• The Journal of Information Technology
• /
• v.6 no.1
• /
• pp.11-20
• /
• 2003

With the development of Information Communication Technique, electronic commerce using PKIs is widely used over the Internet. The goal of access control is to counter the threat of unauthorized operations involving Web-server or data base systems. The RBAC(Role-Based Access Control) has recently received considerable attention as a promising alternative to traditional discretionary and mandatory access controls. In this paper we propose two methods, the RBAC system using attribute certificates and the RBAC system using SPKI certificates. And we analyze and compare the two methods.

• The Transactions of the Korea Information Processing Society
• /
• v.2 no.4
• /
• pp.581-591
• /
• 1995

An MIB is the heart of a network management system and it stores all information that is necessary for network management. To operate networks safely, it is essential to control accesses to managed objects. This paper provides three-level architecture of managers so as to perform network management more efficiently in large networks. Moreover, mandatory access control(MAC) policy and role-based access control policy are adopted to ensure the secure access to the MIB. These policies are modeled by using the active object-oriented data model, which makes easy to map these access control models into the active object-oriented database.

• The Journal of Society for e-Business Studies
• /
• v.7 no.1
• /
• pp.66-74
• /
• 2002

Through the increment of requirement for EC(Electronic Commerce) oriented communication services, security multicast communications is becoming more important. However, multicast to EC environment is much different from unicast concept most network security protocols. On the network security, using mandatory access control of multilevel architecture which assigns a specific meaning to each subject, so we accomplish access control. In this way, access control security based on the information security level is proposed. A security protocol based on the architecture proposed in this paper would be utilized in security multicast communications, group key management service and leveled security service through multilevel EC security policy, Also we discuss and propose the security level scaleability and key management method on the network.

• Proceedings of the Korean Information Science Society Conference
• /
• 2000.10a
• /
• pp.650-652
• /
• 2000

본 논문은 최근에 그 수요가 증가하고 있는 리눅스를 기반으로 하여 안전한 운영체제의 설계 및 구현에 대하여 기술한다. 안전한 운영체제를 위해 사용되는 보안 기능들은 MAC(Mandatory Access Control), DAC(Discretionary Access Control), 그리고 SOP(Separate of privilege)과 같이 파일, 디렉토리, 그리고 디바이스와 같은 시스템 자원에 대한 접근을 제어하는 기능과 감사 추적(Auditing)기능, 그리고 사용자 인증기능 등이 있다. 접근제어란 컴퓨터자원, 통신자원, 정보자원 등에 대한 허가되지 않는 접근을 막는 것이다 본 논문에서는 리눅스 운영체제의 보안을 위해 필요한 접근 제어 기능과 다중 레벨의 사용자 인증기능의 설계 및 구현에 대해 기술한다. 또한 접근 제어기능 구현은 국제 표준화인 OSIX1003.le을 기준으로 하였다.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2004.11a
• /
• pp.331-334
• /
• 2004

공통평가기준(CC, Common Criteria)의 고등급 평가를 받으려면 정형화된 보안정책 모델이 필요하다. 보안정책 중 하나인 접근제어 정책은 시스템의 자원과 데이터의 접근을 중재하여 오직 허가된 접근만 가능하도록 한다. 오늘날 임의적 접근제어(DAC, Discretionary Access Control)와 강제적 접근제어(MAC, Mandatory Access Control)의 대안으로 주목받는 역할기반 접근제어(RBAC, Role-Based Access Control)는 기업이나 정부의 다양한 조직체계를 반영하는 데 적합한 접근제어 정책이다. 다양한 기능과 보안성이 강조되는 스마트카드 시스템의 접근제어정책으로 RBAC을 적용하고 그에 관한 그래프형태의 정형화된 SPM을 보인다.

