• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제15권9호
• /
• pp.3322-3347
• /
• 2021

Cloud Storage is the primary component of many businesses on cloud. Majority of the enterprises today are adopting a multicloud strategy to keep away from vendor lock-in and to optimize cost. Auditing schemes are used to ascertain the integrity of cloud data. Of these schemes, only the Provable Data Possession schemes (PDP) are resilient to key-exposure. These PDP schemes are devised using Public Key Infrastructure (PKI-) based cryptography, Identity-based cryptography, etc. PKI-based systems suffer from certificate-related communication/computational complexities. The Identity-based schemes deal with the exposure of only the auditing secret key (audit key). But with the exposure of both the audit key and the secret key used to update the audit key, the auditing process itself becomes a complete failure. So, an Identity-based PDP scheme with Parallel Key-Insulation is proposed for multiple cloud storage. It reduces the risk of exposure of both the audit key and the secret key used to update the audit key. It preserves the data privacy from the Third Party Auditor, secure against malicious Cloud Service Providers and facilitates batch auditing. The resilience to key-exposure is proved using the CDH assumption. Compared to the existing Identity-based multicloud schemes, it is efficient in integrity verification.

• Journal of Information Technology Applications and Management
• /
• 제11권2호
• /
• pp.45-64
• /
• 2004

Many researchers have proved that information systems auditing is a very effective tool for improving information systems quality. However, information system auditing in Korea still includes many subjective judgements. This study deals with applying a quantitative model to improve information system auditing quality on security domain. First of all, we have looked at previous researches on information systems audit, especially on security audit. Based on this survey, we have come up with solutions to improve the evaluation efficiency on security audit. We have merged the security audit guidelines of NCA and KISA, and developed a quantified evaluation scheme. We have proved the validity of this model by interviews with experts and by case studies.

• 한국산업정보학회:학술대회논문집
• /
• 한국산업정보학회 1998년도 공동추계학술대회 경제위기 극복을 위한 정보기술의 효율적 활용
• /
• pp.385-391
• /
• 1998

As the increase in the use of computers and rapid development of information technology exacerbate auditors' judgmental process, achieving objectives(effectiveness) of control and auditing with limited resources requires auditors to identify relative importance and priority of controls. Consequently, auditors' review and evaluation of internal control is been highlighted in modrn auditing process. Especially, as more organizations adopted LAN(Local Area Network) systems. LAN environment is facing with problems arising from characteristics of theLAN and the evaluation of LAN controls. The modern in this study is LAN control evaluation model with information system auditing objectives. This study concludes that auditors' proper evalution of the importance of LAN controls contributes to the effective achievement of IS auditing objectives.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• 제11권4호
• /
• pp.2219-2236
• /
• 2017

With cloud storage services, users can handle an enormous amount of data in an efficient manner. However, due to the widespread popularization of cloud storage, users have raised concerns about the integrity of outsourced data, since they no longer possess the data locally. To address these concerns, many auditing schemes have been proposed that allow users to check the integrity of their outsourced data without retrieving it in full. Yuan and Yu proposed a public auditing scheme with a deduplication property where the cloud server does not store the duplicated data between users. In this paper, we analyze the weakness of the Yuan and Yu's scheme as well as present modifications which could improve the security of the scheme. We also define two types of adversaries and prove that our proposed scheme is secure against these adversaries under formal security models.

• 한국멀티미디어학회논문지
• /
• 제20권4호
• /
• pp.660-670
• /
• 2017

In case of auditing of the information system development project applying agile methodology, it is not appropriate to carry out a comprehensive check on the establishment of information system with only the existing check on software. This study considers the characteristics of the agile methodology in terms of Information System Auditing. To improve inspection quality of development project with agile methodology by deriving detailed check items of test activities at each stage, this study proposes a strategy to improve the check on software for the test activities of the supervisory model that is suitable for agile methodology, which emphasizes repetitive work.

• Journal of Information Processing Systems
• /
• 제11권1호
• /
• pp.104-115
• /
• 2015

Along with the evolution of Internet and its new emerging services, the quantity and impact of attacks have been continuously increasing. Currently, the technical capability to attack has tended to decrease. On the contrary, performances of hacking tools are evolving, growing, simple, comprehensive, and accessible to the public. In this work, network penetration testing and auditing of the Redhat operating system (OS) are highlighted as one of the most popular OS for Internet applications. Some types of attacks are from a different side and new attack method have been attempted, such as: scanning for reconnaissance, guessing the password, gaining privileged access, and flooding the victim machine to decrease availability. Some analyses in network auditing and forensic from victim server are also presented in this paper. Our proposed system aims confirmed as hackable or not and we expect for it to be used as a reference for practitioners to protect their systems from cyber-attacks.

