• International Journal of Computer Science & Network Security
• /
• v.24 no.8
• /
• pp.174-178
• /
• 2024

IoT is collection of different "things" which are associated with open web. As all the things are connected to the Internet, it offers convenience to end users for accessing the resources from "Any Where, Any Time" throughout the globe. At the same time, open nature of IoT provides a fertile ground to an intruder for launching different security related threats. If we can no apply proper security safeguards to the IoT System, then it will be not useful to society. Authentication, Encryption, Trust Management and Secure Routing are different domains to offer security in IoT system. Among them, Authentication is very much important security service as it validates device identity before granting access to system services/ resources. Existing IoT Authentication algorithms are fail to verify device identity in unambiguous way. They are vulnerable to different security threats such as Key Stolen threat, MITM threat and Location Spoofing threat. So, it is a demand of time to design an efficient and secure Multi-factor IoT algorithm which can offer better security and validate device identity in unambiguous way.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.36 no.4C
• /
• pp.197-206
• /
• 2011

In the RFID system, bulk tag information is stored into the back-end database as plaintext format not ciphertext. In this case, the tags's private informations can be easily compromised by an external hacker or an insider attacker. If the private informations of tags disclosed by the attackers, it can occur serious privacy invasion problem. Recently the database(DB) security is an important issue to prevent the above DB compromised attack. However, DB security for RFID systeme has not been considered yet. If we use the DB security technique into the RFID system, the above described privacy invasion' problem can be easily prevented. Based on this motivation, this paper proposes a secure and efficient back-end database security and authentication(S-DB) scheme with XOR-based encryption/decryption algorithm. In the proposed scheme, all tag's private information is encrypted and stored by using the DB secret key to protect the DB compromised attack. As a result, the proposed S-DB scheme 'can provide stronger security and more efficiency for the secure RFID system environment.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.22 no.3
• /
• pp.473-483
• /
• 2012

To achieve an entire end-to-end security, the classical authentication setting such that all participants have a same password is not practical since a password is not a common secret but a personal secret depending on an individual. Thus, an efficient client to client different password-based authenticated key agreement protocol (for short, EC2C-PAKA) has been suggested in the cross-realm setting. Very recently, however, a security weakness of the EC2C-PAKA protocol has been analyzed by Feng and Xu. They have claimed that the EC2C-PAKA protocol is insecure against a password impersonation attack. They also have presented an improved version of the EC2C-PAKA protocol. In this paper, we demonstrate that their claim on the insecurity of EC2C-PAKA protocol against a password impersonation attack is not valid. We show that the EC2C-PAKA protocol is still secure against the password impersonation attack. In addition, ironically, we show that the improved protocol by Feng and Xu is insecure against an impersonation attack such that a server holding password of Alice in realm A can impersonate Bob in realm B. We also discuss a countermeasure to prevent the attack.

• Smart Media Journal
• /
• v.5 no.2
• /
• pp.77-83
• /
• 2016

Today, the great revolution in all financial industrial such as bank have been progressing through the utilization of IT technology actively, it is called the fintech. In this paper, we draw the draft design of NFC-based electronic payment and coupon system using FIDO framework to apply the 2 factor authentication technique for strength security. In detailed, we will study that the terminal device in front-end will be applied the 2 factor authentication and electric signature, and cloud-based payment gateway in back-end will be applied malicious code detection technique of distributed avoidance type.

• Annual Conference of KIPS
• /
• 2001.04a
• /
• pp.81-84
• /
• 2001

PC 환경이 아닌 무선 인터넷 환경에서 제공되는 Mobile GIS(Geographic Information System)는 시간과 공간의 제약을 극복하고 실시간으로 지리정보를 얻을 수 있는 장점을 가지고 있으나, 사용자의 무선단말기와 서버 사이에 접속이 유지되어 있어야만 무선으로 GIS 서비스를 이용할 수 있다. 이는 현재 국내 무선 네트워크의 느린 속도와 비싼 이용 요금을 감안하면 Mobile GIS 가 대중화되는데 장애요인이 되고있다. 그리고 무선 인터넷 서비스가 급격히 증가하면서 Mobile GIS는 보안상 약점을 드러낼 것으로 예측된다. 그러므로 본 논문에서는 공개된 불특정다수의 무선 네트워크 환경에서 발생할 수 있는 보안의 피해와 그에 따른 기본적 Mobile Security 서비스에 대해 알아보고, 정보보호 입장에서 Mobile Database 를 연구하였다. 또한 Mobile GIS 를 위한 WAP 게이트웨이에서 공간데이터의 유출 가능성을 발견하였고, 이를 위한 해결책으로 J2ME 의 Pre-verification 기능과 종단간 암호화 (End-to-End Security) 기능을 Mobile GIS 설계에 적용하여 무선 환경에서 동적인 지도서비스와 더불어 공간 데이터의 보안을 유지할 수 있는 기법을 제시하였다. 이 연구를 통해 대역폭(Bandwidth)의 한계를 지닌 개방적 무선환경에서 Mobile GIS와 같은 컨텐츠 프라이버시(Contents Privacy) 보호가 요구되는 분야에 응용될 수 있으리라 기대된다.

