• 한국정보처리학회:학술대회논문집
• /
• 한국정보처리학회 2003년도 춘계학술발표논문집 (하)
• /
• pp.2117-2120
• /
• 2003

Trusted channel provides a means of secure communication and it includes security services such as confidentiality, authentication, and so on. This paper describes the implementation of trusted channel between secure operating systems that integrates access control mechanisms with FreeBSD kernel code[1]. The trusted channel we developed offers confidentiality an4 message authentication for network traffic based on the destination address. It is implemented in the kernel level of IP layer and transparent to users.

• Journal of Information Processing Systems
• /
• 제10권1호
• /
• pp.92-102
• /
• 2014

In recent years, there has been growing interest in secure pairing, which refers to the establishment of a secure communication channel between two mobile devices. There are a number of descriptions of the various types of out-of-band (OOB) channels, through which authentication data can be transferred under a user's control and involvement. However, none have become widely used due to their lack of adaptability to the variety of mobile devices. In this paper, we introduce a new OOB channel, which uses accelerometer-based gesture input. The gesture-based OOB channel is suitable for all kinds of mobile devices, including input/output constraint devices, as the accelerometer is small and incurs only a small computational overhead. We implemented and evaluated the channel using an Apple iPhone handset. The results demonstrate that the channel is viable with completion times and error rates that are comparable with other OOB channels.

• 한국군사과학기술학회지
• /
• 제11권3호
• /
• pp.106-114
• /
• 2008

In this paper we suggest a protocol and an algorithm which connect a secure channel between a server and a client over a TCP layer. To make key exchange time the most quickly, the protocol adopts ECC Diffie Hellman(ECCDH) algorithm. And the protocol does not use Hello message for key exchanges and state changes. We also implement this protocol over an open TCP/IP program and check the secure channel connecting time over the military computer network. The suggested protocol could be practically used on the military computer network without a hardware implementation.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제13권5호
• /
• pp.2718-2731
• /
• 2019

Conjunctive keyword search encryption is an important technique for protecting sensitive data that is outsourced to cloud servers. However, the process of searching outsourced data may facilitate the leakage of sensitive data. Thus, an efficient data search approach with high security is critical. To solve this problem, an efficient conjunctive keyword search scheme based on ciphertext-policy attribute-based encryption is proposed for cloud storage environment. This paper proposes an efficient mechanism for removing the secure channel and resisting off-line keyword-guessing attacks. The storage overhead and the computational complexity are regardless of the number of keywords. This scheme is proved adaptively secure based on the decisional bilinear Diffie-Hellman assumption in the standard model. Finally, the results of theoretical analysis and experimental simulation show that the proposed scheme has advantages in security, storage overhead and efficiency, and it is more suitable for practical applications.

• Journal of Communications and Networks
• /
• 제12권5호
• /
• pp.411-432
• /
• 2010

We consider three different secure broadcasting scenarios: i) Broadcast channels with common and confidential messages (BCC), ii) multi-receiver wiretap channels with public and confidential messages, and iii) compound wiretap channels. The BCC is a broadcast channel with two users, where in addition to the common message sent to both users, a private message, which needs to be kept hidden as much as possible from the other user, is sent to each user. In this model, each user treats the other user as an eavesdropper. The multi-receiver wiretap channel is a broadcast channel with two legitimate users and an external eavesdropper, where the transmitter sends a pair of public and confidential messages to each legitimate user. Although there is no secrecy concern about the public messages, the confidential messages need to be kept perfectly secret from the eavesdropper. The compound wiretap channel is a compound broadcast channel with a group of legitimate users and a group of eavesdroppers. In this model, the transmitter sends a common confidential message to the legitimate users, and this confidential message needs to be kept perfectly secret from all eavesdroppers. In this paper, we provide a survey of the existing information-theoretic results for these three forms of secure broadcasting problems, with a closer look at the Gaussian multiple-input multiple-output (MIMO) channel models. We also present the existing results for the more general discrete memoryless channel models, as they are often the first step in obtaining the capacity results for the corresponding Gaussian MIMO channel models.

• 제어로봇시스템학회:학술대회논문집
• /
• 제어로봇시스템학회 2003년도 ICCAS
• /
• pp.2097-2100
• /
• 2003

Many studies have been done on secure operating system using secure kernel that has various access control policies for system security. Secure kernel can protect user or system data from unauthorized and/or illegal accesses by applying various access control policies like DAC(Discretionary Access Control), MAC(Mandatory Access Control), RBAC(Role Based Access Control), and so on. But, even if secure operating system is running under various access control policies, network traffic among these secure operating systems can be captured and exposed easily by network monitoring tools like packet sniffer if there is no protection policy for network traffic among secure operating systems. For this reason, protection for data within network traffic is as important as protection for data within local system. In this paper, we propose a secure operating system trusted channel, SOSTC, as a prototype of a simple secure network protocol that can protect network traffic among secure operating systems and can transfer security information of the subject. It is significant that SOSTC can be used to extend a security range of secure operating system to the network environment.