• International Journal of Computer Science & Network Security
• /
• 제24권2호
• /
• pp.124-128
• /
• 2024

Cloud computing is a technology for delivering information in which resources are retrieved from the internet through a web-based tools and applications, rather than a direct connection with the server. It is a new emerging computing based technology in which any individual or organization can remotely store or access the information. The structure of cloud computing allows to store and access various information as long as an electronic device has access to the web. Even though various merits are provided by the cloud from the cloud provides to cloud users, it suffers from various flaws in security. Due to these flaws, data integrity and confidentiality has become a challenging task for both the storage and retrieval process. This paper proposes a novel approach for data protection by an improved auditing based methodology in cloud computing especially in the process of cloud storage. The proposed methodology is proved to be more efficient in auditing the threats while storing data in the cloud computing architecture.

• 한국콘텐츠학회지
• /
• 제13권1호
• /
• pp.58-61
• /
• 2015

• 정보처리학회논문지:컴퓨터 및 통신 시스템
• /
• 제2권11호
• /
• pp.483-488
• /
• 2013

사용자들은 외부 스토리지를 사용함으로써 언제, 어디서나 자신의 데이터에 접근할 수 있다. 하지만 자신의 데이터가 어떻게 관리되고 있는지는 알 수 없다. 심지어 자신의 데이터에 손상이 발생하여도 인지할 수 없다. 이와 같은 불편을 해결하기 위해 외부 스토리지 검증기법들이 제안되었다. 대부분의 기법들이 준동형 검증 태그(homomorphic verifiable tags)를 사용하고 있지만, 이는 데이터를 지수로 하여 계산하기 때문에 효율성에 한계가 있다. 본 논문에서는 외부 스토리지 무결성 검증의 새로운 접근 방법으로써 계수행렬을 이용한 기법을 제안한다. 제안하는 기법은 데이터를 계수행렬의 형태로 변환하여 검증에 사용한다. 검증과정은 선형연립방정식의 해를 구하는 형태로 진행되며, 검증자는 수식에 해벡터를 대입함으로써 쉽게 검증을 수행할 수 있다. 제안하는 기법을 사용하면 검증자는 sqrt(n) 크기의 데이터로 크기가 n인 데이터를 검증할 수 있다.

• 정보보호학회논문지
• /
• 제18권1호
• /
• pp.139-148
• /
• 2008

정보기술의 발전은 비즈니스 환경의 변화는 물론 대형 산업 시설의 자동화에 많은 변화를 가져왔다. 전력, 수자원, 에너지, 교통, 통신, 등은 국가의 안보와 국민 생활의 안정 그리고 국가 경제발전의 기반을 형성하는 국가의 주요 기반시설이며 이들 모두 산업제어 시스템에 의해 통제되고 있다. 또 비즈니스 환경의 변화는 조직의 모든 시스템을 통합하고 있어 경영정보시스템과 산업제어 시스템의 통합이 이루어지고 있다. 이에 따라 산업제어 시스템의 표준화와 개방형 시스템으로 전환이 이루어지고 있어 더욱 보안의 중요성이 커지고 있다. 제어시스템 보안에 대한 연구가 기술, 관리, 환경 등 다양한 분야에서 추진되고 있다. 그럼에도 제어시스템 감사에 대한 연구는 아직 미약하다. 정부는 최근 정부 및 주요 공공 시스템에 대한 정보시스템 감리를 의무화하여 안정성, 효율성, 효과성을 평가하고 있다. 또 주요정보통신기반시설에 대해서는 취약점 분석을 하고 그 개선 작업을 하도록 의무화하고 있다. 그럼에도 제어시스템에 대한 감리를 하지 않고 있고 제어시스템에 대한 보안 아키텍처나 감리 프레임워크도 준비되어 있지 않다. 본 연구는 제어시스템 감리를 위한 정보보안 아키텍처와 정보보안 감리 프레임워크를 제시하여 감리의 기반을 마련하였다.