• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.15 no.3
• /
• pp.13-29
• /
• 2005

An important characteristic of role-based access control model(RBAC) is that by itself it is policy neutral. This means RBAC articulates security policy without embodying particular security policy. Because of this reason, there are several researches to configure RBAC to enforce traditional mandatory access control(MAC) policy and discretionary access control(DAC) policy. Specifically, to simulate MAC using RBAC several researches configure a few RBAC components(user, role, role-hierarchy, user-role assignment and session) for keeping no-read-up rule and no-write-down rule ensuring one-direction information flow from low security level to high security level. We show these researches does not ensure confidentiality. In addition, we show the fact that these researches overlook violation of integrity due to some constraints of keeping confidentiality. In this paper we propose a RBAC model satisfying both confidentiality and integrity. We reexamine a few RBAC components and constructs additional constraints.

• The Journal of Korean Institute of Information Technology
• /
• v.17 no.5
• /
• pp.105-116
• /
• 2019

Most of the public and private buildings in Korea are installing CCTV for crime prevention and follow-up action, insider security, facility safety, and fire prevention, and the number of installations is increasing each year. In the questionnaire conducted on the increasing CCTV, many reactions were positive in terms of the prevention of crime that could occur due to the installation, rather than negative views such as privacy violation caused by CCTV shooting. However, CCTV poses a lot of privacy risks, and when the image data is collected using the cloud, the personal information of the subject can be leaked. InseCam relayed the CCTV surveillance video of each country in real time, including the front camera of the notebook computer, which caused a big issue. In this paper, we introduce a system to prevent leakage of private information and enhance the security of the cloud system by processing the privacy technique on image information about a subject photographed through CCTV.

• Journal of Information Processing Systems
• /
• v.15 no.1
• /
• pp.169-180
• /
• 2019

Transmitting visual information over a broadcasting network is not only prone to a copyright violation but also is a forgery. Authenticating such information and protecting its authorship rights call for more advanced data encoding. To this end, electronic watermarking is often adopted to embed inscriptive signature in imaging data. Most existing watermarking methods while focusing on robustness against degradation remain lacking of measurement against security loophole in which the encrypting scheme once discovered may be recreated by an unauthorized party. This could reveal the underlying signature which may potentially be replaced or forged. This paper therefore proposes a novel digital watermarking scheme in temporal-frequency domain. Unlike other typical wavelet based watermarking, the proposed scheme employed the Lorenz chaotic map to specify embedding positions. Effectively making this is not only a formidable method to decrypt but also a stronger will against deterministic attacks. Simulation report herein highlights its strength to withstand spatial and frequent adulterations, e.g., lossy compression, filtering, zooming and noise.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.18 no.4
• /
• pp.167-174
• /
• 2008

As both a digital camera and a digital camcorder are popularized in recent years, UCC created by general users is also popularized. Unfortunately, according to that, the lack of privacy is also increasing more and more. The UCC is saved on the recordable media(Media) like DVD and deposited personally as well as distributed through Internet portal service. If you use Internet portal service to put up your contents, you can partially prevent the violation of privacy using security technologies such as authentication and illegal copy protection offered by internet portal service providers. Media also has technologies to control illegal copy. However, it is difficult to protect your privacy if your Media having personal contents is stolen or lost. Therefore, it is necessary to develope an additional security mechanism to guarantee privacy protection when you use Media. In this paper, we describe AACS framework for Media Security and propose improved AACS framework to control the access to personal contents saved on Media.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.31 no.3
• /
• pp.291-307
• /
• 2021

There has been global efforts to prevent the further spread of the COVID-19 and get society back to normal. 'Contact tracing' is a crucial way to detect the infected person. However the contact tracing makes another concern about the privacy violation of the personal data of infected people, released by governments. Therefore Google and Apple are announcing a joint effort to enable the use of Bluetooth technology to help governments and health agencies reduce the spread of the virus, with user privacy and security central to the design. However, in order to provide the improved tracing application, it is necessary to identify potential security threats and investigate vulnerabilities for systematically. In this paper, we provide security analysis of Privacy-Preserving COVID-19 Contact Tracing App with STRIDE and LINDDUN threat models. Based on the analysis, we propose to adopt a verifiable computation scheme, Zero-knowledge Succinctness Non-interactive Arguments of Knowledges (zkSNARKs) and Public Key Infrastructure (PKI) to ensure both data integrity and privacy protection in a more practical way.

