• Journal of Korea Society of Industrial Information Systems
• /
• v.5 no.4
• /
• pp.16-21
• /
• 2000

Role Based Access Control(RBAC) reduces the cost of administering access control policies as well as making the process less error-prone. Administration tool is most important component in the concept of RBAC. The administration tool for the RBAC security system must be maintain the integrity of user-role and role-role relationships in the RBAC Database. Therefor, it is required set functions, properties defining integrity of database. When it will be designed security systems which is applying RBAC policy on the Linux(server system environments, this paper defines integrity of database for user-role and role-role relationships, and we propose formal specification of operation in order to manage these relationships. The proposed formal specification leads to the consistency requirements for the RBAC database which are defined as a set of relationship. Also, this paper can easily derive the implementation of the RBAC administration tool by formal specification of operations. It leads us tn the minimal set for a more efficiently implementation of administration tool.

• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 2003.12a
• /
• pp.160-165
• /
• 2003

최근 들어 무선 랜에 대한 사람들의 인식이 높아지고, KT의 NESPOT과 같은 공중망 사업자들에 의한 핫스팟 서비스가 제공되면서 무선 랜의 수요 또한 급증하고 있다. 무선 랜의 사용자가 증가하면서 무선 랜 보안의 중요성 역시 증가하고 있으며, 실제로 무선 랜에서의 안전한 네트워킹을 위하여 여러 단체들이 다양한 방향에서 연구를 진행 중에 있다. 그 한 예가 802.1X인데, 이것은 인증 서버를 따로 두어 AP를 통해 네트워크에 접속하려는 사용자들을 인증하여 주는 것이다. 이 논문에서는 802.1X 인증 방법 중 X.509 기반의 인증서를 사용하여 서버와 클라이언트간의 상호 인증을 가능하게 하여 주는 EAP-TLS 환경을 분석하고, LINUX 환경에서 공개 소스로 구축하여, 실제로 무선 랜을 사용하는 환경에 적용하는 과정을 기술한다.

• The KIPS Transactions:PartC
• /
• v.18C no.3
• /
• pp.157-166
• /
• 2011

The virtualization layer is executed in higher authority layer than kernel layer and suitable for monitoring operating systems. However, existing virtualization monitoring systems provide simple information about the usage rate of CPU or memory. In this paper, the monitoring system using full virtualization technique is proposed, which can monitor virtual machine's dynamic kernel object as memory, register, GDT, IDT and system call table. To verify the monitoring system, the proposed system was implemented based on KVM(Kernel-based Virtual Machine) with full virtualization that is directly applied to linux kernel without any modification. The proposed system consists of KvmAccess module to access KVM's internal object and API to provide other external modules with monitoring result. In experiments, the CPU utilization for monitoring operations in the proposed monitering system is 0.35% when the system is monitored with 1-second period. The proposed monitoring system has a little performance degradation.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.13 no.6
• /
• pp.123-129
• /
• 2013

Android file system is vulnerable to the external access of system resources via its arbitrary access mode and need user's control for SD and UMS medias due to its open architecture. In response to the device control, there is a drawback that its controlability is valid only in the case of embedded linux kernel with VDC function. Hence the solution is to directly implement VDC through system call, with another security module for device storage than system module being added to android system. In this paper the new method of android storage access control for personal information is proposed via VDC for mount system of storage. The access method for SD and UMS were implemented using VDC and mount mechanism. This access control system has been designed to control the granted users in kernel level if files are flowed out by copying. As a result, it was proved through testing that the access control system has exactly detected the write access operation.

• Proceedings of the Korea Society for Industrial Systems Conference
• /
• 1999.05a
• /
• pp.91-96
• /
• 1999

Role-Based Access Control(RBAC) is an access control mechanism that reduce the cost of administering access control policies. The Admin Tool developed for RBAC Model manages relationship informations of user and role. In order to maintain the consistency of the information for these relationships, a set of properties defining consistency of the relationship informations is required. When it will be designed security systems applying RBAC policy on the Linux server system environments, this paper described consistency properties of relationship informations for information management of user and role relationships. It leads us to the development of minimal set obtainable the equivalent results of consistency properties for a more efficient Admin Tool implementation.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2018.07a
• /
• pp.466-469
• /
• 2018

