Information Security Products Research Articles

암호 프로그램 검증 시스템 설계 및 구현

In this paper, we propose an automation system to verify the cryptographic modules. The automation system is the cryptographic verification tool that integrates the specific test technologies and manage the test results. The requirement of design and implementation for cryptographic verification system is described. We also describe the domestic cryptographic verification policy and CC to examine the information security products and to provide the enhancement of verification technology. The function requirement of automation tool for cryptographic software is produced to analyze the stability of encryption algorithm and to verify the safety evaluation. Cryptographic Software verification system is designed and implemented.

Design and Implementation of Testing and Management System on Special Information Security Products

In order to solve the problem that the security function testing on special information security products, a system, that is, Testing and Management system on special Information security Products, is designed and implemented. By ways of Hibernate framework and WebService, the conformance testing on the security function of the special information security products is accomplished. And the testing requirements on the special information security products are normalized and the testing methods of the special information security products are integrated. The testing reports which provide reference for Mandatory Certification on special information security products about the conformance of function can be produced.

Information Security of Cloud Computing for Enterprises

Cloud computing has become one of the most significant information security issues in recent years. That is due to the dramatically emerging applications and required services of cloud computing. However, in order to safely utilize and enjoy the benefit of cloud computing through wired/wireless networking, sufficient assurance of information security such as confidentiality, authentication, nonrepudiation, and integrity is the most critical factor for adoption. In order to well understand the security of cloud computing, experimental platform based on kernel-based virtual machine has established. Besides, a dynamic intrusion detection system for strengthening the security application of cloud computing is implemented. In the proposed mechanism, numbers of intrusion detectors are dispatched on the whole topology of the networking system through multi-layers and multi-stages deployment. Those information security issues related with the application and service of cloud computing will be experimented and discussed. The experiments include the equipment security of the client side termination, the threats of web site and webpage, the detection and diagnosis and surveillance of intrusion, the access and security of database in the cloud side, the detection of system leakage and the monitor of real-time repairing process, the management of server system, the management of mobile e-commerce processing, and the integrated analysis of associated security information and issues. The goal of the proposed mechanism is not only focused on find out some solutions, but also focused on develop some feasible information security techniques or products for the application and service of cloud computing.

The Study of Influencing Online Banking Information Security Products Service Quality Factors Based on Customer Perception

The Study of Influencing Online Banking Information Security Products Service Quality Factors Based on Customer Perception

침입차단시스템의 품질평가 방법

Abstract International standard is the documents that is constructed based on general and common characteristics of software. Thus, it is necessary to consider the characteristics of product and optimize the evaluation method by using related standard to adapt to some specific knowledge information security products. Also, because rapid development of software field was obliged to change the international standard, the content and construction of standard has changed, it is necessary to construct the evaluation method with this change. In this paper, we developed the evaluation model that can support the quality enhancement by evaluating the quality level and extracting the improvement method of firewall. For this, we surveyed and analyzed the trend and the technical elements of firewall and considering the general quality requirements and unique quality requirements, and proposed the quality evaluation model and method.Key Words : Firewall, Knowledge Information Security, Quality Evaluation

A Derivation of Evaluation Item about Enterprise Security Management

The Enterprise Security Management system is a centralized control system based on predefined security policies by organizations. In Korea, there is a Common Criteria security certification according to the strict standards for various features. As the needs of information security product are increasing, the ESM system should be evaluated with quality characteristics. In this paper, we propose evaluation items for functionality and performance of Enterprise Security Management system, and the best practices for evaluation.

컴포넌트기반 보안개발방법의 프레임워크

본 논문은 컴포넌트 기반의 보안 시스템 개발을 위해 요구되는 개발 프레임워크에 관한 것이다. 정보시스템의 개발방법론 적용과 함께, 정보보호 제품의 개발방법론 적용이 현시점에 요구되고 있다. 본 논문에서는 개발방법의 NIST 요구규격, SDLC 단계별 요구기준, 위험평가 주요 보안 가이드 라인을 살펴보았다. 또한 SDLC 주요 보안 요소를 살펴보았고, 컴포넌트 기반 보안 프레임워크 수립에 대한 이해를 돕기 위해, 위협트리 STRIDE 기반의 외부 엔티티에 대한 스푸핑 측면에서 보안설계와 DFD 관계를 분석 제시하였다. This paper is about a development framework, which is required to develop of security system is based on component. With applying of SDLC(system development life cycle) of information system, the application of information security products DLC is required at this point of time. In this paper, we review NIST requirement specification of development method, requirement criteria of SDLC in each stage, and major security guidelines of risk assessment. Also we are reviewed major security element of SDLC, and to aid understanding of security framework based on component, present the relationship fo security design and DFD in respect of spoofing for the outside entity based on threat tree STRIDE.

Taiwan: Focus on the information security market

After many years of planning and promotion, Taiwan has considerable experience and expertise in information security. With everyone's day-to-day lives becoming more closely entwined with the Internet, the government and commercial companies have invested significant manpower and other resources in this area. Their goal is to ensure Taiwan's competitiveness in the use of IT and as a producer of IT products and services. As a producer and consumer of information security products and services,Taiwan has a growing place in the world's economy. It has ambitious plans for further investment in several areas of information security, extending the types and number of products it produces and consumes.