• Title/Summary/Keyword: Secure Programming

Search Result 70, Processing Time 0.03 seconds

Software Security Quality Improvement Using Secure Coding Standard (소프트웨어 보안품질 향상을 위한 시큐어 코딩표준 활용)

  • Jang, Young Su;Choi, Jin Young
    • Proceedings of the Korea Information Processing Society Conference
    • /
    • 2010.11a
    • /
    • pp.1101-1103
    • /
    • 2010
  • 과거 인터넷을 사용하지 않는 시스템의 경우 소프트웨어의 안전성과 강건성은 철도, 국방, 우주, 항공, 원자력 등 오류 없이 수행되어야 하는 임베디드 소프트웨어에 국한되어 있었다. 그러나 인터넷의 발전으로 인터넷을 통한 정보의 교류 및 서비스가 증대하면서 소프트웨어의 보안품질은 개인, 사회, 국가 모두에게 정보보호의 중요성을 더욱 강조하고 있다. 특히 오류 없이 수행되어야 하는 고안전성 소프트웨어의 개발 기법은 이제 응용 소프트웨어의 보안강화 활동에 활용 되고 있다. 시큐어 코딩 (Secure Coding)은 방어적 프로그램(Defensive Programming)을 포함하는 개념으로 소프트웨어의 안전성과 보안성을 향상 시킬 수 있다. 본 논문에서는 C 언어의 취약가능성 유발 명령어를 예를 들고 시큐어 코딩 기법을 적용하여 취약한 코드를 개선하였다. 이러한 개선을 통해 보안 취약성 유발 가능한 코드 부분을 손쉽게 수정하여 소프트웨어 보안품질을 개선할 수 있다.

A cryptographic API to provide the secure key protection function (안전한 키보호 기능을 제공하는 암호 API)

  • 김명희;전문석
    • Proceedings of the Korean Information Science Society Conference
    • /
    • 2004.10a
    • /
    • pp.334-336
    • /
    • 2004
  • 국내 전자상거래 제품과의 호환성과 확장성을 위하여 국내 전자서명 표준인 KCDSA(Korean Certificate-based Digital Signature Algorithm) 메커니즘을 PKCS(Public Key Cryptographic Standard) #11 암호 API(Application Programming Interface)에 기능을 추가한다. PKCS #11에서 정의한 키 관리(Hey Management) 함수의 입력 파라미터에 암호화할 키를 바로 입력하면 변조된 키를 전달할 수 있으므로, 본 논문에서는 안전한 키보호(Key Protection) 함수를 새로 정의하여 암호화할 키 대신 사용자 PIN(Personal Identification Number: 패스워드) 입력하여 사용자의 KCDSA 개인키와 공개키를 보다 더 안전하게 보관하고자 한다.

  • PDF

A Systematic Literature Review on Secure Software Development using Feature Driven Development (FDD) Agile Model (기능주도개발 Agile 방법을 사용할 때의 안전한 소프트웨어 개발에 관한 문헌연구)

  • Arbain, Adila Firdaus;Ghani, Imran;Jeong, Seung Ryul
    • Journal of Internet Computing and Services
    • /
    • v.15 no.1
    • /
    • pp.13-27
    • /
    • 2014
  • Agile methodologies have gained recognition as efficient development processes through their quick delivery of software, even under time constraints. However, like other agile methods such as Scrum, Extreme Programming (XP) and The Dynamic Systems Development Method (DSDM), Feature Driven Development (FDD) has been criticized due to the unavailability of security elements in its twelve practices. In order to examine this matter more closely, we conducted a systematic literature review (SLR) and studied literature for the years 2001-2012. Our findings highlight that, in its current form, the FDD model partially supports the development of secure software. However, there is little research on this topic, as detailed information about the usage of secure software is rarely published. Thus, we have been able to conclude that the existing five phases of FDD have not been enough to develop secure software until recently. For this reason, security-based phase and practices in FDD need to be proposed.

