Abstract: Provided is a technology which creates an autorun file that is used in autorun for preventing the autorun of a USB-based portable storage, thereby allowing an arbitrary user or worm virus not to manipulate the autorun file. A method for preventing autorun of portable storage accesses at least one of a master file table entry of a root directory and a master file table entry of an autorun file, and sets non-autorun in the at least one accessed master file table entry.

Abstract: In a method for recovering a partition using backup boot record information, an unallocated area is separated from a disk or an evidence image. The unallocated area is searched for a location of a backup boot record. Whether is backup boot record of a file system to be detected is present in found sectors is analyzed. If the backup boot record is found to be the backup boot record of the file system desired to be detected as a result of the analysis, it is verified whether the backup boot record is a boot record of a valid partition. If it is verified that the backup boot record is the boot record of the valid partition, a file system of a deleted partition is parsed using the backup boot record and a deleted directory or file is recovered.

Abstract: Provided is a technology which searches an unallocated area to quickly extract information on a deleted partition when checking a disk and an evidence image in digital forensic, and adds a recovered partition to a forensic tool as a new partition. For this, the technology has direct access to the sector of a disk or an evidence image which is obtained, limits information search on an unallocated area only to an area satisfying the minimum size in which a partition may be created, changes an LBA-based sector access scheme into a CHS-based sector access scheme, and reads only the sector of a location having the possibility that a boot record exists to search information of a deleted partition, recovering a partition at high speed.

Abstract: Method and apparatus for collecting evidence are provided. An exemplary embodiment enhances accuracy and efficiency of collecting evidence by analyzing link information in the target computer and collecting collection target file. And the exemplary embodiment can collect evidence from a target computer as well as from a remote computer through analyzing the link information in the target computer, identifying the path of collection target file and extracting the target file.

Abstract: A terminal discriminating apparatus and a terminal discriminating method using the same are provided. The terminal discriminating apparatus includes: a measurement unit for measuring a pull-up voltage and a pull-down voltage of each of candidate terminals to be discriminated; a discriminating unit for comparing the pull-up voltages, pull-down voltages, and the differences between the pull-up voltages and pull-down voltages for the candidate terminals to discriminate the types of the candidate terminals; and an output unit for outputting results of the discrimination of the candidate terminals transferred from the discriminating unit. The types of the candidate terminals can be discriminated by comparing the pull-up voltage, the pull-down voltage, and the differences between the pull-up voltages and the pull-down voltages for the candidate terminals.

Abstract: In a method for recovering a partition using backup boot record information, an unallocated area is separated from a disk or an evidence image. The unallocated area is searched for a location of a backup boot record. Whether is backup boot record of a file system to be detected is present in found sectors is analyzed. If the backup boot record is found to be the backup boot record of the file system desired to be detected as a result of the analysis, it is verified whether the backup boot record is a boot record of a valid partition. If it is verified that the backup boot record is the boot record of the valid partition, a file system of a deleted partition is parsed using the backup boot record and a deleted directory or file is recovered.

Abstract: Provided are an arithmetic method and apparatus for supporting Advanced Encryption Standard (AES) and Academy, Research Institute and Agency (ARIA) encryption/decryption functions. The apparatus includes: a key scheduler for generating a round key using an input key; and a round function calculator for generating encrypted/decrypted data using input data and the round key. Here, the round function calculator includes an integrated substitution layer and an integrated diffusion layer capable of performing both AES and ARIA algorithms.

Abstract: Provided are an arithmetic method and apparatus for supporting Advanced Encryption Standard (AES) and Academy, Research Institute and Agency (ARIA) encryption/decryption functions. The apparatus includes: a key scheduler for generating a round key using an input key; and a round function calculator for generating encrypted/decrypted data using input data and the round key. Here, the round function calculator includes an integrated substitution layer and an integrated diffusion layer capable of performing both AES and ARIA algorithms.

Abstract: Provided is an apparatus for computing a T-function based Stream Cipher (TSC)-4 stream cipher. The apparatus includes: two T-function units; and a nonlinear filter for receiving bits output from the two T-function units and generating an 8-bit output sequence per clock. Each of the T-function units includes: a first register for storing an internal state value of the lower N bits; an N-bit internal state updater for updating the internal state value of the lower N-bits stored in the first register; an intermediate result register for storing an intermediate result value output from the N-bit internal state updater; a second register for storing an internal state value of the upper M bits; and an M-bit internal state updater for updating the internal state value of the upper M bits stored in the second register using the value stored in the intermediate result register.

