• Proceedings of the Korea Information Processing Society Conference
• /
• 2012.11a
• /
• pp.1108-1110
• /
• 2012

파일 시스템은 컴퓨터에서 파일이나 자료를 쉽게 발견 및 접근할 수 있도록 보관 또는 조직하는 체제를 가리키는 말이다. 기존에는 Windows에 사용되는 FAT(File Allocation Table) 파일 시스템과 NTFS(New Technology File System), Unix/Linux 등에서 주로 활용되는 ext계열 파일 시스템 등이 주된 분석 대상이었으나 스마트폰과 태블릿 PC, NAS(Network Attached Storage) 서버 등 다양한 IT기기가 보급되면서 이들 기기에서 사용되는 파일시스템을 추가적인 분석이 필요하다. 따라서 본 논문에서는 추가적으로 분석해야할 파일 시스템의 종류를 나열하고 각각의 특성을 서술하여 향후 추가 분석의 지침으로 활용하고자한다.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2003.05a
• /
• pp.637-640
• /
• 2003

Authentication between Server and Client is necessary in most of Internet Service because of increasing of using of Internet. Unix-based Server upgraded security of user authentication using "Shadow Password" instead of "crypt" function. But "Shadow Password" most use same authentication method about all services. But we individually can set user authentication method using PAM(Pluggable Authentication Module). This paper will propose user authentication system using Linux-PAM that use SMART CARD as authentication token.

• Proceedings of the Korea Information Assurance Society Conference
• /
• 2004.05a
• /
• pp.9-14
• /
• 2004

OVAL은 시스템의 특성 및 설정 정보를 대상으로 하여 로컬 시스템상의 취약점을 탐지 할 수 있는 표준 언어로서 MITRE에서 제안하였다. OVAL은 취약점을 정의하는 익스플로잇스크려트를 사용하지 알고 취약점을 탐지하는 XML 스키마와 SQL 질의문으로 구성되어있다. 본 논문에서는 OVAL을 사용하여 리눅스 시스템의 취약점을 탐지 할 수 있는 진단 도구를 설계한다.

• Proceedings of the IEEK Conference
• /
• 2003.11c
• /
• pp.125-128
• /
• 2003

In this paper, we propose a dynamic key lifetime change protocol for performance enhancement of virtual private networks using IPSec. The proposed protocol changes the key lifetime according to the number of secure tunnels. The proposed protocol is implemented with Linux 2.4.18 and FreeS/WAN 1.99. The system employing our proposed protocol performs better than the original version in terms of network performance and security.

• Proceedings of the Korean Information Science Society Conference
• /
• 2003.10a
• /
• pp.844-846
• /
• 2003

웹서비스 등 다양한 응용분야에서 리눅스 서버의 사용이 일반화되면서 침입으로 인한 정보 유출 문제 및 다른 시스템으로의 침입 등의 문제를 발생시키고 있다. 한번 침입을 받은 시스템의 경우 시스템 설정이 변경되거나 백도어가 설치되어 쉽게 재침입의 표적이 될 수 있다는 점에서 침입으로 인한 부작용을 최소화하는 것이 필요하다. 본 논문에서는 시스템 침입이 있더라도 시스템 설정을 변경하거나 백도어 설치를 할 수 없도록 제어하기 위한 파일 접근 제어 모듈을 제안한다.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.29 no.4C
• /
• pp.559-569
• /
• 2004

It has become more difficult to correspond an cyber attack quickly as a pattern of attack becomes various and complex. And, current security mechanisms just have passive defense functionalities. In this paper, we propose new network security architecture to respond various cyber attacks rapidly and to chase and isolate the attackers through cooperation between security zones. The proposed architecture make possible to deal effectively with cyber attacks such as IP spoofing or DDoS(Distributed Denial of Service) using active packet technology including a mobile sensor on active network. Active Security Management System based on proposed security architecture consists of active security node and active security server in a security zone, and is designed to have more active correspondent than that of existing mechanisms. We implemented these mechanisms in Linux routers and experimented on a testbed to verify realization possibility of Active Security Management System. The experimentation results are analyzed.

• Convergence Security Journal
• /
• v.6 no.3
• /
• pp.21-28
• /
• 2006

Beginning flag security it was limited in Firewall but currently many information security solutions like Anti-virus, IDS, Firewall are come to be many. For efficiently managing different kinds of information security products ESM (Enterprise Security management) are developed and operated. Recently over the integrated security management system, TMS (Threat Management System) is rising in new area of interest. It follows in change of like this information security product and also collection information is being turning out diversification. For managing cyber threats, we have to analysis qualitative information (like vulnerabilities and malware codes, security news) as well as the quantity event logs which are from information security products of past. Information Threats and Vulnerability Auto Collector raises the accuracy of cyber threat judgement and can be utilized to respond the cyber threat which does not occur still by gathering qualitative information as well as quantity information.

• Convergence Security Journal
• /
• v.8 no.1
• /
• pp.57-65
• /
• 2008

The implement of JAVA API for supporting the embedded system is capable of developing the object oriented system with code reuse because the developer is able to use JAVA in the embedded system. The system dependant parts for implementing JAVA API are realized from a native function. In this paper, we devide JAVA API into the platform-independent JAVA part and platform-dependent native part for the implementation of JAVA API to manage the linux based embedded system devices, and focus on the control of the embedded system devices using JAVA API.

• The KIPS Transactions:PartC
• /
• v.13C no.7 s.110
• /
• pp.821-830
• /
• 2006

As internet worms are spread out worldwide, the detection and filtering of worms becomes one of hot issues in the internet security. As one of implementation methods to detect worms, the Linux Netfilter kernel module can be used. Its basic operation for worm detection is a string matching where coming packet(s) on the network is/are compared with predefined worm signatures(patterns). A worm can appear in a packet or in two (or more) succeeding packets where some part of worm is in the first packet and its remaining part is in its succeeding packet(s). Assuming that the maximum length of a worm pattern is less than 1024 bytes, we need to perform a string matching up to two succeeding packets of 2048 bytes. To do so, Linux Netfilter keeps the previous packet in buffer and performs matching with a combined 2048 byte string of the buffered packet and current packet. As the number of concurrent connections to be handled in the worm detection system increases, the total size of buffer (memory) increases and string matching speed becomes low In this paper, to reduce the memory buffer size and get higher speed of string matching, we propose a string matching scheme without using buffer. The proposed scheme keeps the partial matching result of the previous packet with signatures and has no buffering for previous packet. The partial matching information is used to detect a worm in the two succeeding packets. We implemented the proposed scheme by modifying the Linux Netfilter. Then we compared the modified Linux Netfilter module with the original Linux Netfilter module. Experimental results show that the proposed scheme has 25% lower memory usage and 54% higher speed compared to the original scheme.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.2
• /
• pp.471-484
• /
• 2018

Recently, cyber threats are frequently occurring in ICS(industrial control systems) of government agencies, infrastructure, and manufacturing companies. In order to cope with such cyber threats, it is necessary to apply CTI to ICS. For this purpose, a security information collection system is needed. However, it is difficult to install security solution in control devices such as PLC. Therefor, it is difficult to collect security information of ICS. In addition, there is a problem that the security information format generated in various assets is different. Therefore, in this paper, we propose an efficient method to collect ICS security information. We utilize CybOX/STIX/TAXII CTI models that are easy to apply to ICS. Using this model, we designed the formats to collect security information of ICS assets. We created formats for system logs, IDS logs, and EWS application logs of ICS assets using Windows and Linux. In addition, we designed and implemented a security information collection system that reflects the designed formats. This system can be used to apply monitoring system and CTI to future ICS.