• Proceedings of the Korean Information Science Society Conference
• /
• 2004.04a
• /
• pp.376-378
• /
• 2004

인터넷의 사용이 날로 증가함에 따라 전자상거래가 인터넷을 통해 활발하게 이루어지는데 있어서 금융권 및 각종 기타 기관에서는 인증서 기반의 전자서명을 사용하고 있다. 이러한 인증서 기반의 시스템은 궁극적으로 SSO(Single Sign-On)를 지향하는데, 동일 인증기관 내의 모든 서비스는 단 한 번의 접속으로 모두 사용할 수 있게 하는 것이 그 목적이다. 그러나 SSO는 동일 인증기관이라는 제약사항이 따르기 때문에 인터넷을 이용하는 사용자들이 각 인증기관별로 인증서를 따로 관리하게 되는 불편함이 생기게 된다. 따라서 본 논문에서는 OASIS에서 발표한 SAML을 이용하여 다른 이질적인 인증기관간의 인증을 통합 할 수 있는 방법을 제시하고자 한다.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.18 no.1
• /
• pp.32-39
• /
• 2017

Recently, usage of mobile cloud services has been increasing. In particular, beyond the constraints of a single cloud computing service, studies on the multi-cloud have been actively pursued. A user must authenticate multiple cloud service providers to use additional cloud services in a multi-cloud. In previous studies, an authentication method using single sign-on (SSO) was not available in all cloud services. Cloud services will not be available when the SSO server is not available due to malicious attacks, because all authentication is done via the SSO server. Additionally, using a broker, there is a vulnerability that can expose authentication information for the service provider to a user who did not sign up. In this paper, we propose a secure user authentication protocol using biometric authentication that does not expose user information when using additional cloud services. The proposed protocol can use a single biometric authentication for multi-cloud services without storing authentication information in each cloud service. In terms of key stability (to ensure stability through the key agreement process and the key area), by disabling various attack methods, such as man-in-the-middle attacks and replay attacks, we provide secure mobile cloud services.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.27 no.2
• /
• pp.373-381
• /
• 2017

Currently, various types of user authentication methods based on public certificates are used in domestic financial transactions. Such an authorized certificate method has a problem that a different security module must be installed every time a user connects an individual financial company to a web server. Also, the financial company relying on this authentication method has a problem that a new security module should be additionally installed for each financial institution whenever a next generation authentication method such as biometric authentication is newly introduced. In order to solve these problems, we propose an integrated authentication system that handles user authentication on behalf of each financial institution in financial transactions, and proposes an integrated authentication protocol that handles secure user authentication between user and financial company web server. The new authentication protocol is a modified version of OAuth2.0 that increases security and efficiency. It is characterized by performing a challenge-response protocol with a pre-shared secret key between the authentication server and the financial company web server. This gives users a convenient and secure Single Sign-On (SSO) effect.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.14 no.5
• /
• pp.11-21
• /
• 2004

To authorize IPSec-VPN Client in Client-to-Gateway type of the IPSec-VPN system, it can be normally used with ID/Password verification method or the implicit authorization method that regards implicitly IPSec-VPN gateway as authorized one in case that the IPSec-VPN client is authenticated. However, it is necessary for the Client-to-Gateway type of the IPSec-VPN system to have a more effective user authorization mechanism because the ID/Password verification method is not easy to transfer the ID/Password information and the implicit authorization method has the vulnerability of security. This paper proposes an effective user authorization mechanism using an attribute certificate and designs a user authorization engine. In addition, it is implemented in this study. The user authorization mechanism for the IPSec-VPN system proposed in this study is easy to implement the existing IPSec-VPN system. Moreover, it has merit to guarantee the interoperability with other IPSec-VPN systems. Furthermore, the user authorization engine designed and implemented in this paper will provide not only DAC(Discretional Access Control) and RBAC(Role-Based Access Control) using an attribute certificate, but also the function of SSO(Single-Sign-On).

