• Journal of Information Processing Systems
• /
• v.6 no.1
• /
• pp.91-106
• /
• 2010

The rapid growth of communication and globalization has changed the software engineering process. Security has become a crucial component of any software system. However, software developers often lack the knowledge and skills needed to develop secure software. Clearly, the creation of secure software requires more than simply mandating the use of a secure software development lifecycle; the components produced by each stage of the lifecycle must be correctly implemented for the resulting system to achieve its intended goals. This study demonstrates that a more effective approach to the development of secure software can result from the integration of carefully selected security patterns into appropriate stages of the software development lifecycle to ensure that security designs are correctly implemented. The goal of this study is to provide developers with an Integrated Security Development Framework (ISDF) that can assist them in building more secure software.

• Proceedings of the Korean Operations and Management Science Society Conference
• /
• 2002.05a
• /
• pp.724-728
• /
• 2002

This paper considers a security framework for geographic information System(GIS). The GIS is an information system for supporting fast decision associated spacial problems and the system has a role of infra structure of the information system. The security is also one of the major technology for information system. However, researches on secure GIS are presented little and this paper considers the secure GIS. This paper suggest a framework for the secure GIS based on derived requirements on the secure system. Analysis on security for a serial, parallel and hierarchical secure system is also added.

• International Journal of Computer Science & Network Security
• /
• v.24 no.6
• /
• pp.41-48
• /
• 2024

Existing PoS (Point of Sale) based payment frameworks are vulnerable as the Payment Application's integrity in the smart phone and PoS are compromised, vulnerable to reverse engineering attacks. In addition to these existing PoS (Point of Sale) based payment frameworks do not perform point-to-point encryption and do not ensure communication security. We propose a Smart and Secure PoS (SSPoS) Framework which overcomes these attacks. Our proposed SSPoS framework ensures point-to-point encryption (P2PE), Application hardening and Application wrapping. SSPoS framework overcomes repackaging attacks. SSPoS framework has very less communication and computation cost. SSPoS framework also addresses Heartbleed vulnerability. SSPoS protocol is successfully verified using Burrows-Abadi-Needham (BAN) logic, so it ensures all the security properties. SSPoS is threat modeled and implemented successfully.

• 한국경영정보학회:학술대회논문집
• /
• 2007.06a
• /
• pp.646-651
• /
• 2007

Secure digital payment is critical in the successful shaping of global digital business. Digital payments are increasingly being used as a substitute to traditional payments, contributing markedly to the efficiency of the economy. The focus of every digital business transaction is to minimize risks arising from transactions. It is essential to ensure the security of digital payment whether used in internal networks or over wireless Internet. This paper analyses secure digital payment methods from the viewpoint of systemic security and transaction security. According to comparative analysis of digital payment models, this paper proposes a comparative analysis framework to investigate and evaluate secure digital payment. In conclusion, the comparative analysis framework, comparison of digital payment models and mobile payment models proposes a useful academic and practical foundation to enhance the understanding of secure digital payment methods. It also provides academic background and practical guidelines for the development of secure digital payment systems.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.16 no.4
• /
• pp.43-57
• /
• 2006

When building a software system out of software components, the composition is not simple because of the complexity caused by diverse versions, digital signatures, static type information, and off-the-shelf components from various vendors. Well-established linking policies are one of the best solutions to solve the complexity problem at linking time. Secure Linking (SL) enables users to specify their linking policies which can be enforced at link time. Secure Linking framework is a framework based on a higher-order logic in order to help build a SL system. This paper shows that the Secure Linking logic is expressive enough to describe a real-world component composition system, the linking protocol of.NET. The paper also demonstrates the advantage of the logic-based linking framework by discussing the weakness of the code signing protocol in.NET which was found while we encoded the assembly linking system of.NET.

• Journal of information and communication convergence engineering
• /
• v.8 no.2
• /
• pp.129-135
• /
• 2010

Wireless sensor networks (WSNs) are an emerging technology and offers economically viable monitoring solution to many challenging applications. However, deploying new technology in hostile environment, without considering security in mind has often proved to be unreasonably unsecured. Apparently, security techniques face many critical challenges in WSNs like data security and secrecy due to its hostile deployment nature. In order to resolve security in WSNs, we propose a novel and efficient secure framework called TriSec: a secure data framework for wireless sensor networks to attain high level of security. TriSec provides data confidentiality, authentication and data integrity to sensor networks. TriSec supports node-to-node encryption using PingPong-128 stream cipher based-privacy. A new PingPong-MAC (PP-MAC) is incorporated with PingPong stream cipher to make TriSec framework more secure. PingPong-128 is fast keystream generation and it is very suitable for sensor network environment. We have implemented the proposed scheme on wireless sensor platform and our result shows their feasibility.

