhance the efficiency of network, content-centric networking (CCN), one of future Internet architectures, allows network nodes to temporally cache transmitted contents and then to directly respond to request messages which are relevant to previously cached contents. Also, since CCN uses a hierarchical content-name, not a host identity like source/destination IP address, for request/response packet routing and CCN request message does not include requester's information for privacy protection, contents-providers/ network nodes can not identify practical requesters sending request messages. So to send back relevant contents, network nodes in CCN records both a request message and its incoming interfaces on Pending Interest Table (PIT). Then the devices refer PIT to return back a response message. If PIT is exhausted, the device can not normally handle request/response messages anymore. Hence, it is needed to detect/react attack to exhaust PIT. Hence, in this paper, we propose improved detection/reaction schemes against attacks to exhaust PIT. In practice, for fine-grained control, this proposal is applied to each incoming interface. Also, we propose the message framework to control attack traffic and evaluate the performance of our proposal.

• Journal of Korea Multimedia Society
• /
• v.15 no.2
• /
• pp.226-233
• /
• 2012

Recently, Like we saw with 3.4 DDoS Cyber Terror, a behavior of cyber terror becomes increasingly more complicated, sophisticated and larger, and there has been largely damage on industry, the general economy. For responding cyber terrors which occur in the future, we should recognize security holes of system which isn't exposed yet before attacker in advance as we anticipate and implement new technique of cyber attack which not exist hitherto. We design and implement a new technique of cyber attack; it seems to us that a server denies agent' service by altering value of registry in windows system. Network connections of agent are restricted to the new technique we suggest as the a value of registry is changed to a less value than a necessary value and there has happened packet loss by attacker.

• Journal of Digital Convergence
• /
• v.13 no.2
• /
• pp.177-183
• /
• 2015

Cross Site Scripting enables hackers to steal other user's information (such as cookie, session etc.) or to do abnormal functions automatically using vulnerability of web application. This attack patterns of Cross Site Scripting(XSS) can be divided into two types. One is Reflect XSS which can be executed in one request for HTTP and its reply, and the other is Stored XSS which attacks those many victim users whoever access to the page which accepted the payload transmitted. To correspond to these XSS attacks, some measures have been suggested. They are data validation for user input, output validation during HTML encoding procedures, and removal of possible risk injection point to prevent from trying to insert malicious code into web application. In this paper, the methods and procedures for these two types are explained and a penetration testing is done. With these suggestions, the attack by XSS could be understood and prepared by its countermeasures.

• Proceedings of the Korean Information Science Society Conference
• /
• 2004.10a
• /
• pp.643-645
• /
• 2004

네트워크가 복잡해지면서 다양한 형태의 위험에 노출된다. 일반적인 보안 솔루션으로 사용하는 방화벽(Firewall)이나 침입탐지시스템(IDS)은 허가받지 않은 외부의 접속이나 알려진 공격만을 차단하는 단순하고 수동적인 시스템이다. 이에 반해 허니팟은 웹서버와 같은 실제 Front-End 시스템과 유사하거나, 밀접한 관련을 갖고 직접적으로 반응하므로 신뢰성 높은 실시간 정보를 얻을 수 있어서 관리자가 다양한 위협에 능동적이고 효과적으로 대응할 수 있다. 실제로 웜이나 DRDoS(Distributed Reflection DoS)등 수분만에 네트워크를 점유하는 자동화 공격과 함께 시스템 구성 취약점을 파고들거나 계정 획득을 통한 DB서버 등의 Back-End 시스템에 대한 수동 공격이 혼재한다. 따라서 시스템 전반적인 관리의 중요성이 강조되고 있다. 본 논문에서는 그간의 실험결과를 바탕으로 가상 머신으로 허니팟을 구성하고 특성별로 포트를 분리하여 관리하는 허니넷을 제안하고자 한다 이를 통해 1) 유연한 보안 시스템 구성이 가능하고 2) 관리 효율이 높아지며 3) 하드웨어 도입 비용 절감을 통해 시스템의 TCO(Totai Cost of Ownership)를 감소시키는 효과를 기대할 수 있다.

