Hyeong Seon Yoo

Security Issues on Smarthome in IoT Environment

Smarthome as one of IoT(Internet of Things) services is growing more and more interested. Due to the development of mobile network, proliferation of smartphones and increasing of interest for personal safety, many enterprises enter the smartphone market. However, incidents could happen because they provide their services without considering security. This paper analyzes security vulnerabilities of smarthome and proposes countermeasures.

Modified token-update scheme for site authentication

This paper proposes a new site authentication algorithm using a token-update. One-time password and smart card schemes are widely studied to protect servers from various malicious activities. Most papers discuss schemes with nounce and token updates. Since the LAN card’ ID could be used to identify a PC, an authentication scheme with LAN card’s Mac address might strengthen the conventional token update method. The suggested modified token-upgrade method algorithm is shown to be very effective in site authentication.

Personal Information Classification for Privacy Negotiation

Privacy has been recognized as a critical topic in the Internet for a long time, and technical developments in this area are ongoing. With the proliferation of various network sites and the unification of them, it has become more evident that the problem of privacy is not bounded by the perimeters of a specific system. Nowadays, many network services rapidly drive toward unification. In this paper, we mainly consider unified personal information. We propose an evaluation method of privacy sensitivity-level. The information sensitivity level (SL) is evaluated with four main factors; the degree of conjunction (DC), the principle of identity (JA), the principle of privacy (PA), and the value of analogism (aA), SL:= sigma(DC, JA, PA , AA). If we classify the information based on the information sensitivity level (SL), it can show the objective validity. Finally, we outline new research directions for currently existing methods for privacy-preserving data analysis in the combined social network environment.

A provable secure authentication protocol given forward secure session key

This paper proposes a key distribution and authentication protocol between user, service provider and key distribution center (KDC). This protocol is based on symmetric cryptosystem, challenge-response, Diffie-Hellman component and hash function. In proposed protocol, user and server update the session key under token-update operation, and user can process repeated efficient authentications by using updated session keys. Another merit is that KDC needs not to totally control the session key between user and server in proposed protocol. Even if an attacker steals the parameters from the KDC, the attacker still can not calculate session key. We use BAN logic to proof these merits of our proposed protocol. Also according to the comparison and analysis with other protocols, our proposed protocol provides good efficiency and forward secure session key.

Some Effects of Viscoelastic Matrix on the Squeeze Films

The solution method in (6) is extended to include a viscoelastic, linear solid matrix. The film thickness and the bearing volume of the viscoelastic cases are obtained and show lower values than that of the elastic counterpart. The result is also compared with the Winkler solid case (7) and it shows a larger film thickness than Winkler obtained. The squeeze-suction phenomenon is again observed for low applied load, small period and large compliance parameter cases, and it becomes stronger for small D2 values. It clearly indicates that for the viscoelastic model a fluid film can be maintained under cyclic positive load conditions.

View updates and constraint validations in collaborative design environments

In collaborative designs that are either intracompany or intercompany, data security and integrity validation are two major concerns. Even though design views can be used effectively for access controls, view updates may cause violation of integrity constraints defined for the base designs. This article focuses on the validation of integrity constraints after view updates. Following standard for the exchange of product model data methodologies, information model is defined by EXPRESS and views are defined by EXPRESS-X. Shared design data are stored in a relational database system (e.g. Oracle 11g XE). The integrity constraints defined in EXPRESS schema are translated into UNIQUE and CHECK and triggers in SQL. Then, they are automatically validated after view updates. Because the paradigm presented in this article is based on open standards such as EXPRESS, EXPRESS-X, and SQL, it is independent from any proprietary system and suitable for collaborative design environments that consist of heterogeneous systems.

An Inside Attacker Proof Intrusion Detection System

Recently, an intrusion detection system which named CONFIDANT was proposed, which utilized file integrity analyzers and mobile agent for intrusion detection and aimed to detection of malicious activity by insiders. But CONFIDANT has vulnerabilities in security aspect, the sensor agents in the lowest echelon are easily compromised by malicious platforms. Therefore, we integrate a security mechanism which named clone agent protocol into CONFIDANT. We improved the structure of CONFIDANT to protect those agents and strengthen its security, make sure them finish their computation and detect malicious hosts even though there are a few malicious platforms.

An efficient electronic marketplace bidding auction protocol with bid privacy

We modified the multi-agent negotiation test-bed which was proposed by Collins et al. In 2004, Jaiswal et al. have modified Collinss scheme, but Jaiswals scheme still has some security weaknesses: such as replay data attack and DOS (denial-of-service) attack, anonymity disclosure, collision between customers and a certain supplier. So the proposed protocol tries to reduce DOS attack and avoids replay data attack by providing ticket token and deal sequence number to the supplier. It utilizes efficient LPN-based authentication method to accomplish lightweight authentication. And it publishes an interpolating polynomial for sharing the determination process data and avoids collusion between a customer and a certain supplier. Also the proposed scheme relaxes the trust assumptions for three-party in Jaiswals scheme. According to comparison and analysis with other protocols, our proposed protocol shows good security and less computation cost.

Pseudorandom number generator using optimal normal basis

This paper proposes a simple pseudorandom number generator [PRNG] by using optimal normal basis. It is well known that the squaring and multiplication in finite field with optimal normal basis is very fast and the basis can be transformed to a canonical form. The suggested PRNG algorithm combines typical multiplications and exclusive-or bit operations, both operations can be easily implemented. It is shown that the algorithm passes all terms of the Diehard and the ENT tests for long sequences. This algorithm can be applied in various applications such as financial cryptography.

Efficient nonce-based authentication scheme using token-update

In this paper an efficient token-update scheme based on nonce is proposed. This scheme provides an enhancement, resolving some problems with regard to Lees scheme, which cannot defend against and replay and impersonation attacks. Accordingly, an analysis and comparison with Lees and other schemes, demonstrate that the current paper avoids replay and impersonation attacks, providing mutual authentication, and also results in a lower computation cost than the original scheme.