• Journal of Broadcast Engineering
• /
• v.14 no.4
• /
• pp.463-474
• /
• 2009

By employing the subscriber concept in broadcasting services, IPTV (Internet Protocol Television) operators provide various grades of services to subscribers based on the billing level of the subscribers. With the income from subscribers for a basis, IPTV operators plan to provide high quality services. Since Web browser-based IPTV provides T-commerce and E-commerce services as well as television services, users may frequently visit other service domains to buy goods or content. To provide the user with charged or private services, these service domains request authentication of user. The existing authentication system is not appropriate for the IPTV service environment because the environment unavoidably forces the user to cross from one authentication-based service domain to another. Single sign-on provides a user with transparent authentication services by enabling an authenticated user to move between authentication-based service domains without any re-authentication. Like this distributed environment, since the IPTV service environment also provides a variety of authentication-based services, transparent authentication service needs to be provided to subscribers who want to access charged or private services. In this paper, we propose a new user authentication scheme for the IPTV environment. This scheme integrates the Security Assertion Markup Language (SAML), which is a standard for XML-based single sign on. We validate this scheme using a simple use case scenario.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2005.11a
• /
• pp.1179-1182
• /
• 2005

공공 부문이나 대기업에서 운영하는 웹 사이트의 규모가 커지면서 분야별로 사이트가 나누어지게 되는데, 사이트를 이동할 때 마다 로그인을 다시 해야 하는 불편이 있다. 따라서 최근 이용자들의 불편을 줄이기 위하여 SSO(Single Sign-On) 통합인증 체제를 도입하는 사례가 늘고 있으나 전체 패밀리 사이트를 일괄적으로 가입과 탈퇴되는 문제가 발생한다. 이에 이용자의 필요에 따라 선택적으로 가입과 탈퇴가 가능한 통합 인증체제 방안을 제안하고자 한다.

• Journal of the Korea Society of Computer and Information
• /
• v.24 no.8
• /
• pp.67-76
• /
• 2019

Along with the diversification of digital content services using wired/wireless networks, the market for the construction of base systems is growing rapidly. Cloud computing services are recognized for a reasonable cost of service and superior system operations. Cloud computing is convenient as far as system construction and maintenance are concerned; however, owing to the security risks associated with the system construction of actual cloud computing service, the ICT(Information and Communications Technologies) market is lacking regardless of its many advantages. In this paper, we conducted an experiment on a cloud computing security enhancement model to strengthen the security aspect of cloud computing and provide convenient services to the users. The objective of this study is to provide secure services for system operation and management while providing convenient services to the users. For secure and convenient cloud computing, a single sign-on (SSO) technique and a system access control technique are proposed. For user authentication using SSO, a security level is established for each user to facilitate the access to the system, thereby designing the system in such a manner that the rights to access resources of the accessed system are not abused. Furthermore, using a user authentication ticket, various systems can be accessed without a reauthorization process. Applying the security technique to protect the entire process of requesting, issuing, and using a ticket against external security threats, the proposed technique facilitates secure cloud computing service.

• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 2002.11a
• /
• pp.280-283
• /
• 2002

본 논문에서는 기존 서버 원격관리 시스템이 안고있던 보안상의 문제점을 최근에 보안 인프라로써 각광을 받고 있는 PKI(Public Key Infrastructure)를 사용한 원격 통합 서버관리 시스템을 제안하고자 한다. 통합 인증서버는 관리자의 인증을 SCVP를 사용해서 검증하며, SSL(Secure Socket Layer)을 통해서 데이터의 기밀성을 보장한다. 또한 제안된 시스템은 관리자가 다양한 종류의 플랫폼과 운영체제를 한번의 인증과정으로 원격에서 통합 관리가 가능한 SSO(Single-Sign On) 시스템이다.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.35 no.3B
• /
• pp.503-516
• /
• 2010

In this paper, we propose the converged profile and authentication scheme for supporting converged media services of broadcasting & communications convergence in fixed mobile convergence networks. The proposed scheme supports the management of access, service, mobility and IPTV profiles on subscriber and a function of open API(Application Program Interface) for providing the subscriber profile for the third party service provider with the PUSH/PULL method. The open API is based on a web service and a REST(Representational State Transfer) and provides various services for the third party service provider with ease. In addition, the proposed scheme supports a function of SSO(Single Sign-on). After user succeeded in establishing an access connection, user can sustain the same authentication state with this function although connected access network is changed or IMS(IP Multimedia Subsystem) service network is attached. We evaluate and analyze the performance of the proposed scheme through the implementation of CUPS(Converged User Profile Server) system test-bed.

• Journal of the Institute of Electronics Engineers of Korea CI
• /
• v.47 no.6
• /
• pp.19-27
• /
• 2010

Many security issues occur in cloud computing service environment such as authentication, access control, and so on. In this paper, we propose an effective authentication and access control model which provide integrated management and control when we access various resources in cloud computing environment. To address these problems, we suggest a context-aware single sign-on and access control system using context-awareness, integrated authentication, access control, and OSGi service platform in cloud computing environment. And we show design and implementation of context-aware single sign-on and access control system. Also we verified the flexibility and convenience of the proposed system through multi fact based integrated authentication in cloud computing environment. We could provide flexible and secure seamless security service by user context in cloud computing environment.