-
公开(公告)号：KR1020050065978A
公开(公告)日：2005-06-30
申请号：KR1020030097154
申请日：2003-12-26
Applicant: 한국전자통신연구원
IPC: H04L9/08
CPC classification number: H04L9/0894
Abstract: 본 발명은 암호화/복호화 키를 이용한 메시지 송수신 방법에 관한 것으로 특히, 전자적 수단을 이용한 메시지의 송수신 진행 중에 송신자와 수신자가 각각 암호화/복호화 키를 생성할 수 있을 뿐만 아니라, 암호화/복호화에 사용된 키를 복구할 수 있는 암호화/복호화 키를 이용한 메시지 송수신 방법에 관한 것이다.
본 발명이 제공하는 암호화/복호화 키를 이용한 메시지 송수신 방법은 (a)사용자가 자신의 개인키와 공개키를 생성하여 상기 공개키를 키 복구 대행기관(KRA)에 등록하고 공유된 비밀정보를 설정하는 사용자 등록 단계; 및 (b)송신 사용자는 전송 메시지의 복호화에 필요한 세션 키의 복구 정보를 생성하여 수신 사용자에게 전송하고, 상기 수신 사용자는 상기 복구 정보로부터 상기 복호화에 필요한 키를 직접 생성하여, 상기 전송 메시지를 복호화하는 암호 통신 단계를 포함하여 본 발명의 목적 및 기술적 과제를 달성한다.
아울러 본 발명의 목적 및 기술적 과제를 달성하기 위해 (c)상기 수신 사용자가 상기 KRA에 상기 세션 키의 복구를 요청하는 키 복구 요청 단계를 더 포함할 수 있다.-
公开(公告)号：KR100447511B1
公开(公告)日：2004-09-07
申请号：KR1020010084866
申请日：2001-12-26
Applicant: 한국전자통신연구원
IPC: G06F15/00
Abstract: PURPOSE: A role based access control method is provided to control an access request based on a user role at a kernel level for preventing or intercepting a system hacking. CONSTITUTION: The method comprises several steps. A process selects effective roles among current roles by checking whether the roles, whose current member is the process, exist with the data on all the generated roles stored at a role data file(S1). The generation number of the effective roles, stored at the role data file, is compared with that of the roles, stored at an object security database, and a permission value of the role defined at an object is regarded as meaningless in a case that the two generation numbers are not same(S2). An OR operation is applied to attribute values defined at the object corresponding to the remaining roles processed via the steps, S1 and S2, it is checked whether a requested attribute value exists at the object, and an access permission result is output according to the check result(S3).
Abstract translation: 目的：提供基于角色的访问控制方法来控制基于内核级用户角色的访问请求，以防止或拦截系统黑客行为。 构成：该方法包括几个步骤。 进程通过检查当前成员是进程的角色是否与存储在角色数据文件（S1）上的所有生成角色的数据一起存在，从而在当前角色中选择有效角色。 存储在角色数据文件中的有效角色的世代号与存储在对象安全数据库中的角色的世代号进行比较，并且在对象安全数据库中定义的角色的许可值被认为是无意义的 两代号码不一样（S2）。 对在与通过步骤S1和S2处理的剩余角色相对应的对象处定义的属性值应用OR操作，检查在对象处是否存在请求的属性值，并且根据该检查输出访问许可结果 结果（S3）。
-
公开(公告)号：KR1020040039845A
公开(公告)日：2004-05-12
申请号：KR1020020068066
申请日：2002-11-05
Applicant: 한국전자통신연구원
IPC: H04L9/00
CPC classification number: H04L63/08 , H04L63/0428 , H04L63/105
Abstract: PURPOSE: An apparatus and a method for encrypting user authentication information and data using MAC(Mandatory Access Control) and RBAC(Role Based Access Control) are provided to perform an encrypting process corresponding to a grade of the user information by encrypting selectively a transmitting file according to an important grade of the transmitting file. CONSTITUTION: An apparatus for encrypting user authentication information and data using MAC and RBAC includes an FTP client program(10), a kernel layer(20), an FTP demon program(15), and a security database(30). The FTP client program(10) provides a user authentication information request and a server connection request. The kernel layer(20) is used for requesting the user authentication according to the server connection request of the FTP client program. In addition, the kernel layer is used for performing an encrypting/decrypting processing data of the FTP client program when being connected by a grade of MAC corresponding to the user authentication request. The FTP demon program(15) is used for analyzing the encrypted user authentication information and performing a user authentication process according to the grade of MAC. The security database(30) is used for storing the grade of MAC for the client and the grade of MAC for the data.
