Electronics and Telecommunications Research Institute

Hyoung-Chun Kim

Byung-Joon Kim

Sung-Jin Kim

Woomin Hwang

Chulwoo Lee

Hyunyi Yi

Seong-Joong Kim

Sang-Woo Park

E-Joong Yoon

Wook Shin

Jung-Hwan Moon

Chul-Woo Lee

Seunghun Han

Seung-Hun Han

Jung-Hwan Kang

Hyun Ku Kim

Hyun-Yi Yi

An operation method of a system for generating a security profile of a security instance includes extracting executable code and a library file from a container, thereby identifying a target to be analyzed; performing binary static analysis for the executable code and the library file in order to generate a system call list; and generating a Secure Computing Mode (SECCOMP) security profile based on the system call list.

System and method for generating security profile of container instance

Disclosed herein are an apparatus and method for booting a virtual machine. The apparatus for booting a virtual machine includes: an access unit for accessing a virtual disk, corresponding to a virtual machine that exists in a virtualization area, using a trap generated by a trap generation unit, and for controlling the input and output of data stored in the virtual disk; an extraction unit for extracting data used for booting from the virtual disk; and a verification unit for extracting a trusted boot image from image storage and verifying the integrity of the data used for booting based on a result of comparing the trusted boot image with the data used for booting.

Apparatus and method for booting virtual machines

An apparatus for monitoring file access in a virtual machine in a cloud-computing system based on a virtualized environment includes a hypervisor for implementing at least one virtual machine and managing the virtual machine by monitoring a task in which a the virtual machine accesses a file loaded from storage to memory, the storage storing data including environment information of the virtual machine.

Apparatus for monitoring file access in virtual machine and method for the same

An apparatus and method for storing an audit trail in response to execution of a virtual-machine process. The method for storing an audit trail, performed by the apparatus for storing an audit trail in response to execution of a virtual-machine process, includes detecting execution of a process inside a virtual machine, determining whether the executed process is a monitoring target process and determining a type of the process, activating one or more monitoring events for monitoring at least one of an upload, a download and a drop by the process based on a result of the determination, and storing information about occurrence of the activated monitoring event as an audit trail.

Apparatus and method for storing audit trail in response to virtual-machine process execution

An apparatus and method for collecting an audit trail in a virtual machine boot process, the audit-trail-collecting apparatus including an event detection unit for detecting a software interrupt event, a register state information extraction unit for extracting state information of a CPU register corresponding to a detection time of the software interrupt event, a monitoring unit for monitoring a change in a vector value corresponding to the software interrupt event in an interrupt vector table, a threat occurrence detection unit for detecting a threat occurrence in a virtual machine boot process based on at least one of the CPU register state information and a monitored result, and an audit trail collection unit for storing an audit trail corresponding to at least one of the CPU register state information and the monitored result when the threat occurrence is detected in the virtual machine boot process.

Apparatus and method for collecting audit trail in virtual machine boot process

A user terminal using cloud service, an integrated security management server for the user terminal, and an integrated security management method for the user terminal. The integrated security management method includes receiving, by an integrated security management server, authentication information from at least one user terminal that use a cloud service, authenticating, by the integrated security management server, the user terminal using the authentication information, transmitting, by the integrated security management server, task information to the user terminal so as to control the user terminal, receiving, by the integrated security management server, at least one of a result of processing the task information and state information from the user terminal that verifies the task information, and managing, by the integrated security management server, a state of the user terminal based on at least one of the result of processing and the state information.

User terminal using cloud service, integrated security management server for user terminal, and integrated security management method for user terminal

A hypervisor-based virtual machine isolation apparatus and method. The hypervisor-based virtual machine isolation method performed by the hypervisor-based virtual machine isolation apparatus includes when a hypervisor starts to run virtual machines, allocating one or more colors to each of the virtual machines, allocating a page frame corresponding to the allocated colors to the corresponding virtual machine, allocating an accessible core depending on the colors of the virtual machine, and performing isolation between virtual machines corresponding to an identical color by changing a temporal/spatial scheduling order between the virtual machines corresponding to the identical color.

Hypervisor-based virtual machine isolation apparatus and method

A method and apparatus for providing an operating system based on a lightweight hypervisor. An electronic device includes a hypervisor, an operating system monitor, and a virtualized operating system. The hypervisor enables the virtualized operating system and a physical machine to share the resources of the physical machine. If the virtualized operating system accesses the resource, the operating system monitor determines whether to allow the access to the resource. Also, the operating system monitor verifies the integrity of the virtualized operating system and determines whether a threat to the virtualized operating system exists.

Method and apparatus for providing operating system based on lightweight hypervisor

A software update apparatus and method in a virtualized environment. The software update method performed by a software update apparatus in a virtualized environment includes monitoring an operation that is invoked when software is updated in a guest operating system area, creating a software profile by analyzing results of the monitoring, mounting a virtual disk image for a target virtual machine in a target directory in a virtual machine monitor area, and incorporating update information of at least one of a file and a registry that are specified in the software profile into the target directory in which the virtual disk image is mounted.

Software update apparatus and method in virtualized environment

A method and an apparatus for authorizing online financial transactions are provided. The apparatus for authorizing online financial transactions includes: randomly selecting, using an apparatus for authorizing online financial transactions, a portion of main transaction information corresponding to a user and combining the selected information to create authorization information; converting the authorization information into a form displayed to the user through a specific process; providing the main transaction information and the converted authorization information to the user; receiving user select information, which is recognized by the user and is part of the main transaction information, and the converted authorization information provided to the user; and comparing the user select information with the authorization information and determining whether the user recognizes the authorization information based on the comparison results.

Apparatus and method for authorization of online financial transaction

An apparatus and method for preventing falsification of a client screen is provided, in which a web server dynamically generates URIs and provides them to clients, thus preventing the falsification of client screens due to a web injection attack or a memory hacking attack. The apparatus includes a random web generation unit for converting an identical web page into random URIs that are randomly generated, at a request of a plurality of clients, generating different random web sources, and providing the different random web sources to the respective clients. A web falsification determination unit compares display web source eigenvalues respectively generated by the clients with respect to any one of the random web sources with a generative web source eigenvalue for the one of the random web sources, thus determining whether screens corresponding to the random web sources displayed on the respective clients have been falsified.

Growing community of inventors

Daejeon, South Korea

Hyoung-Chun Kim