• The KIPS Transactions:PartC
• /
• v.14C no.6
• /
• pp.537-544
• /
• 2007

A home network is a residential local area network in which digital home appliances are connected with each other. Applying the mobile agent technology to the home network is expected to provide a new computing model. In particular, mobility and asynchronous ability of mobile agent can be used to reduce network traffic generated for managing home appliances. However, in order to apply the mobile agent concept to the home network, access control for mobile agents is necessary. In the existing home network system, there is one special server, sometimes called home server This server generally has mapping tables to be updated periodically, which describes access control lists between users' authorities and corresponding devices. In this paper, we propose a role-based access control framework with mobile agents in home networks. This framework, called Secure KAgent framework, is designed and implemented based on KAgent system. It has two main characteristics: to control access permissions based on Role-Based Access Control(RBAC) scheme and to safety assign roles to mobile agents by role tickets.

• Journal of Internet Computing and Services
• /
• v.14 no.4
• /
• pp.35-42
• /
• 2013

Nowadays many tasks are performed using the Web. Accordingly, many web-based application systems with various and complicated functions are being requested. In order to develop such web-based application systems efficiently, object-oriented analysis and design methodology is used, and Java EE(Java Platform, Enterprise Edition) technologies are used for its implementation. The security issues have become increasingly important. For such reasons, Java EE provides mechanism related to security but it does not provide interconnections with object-oriented analysis and design methodology for developing web application system. Consequently, since the security method by Java EE mechanism is implemented at the last step only, it is difficult to apply constant security during the whole process of system development from the requirement analysis to implementation. Therefore, this paper suggests an object-oriented analysis and design methodology emphasized in the security for secure web application systems from the requirement analysis to implementation. The object-oriented analysis and design methodology adopts UMLsec, the modeling language with an emphasis on security for the requirement analysis and system analysis & design with regard to security. And for its implementation, RBAC (Role Based Access Control) of servlet from Java EE technologies is used. Also, the object-oriented analysis and design methodology for the secure web application is applied to online banking system in order to prove its effectiveness.

• Journal of the Korea Society of Computer and Information
• /
• v.18 no.6
• /
• pp.63-70
• /
• 2013

In accordance with the advancement of IT, application systems with various and complex functions are being required. Such application systems are typically built based on database in order to manage data efficiently. But most object-oriented analysis design methodologies for developing web application systems have not been providing interconnections with the database. Since the requirements regarding the security issues increased, the importance of security has become emphasized. However, since the security is usually considered at the last step of development, it is difficult to apply the security during the whole process of system development, from the requirement analysis to implementation. Therefore, this paper suggests an object-oriented analysis and design methodology for secure database design from the requirement analysis to implementation. This object-oriented analysis and design methodology for secure database design offers correlations with database that most existing object-oriented analysis and design methodologies could not provide. It also uses UMLsec, the modeling language, to apply security into database design. In addition, in order to implement security, RBAC (Role Based Access Control) of relational database is used.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.12 no.4
• /
• pp.41-53
• /
• 2002

Role Based Access Control (RBAC), which is a method, using role as an access control, has been popular with users and it is recognized as an effective method to replace the Discretionary Access Control and the Mandatory Access Control However, the existing Role Based Access Control Models have only been limited to the bureaucracy organization in which a distinctive hierarchy system was used, incorporating a stable structure and a standardized work system. Only in some parts, some access control models have been used, which supports 'Team' concept, such as Team Based Access Control Model. However, it did not incorporate the characteristics of the adhocracy organization, which is similar to the company's task force team, whose characteristics are organic, temporary, no standardized operation procedures, and many frequent changes. In this study, we have discussed the characteristics of the adhocracy organization which is different from the existing bureaucracy organization, and we have also discussed the problems related to when the existing access control models are used as the access control model for the adhocracy organization due to its characteristics. In addition, based on the problems, we have suggested an improved role based access control model for the adhocracy organization, and have come up with the solutions when any problems occur in the access control system.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.16 no.3
• /
• pp.39-52
• /
• 2006

Recently purpose is used by an crucial part to security management when collecting data about privacy. The W3C(World Wide Web Consortium) describes a standard spec to control personal data that is provided by data providers who visit the web site. But they don't say anymore about security management about personal data in transit after data collection. Recently several researches, such as Hippocratic Databases, Purpose Based Access Control and Hippocratic in Databases, are dealing with security management using purpose concept and access control mechanism after data collection a W3C's standard spec about data collection mechanism but they couldn't suggest an efficient mechanism for privacy protection about personal data because they couldn't represent purpose expression and management of purposes sufficiently. In this paper we suggest a mechanism to improve the purpose expression. And then we suggest an accesscontrol mechanism that is under least privilege principle using the purpose classification for privacy protection. We classify purpose into Along purpose structure, Inheritance purpose structure and Stream purpose structure. We suggest different mechanisms to deal with then We use the role hierarchy structure of RBAC(Role-Based Access Control) for flexibility about access control and suggest mechanisms that provide the least privilege for processing the task in case that is satisfying using several features of purpose to get least privilege of a task that is a nit of business process.