• Korea Information Processing Society Review
• /
• v.10 no.2
• /
• pp.58-63
• /
• 2003

본 고에서는 1.25 인터넷 대란과 같은 버퍼오버플로우를 이용해 침투하는 인터넷 웜 및 DOS (Denial of Service) 공격을 Secure OS(보안운영체제), IDS(Intrusion Detection System : 침입탐지시스템), Scanner(취약성진단도구), Firewall(침입차단시스템)의 지능형 상호연동 스킴을 이용해, 근본적인 대응이 가능한 지능형 다단계 정보보호체계를 제시하였다. 본 고에서 제시한 정보보호대응책은 고도로 지능화하고 있는 인터넷 웜 및 DoS(Denial of Service 서비스거부) 공격을 미연에 예방하고, 실시간으로 대응할 수 있는 시스템이 될 것이다.

• Journal of the Korea Society of Computer and Information
• /
• v.26 no.9
• /
• pp.89-96
• /
• 2021

In this paper, we analyzed that the user authentication scheme for TMIS(Telecare Medicine Information System) proposed by Al-Saggaf et al. In 2019, Al-Saggaf et al. proposed authentication scheme using biometric information, Al-Saggaf et al. claimed that their authentication scheme provides high security against various attacks along with very low computational cost. However in this paper after analyzing Al-Saggaf et al's authentication scheme, the Al-Saggaf et al's one are missing random number s from the DB to calculate the identity of the user from the server, and there is a design error in the authentication scheme due to the lack of delivery method. Al-Saggaf et al also claimed that their authentication scheme were safe against a variety of attacks, but were vulnerable to password guessing attack using login request messages and smart cards, session key exposure and insider attack. An attacker could also use a password to decrypt the stored user's biometric information by encrypting the DB with a password. Exposure of biometric information is a very serious breach of the user's privacy, which could allow an attacker to succeed in the user impersonation. Furthermore, Al-Saggaf et al's authentication schemes are vulnerable to identity guessing attack, which, unlike what they claimed, do not provide significant user anonymity in TMIS.

• Journal of KIISE:Information Networking
• /
• v.32 no.3
• /
• pp.279-290
• /
• 2005

Recently, as the serious damage caused by DDoS attacks increases, the rapid detection and the proper response mechanisms are urgent. However, existing security mechanisms do not effectively defend against these attacks, or the defense capability of some mechanisms is only limited to specific DDoS attacks. In this paper, we propose a detection architecture against DDoS attack using data mining technology that can classify the latest types of DDoS attack, and can detect the modification of existing attacks as well as the novel attacks. This architecture consists of a Misuse Detection Module modeling to classify the existing attacks, and an Anomaly Detection Module modeling to detect the novel attacks. And it utilizes the off-line generated models in order to detect the DDoS attack using the real-time traffic. We gathered the NetFlow data generated at an access router of our network in order to model the real network traffic and test it. The NetFlow provides the useful flow-based statistical information without tremendous preprocessing. Also, we mounted the well-known DDoS attack tools to gather the attack traffic. And then, our experimental results show that our approach can provide the outstanding performance against existing attacks, and provide the possibility of detection against the novel attack.

• Proceedings of the Korean Institute of Communication Sciences Conference
• /
• 2006.07a
• /
• pp.605-605
• /
• 2006

• The KIPS Transactions:PartC
• /
• v.14C no.5
• /
• pp.411-416
• /
• 2007

The General security method of wireless network provides a confidentiality of communication contents based on the cryptographic stability against a malicious host. However, this method exposes the logical and physical addresses of both sender and receiver, so transmission volume and identification of both may be exposed although concealing that content. Covered address scheme that this paper proposes generates an address to which knapsack problem using super increasing sequence is applied, and replaces the addresses of sender and receiver with addresses from super increasing sequence. Also, proposed method changes frequently secret addresses, so a malicious user cannot watch a target system or try to attack the specific host. Proposed method also changes continuously a host address that attacker takes aim at. Accordingly, an attacker who tries to use DDoS attack cannot decide the specific target system.