• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.34 no.3
• /
• pp.365-378
• /
• 2024

The operating system (OS) of mobiles or embedded devices is based on the Linux kernel. These OSs request random numbers from the Linux kernel for system operation, such as encryption keys and security features. To provide random numbers reliably, the Linux kernel has a dedicated random number generator (Linux Pseudo Random Number Generator, LPRNG). Recently, LPRNG has undergone a major structural changes. However, despite the major changes, no security analysis has been published on the structure of the new LPRNG. Therefore, we analyze these structural changes as a preliminary study to utilize the security analysis of the new LPRNG. Furthermore, the differences between before and after the changes are divided into cryptographic and performance perspectives to identify elements that require security analysis. This result will help us understand the new LPRNG and serve as a base for security analysis.

• The KIPS Transactions:PartC
• /
• v.10C no.2
• /
• pp.145-154
• /
• 2003

Current security efforts provided in such as firewall or IDS (intrusion detection system) of the network level suffer from many vulnerabilities in internal computing servers. Thus the necessity of secure OS is especially crucial in today's computing environment. This paper identifies secure OS requirements, analyzes tile research trends for secure Linux in terms of security kernel, and provides the descriptions of the multi-level security(MLS) Linux kernel which we have implemented. This security kernel-based Linux meets the minimum requirements for TCSEC Bl class as well providing anti-hacking, real-time audit trailing, restricting of root privileges, and enterprise suity management functions.

• Proceedings of the IEEK Conference
• /
• 2003.11b
• /
• pp.77-80
• /
• 2003

Complying with highly demand of information through internet. the utility of computer and network is rapidly provided with to schools. This situation brings about many problems. For example, the stolen information through false identification(Hacking) is the most greatest concern. In this paper it tells that the efficient way of preservating computer use is by using operating system of Open Source, which is Linux system. Further more, it shows the system which was organized by IP-Tabling (offered service-Packet Filtering method from the Linux system) functions well as a security system.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.27 no.1
• /
• pp.49-57
• /
• 2017

With the prevalence of mobile devices, many organizations introduce MDM BYOD and try to increase the level of security with them. However, device control of mobile devices in application level cannot be a solution against the fundamental problems. In this paper, we propose a more flexible and more secure method to control the hardware devices using Linux Security Module in the kernel level with the mandatory access control.

• The Journal of Korea Institute of Information, Electronics, and Communication Technology
• /
• v.3 no.4
• /
• pp.35-42
• /
• 2010

This paper reviews the current studies about the current secure OS, security module and SELinux, and suggests Linux access control module that uses the user discriminating authentication, security authority inheritance of subjects and objects, reference monitor and MAC class process and real-time audit trailing using DB. First, during the user authentication process, it distinguishes the access permission IP and separates the superuser(root)'s authority from that of the security manager by making the users input the security level and the protection category. Second, when the subjects have access to the objects through security authority inheritance of subjects and objects, the suggested system carries out the access control by comparing the security information of the subjects with that of the objects. Third, this system implements a Reference Monitor audit on every current events happening in the kernel. As it decides the access permission after checking the current MAC security attributes, it can block any malicious intrusion in advance. Fourth, through the real-time audit trailing system, it detects all activities in the operating system, records them in the database and offers the security manager with the related security audit data in real-time.

• Journal of KIISE:Computing Practices and Letters
• /
• v.10 no.2
• /
• pp.146-155
• /
• 2004

Currently most of commercial operating systems contain a high-level audit feature to increase their own security level. Linux does not fall behind the other commercial operating systems in performance and stability, but Linux does not have a good audit feature. Linux is required to support a higher security feature than C2 level of the TCSEC in order to be used as a server operating system, which requires the kernel-level audit feature that provides the system call auditing feature and audit event. In this paper, we present LxBSM, which is a kernel module to provide the kernel-level audit features. The audit record format of LxBSM is compatible with that of Sunshield BSM. The LxBSM is implemented as a loadable kernel module, so it has the enhanced usability. It provides the rich audit records including the user-level audit events such as login/logout. It supports both the pipe and file interface for increasing the connectivity between LxBSM and intrusion detection systems (IDS). The performance of LxBSM is compared and evaluated with that of Linux kernel without the audit features. The response time was increased when the system calls were called to create the audit data, such as fork, execve, open, and close. However any other performance degradation was not observed.

• Convergence Security Journal
• /
• v.10 no.2
• /
• pp.27-35
• /
• 2010

We implemented an application system which is able to verify visitor identification for remote bundle control based on OSGi and web camera control using embedded linux system. This system are designed open Oscar framework by porting java on the embedded linux system and implemented web camera system in local area networks. Also This system can verify information of visitor from receiving the data of RFID reader and designed the wireless internet system in home. Basically, in this paper we expect that home network system development and the period of application service development are reduced with integrated service provision based on OSGi.

• Convergence Security Journal
• /
• v.22 no.2
• /
• pp.3-8
• /
• 2022

Security threats occur from the outside, but more often from the inside. In particular, since the internal user knows about the information service, the security threat damage caused by the internal user is greater. In this environment, the actions of all users accessing information services should be monitored and recorded in real-time. However, the current operating system records only the logs of system and application execution, so there is a limit to monitoring user behavior in real-time. In such a security environment, damage may occur due to user's unauthorized actions. To solve this problem, this study proposes an architecture that monitors user behavior in real-time in a Linux environment. As a result of verifying the function to confirm the effectiveness of the proposed architecture, the console input values and output angles of all users who have access to the operating system are monitored in real-time and stored. Although the performance of the proposed architecture is somewhat slower than the identification and authentication functions provided by the operating system, it was confirmed that the performance was not at a level that users would recognize, and thus it was judged to be sufficiently effective. However, since this study focuses on monitoring the console behavior, it is impossible to monitor the behavior of user applications running in the background, so additional research is needed.

• Proceedings of the Korean Information Science Society Conference
• /
• 2005.11a
• /
• pp.142-144
• /
• 2005

최근 웹(World Wide Web)은 전자상거래, e-commerce의 눈부신 성장과 더불어 그 이용률이 급격히 증가하였고, 이와 더불어 웹 취약점을 이용한 해킹사례도 증가하고 있다. 이 해킹 사례의 대부분은 웹 어플리케이션의 취약점을 이용한 것이다. 기존의 네트워크 침입탐지 시스템에서는 침입을 탐지하기위해 시그너쳐 방법이 주로 사용되었다. 시그너쳐 방식은 시그너쳐를 기반으로 우수한 탐지율을 보인다. 그러나 웹 어플리케이션 공격은 다양한 원인과, 변형된 특성들을 가지고 있기 때문에 기존의 시그너쳐 기반의 방법으로는 특정한 패턴을 찾아내기가 곤란하다. 본 논문에서는 이를 보완할 수 있는 방법으로 프로파일 기반의 탐지방법과 한계, 그리고 이 한계를 보완할 수 있는 대책을 제시한다.

• IEMEK Journal of Embedded Systems and Applications
• /
• v.10 no.6
• /
• pp.335-343
• /
• 2015

As the usage of mobile devices becomes diverse, a number of attacks on Android also have increased. Among the attacks, Android can be compromised by flashing a new image of compromised Android Linux. In order to solve this problem, we propose SeBo (Secure Boot System) which prevents compromised Android Linux by guaranteeing secure boot environment for mobile devices based on ARM TrustZone architecture. SeBo checks the hash value of the Android Linux image before the Android Linux executes. SeBo detects all the attacks within 5 seconds. Moreover, since SeBo only trusts the Secure Bootloader from Secure World, SeBo can reduce the additional overhead of checking the Normal Bootloader from Normal World.