Abstract: Exemplary embodiments of the present invention relate to a batch verification method for verifying a plurality of authentication data or digital signature values and an apparatus thereof. A batch verification method according to an embodiment of the present invention comprises: rearranging N pairs of individual instances which compose a batch verification instance; selecting N?1 verification exponents from a verification exponent set E which is used for the batch verification; and performing the batch verification for the rearranged batch verification instance by using the selected verification exponents. Exemplary embodiments of the present invention can be suitable for digital signature and cryptographic confirmation. According to exemplary embodiments, verification computation amount of a plurality of authentication data or digital signature values can be significantly reduced.

Abstract: A similarity calculating method and apparatus are disclosed. A similarity calculating method according to an exemplary embodiment of the present invention includes extracting similarity calculating data, which is determined in advance, by receiving a communication activity record for every user; modeling a communication activity pattern for every user and common information between the users based on the extracted similarity calculating data; and calculating a similarity between users using the modeled communication activity pattern for every user and common information. The modeling includes: modeling the communication activity pattern by calculating a value of a static feature from the similarity calculating data, and modeling the common information by calculating a value of a dynamic feature from the similarity calculating data.

Abstract: A method for visualizing record data with a mobile forensic device for collecting and managing the record data including partner information when an event, such as a call or text service, occurs, includes: calculating an event occurrence frequency for each partner information using the collected record data; and classifying the partner information on the basis of a grade according to the calculated event occurrence frequency. Further, the method includes generating graphic data showing a relation between the partner information and user information of a mobile terminal on the basis of the classified grade; and displaying the graphic data.

Abstract: Exemplary embodiments of the present invention relate to a batch verification method for verifying a plurality of authentication data or digital signature values and an apparatus thereof. A batch verification method according to an embodiment of the present invention comprises: rearranging N pairs of individual instances which compose a batch verification instance; selecting N?1 verification exponents from a verification exponent set E which is used for the batch verification; and performing the batch verification for the rearranged batch verification instance by using the selected verification exponents. Exemplary embodiments of the present invention can be suitable for digital signature and cryptographic confirmation. According to exemplary embodiments, verification computation amount of a plurality of authentication data or digital signature values can be significantly reduced.

Abstract: Disclosed herein are a method that generates an index for an efficient range search in an encrypted DB, and a decryption apparatus and method that are capable of searching for desired data and decrypting search results using the index generation method. The presented index generation method includes preparing a private key and a one-way function, calculating a tag for an input plaintext interval using the private key and the one-way function, and dividing the plaintext interval into a plurality of partial intervals, encrypting information of a partial interval including plaintext using the tag, and then generating an encrypted index.

Abstract: A forensic analysis system and method using a virtualization interface which performs a forensic investigation or analysis on a corresponding system while minimizing a change in system information and operation interference of a live computer which is being operated is provided. In the forensic analysis system which performs a forensic analysis through a connection between an investigation target computer and an analysis computer, the investigation target computer is configured to execute a collection agent installation program stored in the analysis computer, and transmit analysis target information according to a request of the analysis computer.

Abstract: Proposed is a data visualizing apparatus for visualizing data as effectual information using a correlation between forensic data collected from various sources. The proposed data visualizing apparatus may visualize, as effectual information, single-source single-data, single-source multi-data, and multi-source multi-data.

Abstract: A method for visualizing record data with a mobile forensic device for collecting and managing the record data including partner information when an event, such as a call or text service, occurs, includes: calculating an event occurrence frequency for each partner information using the collected record data; and classifying the partner information on the basis of a grade according to the calculated event occurrence frequency. Further, the method includes generating graphic data showing a relation between the partner information and user information of a mobile terminal on the basis of the classified grade; and displaying the graphic data.

Abstract: Provided is a forensic index method by distributed processing, including: generating data to be divided by dividing data to be indexed according to predetermined division setting for distributed processing; allocating the generated data to be divided to a plurality of data processing units according to the predetermined division setting, extracting an index by filtering the allocated data to be divided in the plurality of data processing units, and generating divided index data including the extracted index; and generating an index database by merging the generated divided index data.

Abstract: A similarity calculating method and apparatus are disclosed. A similarity calculating method according to an exemplary embodiment of the present invention includes extracting similarity calculating data, which is determined in advance, by receiving a communication activity record for every user; modeling a communication activity pattern for every user and common information between the users based on the extracted similarity calculating data; and calculating a similarity between users using the modeled communication activity pattern for every user and common information. The modeling includes: modeling the communication activity pattern by calculating a value of a static feature from the similarity calculating data, and modeling the common information by calculating a value of a dynamic feature from the similarity calculating data.

