• The KIPS Transactions:PartC
• /
• v.10C no.4
• /
• pp.405-412
• /
• 2003

As the XML is approved standard language by the UN, the progress which complemented the XML security has being processed rapidly. In this paper, we design and implement the "XML-Signcryption" as a security mechanism to protect the XML document that can operate between other platforms. The signature and encryption which is the standard specification in W3C needs to be able to proceed them separately. Generally the signature and encryption require four times modular exponential operation, however the signcryption only needed three times modular exponential operation. This will benefit overall system effectiveness in terms of cost. And this scheme offers to convenient the user, because the signature and encryption implement as a single XML format. This tool can save the parsing time as a number of tags is few within a document. And also, in this paper, based on a research of Web Services security, we can apply XML-Signcryption to the SOAP message to provide the security services. Based on the XML-Signcryption scheme which provides confidentiality, integrity, authentication and non-repudiation to the XML document and Web Service security simultaneously.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.17 no.1
• /
• pp.3-10
• /
• 2007

In this paper, we show that the status certificate-based encryption(SCBE) scheme proposed at ICISC 2004 and the certificateless signature(CLS) scheme proposed at EUC workshops 2006 are insecure. Both schemes are claimed that an adversary has no advantage if it controls only one of two participants making a cryptographic key such as a decryption key in SCBE or a signing key in CLS. But we will show that an adversary considered in the security model of each scheme can generate a valid cryptographic key by replacing the public key of a user.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.17 no.5
• /
• pp.1450-1470
• /
• 2023

In a Vehicular Cloud (VC) network, an announcement protocol plays a critical role in promoting safety and efficiency by enabling vehicles to disseminate safety-related messages. The reliability of message exchange is essential for improving traffic safety and road conditions. However, verifying the message authenticity could lead to the potential compromise of vehicle privacy, presenting a significant security challenge in the VC network. In contrast, if any misbehavior occurs, the accountable vehicle must be identifiable and removed from the network to ensure public safety. Addressing this conflict between message reliability and privacy requires a secure protocol that satisfies accountability properties while preserving user privacy. This paper presents a novel announcement protocol for secure communication in VC networks that utilizes group signature to achieve seemingly contradictory goals of reliability, privacy, and accountability. We have developed the first comprehensive announcement protocol for VC using group signature, which has been shown to improve the performance efficiency and feasibility of the VC network through performance analysis and simulation results.

• The Journal of Society for e-Business Studies
• /
• v.6 no.3
• /
• pp.101-113
• /
• 2001

Security is very important in EC(Electronic Commerce) environment because exchanged information(that is transaction details, private data, charges data(card-no, accounts), etc) is various and is very sensitive. So, In this paper, we propose Secure-ReXpis(Reliable St excellent Xh3 Processing Infrastructure) System that transfer message and support Message Level Security(Encryption/Decryption and Digital Signature). And we implement Message Confidentiality Service, User Authentication ＆ Message Integrity Service and Non-Repudiation Service among the various Security Services. This system support XML message format and EDI message, WEB Data and Private Format Data, etc.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.16 no.2
• /
• pp.53-59
• /
• 2020

Malicious file upload attacks mean that the attacker to upload or transfer files of dangerous types that can be automatically processed within the web server's environment. Uploaded file content can include exploits, malware and malicious scripts. An attacker can user malicious content to manipulate the application behavior. As a method of detecting a malicious file upload attack, it is generally used to find a file type by detecting a file extension or a signature of the file. However, this type of file type detection has the disadvantage that it can not detect files that are not encoded with a specific program, such as PHP files. Therefore, in this paper, research was conducted on how to detect and block any program by using essential commands or variable names used in the corresponding program when writing a specific program. The performance evaluation results show that it detected specific files effectively using the suggested method.

• Journal of Korea Multimedia Society
• /
• v.23 no.5
• /
• pp.658-666
• /
• 2020

PGP is an encryption software designed to provide information protection, security and authentication services for online communication systems. The characteristic of behavior done on the Internet is that you don't know the other person. It is very important to protect information from someone you cannot trust. So identification of the other person is an important task. PGP uses an digital signature algorithm to verify the identity of the other party. However, it is not accurate to check the other party's credibility. PGP increases trust as other users sign more on public keys of user. In other words, credibility is not perfect. In this paper, PGP certification system that key management in Ethereum blockchain, one of the blockchain platforms, is proposed. Key management in blockchain ensures data integrity, transparency and reliability.

• The Journal of Society for e-Business Studies
• /
• v.9 no.2
• /
• pp.51-68
• /
• 2004

The purpose of this article is to review the current status of PKI, and to check the major results of Electronic signature business in Korea by conducting face-to-face interview. It is expected that the main implications from the PKI users would be considered by the government for improving the environment of PKI utilization in the favor of users.

• Proceedings of the Korean Society of Computer Information Conference
• /
• 2019.01a
• /
• pp.361-363
• /
• 2019

인터넷환경에서 금융회사는 홈페이지 사용자의 신원확인, 부인방지 등의 목적으로 공개키 기반구조(PKI: Public Key Infrastructure) 환경의 공인인증서를 홈페이지 로그인, 전자금융거래 등의 업무에 적용하고 있다. 사용자의 공인인증서를 이용하여 생성된 전자서명이 악성코드 감염 등으로 인하여 유출 시 사용자가 과거에 서명했던 전자서명이 재사용(로그인, 전자금융거래 등)될 수 있는 취약점이 존재하기에 인터넷 상에서의 전자서명 재사용에 대한 원인, 방지 절차 및 방법을 제안 하고자 한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.13 no.4
• /
• pp.169-176
• /
• 2003

Distributed signcryption was specially designed for distributing a signcrypted message to a designated group. Since a verifier of this signcryption should how the signer's public key in advance, it cannot provide the signer's anonymity. This study adds anonymity and non-repudiation by trusted party to the distributed signcryption with almost the same computational load. We also analyze security and computational loads of the proposed scheme. In addition, we extend our scheme to an efficient group signcryption.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2008.10a
• /
• pp.703-707
• /
• 2008

Nowadays, Internet becomes an essential element in our life. We can make use of numerous on-line services through Internet such as information search, on-line shopping, e-mail service, etc. But, while getting the benefits of Internet service, invasion of our privacy frequently occurs because on-line service providers tend to request excessive or unnecessary personal information. So, there have been some researches on anonymous authentication, which means that user can authenticate herself, not revealing her identity or personal information. But, most of the researches are not somewhat applicable to current authentication infrastructure. In this paper, we propose a pseudonym-based anonymous PKI with short group signature. Using our proposed scheme, we can provide anonymity with conditional traceability to current PKI.