• The KIPS Transactions:PartD
• /
• v.10D no.7
• /
• pp.1149-1154
• /
• 2003

Due to various requirements for the user access control to large databases in the hospitals and the banks, database security has been emphasized. There are many security models for database systems using wide variety of policy-based access control methods. However, they are not functionally enough to meet the requirements for the complicated and various types of access control. In this paper, we propose a database security system that can individually control user access to data groups of various sites and is suitable for the situation where the user's access privilege to arbitrary data is changed frequently. Data group(s) in different sixes d is defined by the table name(s), attribute(s) and/or record key(s), and the access privilege is defined by security levels, roles and polices. The proposed system operates in two phases. The first phase is composed of a modified MAC (Mandatory Access Control) model and RBAC (Role-Based Access Control) model. A user can access any data that has lower or equal security levels, and that is accessible by the roles to which the user is assigned. All types of access mode are controlled in this phase. In the second phase, a modified DAC(Discretionary Access Control) model is applied to re-control the 'read' mode by filtering out the non-accessible data from the result obtained at the first phase. For this purpose, we also defined the user group s that can be characterized by security levels, roles or any partition of users. The policies represented in the form of Block(s, d, r) were also defined and used to control access to any data or data group(s) that is not permitted in 'read ' mode. With this proposed security system, more complicated 'read' access to various data sizes for individual users can be flexibly controlled, while other access mode can be controlled as usual. An implementation example for a database system that manages specimen and clinical information is presented.

• The KIPS Transactions:PartC
• /
• v.10C no.1
• /
• pp.11-16
• /
• 2003

This paper implements Multiple User Authentication System to which the system authenticating with password only has been upgraded. The 4-staged authentication including user ID, password, smart card and access control information, etc. is used at the suggested Multiple User Authentication System. The user authentication system that this paper suggests has been developed based on SecuROS/FreeBSD with the function of access control added to FreeBSD kernel. It provides both the function to limit accost range to the system to each user and the function to check that when inputting important information the demand is the one if the system ; thus, the reliability becomes increased. In the SecuROS/FreeBSD system, MAC and RBAC are being used. So, in the case of users accessing to the system, the Information about the policies of MAC and RBAC to which users would access is used in the authentication. At the time, the access to system if permitted only when the access control information that users demanded satisfies all the access control rules which have been defined In the system.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.12 no.4
• /
• pp.41-53
• /
• 2002

Role Based Access Control (RBAC), which is a method, using role as an access control, has been popular with users and it is recognized as an effective method to replace the Discretionary Access Control and the Mandatory Access Control However, the existing Role Based Access Control Models have only been limited to the bureaucracy organization in which a distinctive hierarchy system was used, incorporating a stable structure and a standardized work system. Only in some parts, some access control models have been used, which supports 'Team' concept, such as Team Based Access Control Model. However, it did not incorporate the characteristics of the adhocracy organization, which is similar to the company's task force team, whose characteristics are organic, temporary, no standardized operation procedures, and many frequent changes. In this study, we have discussed the characteristics of the adhocracy organization which is different from the existing bureaucracy organization, and we have also discussed the problems related to when the existing access control models are used as the access control model for the adhocracy organization due to its characteristics. In addition, based on the problems, we have suggested an improved role based access control model for the adhocracy organization, and have come up with the solutions when any problems occur in the access control system.

• 제어로봇시스템학회:학술대회논문집
• /
• 2004.08a
• /
• pp.1350-1354
• /
• 2004

This paper proposes a simple but practically useful model for preventing fraud of users called "ERBAC03". The new model consists of qualified mandatory and discretionary features for roles and locations, including the assignment of permissions for the appropriate roles and the assignment of roles for the appropriate locations. Moreover, a static separation of duty (SSoD) principle is applied to the new model for integrity requirements of security systems. The paper also explores some extensions of ERBAC03 including the new model using the SSoD concept from some experiments. The experimental results prove the efficiency improvement of the proposed model that can make benefits for large enterprises.

• Journal of KIISE
• /
• v.43 no.3
• /
• pp.275-288
• /
• 2016

In this paper, we investigate the security issues of the Android platform which dominates the global market of smart mobile devices. The current permission model for Android security is not powerful and has two problems. One is the coarse-grained relationship between permissions and methods which require them. The other is that mobile users do not have rights to control the permissions of the application. To solve these problems, we propose MacDroid which can control the platform's resources for accessing installed applications. Users can control the application's behavior via MacDroid's policy. We have divided the permission set into method units. The results of the performance test using a pure Android platform show that our proposed scheme can improve security within a short time.