Abstract: A terminal discriminating apparatus and a terminal discriminating method using the same are provided. The terminal discriminating apparatus includes: a measurement unit for measuring a pull-up voltage and a pull-down voltage of each of candidate terminals to be discriminated; a discriminating unit for comparing the pull-up voltages, pull-down voltages, and the differences between the pull-up voltages and pull-down voltages for the candidate terminals to discriminate the types of the candidate terminals; and an output unit for outputting results of the discrimination of the candidate terminals transferred from the discriminating unit. The types of the candidate terminals can be discriminated by comparing the pull-up voltage, the pull-down voltage, and the differences between the pull-up voltages and the pull-down voltages for the candidate terminals.

Abstract: Provided is an apparatus and method for virtual private network (VPN) communication in a socket level that can be applied in an Internet Protocol version 4(IPv4)/IPv6 complex network, and can process data in a socket level to make a VPN communication apparatus available in many applications requiring more security, as well as a web application, wherein the data is transmitted to and received from any one of the internal device and the external device.

Abstract: Provided is a cryptographic device performing encryption or decryption on input data, and more particularly, a cryptographic device having a session memory bus for communicating with a session memory. The cryptographic device includes: an external session memory for storing cryptographic information on each session; a cryptographic processor for encrypting or decrypting input data using the cryptographic information; an external session memory bus connected to the external session memory and the cryptographic processor; and a Central Processing Unit (CPU) for transferring and receiving data to and from the external session memory via the cryptographic processor. The separate session memory buses allow the cryptographic processor to access a session memory without being disturbed by another device, thereby improving the entire performance of the cryptographic device.

Abstract: Provided is a technology which creates an autorun file that is used in autorun for preventing the autorun of a USB-based portable storage, thereby allowing an arbitrary user or worm virus not to manipulate the autorun file. A method for preventing autorun of portable storage accesses at least one of a master file table entry of a root directory and a master file table entry of an autorun file, and sets non-autorun in the at least one accessed master file table entry.

Abstract: Provided is a technology which searches an unallocated area to quickly extract information on a deleted partition when checking a disk and an evidence image in digital forensic, and adds a recovered partition to a forensic tool as a new partition. For this, the technology has direct access to the sector of a disk or an evidence image which is obtained, limits information search on an unallocated area only to an area satisfying the minimum size in which a partition may be created, changes an LBA-based sector access scheme into a CHS-based sector access scheme, and reads only the sector of a location having the possibility that a boot record exists to search information of a deleted partition, recovering a partition at high speed.

Abstract: Method and apparatus for collecting evidence are provided. An exemplary embodiment enhances accuracy and efficiency of collecting evidence by analyzing link information in the target computer and collecting collection target file. And the exemplary embodiment can collect evidence from a target computer as well as from a remote computer through analyzing the link information in the target computer, identifying the path of collection target file and extracting the target file.

Abstract: Provided is an apparatus and method for virtual private network (VPN) communication in a socket level that can be applied in an Internet Protocol version 4 (IPv4)/IPv6 complex network, and can process data in a socket level to make a VPN communication apparatus available in many applications requiring more security, as well as a web application.

Abstract: Provided is a cryptographic device performing encryption or decryption on input data, and more particularly, a cryptographic device having a session memory bus for communicating with a session memory. The cryptographic device includes: an external session memory for storing cryptographic information on each session; a cryptographic processor for encrypting or decrypting input data using the cryptographic information; an external session memory bus connected to the external session memory and the cryptographic processor; and a Central Processing Unit (CPU) for transferring and receiving data to and from the external session memory via the cryptographic processor. The separate session memory buses allow the cryptographic processor to access a session memory without being disturbed by another device, thereby improving the entire performance of the cryptographic device.

Abstract: Provided is an apparatus for computing a T-function based Stream Cipher (TSC)-4 stream cipher. The apparatus includes: two T-function units; and a nonlinear filter for receiving bits output from the two T-function units and generating an 8-bit output sequence per clock. Each of the T-function units includes: a first register for storing an internal state value of the lower N bits; an N-bit internal state updater for updating the internal state value of the lower N-bits stored in the first register; an intermediate result register for storing an intermediate result value output from the N-bit internal state updater; a second register for storing an internal state value of the upper M bits; and an M-bit internal state updater for updating the internal state value of the upper M bits stored in the second register using the value stored in the intermediate result register.

Abstract: An encrypted backup data storage device and a storage system using the same are provided. A backup memory stores at least one of plain-text data and a secret key. A leakage current blocking circuit includes at least one inverter and a complementary metal oxide semiconductor (CMOS) NAND gate circuit and cuts off leakage current paths formed by the lines connected to the battery backup memory.

Abstract: Provided are an arithmetic method and apparatus for supporting Advanced Encryption Standard (AES) and Academy, Research Institute and Agency (ARIA) encryption/decryption functions. The apparatus includes: a key scheduler for generating a round key using an input key; and a round function calculator for generating encrypted/decrypted data using input data and the round key. Here, the round function calculator includes an integrated substitution layer and an integrated diffusion layer capable of performing both AES and ARIA algorithms.