• The Journal of the Korea Contents Association
• /
• v.22 no.2
• /
• pp.71-79
• /
• 2022

Currently, even if control and mock hacking are performed for the security of web servers, vulnerabilities continue to occur and be hacked. To solve this problem, we have developed a secure web server that can control all web communication using sockets between L4 and L5. And when giving HTTP responses, we proposed a method of combining files and headers in advance. As a result, both security and speed could be improved. Therefore, in this paper, we proposed the reason why vulnerabilities occur even if control and mock hacking occur, a solution to it, and a security web server development method that can maintain security up to DB.

• Journal of KIISE:Computer Systems and Theory
• /
• v.37 no.4
• /
• pp.226-238
• /
• 2010

OpenSSL is an open-source library implementing SSL that is a secure communication protocol. However, the library has a severe vulnerability that its security information can be easily exposed to malicious software when the library is used in a form of shared library on Linux and UNIX operating systems. We propose a scheme to attack the vulnerability of the OpenSSL library. The scheme injects codes into a running client program to execute the following attacks on the vulnerability in a SSL handshake. First, when a client sends a server a list of cryptographic algorithms that the client is willing to support, our scheme replaces all algorithms in the list with a specific algorithm. Such a replacement causes the server to select the specific algorithm. Second, the scheme steals a key for data encryption and decryption when the key is generated. Then the key is sent to an outside attacker. After that, the outside attacker decrypts encrypted data that has been transmitted between the client and the server, using the specified algorithm and the key. To show that our scheme is realizable, we perform an experiment of collecting encrypted login data that an ftp client using the OpenSSL shared library sends its server and then decrypting the login data.

• Journal of the Korea Society of Computer and Information
• /
• v.9 no.1
• /
• pp.79-86
• /
• 2004

In general, operating system is offering the security function of OS level to support several web services. However, it is true that security side of OS level is weak from many parts. Specially, it is needed to audit/trace function in security kernel level to satisfy security more than B2 level that define in TCSEC(Trusted Computer System Evaluation Criteria). So we need to create audit data at system call invocation for this, and do to create audit data of equal format about almost event and supply information to do traceback late. This Paper Proposes audit/trace system module that use LKM(Loadable Kernel Module) technique. It is applicable without alteration about existing linux kernel to ensure safe evidence. It offers interface that can utilize external audit data such as intrusion detection system, and also offers safe role based system that is divided system administrator and security administrator These data will going to utilize to computer forensics' data that legal confrontation is Possible.

• The Journal of the Korea Contents Association
• /
• v.18 no.3
• /
• pp.309-319
• /
• 2018

SELinux is used for system level security in various systems using Linux, and is now being used for device security such as IoT. However, since SELinux has inherent problems of execution time degradation, various studies have been conducted to solve this problem. In this paper, we show that performance can be improved through policy reconfiguration in the environment where the loadable module policy method, which is a general method using SELinux, is applied. By reconfiguring the access query table through the Priority-TE policy that gives priority to the type, it is possible to provide faster execution time for types requiring faster access query performance. This paper introduces the differences between SELinux policy configuration method in Monolithic environment and performance analysis. This can be used as a reference by security administrators or developers in applying SELinux.

• The Bulletin of The Korean Astronomical Society
• /
• v.35 no.1
• /
• pp.38.2-38.2
• /
• 2010

We report the current status of CQUEAN (Camera for QUasars in EArly uNiverse) development. CQUEAN is an optical CCD camera which uses a 1024*1024 pixel deep-depletion CCD. It has an enhanced QE than conventional CCD at wavelength band around 1${\mu}m$, thus it will be an efficient tool for observation of quasars at z > 7. It will be attached to the 2.1m telescope at McDonald Observatory, USA. A telescope interface containing a focal reducer is being designed to secure a larger field of view at the cassegrain focus of 2.1m telescope. Instrument control software will be written with python on linux platform. We are carrying out lab tests to investigate the characteristics of the system components in order to maximize the observational efficiency. Preliminary results of the tests will be presented. CQUEAN is expected to see the first light during summer season of 2010.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.8 no.6
• /
• pp.1086-1090
• /
• 2004

Architecture generation is the first step in the design of software systems. Most of the qualities that the final software system possesses are usually decided at the architecture development stage itself. Thus, if the final system should be usable, testable, secure, high performance, mobile and adaptable, then these qualities or non-functional requirements should be engineered into the architecture itself. In particular, adaptability is emerging as an important attribute required by almost all software systems. The machinery and tools in the remote site surveillance and connects intelligence information machinery and tools at Internet. We need the server which uses different embedded operating system to become private use. With the progress of information-oriented society, many device with advanced technologies invented by many companies. However, the current firmware technologies have many problems to meet such high level of new technologies. In this paper, we have successfully ported linux on an embedded system, which is based on intel Strong ARM SA-1110 processor, then written several network modules for internet-based network devices.

• Journal of Korea Society of Industrial Information Systems
• /
• v.12 no.3
• /
• pp.47-59
• /
• 2007

IPv4 NAT, which often used in households or under SOHO environments, is one of the factors that delays IPv6 propagation. As IPv4 NAT does not operate properly under the transition mechanism like ISATAP or 6to4 that acts as IPv6-in-IPv4 tunneling type, Microsoft proposed Teredo in order to resolve this issue. However, tunneling transition mechanism like Teredo has a security problem. That is, being tunneled packets have dual IP headers; general firewall systems apply the filtering rules only to the outer header but not inner header when these packets pass the firewall. Furthermore, attacks using unregistered server and relay can take place in Teredo. To resolve these problems, we propose a new packet filtering mechanism exclusively for Teredo. The proposed packet filtering mechanism was designed and implemented by using Linux Netfilter and ip6tables. Through functional and experimental performance tests, this packet filtering system was found operating properly and solving the Teredo packet filtering problems without serious performance degradation.