• 한국컴퓨터산업학회논문지
• /
• 제3권3호
• /
• pp.351-362
• /
• 2002

SNMP 관리 영역이 네트워크에서 시스템, 요금데이터 등 다양한 영역으로 확대되고, 보다 중요한 데이터를 전송하는 수단으로 사용된다. SNMPv3는 사용자그룹기반의 view기반 보안모델을 통한 보안강화 기능을 제공한다. 그러나, view기반보안모델을 이용한 보안관리는 데이터 접근목적에 연관된 접근제어 기능이 없고, 다양한 사용자그룹 생성에 따른 관리의 복잡성이 증대되는 문제가 있다. 따라서, 이러한 관리의 복잡성 문제를 해결하고, 보안강화를 하기 위한 직무기반 보안모델을 통한 접근강화 방법을 제안한다. 제안된 직무기반 보안관리는 관리대상에 따라 네트워크관리자 직무, 시스템 관리자 또는 계정관리자 등의 직무로 구분하여 직무를 통한 접근을 제한하여 관리의 복잡성을 해소하고, 직무와 목적간 관계를 확인하여 보다 강화된 보안기능을 제공한다.

• 디지털산업정보학회논문지
• /
• 제7권1호
• /
• pp.51-61
• /
• 2011

A smartphone is a mobile phone that offers more advanced computing ability and connectivity than a contemporary basic feature phone. Unlike feature phone, a smartphone allows the user to install and run more advanced applications based on a specific platform. Smartphones run complete operating system software providing a platform for application developers. A smartphone will become the default computing method for many point activities in the not-too-distant future, such as e-mail, online shopping, gaming, and even video entertainment. For smartphone that contains sensitive information and access the Internet, security is a major issue. In the 1980s, security issues were hardly noticed; however, security is a major issue for users today, which includes smart phones. Because security is much more difficult to address once deployment and implementation are underway, it should be considered from the beginning. Recently our government recognized the importance of smartphone security and published several safety tips for using the smartphone. However, theses tips are user-oriented measures. Maintaining the security of a smartphone involves the active participation of the user. Although it is a important users understand and take full advantage of the facilities afforded by smarphone, it is more important developers distribute the secure smartphone application through the market. In this paper we describe some scenarios in which user is invaded his/her privacy by smartphone stolen, lost, misplaced or infected with virus. Then we suggest the security considerations for securing smartphone applications in respect with developers. We also suggest the methods applying domestic encryption algorithms such as SEED, HIGHT and ARIA in developing secure applications. This suggested security considerations may be used by developers as well as users (especially organizations) interested in enhancing security to related security incidents for current and future use of smartphones.

• 한국통신학회논문지
• /
• 제29권3B호
• /
• pp.314-324
• /
• 2004

최근 초고속 인터넷 사용자는 꾸준하게 증가해서 천만을 넘어섰다. 그러나 사용자 액세스 네트워크(xDSL, Cable, B-WLL 등)가 다양해지고, 고부가가치의 유무선 컨텐츠 서비스가 발전함에 따라 기존의 단순 접속만을 하던 서비스는 네트워크 대역폭 보장 및 지연 방지 등의 한계에 부딪히게 되었다. 본 논문에서 제안한 에이전트 기반의 인터네트워킹 플랫폼(Agent based Inter Networking Platform)은 계층적 객체지향 시스템으로 사용자 요구(User on Demand)에 따른 다양한 서비스(Access QoS, 맞춤 응용 서비스, 보안 서비스)를 제공할 수 있다. 이 시스템은 사용자 에이전트와 에이전트 지역관리 서버 및 중앙관리 서버로 나뉘어져 있으며, 중앙 관리 서버는 사용자 에이전트로부터 할당된 대역폭, 현재 전송 속도, 지연, 현재 서비스 등의 상태정보를 주기적으로 받아서 처리한 후, 정책을 세우고, 이를 토대로 작성된 사용자 개개인의 프로파일에 따라 서비스를 하는 것이다. 시스템의 이식성과 통합을 고려해 객체지향의 모델링 기법을 사용하교 계층화된 서버를 통하여 보안에 강한 시스템을 구현하는 방안을 제시하고자 한다.

