• Journal of KIISE:Computer Systems and Theory
• /
• v.31 no.1_2
• /
• pp.27-40
• /
• 2004

The OSGi service platform has several characteristics as in the followings. First, the service is deployed in the form of self-installable component called service bundle. Second, the service is dynamic according to its life-cycle and has interactions with other services. Third, the system resources of a home gateway are restricted. Due to these characteristics of a home gateway, there are a lot of rooms for malicious services can be Installed, and further, the nature of service can be changed. It is possible for those service bundles to influence badly on service gateways and users. However, there is no service bundle authentication mechanism considering those characteristics for the home gateway In this paper, we propose a service bundle authentication mechanism considering those characteristics for the home gateway environment. We design the mechanism for sharing a key which transports a service bundle safely in bootstrapping step that recognize and initialize equipments. And we propose the service bundle authentication mechanism based on MAC that use a shared secret created in bootstrapping step. Also we verify the safety of key sharing mechanism and service bundle authentication mechanism using a BAN Logic. This service bundle authentication mechanism Is more efficient than PKI-based service bundle authentication mechanism or RSH protocol in the service platform which has restricted resources such as storage spaces and operations.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2006.05a
• /
• pp.905-908
• /
• 2006

MIPv6 는 MN(Mobile Node)가 자신의 홈 네트워크를 벗어나 외부 네트워크로 이동하여도 다른 노드들과 끊김 없이 지속적인 통신을 할 수 있게 해주는 인터넷 프로토콜이다. MN 은 외부네트워크로 이동 후 HA(Home Agent) 및 CN(Correspondent Node)로 핸드오버(Handover) 동작의 수행하며 이로 인한 지연이 발생하게 된다. 이러한 지연을 줄이기 위한 대책으로 Fast 핸드오버가 등장하였다. Fast 핸드오버 과정에서 MN 은 이동하려는 서브넷의 라우터(New Access Router: NAR)로의 전환을 위하여 현재 연결된 AR 과 미리 정보를 주고 받게 되고, 이동이 발생한 후에 NAR 과의 핸드오버 지연시간이 감소하게 된다. 반면 공격자가 flooding 을 통해 MN 에게 DoS(Denial of Service) 공격을 가하여 MN 을 다운시킨 후, MN 으로 위장하여 데이터를 가로채는 취약점이 존재한다. 본 논문에서는 위의 취약점을 보완하기 위하여 핸드오버 과정에서 주고받는 메세지에 대한 기밀성 및 노드 인증을 제공하는 ID 기반 암호시스템에 기반한 안전한 Fast 핸드오버 방식을 제안한다. 제안하는 모델은 메시지의 암호화와 노드 인증을 통해 무결성 및 기밀성을 보장하고 Traditional PKI 시스템에 비해 공개키 인증시간을 단축하는 이점을 가질 것으로 기대된다.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.14 no.1
• /
• pp.437-454
• /
• 2020

According to the privacy regulations of the health insurance portability and accountability act (HIPAA), patients' control over electronic health data is one of the major concern issues. Currently, remote access authorization is considered as the best solution to guarantee the patients' control over their health data. In this paper, a new biometric-based key management scheme is proposed to facilitate remote access authorization anytime and anywhere. First, patients and doctors can use their biometric information to verify the authenticity of communication partners through real-time video communication technology. Second, a safety channel is provided in delivering their access authorization and secret data between patient and doctor. In the designed scheme, the user's public key is authenticated by the corresponding biometric information without the help of public key infrastructure (PKI). Therefore, our proposed scheme does not have the costs of certificate storage, certificate delivery, and certificate revocation. In addition, the implementation time of our proposed system can be significantly reduced.

• The KIPS Transactions:PartC
• /
• v.14C no.4
• /
• pp.321-330
• /
• 2007

This paper proposes a two-phase server login authentication system by XML-Signature schema extension to protect server's information resources opened on network which offer various web contents. A proposed system requests and publishes XML-based certificate through on-line, registers certificate extension information provided by CA(Certification Authority) to XCMS(XML Certificate Management Server), and performs prior authentication using user's certificate password. Then, it requests certificate extension information added by user besides user's certificate password and certificate extension information registered in XCMS by using SOAP message, and performs posterior authentication by comparing these certificate extension information. As a result, a proposed system is a security reinforced system compared with existing systems.