최근 PC를 비롯한 모바일, IOT 기기 등 다양한 환경에서의 사이버 공격이 기승을 부리고 있으며, 그 방법 또한 나날이 발전하고 있다. 이러한 사이버위협으로부터 개인 및 기업의 자산을 지키기 위한 근본적인 대안이 없이는 매번 반복적인 피해를 피하기 어려운 현실이다. 다양한 환경이라고 함은, 다양한 OS(Operation System), 다양한 ISA (Instruction Set Architecture)의 조합으로 이루어지는 사이버환경을 의미한다. 이러한 조합들은 일반 사용자들에게 가장 많이 쓰이는 Windows & Intel 조합의 환경과, Linux & Intel 또는 Linux & ARM 등 기업에서 서비스를 위해 쓰이는 서버 환경 등을 예로 들 수 있다. 그밖에 최근 IOT기기나 모바일 기기와 같은 환경도 있을 수 있다. 바이너리 파일에 대한 보안은 다양한 연구가 진행되고 있지만 그 범위가 방대하고, 깊이가 필요한 영역이라 진입 장벽이 높은 실정이다. 본 논문에서는 이러한 바이너리의 취약점을 분석하기 위한 첫 번째 단계로써 다양한 바이너리 파일을 하나의 정형화된 자료구조로 변환하는 바이너리 포맷 분석기의 한 방법을 제시하고자 한다. 다양한 OS와 다양한 ISA환경에서 사용되는 바이너리들에서 공통적으로 존재하는 정보들 중, 바이너리의 취약점 분석을 위해 필요한 데이터를 보다 효율적으로 수집하고, 관리하는 것이 바이너리를 통한 사이버 위협을 탐지하는 연구에서 기초가 된다고 할 수 있기 때문이다.

• The KIPS Transactions:PartA
• /
• v.8A no.4
• /
• pp.391-398
• /
• 2001

To design and develop secure operating systems, the BLP (Bell-La Padula) model that represents the MLP (Multi-Level Policy) has been widely adopted. However, user\`s security level in the most developed systems based on the BLP model is inherited to a process that is actual subject on behalf of the user, regardless whatever the process behavior is. So, there could be information disclosure threat or modification threat by malicious or unreliable processes even though the user is authorized in the system. These problems can be solved by defining the subject as (user, process) ordered pair and by defining the process reliability. Moreover, when the leveled programs which exist as objects in a disk are executed by a process and have different level from the process level, the security level decision problem occurs. This paper presents an extended BLP (E-BLP) model in which process reliability is considered and solves the security level decision problem. And this model is implemented into the Linux kernel 2.4.7.

• Journal of Digital Convergence
• /
• v.12 no.1
• /
• pp.313-317
• /
• 2014

Smart-phone, PC or tablet platforms, such as smart terminals spread to the masses trying to capitalize. Smart TV also is increasing. In Korea, market size of TV is growing fast with growth of risk of hacking. In this paper, several kinds of Smart TV hacking cases are presented with the possibility of attacks against the vulnerability analysis and countermeasures. Most of the Linux operating system is open. Thus, it is vulnerable for latest hacking techniques. Most are based on the Linux OS to enhance security mount Sand-Box. However, bypass procedure using the technique, or APT attacks can avoid San-Box technique. New hacking techniques and a variety of ways will occur in the future. Therefore, this paper will develop Smart TV, and it analysis of a security threat and establishes better prepared in the future because new hacking attacks are expected to prepare more.

• The Journal of the Korea Contents Association
• /
• v.10 no.3
• /
• pp.101-112
• /
• 2010

The recent trend of the hacking deals with all the IT infrastructure related to the profit of the companies. Presently, they attack the service itself, the source of the profit, while they tried to access to the service infrastructure through the non-service port in the past. Although they affect the service directly, it is difficult to block them with the old security solution or the old system and they threaten more and more companies with the demand of money menacing the protection of customers and the sustainable management. This paper aims to design and implement multi-platform network packet scanner targeting the exception handling network intrusion detection system which determines normal, abnormal by traffic. Linux and unix have the various network intrusion detection and packet management tools like ngrep, snort, TCPdump, but most of them are based on CUI (Character based User Interface) giving users discomfort who are not used to it. The proposed system is implemented based on GUI(Graphical User Interface) to support the intuitive and easy-to-use interface to users, and using Qt(c++) language that supports multi-platform to run on any operating system.

• Journal of KIISE:Computing Practices and Letters
• /
• v.7 no.6
• /
• pp.703-714
• /
• 2001

In C language, a local buffer overflow in stack can destroy control information stored near the buffer. In case the buffer overflow is used maliciously to overwrite the stored return address, the system is exposed to serious security vulnerabilities. This paper analyzes the process of buffer overflow hacking and methodologies to avoid the attacks in details. And it proposes a device of static buffer overflow detection by using function summary and tracking information flow of buffer domain at assembly source code level(SASS, Static Assembly Source code Scanner) and then show the feasibility and validity of it by implementing a prototype in Pentium based Linux environment.