• 대한전자공학회:학술대회논문집
• /
• 대한전자공학회 2004년도 학술대회지
• /
• pp.759-763
• /
• 2004

While the needs for VoIPs(Voice over IP) encourage the commercial trials for VoIP services, there are many problems such as user authentication, blocking of illegal user and eavesdropping. In this paper, a management algorithm of registration of VoIP terminals is explained and security methods for tolling and data encryption module is designed and built up. The module structure will have the advantages of the entire development of secured gatekeeper without whole modification of gatekeeper. In order to secure the ordinary gatekeeper based on H.323 standard, user authentication and data encryption technologies are developed based on the H.235 standard and simply located over the plain H.323 stacks. The data structures for secured communications are implemented according to ASN.1 structures by H.235.

• 정보처리학회논문지C
• /
• 제8C권5호
• /
• pp.573-584
• /
• 2001

정책기반 통신망관리 시스템은 다양한 사용자의 요구에 부응하고 대형화, 분산화되는 통신망의 효과적인 관리에 적합한 아키텍처이다. 이 시스템에서의 통신망 관리자는 각 통신망 구성요소에 대한 직접적인 동작설정 대신 미리 설정한 규칙에 따라 통신망 구성요소나 서비스의 동작을 결정하게 된다. 한편, 융통성있는 통신망 관리 프레임워크를 제시한 SNMPv3는 인증, 암호화, 접근통제 등의 보안서비스를 제공함으로써, 이전 SNMP 버전들이 제공하지 못했던 안전한 통신망 관리를 위한 기반기술을 제공하고 있다. 그러나, SNMPv3의 개선된 보안서비스에도 불구하고 통신망 관리자별로 인증과 암호화 과정에 이용되는 보안정보가 관리되고, 보안정보가 통신망 구성요소에 분산되어 있어 중앙집중방식의 체계적인 보안관리기능이 제공되지 않아 여러 관리자에 의해 운영되는 대규모 통신망을 효과적으로 관리하는데 부적합한 문제점을 가지고 있다. 본 논문에서는 중앙집중방식의 규모확장성과 통신망 보안관리기능을 제공하기 위해 보안관리정책을 지원하는 역할기반 보안관리 모델을 제시하고, 이를 추가한 SNMPv3의 확장된 보안시스템의 구조, 동작절차 및 보안관리 관점에서의 효율성 분석에 대해 기술한다.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제13권11호
• /
• pp.5653-5672
• /
• 2019

In cloud computing era, an increasing number of resource-constrained users outsource their data to cloud servers. Due to the untrustworthiness of cloud servers, it is important to ensure the integrity of outsourced data. However, most of existing solutions still have challenging issues needing to be addressed, such as the identity privacy protection of users, the traceability of users, the supporting of dynamic user operations, and the publicity of auditing. In order to tackle these issues simultaneously, in this paper, we propose a traceable dynamic public auditing scheme with identity privacy preserving for cloud storage. In the proposed scheme, a single user, including a group manager, is unable to know the signer's identity. Furthermore, our scheme realizes traceability based on a secret sharing mechanism and supports dynamic user operations. Based on the security and efficiency analysis, it is shown that our scheme is secure and efficient.

• 한국항행학회논문지
• /
• 제20권1호
• /
• pp.72-78
• /
• 2016

리눅스는 초창기부터 사용자 패스워드의 암호화를 위해 해시 알고리즘인 MD-5를 사용해 왔다. 최근 보안성이 강화된 패스워드 관리가 요구되면서 엔터프라이즈 리눅스 시스템에서는 MD-5보다 더욱 높은 신뢰성을 보이는 SHA-512 알고리즘을 사용하고 있다. 본 논문에서는 해시 및 암호화 알고리즘의 특징에 대해 비교 분석하고, 리눅스 사용자 정보의 관리 체제에 대해 알아본다. 이러한 분석을 기반으로 사용자 패스워드에 적용된 해시 알고리즘의 보안성에 대해 분석하고, 추가적으로 Apache, PHP, MySQL과 같은 공개 소프트웨어 파일 검증에 사용되는 해시 알고리즘 적용 사례를 분석한다. 마지막으로 관련 보안 도구인 John The Ripper를 분석하여 사용자 패스워드 관리를 통한 시스템 보안 강화 방법을 제시한다.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제11권1호
• /
• pp.466-483
• /
• 2017

