• Proceedings of the KIEE Conference
• /
• 2007.04a
• /
• pp.163-165
• /
• 2007

Recently, the security requirements of the embedded system which were not considered when the embedded system is independently deployed are being increased because the embedded system is connected to an internet. The connection to the internet of embedded system is the meaning that it is exposed to the various kinds of external attack and can be a victim to these attacks in anytime. Particularly, it is trend that the user-related information is stored into the personal terminals and/or electrical appliances such as PDA, home gateway for home network, settop boxes and so on. So it is needed the security mechanism which protects the user information from the malicious accesses. Accordingly, the coverage of the system security is being expanded from the general server to the embedded system. And it is not enough that the embedded system supports only its inherent functions and it becomes the essential element to provide the security function to the embedded system. This paper applies the RBAC(role-based access control) function to the embedded linux OS and tries to strengthen the security of the embedded linux OS. RBAC is implemented as a loadable kernel module with LSM(Linux Security Module) security framework for user's flexibility.

• Journal of Navigation and Port Research
• /
• v.47 no.2
• /
• pp.57-65
• /
• 2023

In 2017, the International Maritime Organization (IMO) adopted MSC.428 (98), which recommends establishing a cyber-risk management system in Ship Safety Management Systems (SMSs) from January 2021. The 27th International Association of Marine Aids to Navigation and Lighthouse Authorities (IALA) also discussed prioritizing cyber-security (cyber-risk management) in developing systems to support Maritime Autonomous Surface Ship (MASS) operations (IALA guideline on developments in maritime autonomous surface ships). In response to these international discussions, Korea initiated the Korea Autonomous Surface Ship technology development project (KASS project) in 2020. Korea has been carrying out detailed tasks for cybersecurity technology development since 2021. This paper outlines the basic concept of ship network security equipment for supporting MASS ship operation in detailed task of cybersecurity technology development and defines ship network security equipment interface for MASS ship applications.

• The KIPS Transactions:PartC
• /
• v.11C no.4
• /
• pp.519-526
• /
• 2004

This paper presents an efficient interoperation scheme of a VPN(Virtual Private Network) and Mobile IP using a hierarchical structure of a FA(Foreign Agent). In the proposed scheme, the GFA(Gateway Foreign Agent) plays a role of VPN gateway on behalf of the MN(Mobile Node). When the MN moves in the same GFA domain, because the GFA has already an IPsec security association with a VPN gateway in the home network of the MN, the MN does not need an IPsec re-negotiaion. In this way, our mechanism reduces a message overhead and a delay resulted from an IPsec negotiation. And a MN can send a data to a correspondent node without a packet leakage. We show a performance of our scheme by using a discrete analytical model. Analytical results demonstrated that the total processing cost calculated by a registration update cost and a packet delivery cost is significantly reduced through our proposed scheme.

• The Journal of the Korea Contents Association
• /
• v.11 no.2
• /
• pp.142-151
• /
• 2011

All medical information over sensor networks need to transmit and process securely in the u-Health services. The reliability of transmission between u-Health medical sensor devices and gateway is very important issue. When the user moves to other place with u-Health devices, its signal strength is going down and is far from the coverage of gateway. In this case, Malicious user can be carried out an intrusion under the situation. And also rogue gateway can be tried to steal medical information. Therefore, it needs mutual authentication between sensor devices and gateway. In this paper, we design a mutual authentication protocol which divided sessions from an authenticated session are updated periodically. And in order to reduce the traffic overhead for session authentication, we also introduce dynamic session management according to sampling rate of medical sensor type. In order to verify this, we implemented the programs for the test-bed, and got an overall success from three types of experiment.

• Journal of the Korea Society of Computer and Information
• /
• v.8 no.1
• /
• pp.60-68
• /
• 2003

Now the development of using a internet and security equipment is Processed actively. But It is presented problems about compatability and availability between variable equipment as several protocol. It is able to occur the Problem which is not considered efficiency as monopoly security equipment for the standardization of some vendor As a using of VPN gateway equipment. the same equipments have been actually used only for sale a communication equipment which are not confirmed(authenticate) between of mutual equipments. These problem is remain which are not considered suitable network environment and Position by mutual authentication Processing. Because it is considered for only sale a equipment of several vendor. And You will be remain where is unable to protect from attack of using the same equipment, and You will need a actually Protected method. By authentication system of base on Pn , although there is an intended attack from the third intruder, users can be protected with safe from the physical attacks since he is not a Permitted user by employing CA-VPN gateway that is more viable than the previous VPN connection in its security and certification.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.5 no.4
• /
• pp.87-97
• /
• 2009

