• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.21 no.4
• /
• pp.11-26
• /
• 2011

The existing anonymous authentication schemes based on group signatures for protecting privacy do not provide anonymous authorization which is required in the practical environments. In this paper, we propose an anonymous authentication and authorization scheme that enables a service provider both to authenticate anonymously its users and to provide different service according to their authorization. In the proposed scheme, a user's real identity, anonymity and authorization are managed distinctly through the separation of group manager's capabilities and an authorization authority. It is also possible for the proposed scheme to apply various access control models.

• Journal of Internet Computing and Services
• /
• v.17 no.5
• /
• pp.9-16
• /
• 2016

Pervasive computing and Internet of Things (IoT) have recently received considerable interest to deploy solutions for the future Internet. Smart environments are integrated with Semantic Web to provide context-awareness to the processed information. Self-learning techniques have been adopted within smart solutions for efficient retrieval of data but do not process data with privacy parameters for in-place authorization. To overcome this issue, we present a novel approach of deploying access control as a service mechanism within Semantic Web based smart environment by using eXtensible Access Control Markup Language (XACML). The proposed XACML as a Service (XACMLaaS) approach offers fine-grained access control for protecting information within smart environment. In this paper, we have defined mathematical rules for each components of proposed access control service layer. These rules are for implementation of access control using XACML. The proposed approach allows the adaptation of authorization of information at component level and provides scalable solution for authorization policies and rule enforcement within smart environment.

• Journal of the Korea Society of Computer and Information
• /
• v.11 no.5 s.43
• /
• pp.127-137
• /
• 2006

We propose two phase filtering scheme to develop an efficient mechanism for XML databases to control query-based access. An access control environment for XML documents and some techniques to deal with fine-grained authorization priorities and conflict resolution issues are proposed. Despite this, relatively little work has been done to enforce access controls particularly for XML databases in the case of query-based access. The basic idea utilized is that a user query interaction with only necessary access control rules is modified to an alternative form through a query optimization technique, which is guaranteed to have no access violations using tree-aware metadata of XML schemas. The scheme can be applied to any XML database management system and has several advantages such as small execution time overhead, fine-grained controls, and safe and correct query modification. The experimental results clearly demonstrate the efficiency of the approach.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.17 no.9
• /
• pp.2550-2572
• /
• 2023

Epidemiological survey is an important means for the prevention and control of infectious diseases. Due to the particularity of the epidemic survey, 1) epidemiological survey in epidemic prevention and control has a wide range of people involved, a large number of data collected, strong requirements for information disclosure and high timeliness of data processing; 2) the epidemiological survey data need to be disclosed at different institutions and the use of data has different permission requirements. As a result, it easily causes personal privacy disclosure. Therefore, traditional access control technologies are unsuitable for the privacy protection of epidemiological survey data. In view of these situations, we propose a black box-assisted fine-grained hierarchical access control scheme for epidemiological survey data. Firstly, a black box-assisted multi-attribute authority management mechanism without a trusted center is established to avoid authority deception. Meanwhile, the establishment of a master key-free system not only reduces the storage load but also prevents the risk of master key disclosure. Secondly, a sensitivity classification method is proposed according to the confidentiality degree of the institution to which the data belong and the importance of the data properties to set fine-grained access permission. Thirdly, a hierarchical authorization algorithm combined with data sensitivity and hierarchical attribute-based encryption (ABE) technology is proposed to achieve hierarchical access control of epidemiological survey data. Efficiency analysis and experiments show that the scheme meets the security requirements of privacy protection and key management in epidemiological survey.

• Journal of Industrial Technology
• /
• v.23 no.A
• /
• pp.47-53
• /
• 2003

차세대 웹 문서의 새로운 표준으로 자리 잡아 가고 있는 XML은 전자 상거래나 병원 관리 등과 같이 다양한 응용 분야에 적용되고 있다. 이러한 응용 분야는 XML 문서의 각 구성 요소 수준의 세밀한 액세스 제어를 요구한다. 따라서, 현재 XML 문서의 미세 접근 제어 기법에 대한 연구가 활발히 이루어지고 있다. 현재 제안된 XML 문서를 위한 미세 접근 제어 기법은 대부분 묵시적 권한 기법을 사용하여 상위 구성요소에 한번의 권한 부여로 하위노드에 권한을 부여하는 효과를 가지는 장점을 가지나, 각 구성 요소간의 권한을 체크하는 시간 오버헤드를 가지는 단점이 있다. 본 논문에서는 권한을 체크하는 시간을 감소시키기 위하여 XML 문서의 미세 접근 제어를 위한 명시적 권한 기법을 제안하고, 이를 이용하여 노드의 권한에 대한 모든 정보를 저장하고 있는 접근 권한 트리 모델을 제시하였다. 본 논문에서 제안한 접근 권한 트리 모델을 사용하면, 권한 정보를 저장하는 공간 오버헤드가 있지만, 권한 체크 시간을 감소시켜 사용자에게 보다 빠른 뷰를 제공할 수 있다.