Abstract translation: 目的：提供一种使用MAC（强制访问控制）和RBAC（基于角色的访问控制）加密用户认证信息和数据的装置和方法，用于通过有选择地加密发送文件来执行与用户信息等级对应的加密处理 根据传输文件的重要等级。 构成：使用MAC和RBAC加密用户认证信息和数据的装置包括FTP客户端程序（10），内核层（20），FTP恶魔程序（15）和安全数据库（30）。 FTP客户端程序（10）提供用户认证信息请求和服务器连接请求。 内核层（20）用于根据FTP客户端程序的服务器连接请求请求用户认证。 此外，当通过与用户认证请求相对应的MAC级别连接时，内核层用于执行FTP客户端程序的加密/解密处理数据。 FTP恶魔程序（15）用于分析加密的用户认证信息，并根据MAC的等级进行用户认证过程。 安全数据库（30）用于存储客户端的MAC级别和数据的MAC级别。
-
公开(公告)号：KR1020040037583A
公开(公告)日：2004-05-07
申请号：KR1020020066130
申请日：2002-10-29
Applicant: 한국전자통신연구원
IPC: H04L12/22
CPC classification number: H04L63/0428 , H04L63/162 , H04L63/164
Abstract: PURPOSE: An apparatus and a method for providing a reliable channel in a security OS(Operating System) to which MAC(Mandatory Access Control) is applied is provided to offer a new header for independently encoding a packet used in communication by a security level of the MAC and minimize network performance degradation using the security level of the MAC. CONSTITUTION: If data according to a communication request provided from a transmission-side user(S1) are for a packet transmission request, a reliable channel subsystem(12) judges whether a reliable channel is applied. If the reliable channel is applied, the reliable channel subsystem(12) composes a reliable channel header, encodes a specific portion of a packet, stores authentication information in the reliable channel header, and transmits the packet through a network(A). A MAC module(20) provides MAC information for indicating whether the reliable channel is applied. A kernel memory(30) provides an encryption key and an authentication key necessary for encoding a reliable channel application host address and the packet and generating authentication data. A reliable channel subsystem(12-1) retrieves the authentication data of the reliable channel header before decoding the packet received through the network(A). If the authentication data are valid, the reliable channel subsystem(12-1) decodes the encoded packet. If process for the reliable channel is ended, the reliable channel subsystem(12-1) transmits the packet to an upper level to transmit the packet to a reception-side user(S2). A kernel memory provides an authentication key and an encryption key necessary for checking authentication with respect to the packet encoded by the reliable channel subsystem(12) and decoding the packet.
Abstract translation: 目的：提供一种用于在应用MAC（强制访问控制）的安全OS（操作系统）中提供可靠信道的装置和方法，以提供用于通过安全级别独立地编码通信中使用的分组的新标题 MAC，并使用MAC的安全级别最小化网络性能下降。 构成：如果从发送侧用户（S1）提供的根据通信请求的数据用于分组发送请求，则可靠的信道子系统（12）判断是否应用了可靠的信道。 如果可靠的信道被应用，可靠的信道子系统（12）构成可信的信道报头，对分组的特定部分进行编码，将认证信息存储在可信的信道报头中，并通过网络（A）发送分组。 MAC模块（20）提供用于指示是否应用可靠信道的MAC信息。 内核存储器（30）提供对可靠的信道应用主机地址和分组进行编码所需的加密密钥和认证密钥，并生成认证数据。 可靠的信道子系统（12-1）在对通过网络（A）接收的分组进行解码之前检索可靠信道报头的认证数据。 如果验证数据有效，则可靠的信道子系统（12-1）解码编码的分组。 如果可靠信道的处理结束，则可靠信道子系统（12-1）将分组发送到上层，将分组发送给接收侧用户（S2）。 内核存储器提供验证密钥和加密密钥，用于检查关于由可靠信道子系统（12）编码的分组的认证并对分组进行解码。
-
公开(公告)号：KR1020030055702A
公开(公告)日：2003-07-04
申请号：KR1020010085757
申请日：2001-12-27
Applicant: 한국전자통신연구원
IPC: G06F9/06
CPC classification number: G06F21/6218 , G06F2221/2107 , G06F2221/2113
Abstract: PURPOSE: A file security system using a security level and a method for managing an encryption key are provided to encrypt or decrypt a file having the security level by using the encryption key of each security level, and to offer the file to a user, or save the file in a disk. CONSTITUTION: The disk(130) stores the encryption key matched with the security level set by an access control module(120), a key file storing the encryption key, and the file encrypted by the encryption key. A kernel memory(140) stacks the encryption key stored in the disk(130) according to the driving of the encryption file system(110). The encryption file system(110) draws out the encryption key matched with the security level of the file to read or stored by the user from the kernel memory(140), and transmits the file decrypted or encrypted by the encryption key to the user, or stores the file in the disk.
