• Journal of Communications and Networks
• /
• v.9 no.4
• /
• pp.457-465
• /
• 2007

Native information provider(IP) anycast suffers from routing scalability issues and the lack of stateful communication support. For this reason, we propose architecture for scalable and transparent anycast services(ASTAS), a proxy-based architecture that provides support for stateful anycast communications, while retaining the transparency offered by native anycast. Dynamic resource assignment for each initiated session guarantees that a connection is established with the most suitable target server, based on network and server conditions. Traffic engineering in the overlay can be realized in an effective way due to the dissemination of aggregated state information in the anycast overlay. To minimize the total deployment cost for ASTAS architectures, we propose optimized proxy placement and path finding heuristics based on look-ahead information gathered in network nodes. Contrary to a regular integer linear program(ILP) formulation, these heuristics allow to optimize proxy placement in large networks. A use case on a European reference network illustrates that lower proxy costs enable proxy deployment closer to the end-users, resulting in a reduced network load.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.22 no.2
• /
• pp.317-326
• /
• 2012

Internet service provider is able to collect personal information to prevent the violations of the rights of service providers and customers using internet. But there are still many debates going on between a personal privacy and a regulation. Proxy servers are used in various technical purposes include bypass access. Although the proxy server users are increasing but there are not any proper institutional mechanisms and regulations to protect users. In this study, we discuss the two sides of a proxy service includes its privacy protection function and the cyber-crime threat and propose supplementary measures to mediate between the interests of public and private.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.28 no.8B
• /
• pp.730-737
• /
• 2003

In this paper, we present an efficient authentication proxy for IEEE 802.1x systems based on the port-based access control mechanism. An IEEE 802.1x system consists of PC supplicants, a bridge with authentication client functions, and an authentication server. For the network security and user authentication purposes, a supplicant who wants to access Internet should be authorized to access the bridge port using the Extended Authentication Protocol (EAP) over LAN. The frame of EAP over LAN is then relayed to the authentication server by the bridge. After several transactions between the supplicant and the server via the bridge, the supplicant may be either authorized or not. Noting that the transactions between the relaying bridge and the server will be increased as the number of supplicants grows in public networks, we propose a scheme for reducing the transactions by employing an authentication proxy function at the bridge. The proxy is allowed to cache the supplicant's user ID and password during his first transaction with the server. For the next authentication procedure of the same supplicant, the proxy function of the bridge handles the authentication transactions using its cache on behalf of the authentication server. Since the main authentication server handles only the first authentication transaction of each supplicant, the processing load of the server can be reduced. Also, the authentication transaction delay experienced by a supplicant can be decreased compared with the conventional 802.1x system.

• The KIPS Transactions:PartA
• /
• v.13A no.2 s.99
• /
• pp.111-122
• /
• 2006

As VOD service over the Internet becomes popular, a large sealable VOD system in P2P streaming environment has become increasing important. In this paper, we propose a new proxy caching scheme, called P2Proxy, to replace the traditional proxy with a sealable P2P proxy in P2P streaming environment. In the proposed scheme, each client in a group stores a different part of the stream from a server into its local buffer and then uses a group of clients as a proxy. Each client receives the request stream from other clients as long as the parts of the stream are available in the client group. The only missing parts of the stream which are not in the client group are directly received from the server. We represent the caching process between clients in a group and a server and then describe a group creation process. This paper proposes the directory structure to share the caching information among clients. By using the directory information, we minimize message exchange overload for a stream caching and playing. We also propose a recovery method for failures about the irregular behavior of P2P clients. In this paper, we evaluate the performance of our proposed scheme and compare the performance with the existing P2P streaming systems.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.29 no.5C
• /
• pp.737-749
• /
• 2004

Kerberos authenticates clients using symmetric-key cryptography, and supposed to Oust other systems of the realm in distributed network environment. But, authentication and authorization are essential elements for the security. In this paper, we design an efficient and secure authentication/authorization mechanism by introducing the public/private-key and installing the proxy privilege server to Kerberos. In the proposed mechanism, to make a system more secure, the value of the session key is changed everytime using MAC(message authentication code) algorithm with the long-term key for user-authentication and a random number exchanged through the public key. Also, we reduce the number of keys by simplifying authentication steps. Proxy privilege server certifies privilege request of client and issues a privilege attribute certificate. Application server executes privilege request of client which is included a privilege attribute certificate. Also, a privilege attribute certificate is used in delegation. We design an efficient and secure authentication/authorization algorithm with Kerberos.