• ETRI Journal
• /
• 제43권3호
• /
• pp.561-570
• /
• 2021

This paper presents master key identifier based protocol steganography (MKIPS), a new approach toward creating a covert channel within the Secure Real-time Transfer Protocol, also known as SRTP. This can be achieved using the ability of the sender of Voice-over-Internet Protocol packets to select a master key from a pre-shared list of available cryptographic keys. This list is handed to the SRTP sender and receiver by an external key management protocol during session initiation. In this work, by intelligent utilization of the master key identifier field in the SRTP packet creation process, a covert channel is created. The proposed covert channel can reach a relatively high transfer rate, and its capacity may vary based on the underlying SRTP channel properties. In comparison to existing data embedding methods in SRTP, MKIPS can convey a secret message without adding to the traffic overhead of the channel and packet loss in the destination. Additionally, the proposed covert channel is as robust as its underlying user datagram protocol channel.

• 한국통신학회논문지
• /
• 제34권10C호
• /
• pp.946-954
• /
• 2009

일반적인 RFID 시스템에서는 리더와 백 엔드 데이터베이스 사이의 통신 채널을 안전한 채널로 가정하고 있다. 하지만 응용 환경에 따라 리더와 데이터베이스 사이의 통신 채널이 리더와 태그 간의 통신 채널처럼 안전하지 않은 채널을 통하여 메시지를 송수신 하게 되는 경우가 얼마든지 존재한다. 본 논문에서는 데이터베이스, 리더 그리고 태그 간의 모든 통신 채널이 안전하지 않은 공개 채널임을 가정하여 공개 채널 기반의 안전한 RFID 상호인증 프로토콜을 제안한다. 제안한 프로토콜은 공개된 채널 상에 송수신되는 모든 통신 메시지의 인증과 무결성을 보장하기 위해 안전한 일방향 해쉬 함수를 사용하였다. 또한 상호인증 후 데이터베이스와 태그가 다음 세션을 위해 기존의 비밀키를 새로운 비밀키로 각각 갱신하도록 하여 전방향 안전성을 제공하도록 설계하였다.

• 대한전자공학회:학술대회논문집
• /
• 대한전자공학회 2000년도 ITC-CSCC -2
• /
• pp.735-738
• /
• 2000

The most important issue in database security is correct concurrency control under the restrictive security policy. The goal of secure transaction management is to keep security and provide many concurrent users with the high availability of database. In this paper, we consider the security environment of multidatabase system with replicated data. The read-from relationship in the existed serializability is improper in security environment. So, we define new read-from relationship and propose new secure 1-copy quasi-seriailzability by utilizing this relationship and display some examples. This security environment requires both the existed local autonomy and the security autonomy as newly defined restriction. To solve covert channel problem is the most difficult issue in developing secure scheduling scheme. The proposed secure 1-copy quasi-serializability is very proper for global transactions in that this serializability not violates security autonomy and prevents covert channel between global transactions.

• 정보보호학회논문지
• /
• 제14권3호
• /
• pp.3-12
• /
• 2004

보안운영체제는 운영체제에 내재된 보안상의 결함으로 인하여 발생할 수 있는 각종 해킹으로부터 시스템을 보호하기 위해서 기존 운영체제에 다양한 보안기능을 추가한 운영체제이다. 보안운영체제는 시스템 보안을 목적으로 고안되었으나 전체 시스템의 안전을 위해서는 네트워크 측면에서의 보안이 필수적이다. 이를 위해서 IPsec이나 SSL과 같은 네트워크 보안 프로토콜들이 개발되어 사용되고 있으나 정책이나 키 관리에 많은 주의를 필요로 하고 보안운영체제의 특성을 반영하기 어렵다. 본 논문에서는 보안운영체제 사이에서 안전한 통신을 제공하기 위한 간단한 신뢰채널 메커니즘을 소개한다. 본 신뢰채널은 네트워크 트래픽에 대해 기밀성과 인증 서비스를 제공하며, 보안운영체제에 사용되는 특정 보안정보를 전달할 수 있는 구조를 가진다. IP 계층의 커널 수준에서 구현된 신뢰채널은 단순한 처리구조를 통하여 신뢰채널 처리과정에서 발생할 수 있는 오버헤드를 줄일 수 있다.