Abstract translation: 目的：提供使用安全级别的文件安全系统和用于管理加密密钥的方法，以通过使用每个安全级别的加密密钥对具有安全级别的文件进行加密或解密，并将文件提供给用户，或 将文件保存在磁盘中。 构成：磁盘（130）存储与由访问控制模块（120）设置的安全等级相匹配的加密密钥，存储加密密钥的密钥文件和通过加密密钥加密的文件。 内核存储器（140）根据加密文件系统（110）的驱动堆叠存储在盘（130）中的加密密钥。 加密文件系统（110）从内核存储器（140）中提取与用户要读取或存储的文件的安全级别匹配的加密密钥，并将用加密密钥解密或加密的文件发送给用户， 或将文件存储在磁盘中。
-
Patent Agency Ranking
公开(公告)号：KR100670790B1
公开(公告)日：2007-01-17
申请号：KR1020040101091
申请日：2004-12-03
Applicant: 한국전자통신연구원
Abstract: 이동 IPv6 환경에서 AAA(Authentication Authorization Accounting) 기반 구조를 통한 IPSec 보안 연계 분배 방법 및 시스템이 개시되어 있다. 본 발명은 AAA 기반 구조와 연동된 모바일 IPv6환경에서 이동 노드와 홈에이전트간에 IPSec 보안 연계를 분배하는 IPSec 보안 연계 분배 방법에 있어서, 이동 노드가 상기 AAA기반구조로 보안 연계 분배를 요청하면 소정의 인증 절차를 거쳐 상기 홈에이전트에 보안 연계 분배에 필요한 정보를 요청하는 과정, 홈에이전트로부터 보안 연계 분배 요청의 정책 정보와 일치하는 정책의 존재 여부와 알고리듬 선택 메시지를 수신하면 그 메시지를 바탕으로 보안 연계 구성 정보를 생성하는 과정, 생성된 보안 연계 정보 메시지를 상기 이동 노드 및 상기 홈 에이전트로 분배하는 과정을 포함한다.
-
公开(公告)号：KR100463842B1
公开(公告)日：2004-12-29
申请号：KR1020010085757
申请日：2001-12-27
Applicant: 한국전자통신연구원
IPC: G06F9/06
CPC classification number: G06F21/6218 , G06F2221/2107 , G06F2221/2113
Abstract: A file security system uses a security class set by an access control module. The file security system includes a disk, a kernel memory and an encryption file system. The disk includes a key file in which an encryption key corresponding to the security class is stored and a file encoded by the encryption key. The encryption key stored in the disk is loaded into the kernel memory when the file security system starts operating. The encryption file system extracts an encryption key corresponding to a security class of a file that a user intends to read or store; decodes or encodes the file by using the extracted encryption key; and then provides the decoded file to the user or stores the encoded file in the disk.