• International Journal of Internet, Broadcasting and Communication
• /
• v.7 no.2
• /
• pp.56-64
• /
• 2015

The personal image information compiled through closed-circuit television (CCTV) will be open to the internet with the technology such as Long-Tail, Mash-Up, Collective Intelligence, Tagging, Open Application Programming Interface (Open-API), Syndication, Podcasting and Asynchronous JavaScript and XML (AJAX). The movie User Created Contents (UCC) connected to the internet with the skill of web 2.0 has the effects of abuse and threat without precedent. The purpose of this research is to develop the institutional and technological method to reduce these effects. As a result of this research, in terms of technology this paper suggests Privacy Zone Masking, IP Filtering, Intrusion-detection System (IDS), Secure Sockets Layer (SSL), public key infrastructure (PKI), Hash and PDF Socket. While in terms of management this paper suggests Privacy Commons and Privacy Zone. Based on CCTV-UCC linked to the above network, the research regarding personal image information security is expected to aid in realizing insight and practical personal image information as a specific device in the following research.

• The KIPS Transactions:PartC
• /
• v.12C no.3 s.99
• /
• pp.317-322
• /
• 2005

The existing certificate based authentication or identification just verifies whether the owner of private key corresponding to public key of certificate is the DN user set in the user field in the certificate or not, then we cannot find out who is the actual private key owner in a real world. To make up for this weak points, the method to insert the identification number like the resident registration number into the certificate extension field is applied as a technical standard to current domestic PKI system. In this paper, we propose the ECC based integrated identification, identification number checking and key management protocol providing user validation during the login.

• The KIPS Transactions:PartC
• /
• v.12C no.2 s.98
• /
• pp.183-190
• /
• 2005

In this thesis, first, we propose I-frame encryption techniques of video data for video data itself encryption and propose license agent that processing user's certification and decryption in client system automatically when user execute encrypted video data in system server. License agent runs user's certification, encryption and decryption of video data based on PID(Public Key Infrastructure) using shared key-pool when execute of video data. Also, compose duplex buffer control and propose real time decryption method using efficient buffer scheduling to reduce much playing delay times that happen processing decryption when execute of videoa data of high-capacity.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.13 no.1
• /
• pp.99-113
• /
• 2003

As a research on PKI(Public Key Infrastructure) is being very popular, the study relating to certificate status and path validation is being grown with aim to reduce an overhead of the protocol and to provide an efficient operation. But in spite of a lot of related research there is still almost no protocol that we can use for real-time based client-server environment with large scale like internet banking. In this paper, we shows that the existing standards or protocols are not suitable to be used for such a real-time based client-server environment with large scale, and then proposes an efficient certificate status and path validation system.

• The Journal of Society for e-Business Studies
• /
• v.9 no.3
• /
• pp.227-241
• /
• 2004

With the expansion of internet usage and the advanced technology for information and communication, the international e-Trade environment gradually migrates from the VAN/EDI to the global Internet-based e-Traed on an ebXML framework. In an effort to provide a Internet-based e-Trade environment with a security and trust, this paper analyzes security components and proposed the SSL and ebXML security technologies in order to assure of the trust and security over Internet-based e-Trade. In addition, this paper presents 3-phase methodology to realize the secure and trustworthy Internet-based e-Trade. In summary, as the first phase, the e-Trade business processes are re-engineered and the digital signature council for mutual recognition is orgainzed. And as the second phase, the Internet-based e-Trade system and the concerned digital signature technology are implemented. Finally as third phase, the PKI mutual recognition agreement is signed by parties concerned and then the Internet-based e-trade business is started. Furthermore, this paper presents the promising Internet-based e-Trade models where the digital signature can be applied.

• Journal of KIISE:Information Networking
• /
• v.30 no.1
• /
• pp.75-81
• /
• 2003

User authentication, including confidentiality, integrity over untrusted networks, is an important part of security for systems that allow remote access. Using human-memorable Password for remote user authentication is not easy due to the low entropy of the password, which constrained by the memory of the user. This paper presents a new password authentication and key agreement protocol suitable for authenticating users and exchanging keys over an insecure channel. The new protocol resists the dictionary attack and offers perfect forward secrecy, which means that revealing the password to an attacher does not help him obtain the session keys of past sessions against future compromises. Additionally user passwords are stored in a form that is not plaintext-equivalent to the password itself, so an attacker who captures the password database cannot use it directly to compromise security and gain immediate access to the server. It does not have to resort to a PKI or trusted third party such as a key server or arbitrator So no keys and certificates stored on the users computer. Further desirable properties are to minimize setup time by keeping the number of flows and the computation time. This is very useful in application which secure password authentication is required such as home banking through web, SSL, SET, IPSEC, telnet, ftp, and user mobile situation.