A Real Business Cycle Model to Study the Effect of Overseas Oil Resource Development on the Korean Economy (실물경기변동 모형을 이용한 해외석유가스 개발사업의 경제적 효과분석)

  • Park, Hojeong;Kim, Jaekyung
    • Environmental and Resource Economics Review
    • /
    • v.25 no.2
    • /
    • pp.179-197
    • /
    • 2016
  • The development of overseas resource is a driving force to secure the energy security in Korea with low sufficiency rate of energy. This paper analyzes the effect of overseas oil resource development on the economy by presenting a real business cycle model with consolidated energy price index. A linear-quadratic dynamic programming is adopted to raise computational transparency and efficiency. The analysis shows that the overseas oil resource development project during 2010 and 2012 decreases the energy price by 1.2% per annum which effect is equivalent to the positive 0.47% to the GDP. The implication calls for steady and robust support for overseas resource development projects to enhance energy resilience.

A Study on the HDTV Programming of Three Major Terrestrial Broadcasting Systems (지상파방송 3사의 HDTV프로그램 편성에 관한 연구)

  • Yu, Sae-Kyung;Kim, Mi-Ra
    • Korean journal of communication and information
    • /
    • v.29
    • /
    • pp.111-145
    • /
    • 2005
  • In this study, the problems In the current HDTV programming strategies were critically inquired into and reform measures were sought through in-depth interview with HDTV programming staff and program directors of the three major terrestrial broadcasting systems that are in their fourth year of HDTV broadcasting, and through analysis of the characteristics of HDTV programming. The analysis of this study showed that the time allocated to HDTV programs far exceeded the thirteen hours per week set by the Korean Broadcasting Commission. However, the percentage of HDTV programs broadcasted during the prime time was low, which as a result, limited the opportunity for the audiences to experience HDTV. furthermore, the low percentage of programs such as documentaries, sports, movies, etc. that are preferred by early adopters and through which the features of HDTV including high quality of picture, wide screen, etc. can be fully applied and shown did not appear to help in accelerating the popularization of HDTV In order to improve these problems, despite their having to bear the initial production costs, the broadcasting systems must come up with an aggressive strategies for the programming of documentaries, sports programs and dramas in order to strengthen the competitiveness in HDTV production and secure future adopters, and together with this, full support from the policy planning authorities and companies manufacturing electric home appliances, the other leaders in DTTB(Digital Terrestrial Television Broadcasting) transition, are necessary in order to promote the production of HD contents.

  • PDF

Design and Implementation of Information Security System to Prevent Leakage of Drawing Information (설계정보 유출방지를 위한 정보보안시스템 설계 및 구현)

  • Chang, H.B.;Lee, H.S.
    • Korean Journal of Computational Design and Engineering
    • /
    • v.11 no.5
    • /
    • pp.327-334
    • /
    • 2006
  • Recently, security incidents are growing rapidly in which internal employees let the drawing leak out to competitors or other countries. This type of security incidents has a characteristic that it occurs less frequently than other types of security incidents such as network or server security incident, but the damage is a lot more serious. The existing information security technologies to prevent internal information from being leaked out are only applicable to general documents(office documents, web pages and image files in which data are encrypted one by one). However, architectural drawings made up of collection of files with various formats(extensions) have problems with the process speed of en(de) cryption and accuracy, so the developments of security technologies by new methods are required. In this study, we design and develop a security technology based on work area with which users can protect the leakage of critical information in the kernel level while maintaining their work environment when they have to use sharing information that cannot be managed by the unit of file. As a result, we developed the "Virtual Secure Disk" which allows only authorized users and applications to have an access to drawings, and have verified its security by applying it to the actual company.