• Proceedings of the Korean Information Science Society Conference
• /
• 2004.10a
• /
• pp.37-39
• /
• 2004

그리드 컴퓨팅에서 가상조직은 분산되어 있는 여러 자원들과 사용자들로 구성된다. 가상조직을 구성하는 일은 그리드 컴퓨팅에서 중요한 일이다. 가상조직은 목적에 따라 동적으로 구성되며 목적을 완성하고 사라진다 기존의 가상조직을 위한 권한 위임 구조들은 하나의 가상조직 환경에 중점을 두며 동적인 가상조직 환경을 고려하지 못하고 있다. 또한 자원 제공자, 가상조직 관리자, 그리고 사용자 모두를 위한 상세한 권한 위임 기법을 제공하지 않는다. 이 논문에서 우리는 동적인 가상조직에서 티켓을 이용한 상세한 권한 위임 서비스인 TAS 아키텍처를 제안한다. 기존의 아키텍처와 다르게 TAS 아키텍처는 티켓을 사용하여 여러 가상조직들을 위한 상세한 권한 위임 서비스를 제공한다.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.17 no.2
• /
• pp.295-311
• /
• 2023

Cloud computing has evolved significantly, intending to provide users with fast, dependable, and low-cost services. With its development, malicious users have become increasingly capable of attacking both its internal and external security. To ensure the security of cloud services, encryption, authorization, firewalls, and intrusion detection systems have been employed. However, these single monitoring agents, are complex, time-consuming, and they do not detect ransomware and zero-day vulnerabilities on their own. An innovative Record and Replay-based hybrid Honeynet (R2NET) system has been developed to address this issue. Combining honeynet with Record and Replay (RR) technology, the system allows fine-grained analysis by delaying time-consuming analysis to the replay step. In addition, a machine learning algorithm is utilized to cluster the logs of attackers and store them in a database. So, the accessing time for analyzing the attack may be reduced which in turn increases the efficiency of the proposed framework. The R2NET framework is compared with existing methods such as EEHH net, HoneyDoc, Honeynet system, and AHDS. The proposed system achieves 7.60%, 9.78%%, 18.47%, and 31.52% more accuracy than EEHH net, HoneyDoc, Honeynet system, and AHDS methods.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.17 no.7
• /
• pp.1935-1950
• /
• 2023

The arrival of the Internet of Things and 5G technology enables users to rely on edge computing platforms to process massive data. Data sharing based on edge computing refines the efficiency of data collection and analysis, saves the communication cost of data transmission back and forth, but also causes the privacy leakage of a lot of user data. Based on attribute-based encryption and blockchain technology, we design a fine-grained access control scheme for data in edge computing, which has the characteristics of verifiability, support for outsourcing decryption and user attribute revocation. User attributes are authorized by multi-attribute authorization, and the calculation of outsourcing decryption in attribute encryption is completed by edge server, which reduces the computing cost of end users. Meanwhile, We implemented the user's attribute revocation process through the dual encryption process of attribute authority and blockchain. Compared with other schemes, our scheme can manage users' attributes more flexibly. Blockchain technology also ensures the verifiability in the process of outsourcing decryption, which reduces the space occupied by ciphertext compared with other schemes. Meanwhile, the user attribute revocation scheme realizes the dynamic management of user attribute and protects the privacy of user attribute.

• Journal of KIISE:Databases
• /
• v.34 no.1
• /
• pp.1-17
• /
• 2007

As XML is becoming a de facto standard for distribution and sharing of information, the need for an efficient yet secure access of XML data has become very important. To enforce the fine-level granularity requirement, authorization models for regulating access to XML documents use XPath which is a standard for specifying parts of XML data and a suitable language for both query processing. An access control environment for XML documents and some techniques to deal with authorization priorities and conflict resolution issues are proposed. Despite this, relatively little work has been done to enforce access controls particularly for XML databases in the case of query access. Developing an efficient mechanism for XML databases to control query-based access is therefore the central theme of this paper. This work is a proposal for an efficient yet secure XML access control system. The basic idea utilized is that a user query interaction with only necessary access control rules is modified to an alternative form which is guaranteed to have no access violations using tree-aware metadata of XML schemes and set operators supported by XPath 2.0. The scheme can be applied to any XML database management system and has several advantages over other suggested schemes. These include implementation easiness, small execution time overhead, fine-grained controls, and safe and correct query modification. The experimental results clearly demonstrate the efficiency of the approach.

• Journal of Digital Convergence
• /
• v.14 no.2
• /
• pp.191-196
• /
• 2016

The organizations and companies establish personal information protection policy under the law and guidelines. They carry out access control without consideration for distinctiveness of the information although the damage degree varies when the information is leaked. Considering the distinctiveness, a policy needs to be made for individuals to protect his personal information. However, he is not able to write the policy because of lack of understanding the system. To write his own policy efficiently, the system that authorizes ones according to service list provided by organizations is necessary. This paper suggests the model and method that write personal policy for his information protection based on the service list provided by organizations. Through this model, fine-grained authorization and policy change are easily made and ultimately the access control customized according to one's own information is possible.