Zen Cart is an open-source online store management system. It is used all over the world because of its stability and safety. Today, Zen Cart's session security mechanism is mainly used to verify user agents and check IP addresses. However, the security in verifying the user agent is lower and checking the IP address can affect the user's experience. This paper, which is based on the idea of session protection as proposed by Ben Adida, takes advantage of the HTML5's sessionStorage property to store the shared keys that are used in HMAC-SHA256 encryption. Moreover, the request path, current timestamp, and parameter are encrypted by using HMAC-SHA256 in the client. The client then submits the result to the web server as per request. Finally, the web server recalculates the HMAC-SHA256 value to validate the request by comparing it with the submitted value. In this way, the Zen Cart's open-source system is reinforced. Owing to the security and integrity of the HMAC-SHA256 algorithm, it can effectively protect the session security. Analysis and experimental results show that this mechanism can effectively protect the session security of Zen Cart without affecting the original performance.

• 한국IT서비스학회지
• /
• 제20권6호
• /
• pp.17-43
• /
• 2021

Currently, various discussions are underway to establish a more advanced management system for public rental housing. Also, it calls for improvement methods for problems arising in management of the current rental housing system. In this regard, this study aims to evaluate determinants that affect user acceptance intention of blockchain technology to implement a new system that complements drawbacks of the current public rental housing system. The study uses the Unified Theory of Acceptance and Use of Technology (UTAUT) as a theoretical model; the study model utilizes three UTAUT variables -performance expectancy, social influence, and Facilitating conditions-, applies security, availability, and reliability that are perceived from blockchain technology as external parameters to facilitate understanding of user acceptance intention of blockchain technology, and evaluates whether innovativeness can regulate the influence of performance expectancy, social influence, and Facilitating conditions on user acceptance intention of blockchain technology. Based on the significant survey result where 274 IT technicians participated, the study applies structural equation modeling to explore structure of user acceptance intention in the blockchain-based management system for public rental housing. As a result, security-reliability and availability are found to factors as determinants for user acceptance intention, affecting implementation of the public rental housing management system, while innovativeness shows no significant statistical results related to regulation effect. This study has implications in that it understands characteristics of blockchain and empirically analyzes the relationship between the characteristics and acceptance intention to enable blockchain's contribution to activate the public rental housing management system in the future.

• Asia pacific journal of information systems
• /
• 제18권4호
• /
• pp.1-26
• /
• 2008

Rapid progress of information technology and widespread use of the personal computers have brought various conveniences in our life. But this also provoked a series of problems such as hacking, malicious programs, illegal exposure of personal information etc. Information security threats are becoming more and more serious due to enhanced connectivity of information systems. Nevertheless, users are not much aware of the severity of the problems. Using appropriate password is supposed to bring out security effects such as preventing misuses and banning illegal users. The purpose of this research is to empirically analyze a research model which includes a series of factors influencing the effectiveness of passwords. The research model incorporates the concept of risk based on information systems risk analysis framework as the core element affecting the selection of passwords by users. The perceived risk is a main factor that influences user's attitude on password security, security awareness, and intention of security behavior. To validate the research model this study relied on questionnaire survey targeted on evening class MBA students. The data was analyzed by AMOS 7.0 which is one of popular tools based on covariance-based structural equation modeling. According to the results of this study, while threat is not related to the risk, information assets and vulnerability are related to the user's awareness of risk. The relationships between the risk, users security awareness, password selection and security effectiveness are all significant. Password exposure may lead to intrusion by hackers, data exposure and destruction. The insignificant relationship between security threat and perceived risk can be explained by user's indetermination of risk exposed due to weak passwords. In other words, information systems users do not consider password exposure as a severe security threat as well as indirect loss caused by inappropriate password. Another plausible explanation is that severity of threat perceived by users may be influenced by individual difference of risk propensity. This study confirms that security vulnerability is positively related to security risk which in turn increases risk of information loss. As the security risk increases so does user's security awareness. Security policies also have positive impact on security awareness. Higher security awareness leads to selection of safer passwords. If users are aware of responsibility of security problems and how to respond to password exposure and to solve security problems of computers, users choose better passwords. All these antecedents influence the effectiveness of passwords. Several implications can be derived from this study. First, this study empirically investigated the effect of user's security awareness on security effectiveness from a point of view based on good password selection practice. Second, information security risk analysis framework is used as a core element of the research model in this study. Risk analysis framework has been used very widely in practice, but very few studies incorporated the framework in the research model and empirically investigated. Third, the research model proposed in this study also focuses on impact of security awareness of information systems users on effectiveness of password from cognitive aspect of information systems users.