Internet network routing system is used to prevent spread and distribution of malicious data traffic. This study is based on analysis of diagnostic weakness structure in the network security domain. We propose an improved integrated multi-level protection domain for in the internal route of groupware. This paper's protection domain is designed to handle the malicious data traffic in the groupware and finally leads to lighten the load of data traffic and improve network security in the groupware. Infrastructure of protection domain is transformed into five-stage blocking domain from two or three-stage blocking. Filtering and protections are executed for the entire server at the gateway level and internet traffic route ensures differentiated protection by dividing into five-stage. Five-stage multi-level network security domain's malicious data traffic protection performance is better than former one. In this paper, we use a trust evaluation metric for measuring the security domain's performance and suggested algorithm.

• Convergence Security Journal
• /
• v.13 no.1
• /
• pp.11-17
• /
• 2013

In this paper, the information security requirements in the mobile ad-hoc network(MANET) are presented, and the algorithm to establish the protection node(gateway) is proposed to prevent the distributed denial of service(DDoS). The information security technology and security threats in the MANET are presented, and protection node is decided to minimize the total cost through the sending nodes and receiving nodes by way of protection node. To set up the protection node, the minimization algorithms of maximum cost and the average cost between the protection node and receiving nodes are compared with the optimal solutions, in which optimal solution is found out by all enumeration method. From the results, the total cost between the sending and receiving nodes is minimized under the average cost minimization algorithm rather than the using of the maximum cost.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.11 no.1
• /
• pp.59-67
• /
• 2015

A novel authentication mechanism is biometric authentication where users are identified by their measurable human characteristics, such as fingerprint, voiceprint, and iris scan. The technology of biometrics is becoming a popular method for engineers to design a more secure user authentication scheme. In terms of physiological and behavioral human characteristics, biometrics is used as a form of identity access management and access control, and it services to identity individuals in groups that are under surveillance. In this article, we review the biometric-based authentication protocol by Althobati et al. and provide a security analysis on the scheme. Our analysis shows that Althobati et al.'s scheme does not guarantee server-to-user authentication. The contribution of the current work is to demonstrate this by mounting threat of data integrity and bypassing the gateway node on Althobati et al.'s scheme. In addition, we analysis the security vulnerabilities of Althobati et al.'s protocol.

• Proceedings of the Korean Information Science Society Conference
• /
• 2002.10c
• /
• pp.613-615
• /
• 2002

IPsec 기술은 양단간 보안은 물론, 모드, 암호 프로토콜, 다양한 암호화 알고리즘들의 조합을 통하여 다양하고 계층적인 보안 서비스를 제공한다. 또한, 보안 정책 시스템은 패킷 처리에 관한 지칭은 물론, IPsec의 핵심 요소인 Security Association을 협상하기 위한 보안 기반 규칙을 제공한다. 하지만 인터넷의 확장과 더불어 발생한 IP 주소 부족 문제를 해결하기 위한 NAT로 인하여 IPsec과 같은 단대단 통합 보안 서비스를 제공하는데 치명적인 장애가 발생하게 되었다. 또한 서로 다른 네트워크의 정책 서버간 보안 정책 협상도 NAT에 의한 주소 변환으로 인하여 불가능하게 되었다. 따라서 본 논문에서는 NAT상에서의 효율적인 보안 정책 협상과 인증서 발급을 위한 SPS-ALG (Security Policy System-Application Level Gateway)를 제안한다.

• Journal of the Institute of Electronics Engineers of Korea TC
• /
• v.49 no.7
• /
• pp.56-64
• /
• 2012

A smart grid is the next generation power grid which combines the existing power grid with information technology, so an energy efficient power grid can be provided. In this paper, in order to build an efficient smart grid an AMI system, which gears with the existing home network and provides an user friendly management function, is proposed. The proposed AMI system, which is based on an extended home network, consists of various functional units; smart meters, communication modules, home gateway, security modules, meter data management modules (MDMM), electric power application modules and so on. The proposed home network system, which can reduce electric power consumption and transmit data more effectively, is designed by using IEEE 802.15.4. The extended home gateway can exchange energy consumption information with the outside management system via web services. The proposed AMI system is designed to enable two-way communication between the home gateway and MDMM via the Internet. The AES(Advanced Encryption Standard) algorithm, which is a symmetric block cipher algorithm, is used to ensure secure information exchange. Even though the results in this study could be limited to our experimental environment, the result of the simulation test shows that the proposed system reduces electric power consumption by 4~42% on average compared to the case of using no control.