• Proceedings of the Korea Information Assurance Society Conference
• /
• 2004.05a
• /
• pp.141-144
• /
• 2004

The Common Criteria (CC) philosophy is to provide assurance based upon an evaluation of the IT product or system that is to be trusted. Evaluation has been the traditional means of providing assurance. It is essential that not only the customer' srequirements for software functionality should be satisfied but also the security requirements imposed on the software development should be effectively analyzed and implemented in contributing to the security objectives of customer's requirements. Unless suitable requirements are established at the start of the software development process, the resulting end product, however well engineered, may not meet the objectives of its anticipated consumers. By the security evaluation, customer can sure about the quality of the products or systems they will buy and operate. In this paper, we propose a selection guide for If products by showing relationship between security engineering and security evaluation and make help user and customer select appropriate products or system.

• Korean Journal of Legislative Studies
• /
• v.24 no.3
• /
• pp.55-83
• /
• 2018

This paper is written to identify the opportunities and risks of the declaration of the end of the Korean War with North Korea. The declaration has been seriously discussed in the course of negotiation for the denuclearization of North Korea especially in 2018. For this purpose, this paper revisits the concepts of related terms such as peace, peace regime, peace agreement and declaration of the end of war. It assesses the background and intention of North Korean request for the declaration. Then, it analyzes opportunities and risks regarding South Korea, if it agrees on the declaration. As a result, this paper found that declaration of the end of the Korean War could provide South Korea with opportunities such as a progress on the North Korean denuclearization, contribution to the peace regime on the Korean Peninsula and improvement on South Korea and North Korea relations. At the same time, the declaration could bring risks such as the dismantlement of the United Nations Command, demands of the withdrawal of US forces in Korea, a possible stop of North Korean denuclearization process and the weakening of South Korean peoples' awareness on North Korean threats. South Korea need to heed more on the risks than the opportunities, because the national security should be handled with caution.

• Journal of the Institute of Convergence Signal Processing
• /
• v.10 no.4
• /
• pp.256-261
• /
• 2009

While .NET and J2EE bisects recent distributed environment, .NET displays "Remoting" as a technology to call remote object. Remoting is frequently used as a protocol in OLTP's WEB program development in form of RPC that exchange data in XML form under HTTP environment. Purpose of this research is to draw problems when applying security to .NET remoting technology that is recently used in web programming, and to find effective application plan by implementing. The main discussion is following. First, network layer security should be replaced to application layer security for better performance and flexibility. Second, the serialization procedure that is repeated in both remoting and encryption module should take place once. Lastly, implementation of "Surrogate" and "Compress" will be discussed that enables to eliminate unnecessary data(table relations, keys, etc) that is used in dataset object of .NET in order to reduce the size of data. It is possible to achieve improvement in speed by two times through immediate implementation in these cases. In order for easier use, component based framework should be supplied hereafter.

• Journal of the Institute of Electronics Engineers of Korea SP
• /
• v.42 no.2 s.302
• /
• pp.27-36
• /
• 2005

This thesis proposed an effective encryption method for the DCT-based image/video contents and made it possible to operate in a high speed by implementing it as an optimized hardware. By considering the increase in the amount of the calculation in the image/video compression, reconstruction and encryption, an partial encryption was performed, in which only the important information (DC and DPCM coefficients) were selected as the data to be encrypted. As the result, the encryption cost decreased when all the original image was encrypted. As the encryption algorithm one of the multi-mode AES, DES, or SEED can be used. The proposed encryption method was implemented in software to be experimented with TM-5 for about 1,000 test images. From the result, it was verified that to induce the original image from the encrypted one is not possible. At that situation, the decrease in compression ratio was only $1.6\%$. The hardware encryption system implemented in Verilog-HDL was synthesized to find the gate-level circuit in the SynopsysTM design compiler with the Hynix $0.25{\mu}m$ CMOS Phantom-cell library. Timing simulation was performed by Verilog-XL from CadenceTM, which resulted in the stable operation in the frequency above 100MHz. Accordingly, the proposed encryption method and the implemented hardware are expected to be effectively used as a good solution for the end-to-end security which is considered as one of the important problems.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.29 no.12C
• /
• pp.1692-1706
• /
• 2004

Recently, there are rapid development of information and communication and rapid growth of e-business users. Therefore we try to solve security problem on the internet environment which charges from wire internet to wireless internet or wire/wireless internet. Since the wireless mobile environment is limited, researches such as small size, end-to-end and privacy security are performed by many people. Wireless e-business adopts credit card WPP protocol and AIP protocol proposed by ASPeCT. WAP, one of the protocol used by WPP has weakness of leaking out information from WG which conned wire and wireless communication. certification chain based AIP protocol requires a lot of computation time and user IDs are known to others. We propose a Micro-Payment protocol based on credit card. Our protocol use the encryption techniques of the public key with ID to ensure the secret of transaction in the step of session key generation. IDs are generated using ECC based Weil Paring. We also use the certification with hidden electronic sign to transmit the payment result. The proposed protocol solves the privacy protection and Non-repudiation p개blem. We solve not only the safety and efficiency problem but also independent of specific wireless platform. The protocol requires the certification organization attent the certification process of payment. Therefore, other domain provide also receive an efficient and safe service.