Robust Secure Transmit Design with Artificial Noise in the Presence of Multiple Eavesdroppers

  • Liu, Xiaochen;Gao, Yuanyuan;Sha, Nan;Zang, Guozhen;Wang, Shijie
    • KSII Transactions on Internet and Information Systems (TIIS)
    • /
    • v.15 no.6
    • /
    • pp.2204-2224
    • /
    • 2021
  • This paper studies secure wireless transmission from a multi-antenna transmitter to a single-antenna intended receiver overheard by multiple eavesdroppers with considering the imperfect channel state information (CSI) of wiretap channel. To enhance security of communication link, the artificial noise (AN) is generated at transmitter. We first design the robust joint optimal beamforming of secret signal and AN to minimize transmit power with constraints of security quality of service (QoS), i.e., minimum allowable signal-to-interference-and-noise ratio (SINR) at receiver and maximum tolerable SINR at eavesdroppers. The formulated design problem is shown to be nonconvex and we transfer it into linear matrix inequalities (LMIs). The semidefinite relaxation (SDR) technique is used and the approximated method is proved to solve the original problem exactly. To verify the robustness and tightness of proposed beamforming, we also provide a method to calculate the worst-case SINR at eavesdroppers for a designed transmit scheme using semidefinite programming (SDP). Additionally, the secrecy rate maximization is explored for fixed total transmit power. To tackle the nonconvexity of original formulation, we develop an iterative approach employing sequential parametric convex approximation (SPCA). The simulation results illustrate that the proposed robust transmit schemes can effectively improve the transmit performance.

Design and Implementation of Java Crypto Provider for Android Platform (안드로이드 플랫폼을 위한 자바 보안 프로바이더 설계 및 구현)

  • Son, Mikyung;Kang, Namhi
    • The Journal of Korean Institute of Communications and Information Sciences
    • /
    • v.37C no.9
    • /
    • pp.851-858
    • /
    • 2012
  • Java crypto library such as SUN JCA/JCE or BC JCE is generally used to implement secure applications for smart devices using Android platform. Programming functions written by Java language are launched and executed inside Java Virtual Machine (JVM), thereby difficult to use system hardware specific functionalities and degrading performance as well. In case of crypto primitive, few secure applications can use crypto primitive executing in JVM because both amount of computing and complexity of such primitives are very high. From the aspect of performance, in particular, time sensitive real time applications such as streaming services or secure application frequently applying public key based crypto algorithm cannot use Java crypto library. To solve the problem, we design and implement crypto library which employ JNI and NDK methods to directly access functions that implemented by native language such as C or C++. The proposed Java Crypto provider supports faster execution. Also developer can use our provider in the same way by writing traditional Java crypto library.

On-Chip Multiprocessor with Simultaneous Multithreading

  • Park, Kyoung;Choi, Sung-Hoon;Chung, Yong-Wha;Hahn, Woo-Jong;Yoon, Suk-Han
    • ETRI Journal
    • /
    • v.22 no.4
    • /
    • pp.13-24
    • /
    • 2000
  • As more transistors are integrated onto bigger die, an on-chip multiprocessor will become a promising alternative to the superscalar microprocessor that dominates today's microprocessor marketplace. This paper describes key parts of a new on-chip multiprocessor, called Raptor, which is composed of four 2-way superscalar processor cores and one graphic co-processor. To obtain performance characteristics of Raptor, a program-driven simulator and its programming environment were developed. The simulation results showed that Raptor can exploit thread level parallelism effectively and offer a promising architecture for future on-chip multi-processor designs.

  • PDF

Fast Double Random Phase Encoding by Using Graphics Processing Unit (GPU 컴퓨팅에 의한 고속 Double Random Phase Encoding)

  • Saifullah, Saifullah;Moon, In-Kyu
    • Proceedings of the Korea Multimedia Society Conference
    • /
    • 2012.05a
    • /
    • pp.343-344
    • /
    • 2012
  • With the increase of sensitive data and their secure transmission and storage, the use of encryption techniques has become widespread. The performance of encoding majorly depends on the computational time, so a system with less computational time suits more appropriate as compared to its contrary part. Double Random Phase Encoding (DRPE) is an algorithm with many sub functions which consumes more time when executed serially; the computation time can be significantly reduced by implementing important functions in a parallel fashion on Graphics Processing Unit (GPU). Computing convolution using Fast Fourier transform in DRPE is the most important part of the algorithm and it is shown in the paper that by performing this portion in GPU reduced the execution time of the process by substantial amount and can be compared with MATALB for performance analysis. NVIDIA graphic card GeForce 310 is used with CUDA C as a programming language.

  • PDF