• Journal of KIISE:Computing Practices and Letters
• /
• v.9 no.1
• /
• pp.47-59
• /
• 2003

The Internet telephony service is one of the commercially successful Internet application services. VoIP technology makes the service come true. VoIP deploys H.323 or SIP as the standard protocol for the distributed multimedia services over the Internet in which QoS is not guaranteed. VoIP carries the packetized voice over the RTP/UDP/IP protocol stack. The data transmission trouble is caused by UDP when the service is provided in private networks and some ISP-provided Internet access networks in the private address space. The Internet telephony users in such networks cannot listen the voices of the other parties in the public Internet or PSTN. Making the problem more difficult, the Internet telephony service considered in this paper gets the incoming voice packets of every session through only one UDP port number. In this paper, three schemes including the terminal proxy, the gateway proxy, and the protocol translation are suggested to solve the problems. The design and implementation of the NAT proxy server based on gateway proxy scheme are described in detail.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.24 no.1
• /
• pp.165-170
• /
• 2014

In this paper, a hierarchical authentication protocol is proposed to minimize authentication delay in proxy mobile IPv6 networks. The authentication function of the AAA server is distributed to the LMAs and the MAGs. If the LMAs or the MAGs have authentication information of the MNs, they authenticate the MN on behalf of the AAA servers. Therefore, the authentication delay is reduced. The AAA server is vulnerable to denial-of-service attack. If the AAA server is down, MNs cannot access the proxy mobile IPv6 network until they are authenticated. The proposed scheme reduces the load on the AAA server by distributing the authentication function to the LMAs and the MAGs.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2016.04a
• /
• pp.997-998
• /
• 2016

최근 사물인터넷 서비스 활성화로 인해 다양한 사물인터넷 기술이 개발 중이다. 특히, 사물인터넷, 플랫폼, 시메틱, 네트워킹 기술 등은 여러 표준기구에서 독자적 표준기술로 개발이 진행 중이다. 이는 글로벌 서비스 인프라 역활을 수행해하는 사물인터넷 기능이 제 기능을 수행하지 못하는 요인이다. 최근 이런 문제를 해결하기 위해 각 표준기구에서는 각 기술간 상호운용성을 보장하기 위한 논의가 진행 중이며, 관련 기술을 개발 중이다. 본 논문에서는 다양한 상호운용성 기술 중 네트워크 측면에서 상호운용성 기술에 대한 문제를 정의하고 필요 기술을 제안한다.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.5 no.7
• /
• pp.1361-1373
• /
• 2001

In the firewall systems of 3-tier client/server systems, in general, data transmission speed is declined rapidly according to the duplicated proxy services in application server and fire wall server. In this paper, an application server configuration containing the proxy functions of firewall system is proposed so that the high speed data transmission can be achieved. The proposed application server can form the dual-homed gateway by means of the additional network interface card. The screened router of application server forms the screened subnet gateway that can separate the internal network. The proposed server configuration is more effective in traffic control than the traditional firewall systems and provides high speed data transmission with the functions of firewall. It can be also cost-effective alternative to the firewall system.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.4
• /
• pp.661-670
• /
• 2023

With the emergence of serverless computing paradigm and the innovations of cloud technology, the structure of backend server infrastructure has evolved from on-premises to container-based serverless computing. However, an access control on the server still heavily relies on the traditional SSH protocol, which poses limitations in terms of security and scalability. This hampers user convenience and productivity in managing server infrastructure. A web shell is an interface that allows easy access to servers and execution of commands from any device with a web browser. While hackers often use it to exploit vulnerabilities in servers, we pay attention to the high portability of web shell technology for server management. This study proposes a novel proxy-based server management framework utilizing web shell technology. Our evaluation demonstrates that the proposed framework addresses the drawbacks of SSH without additional overhead, and efficiently operates large-scale infrastructures in diverse computing environments.