• IEIE Transactions on Smart Processing and Computing
• /
• v.1 no.1
• /
• pp.65-71
• /
• 2012

Mobile RFID is a new application that uses a mobile phone as an RFID reader with wireless technology and provides a new valuable service to users by integrating RFID and ubiquitous sensor network infrastructures with mobile communication and wireless Internet. Whereas the mobile RFID system has many advantages, privacy violation problems on the reader side are very concerning to individuals and researchers. Unlike in regular RFID environments, where the communication channel between the server and reader is assumed to be secure, the communication channel between the backend server and the RFID reader in the mobile RFID system is not assumed to be safe. Therefore it has become necessary to devise a new communication protocol that secures the privacy of mobile RFID-enabled devices. Recently, Lo et al. proposed a mutual key agreement protocol that secures the authenticity and privacy of engaged mobile RFID readers by constructing a secure session key between the reader and server. However, this paper shows that this protocol does not meet all of the necessary security requirements. Therefore we developed an enhanced mutual key agreement protocol for mobile RFID-enabled devices that alleviates these concerns. We further show that our protocol can enhance data security and provide privacy protection for the reader in an unsecured mobile RFID environment, even in the presence of an active adversary.

• Journal of Korea Multimedia Society
• /
• v.20 no.12
• /
• pp.1913-1927
• /
• 2017

Encryption technology is to hide information in a cyberspace built using a computer and to prevent third parties from changing it. If a malicious user accesses unauthorized device or application services on the Internet of objects, it may be exposed to various security threats such as data leakage, denial of service, and privacy violation. One way to deal with these security threats is to encrypt and deliver the data generated by a user. Encrypting data must be referred to a technique of changing data using a complicated algorithm so that no one else knows the content except for those with special knowledge. As computers process computations that can be done at a very high speed, current cryptographic techniques are vulnerable to future computer performance improvements. We designed and implemented a new encryption program that combines ancient and modern cryptography so that the user never knows about data management, and transmission. The significance of this paper is that it is the safest method to combine various kinds of encryption methods to secure the weaknesses of the used cryptographic algorithms.

• Journal of Korea Society of Digital Industry and Information Management
• /
• v.11 no.3
• /
• pp.159-177
• /
• 2015

As smart phones become more common nowadays, mobile instant messengers such as kakao talk and line are used as essential communication tools exchanging information between individuals. Also, the mobile instant messengers extend their use to business area beyond communication between individuals. This study is on how factors of mobile instant messenger such as perceived security, perceived privacy, perceived enjoyment and perceived interactivity affect business continual usage intention through perceived usefulness. The proposed model is based on Expectation-Confirmation Theory of Oliver and Technology Acceptance Mode of Bhattacherjee. For an analysis, 159 survey responses were collected from the office workers in Seoul and nearby cities, having experiences of mobile instant messengers. To validate the proposed research model, PLS analysis is performed with the valid 154 questionnaires. The path analysis results are as follows. First, perceived security has a positive effect on expectation-confirmation. Second, perceived enjoyment has a positive effect on perceived usefulness. Third, perceived interactivity has a positive effect on both perceived usefulness and expectation-confirmation. Fourth, perceived usefulness has a positive usefulness on satisfaction and continual usage intention of mobile instant messenger. Last, expectation-confirmation has a positive effect on perceived usefulness, and satisfaction has a positive effect on continual usage intention of mobile instant messenger. Since the mobile instant messenger may bring a pressure of work and a violation of privacy, it is necessary that the company provide a guideline for use of the mobile instant messenger and establish the in-house mobile instant messenger system.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2011.10a
• /
• pp.662-665
• /
• 2011

The cognitive radio (CR) network has been studied in the form of open source by vast number of communities, and the potential expectation is very high since the CR is based on reprogrammable platform. However, this characteristics of open-source software take high risk as well. As the peer-to-peer software has been abused, so high is the chance that the CR network can be abused public wide. Consequently, the benefit from the study of next-generation wireless network can be at risk because of the negative impact of violation of communication law or abusing the CR. In this contribution, we analyze the issues and the problems of the CR and discuss an efficient measure against security attacks.

• Journal of information and communication convergence engineering
• /
• v.5 no.3
• /
• pp.254-258
• /
• 2007

Recently, ubiquitous computing in being actively researched and one of the main technology in ubiquitous computing environments is recognized as RFID system. The RFID system has much benefits but simultaneously has some problems such as user's privacy violation. In this paper, in order to improve the survivability of its nodes, it should build available simulation surrounding sensor nodes. Also, In the proposed cryptosystems we use a new hash function for user authentication and a stream cipher based on LFSR(Linear Feedback Shift Register) for message encryption and decryption. Moreover, each algorithm is programmed with C language and simulated on IBM-PC system and we analyze the randomness properties of the proposed algorithms by using statistical tests.