• Review of KIISC
• /
• v.10 no.4
• /
• pp.69-82
• /
• 2000

자바기술은 플랫폼에 독립적인 프로그래밍 언어와 실행환경 특성으로 인터넷의 확산과 함께 활용분야를 넓혀가고 있다. 초기의 매우 엄격한 자비 보안모델은 네트워크 환경에서 유용한 기능을 수행하는 프로그램 개발에 장애가 되었으나, 현재는 보안정책에 기반한 유연한 접근통제기능을 제공하도록 수정, 보완되었다. 그러나 현재의 자바 보안모델이 코드 기반의 접근통제기능만을 제공하고 있어 네트워크 환경에서 여러 사용자에 의해 수행되는 응용 프로그램 실행환경에 적합하지 않은 문제점이 있다. 본 논문에서는 이와 같은 문제점을 해결하기 위해 자바 환경에 역할기반 접근통제모델을 적용하는 연구들에 대해 살펴보고 역할기반 접근통제모델이 적용된 자바 기술이 활용될 수 있는 분야에 대해 기술한다.

• Proceedings of the Korean Information Science Society Conference
• /
• 2002.04a
• /
• pp.853-855
• /
• 2002

안전한 운영체제(Secure Operating System)는 컴퓨터 운영체제의 보안상 결함으로 인하여 발생 가능한 각종 해킹으로부터 시스템을 보호하기 위하여 기존의 운영체제 내에 보안 기능을 통합시킨 보안 커널(Security Kernel)을 추가로 이식한 운영체제이다. 본 논문에서는 polaris 8에서 동작하는 보안 커널을 설계하기 위해 안전한 운영체제와 보안 커널 개발 기술, 솔라리스 운영체제 및 커널 기술을 살펴본다. 이를 토대로 RBAC(Role-Based Access Control)을 지원하고 시스템의 취약점을 감시하는 Solaris 8 기반의 보안 강화용 LKM(Loadable Kernel Module)을 설계한다.

• Proceedings of the Korean Information Science Society Conference
• /
• 2008.06a
• /
• pp.128-129
• /
• 2008

• Proceedings of the Korean Information Science Society Conference
• /
• 2006.06c
• /
• pp.280-282
• /
• 2006

동적인 환경 정보를 제공하는 RFID 플랫폼 환경을 위한 보안 서비스를 제공하기 위해서는 동적인 분산 환경에 대한 고려가 필요하고, 한 번의 인증으로 여러 서비스를 이용할 수 있어야 하고, 다양한 자원의 보안 정책을 단순화 시키고, 보안 정책의 설정과 변경이 쉬워야 있어야 한다. 본 논문에서는 RFID 애플리케이션을 위한 상황 인식 보안 아키텍처로서 Single Sign-On 개념을 구현한 Kerberos를 이용한 통합 인증 모델과 단순한 권한 관리를 위해서 RBAC를 이용한 권한 관리 모델을 제시한다.

• The Magazine of the IEIE
• /
• v.30 no.6
• /
• pp.599-607
• /
• 2003

기업간 파트너쉽이 e-비즈니스 네트워크로 발전하면서 사용자에 대한 안전하고 효과적인 인증은 물론 인증된 사용자의 특정 서비스에 대한 접근권한의 관리요구가 크게 대두되고 있다. PKI 기반 기술로 사용자 인증, 데이터 기밀성 및 무결성 서비스는 가능하지만 사용자 및 자원에 대한 권한 관리는 별도의 기반기술이 요구된다. 웹 사이트들을 파트너 쉽으로 연결해주는 크로스 도메인간의 단일인증, 보호 대상 자원에 대한 접근제어, 파트너간의 상호연동성 및 이기종 연동 등의 요구사항을 만족시키기 위한 권한관리 기반기술이 필요하다. 본고에서는 PMI 표준, 접근제어, RBAC, SAML 및 XACML 기술에 대한 소개와 권한관리 시스템 구축 모델에 대하여 설명한다.