• 제어로봇시스템학회:학술대회논문집
• /
• 2005.06a
• /
• pp.1586-1589
• /
• 2005

GUMF (Global User Management Framework) that is proposed in this research can be applied to next generation network such as BcN (Broadband convergence Network), it is QoS guaranteed security framework for user that can solve present Internet's security vulnerability. GUMF offers anonymity for user of service and use the user's real-name or ID for management of service and it is technology that can realize secure QoS. GUMF needs management framework, UMS (User Management System), VNC (Virtual Network Controller) etc. UMS consists of root UMS in country dimension and Local UMS in each site dimension. VNC is network security equipment including VPN, QoS and security functions etc., and it achieves the QoSS (Quality of Security Service) and CLS(Communication Level Switching) functions. GUMF can offer safety in bandwidth consumption attacks such as worm propagation and DoS/DDoS, IP spoofing attack, and current most attack such as abusing of private information because it can offer the different QoS guaranteed network according to user's grades. User's grades are divided by 4 levels from Level 0 to Level 3, and user's security service level is decided according to level of the private information. Level 3 users that offer bio-information can receive secure network service that privacy is guaranteed. Therefore, GUMF that is proposed in this research can offer profit model to ISP and NSP, and can be utilized by strategy for secure u-Korea realization.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.6 no.12
• /
• pp.3366-3383
• /
• 2012

Reliance on the Internet has introduced Voice over Internet Protocol (VoIP) to various security threats. A reliable security protocol and an authentication scheme are thus required to prevent the aforementioned threats. However, an authentication scheme often demands additional cost and effort. Accordingly, a security framework for known participants in VoIP communication is proposed in this paper. The framework is known as Randomness-Optimized Self-Securing (ROSS), which performs authentication automatically throughout the session by optimizing the uniqueness and randomness of the communication itself. Elliptic Curve Diffie-Hellman (ECDH) key exchange and Salsa20 stream cipher are utilized in the framework correspondingly to secure the key agreement and the communication with low computational cost. Human intelligence supports ROSS authentication process to ensure participant authenticity and communication regularity. The results show that with marginal overhead, the proposed framework is able to secure VoIP communication by performing reliable authentication.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.12 no.1
• /
• pp.81-87
• /
• 2016

Cloud computing technologies are utilized and merged in various domains. Cloud computing technology-based personal cloud service technologies provide mobility and free access by using user centered storages and smart devices such like smart phones and table PCs. Therefore, we should overcome limits on the storage by solving the capacity problems of devices to provide security services in the personal cloud environments It can be addressable to provide the convenience of various security technologies. However, there are some security threats inherited from existing cloud environments and the possibilities of information leakage when devices are lost or stolen. Therefore, we designed a framework for providing secure cloud services by adding objects, such as user authorization, access tokens, set permissions by key generation, and key management assignments, for user management in personal cloud environments. We analyzed the stability of the proposed framework in terms of irreverent use and abuse, access to insiders, and data loss or leakage. And we evaluated the proposed framework in terms of the security with access control requirements in personal cloud environments.

• Journal of The Institute of Information and Telecommunication Facilities Engineering
• /
• v.9 no.3
• /
• pp.102-106
• /
• 2010

Recently process industries from oil and gas procedures and mining companies to manufactures of chemicals, foods, and beverages has been exploring the USN (Ubiquitous Sensor Networks) technology to improve safety of production processes. However, to apply the USN technology in the large-scale plant industry, reliability and security issues are not fully addressed yet, and the absence of the industrial sensor networking standard causes a compatibility problem with legacy equipment and systems. Although this situation, process industry such as energy plants are looking for the secure wireless plant solution to provide detailed, accurate safety monitoring from previously hard-reach, unaccordable area. In this paper, SPSF (Smart Plant Safety Framework based on Reliable-Secure USN) is suggested to fulfill the requirements of high-risk industrial environments for highly secure, reliable data collection and plant monitoring that is resistant to interference. The SPSF consists of three main layers: 1) Smart Safety Sensing Layer, 2) Smart Safety Network Layers, 3) Plant Network System Layer.