Abstract: A masking addition operation apparatus for prevention of a side channel attack, includes a random value generation unit generating a first random value for a first input, second random value for a second input, and a summation random value. The masking addition operation apparatus includes an operation part performing an operation on the first and second random values, a previous carry input, and first and second masked random values generated based on the first and second random values. The masking addition operation apparatus includes a carry generator generating a carry input using a result of the operation part; and a summation bit generator generating a summation bit using the summation random value, the first and second random values, the previous carry input and the first and second masked random values.

Abstract: Disclosed are a system and method for managing digital contents. An exemplary embodiment according to the present invention provides to a system for managing digital contents, including a learning module extracting feature vectors of input digital contents and performing column subspace mapping on the feature vectors to calculate a column subspace projection matrix; an index module using the matrix to perform an index work on the digital contents and then, storing the matrix and the digital contents; and a search module performing the column subspace mapping on the feature vectors of query data when the query data for searching the digital contents are input and searching the digital contents indexed by the matrix having high similarity to the mapped feature vectors of the query data.

Abstract: Disclosed herein is a remote personal authentication system and method using biometrics. The remote personal authentication method using biometrics includes receiving a biometric information of a user remotely detected by a biometric information collection device; decrypting, in a hardware security module (HSM) of the user, the received biometric information and biometric information stored in the HSM; and performing personal authentication for the user by comparing the decrypted biometric information with each other in the HSM.

Abstract: Provided is an intelligent video information retrieval apparatus capable of multi-dimensional video indexing and retrieval. The intelligent video information retrieval apparatus includes an event detector configured to detect pieces of event information from footage collected by a plurality of video capture devices, a data mart builder configured to generate a data cube using the detected pieces of event information, and capture time and capture location information related to the pieces of event information, and store and manage the generated data cube, and a video retriever configured to receive an event retrieval condition from a user to retrieve event information corresponding to the received event retrieval condition using the data cube, and output the retrieval result to the user.

Abstract: Provided is a method for providing an anonymous public key infrastructure (PKI) in a user terminal. The method includes receiving a real-name certificate from a real-name PKI service domain, requesting an anonymous certificate to an anonymous PKI service domain, and receiving the anonymous certificate from the anonymous PKI service domain. Accordingly, the method can ensure anonymity when a user uses a service by providing the anonymous certificate in association with the PKI-based real-name certificate.

Abstract: A user terminal and a method of managing user information are provided. The method includes issuing a request for issuance of a certificate for a user to a certification authority; generating a document including at least part of user information using a certificate issued by the certification authority; and issuing a subscription request to a desired web service provider by providing the document including the at least part of the user information to the desired web service provider. Therefore, it is possible to strengthen the user's right to self-determination and control over the exposure and use of his or her personal information. In addition, it is possible to improve the reliability of user information provided to each website by the user.

Abstract: An anonymous authentication-based private information management (PIM) system and method are provided. The PIM method includes receiving an anonymous certificate not including user information from an anonymous certification authority; generating an anonymous document including the anonymous certificate and some of the user information; and providing the anonymous document to a web service provider so as to be authenticated and thus provided with a web service by the web service provider. Thus, only a minimum of user information may be provided to the web service provider. In addition, it is possible to strengthen a user's right to self-determination and control over the exposure and use of his or her personal information by allowing a user to manage his or her own personal information or entrusting the PIM server to manage user information. Moreover, it is possible to protect the privacy of a user by preventing the exposure of user information.

Abstract: Conditionally traceable anonymous service system is provided. The system respectively separates subject conforming real name, subject conforming anonymity, subject requesting verification for an anonymity certification means, so that privacy of a user is hardly violated, the present invention can acquire real name information for the user only when a trace for a user is surely requested.

Abstract: The present invention can't independently know real name information of a user unless a server of an authority treating real name certificate and a server of an authority treating pseudonym certificate collaborate mutually, so that privacy of a user isn't infringed. The present invention can acquire real name information of a user with collaboration of real name certification sever and pseudonym certification sever only if you need real name information for a user.

Abstract: There is provided a high-speed pipelined ARIA encryption apparatus. The high-speed pipelined ARIA encryption apparatus includes a round key generator for generating a plurality of round keys required for performing an encryption operation using a master key formed to have uniform bits, a plurality of round units whose number is in proportion to the number of times of round operations corresponding to the number of bit of an input value to receive the round keys and the input value and to perform the round operations, and a plurality of pipelined register provided between the round units to transmit the output value of a previous round unit as the input value of the next round unit. A plurality of round units are provided and pipelined registers are inserted between the round units so that it is possible to improve the performance of processing a large amount of data and to perform ARIA encryption at high speed.