Abstract: A system and method for data analysis and digital forensics is provided. The system for data analysis and digital forensics may include: an online data forensic server for collecting and analyzing usage history information from an object device, which is subject to data collection, downloading and collecting data on the Internet based on the usage history information, requesting issuance of a timestamp token for the collected data, and receiving the issued timestamp token; a timestamp token issuing server for issuing the timestamp token for the collected data in response to the request for issuance of the timestamp token and proving the issued timestamp token to the online data forensic server; and a storage device for storing the collected data.

Abstract: Proposed is a data visualizing apparatus for visualizing data as effectual information using a correlation between forensic data collected from various sources. The proposed data visualizing apparatus may visualize, as effectual information, single-source single-data, single-source multi-data, and multi-source multi-data.

Abstract: Provided is a forensic index method by distributed processing, including: generating data to be divided by dividing data to be indexed according to predetermined division setting for distributed processing; allocating the generated data to be divided to a plurality of data processing units according to the predetermined division setting, extracting an index by filtering the allocated data to be divided in the plurality of data processing units, and generating divided index data including the extracted index; and generating an index database by merging the generated divided index data.

Abstract: An apparatus for creating a data table of a forensic data, includes a data parser configured to create primary data tables including unique attributes of the predetermined keywords by parsing the raw data having different formats for each forensics tool, each attribute having a unique standardized format. The apparatus further includes a data filter filtering specific fields or attributes from the primary data tables to newly create secondary data table. The apparatus further includes a data relation analyzer analyzing a relation between the data within the primary data tables to newly create secondary data tables.

Abstract: A digital forensic apparatus for analyzing user activities includes: a collection unit for collecting analysis information related to user activities from a device as an investigation target for analyzing the user activities; and an analysis unit for analyzing the analysis information collected by the collection unit to determine activity information of a user from each type of the analysis information, and for causing the activity information to be arranged and displayed in temporal order.

Abstract: A system and method for data analysis and digital forensics is provided. The system for data analysis and digital forensics may include: an online data forensic server for collecting and analyzing usage history information from an object device, which is subject to data collection, downloading and collecting data on the Internet based on the usage history information, requesting issuance of a timestamp token for the collected data, and receiving the issued timestamp token; a timestamp token issuing server for issuing the timestamp token for the collected data in response to the request for issuance of the timestamp token and proving the issued timestamp token to the online data forensic server; and a storage device for storing the collected data.

Abstract: A remote forensics system based on a network is provided to allow for accessing a forensics analysis center from a remote area to perform forensic analysis. The network-based remote forensic system includes: one or more remote terminals performing forensic analysis on an evidence device in a remote area, through a virtual forensic tool when the evidence device is connected thereto; and an investigation center system connected to the remote terminals via a wide area network to provide the virtual forensic tool, processing a requirement of the remote terminals, and providing requirement processing results to the remote terminals.

Abstract: An apparatus for collecting evidence data includes: an online data collection unit for collecting online data from a location designated by a user; a screen capture unit for capturing shots viewed on a computer screen, as they are; a time stamping unit for calculating a message digest for the collected online data to generate a time stamp including date and time when the message digest has been generated and a signature of the time stamping unit itself; and an image generation unit for generating a forensic image for the collected online data and generating a message digest for the collected online data.

Abstract: Disclosed herein is a method of providing a trusted path between a client and a system using an access control processing technique. The method of providing a trusted path between a client and a system includes the step of determining whether access to resources of the system will be permitted or refused on the basis of access control rules and databased attributes set by a security administrator. Thereafter, the client is notified of permission for or refusal of the access in accordance with the result of the determination.

Abstract: An apparatus for providing a trusted channel among secure operating systems (OSs) to which a mandatory access control (MAC) policy is applied includes on a data transmission side a trusted channel sub system, a MAC module and a kernel memory. The apparatus further includes on a data reception side a trusted channel system and a kernel memory. By using the apparatus, the contents of data can be prevented from being exposed even in case the packet is intercepted while being transmitted since the packet is encrypted. Furthermore, even though the contents of the data packet are replaced with malicious contents, such modulation of data can be detected by examining the integrity of the packet through the use of authentication data.