Abstract translation: 文件安全系统使用由访问控制模块设置的安全类别。 文件安全系统包括磁盘，内核内存和加密文件系统。 该盘包括其中存储了与安全级别对应的加密密钥的密钥文件和由加密密钥编码的文件。 当文件安全系统开始运行时，存储在磁盘中的加密密钥将加载到内核内存中。 加密文件系统提取与用户想要读取或存储的文件的安全等级对应的加密密钥; 通过使用提取的加密密钥对文件解码或编码; 然后将解码的文件提供给用户或将编码的文件存储在磁盘中。
-
公开(公告)号：KR1020060062302A
公开(公告)日：2006-06-12
申请号：KR1020040101091
申请日：2004-12-03
Applicant: 한국전자통신연구원
Abstract: 이동 IPv6 환경에서 AAA(Authentication Authorization Accounting) 기반 구조를 통한 IPSec 보안 연계 분배 방법 및 시스템이 개시되어 있다. 본 발명은 AAA 기반 구조와 연동된 모바일 IPv6환경에서 이동 노드와 홈에이전트간에 IPSec 보안 연계를 분배하는 IPSec 보안 연계 분배 방법에 있어서, 이동 노드가 상기 AAA기반구조로 보안 연계 분배를 요청하면 소정의 인증 절차를 거쳐 상기 홈에이전트에 보안 연계 분배에 필요한 정보를 요청하는 과정, 홈에이전트로부터 보안 연계 분배 요청의 정책 정보와 일치하는 정책의 존재 여부와 알고리듬 선택 메시지를 수신하면 그 메시지를 바탕으로 보안 연계 구성 정보를 생성하는 과정, 생성된 보안 연계 정보 메시지를 상기 이동 노드 및 상기 홈 에이전트로 분배하는 과정을 포함한다.
-
公开(公告)号：KR1020030082187A
公开(公告)日：2003-10-22
申请号：KR1020020020800
申请日：2002-04-17
Applicant: 한국전자통신연구원
IPC: G06F12/14
CPC classification number: G06F21/6209 , G06F21/6218
Abstract: PURPOSE: A method for controlling access using a token having security attribute on a computer system is provided to keep security even if a storing device is flown out by storing a file after encryption using an encryption attribute, and to put no special limitation for conventional operation while keeping the security by making a system manager read only the encrypted contents for backup. CONSTITUTION: The computer system gives the token having the security attribute to a user permitted to access to a file(S101). A user process checks an access request for the file. It is judged that the access requested file has the token having the security attribute(S103). If the file has the token, the access to the file is permitted. If not, the access is permitted or refused by judging that the user requesting the access has the same token(S104).
Abstract translation: 目的：提供一种使用计算机系统上具有安全属性的令牌来控制访问的方法，以便即使通过使用加密属性在加密之后存储文件来存储存储设备，也保持安全性，并且对常规操作没有特别限制 同时通过使系统管理员只读取加密的内容进行备份来保持安全性。 构成：计算机系统向允许访问文件的用户给出具有安全属性的令牌（S101）。 用户进程检查文件的访问请求。 判断访问请求文件具有具有安全属性的令牌（S103）。 如果文件有令牌，则允许访问该文件。 如果不是，则通过判断请求访问的用户具有相同的令牌来允许或拒绝该访问（S104）。
-
公开(公告)号：KR1020030054657A
公开(公告)日：2003-07-02
申请号：KR1020010084866
申请日：2001-12-26
Applicant: 한국전자통신연구원
IPC: G06F15/00
Abstract: PURPOSE: A role based access control method is provided to control an access request based on a user role at a kernel level for preventing or intercepting a system hacking. CONSTITUTION: The method comprises several steps. A process selects effective roles among current roles by checking whether the roles, whose current member is the process, exist with the data on all the generated roles stored at a role data file(S1). The generation number of the effective roles, stored at the role data file, is compared with that of the roles, stored at an object security database, and a permission value of the role defined at an object is regarded as meaningless in a case that the two generation numbers are not same(S2). An OR operation is applied to attribute values defined at the object corresponding to the remaining roles processed via the steps, S1 and S2, it is checked whether a requested attribute value exists at the object, and an access permission result is output according to the check result(S3).
Abstract translation: 目的：提供一种基于角色的访问控制方法，以根据内核级别的用户角色来控制访问请求，以防止或拦截系统黑客。 构成：该方法包括几个步骤。 过程通过检查当前成员是进程的角色是否存在于角色数据文件（S1）中存储的所有生成的角色上的数据，来选择当前角色中的有效角色。 存储在角色数据文件中的有效角色的生成次数与存储在对象安全数据库中的角色的生成次数进行比较，并且在对象的定义角色的权限值被认为是无意义的， 两代数不相同（S2）。 对与通过步骤S1和S2处理的剩余角色相对应的对象定义的属性值应用OR操作，检查对象是否存在请求的属性值，并且根据检查输出访问许可结果 结果（S3）。
-
-
-
-
-
-
-
-
-
Search Results
14
records
(took 0.02 seconds)