Abstract: A data storage device having a smart card based copy protection function is provided. The data storage device encodes data using the temper resistant key of the smart card as the encoding seed, stores the encoded data, and transmits the encoded data to other device. Therefore, it is impossible to modulate or to make the illegal copy of stored or transmitted data, and the reliability of the storage device can be improved.

Abstract: The present invention relates to a system for automatically managing integrity reference information and a method of managing the same. The system includes one or more systems, a system management server, and an integrity management server. The systems are connected over a network and communication with each other. Each of the systems has an integrity measurement program to generate integrity information. The system management server has registration information about each of the systems connected over the network and registration information about a program distributed to each of the systems. Further, the system management server controls network access by each of the systems.

Abstract: A method for dynamically changing an intrusion detection rule in a kernel level intrusion detection system is disclosed. The method includes the steps of: a) generating a replica of the intrusion detection rule in a kernel area; b) changing the replica of the intrusion detection rule according to a request of changing the intrusion detection rule from the kernel area; and c) changing a currently applied intrusion detection rule by exchanging a value of a pointer representing the intrusion detection rule with a value of a pointer representing the changed replica of the intrusion detection rule.

Abstract: Provided are an apparatus and method for detecting illegal motion picture data. The apparatus includes a key frame extractor for extracting a plurality of key frames from motion picture data, a characteristic value file generator for detecting characteristic values of the extracted key frames and generating a characteristic value file, and an illegality determiner for measuring degree of similarity between a previously stored learning model file and the characteristic value file and determining whether or not the motion picture data is legal according to the degree of similarity.

Abstract: Provided are a method and apparatus for providing a security mechanism guaranteeing transparency at a transport layer. The method includes: receiving a data packet from an application program, and searching key information corresponding to the data packet in key information database; determining whether to request a key exchange module of an application layer for a new key negotiation according to a result obtained by searching key information; and performing encrypting/decrypting based on key information when the key exchange module stores key negotiation information obtained by the new key negotiation in a kernel. The apparatus encrypts/decrypts the data packet at the transport layer of the kernel, thereby providing the application program with security transparency, effectively controlling and making it easily expansible.

Abstract: Provided is a method and system for providing an SSO service enabling the use of Web services in different trusted domains through a one-time authentication process. In the method, mutual authentication information is issued from a trusted third party to each of ID-federation service providers managing each of trusted domains, and an ID federation established between the ID-federation service provider and a user in the trusted domain of the ID-federation service provider. The first ID-federation service provider managing the first trusted domain, to which the user belongs to, is confirmed when a Web service provider in the second trusted domain receives a login request from the user in the first trusted domain. User authentication and mutual authentication arc performed between the first ID-federation service provider and a second ID-federation service provider managing the second trusted domain.

Abstract: Disclosed is an access control method using a token having security attributes in a computer system when a user gains access to a specific file. The computer system adopts a token having encryption, modification, execution, and provision attributes to determine access permission or access denial between a user and a file in such a way that a file access request is controlled. The access control method enciphers a file and stores the enciphered file in a storage unit, so that it can maintain security of the file even though the storage unit is stolen. The access control method enables a system manager to read only enciphered contents of the file when the system manager performs a data backup operation, thereby eliminating limitations in commonly operating a system simultaneously with maintaining file security.

Abstract: A packet intrusion detection rule simplification apparatus and method and an intrusion detection apparatus and method are provided. Test conditions of at least one intrusion detection rules are rearranged based on test items, and the same test conditions for the same test items are grouped. Group rules having a connection structure of the test conditions are generated so that the test items and orders of the intrusion detection rules are satisfied. A common rule consisting of test conditions existing at the test start positions in the connection structure of the group rules is generated. Next, packet intrusion detection is performed by using the common rule, and the packet intrusion detection is performed by using the group rules. According, it is possible to reduce a load involved in the intrusion detection process by using the grouped and simplified intrusion detection rules.

Abstract: Disclosed herein is a method of providing a trusted path between a client and a system using an access control processing technique. The method of providing a trusted path between a client and a system includes the step of determining whether access to resources of the system will be permitted or refused on the basis of access control rules and databased attributes set by a security administrator. Thereafter, the client is notified of permission for or refusal of the access in accordance with the result of the determination.

Abstract: A method for dynamically changing an intrusion detection rule in a kernel level intrusion detection system is disclosed. The method includes the steps of: a) generating a replica of the intrusion detection rule in a kernel area; b) changing the replica of the intrusion detection rule according to a request of changing the intrusion detection rule from the kernel area; and c) changing a currently applied intrusion detection rule by exchanging a value of a pointer representing the intrusion detection rule with a value of a pointer representing the changed replica of the intrusion detection rule.