본문 바로가기
KERD
논문KCI 등재

자동차 개발 프로세스에서의 보안 내재화 방법론

A Methodology for Integrating Security into the Automotive Development Process

김승주|강수영|정승연
한국정보처리학회|2020.12|정보처리학회 논문지 (The Transactions of the Korea Information Processing Society)|제9권 제12호|pp. 387-402|DOI https://doi.org/10.3745/KTSDE.2020.9.12.387

1

조회

0

다운로드

3

인용

0

참고문헌

키워드

자동차 개발증거 기반 표준Secure SDLCUNECE 사이버보안 규제Automotive DevelopmentEvidence-based StandardsUNECE Cybersecurity Regulation
주제분류컴퓨터학

초록

기존의 자동차 개발은 주로 정확성(Correctness) 및 안전성(Safety) 확보에 초점을 맞추어 왔으며, 이에 반해 보안성(Security)은 비교적 소홀하게 다루어져 왔다. 하지만 최근 자동차의 인터넷 연결성이 높아짐에 따라 자동차 해킹 사례가 증가하면서, 유엔유럽경제위원회(United Nations Economic Commission for Europe, UNECE)와 같은 국제기관은 자동차 개발에 대한 보안성을 확보하기 위해 사이버보안 규제를 준비하고 있다. 다른 IT 제품과 마찬가지로 자동차 사이버보안 규제에서 또한 개발 초기부터 보안성을 고려하는 “보안 내재화(Security by Design)”의 개념을 강조한다. 특히 자동차 개발은 생명주기가 길고 공급망이 복잡하기 때문에 개발 이후에 아키텍처를 변경하는 것이 매우 어려우므로, 자동차 개발에 있어 보안 내재화는 기존 IT 제품에 비해 훨씬 더 중요시된다. 그러나 문제는 아직 자동차 개발 과정에 보안을 내재화하는 구체적인 방법론이 제시되지 못하고 있다는 것이다. 이에 본 논문에서는 자동차 보안 내재화를 위한 구체적인 방법론을 제안한다. 본 논문에서 제안된 방법론을 통해 자동차 제조사는 자동차 개발 과정에 있어 기능 안전성과 보안성의 측면을 동시에 고려할 수 있으며, 다가오는 UNECE 자동차 사이버보안 규제에 대한 인증에도 대응할 수 있을 것이다.

Abstract

Conventional automotive development has mainly focused on ensuring correctness and safety and security has been relatively neglected. However, as the number of automotive hacking cases has increased due to the increased Internet connectivity of automobiles, international organizations such as the United Nations Economic Commission for Europe(UNECE) are preparing cybersecurity regulations to ensure security for automotive development. As with other IT products, automotive cybersecurity regulation also emphasize the concept of "Security by Design", which considers security from the beginning of development. In particular, since automotive development has a long lifecycle and complex supply chain, it is very difficult to change the architecture after development, and thus Security by Design is much more important than existing IT products. The problem, however, is that no specific methodology for Security by Design has been proposed on automotive development process. This paper, therefore, proposes a specific methodology for Security by Design on Automotive development. Through this methodology, automotive manufacturers can simultaneously consider aspects of functional safety, and security in automotive development process, and will also be able to respond to the upcoming certification of UNECE automotive cybersecurity regulations.

참고문헌 (68)

  1. R. Bell, "Introduction to IEC 61508", ACM International Conference Proceeding Series, 162, pp.3~12 (2006)
  2. Amiso M. George, "Case studies in crisis communication: International perspectives on hits and misses, Part Ⅲ", pp.227~252 (1997)
  3. R. Debouk, "Overview of the 2nd Edition of ISO 26262:Functional safety–road vehicles" (2018), General Motors Company
  4. Craigen, Dan, "Defining cybersecurity", Technology Innovation Management Review, 4(10) (2014)
  5. J. M ssinger, "Software in automotive systems", IEEE Software, 27(2), pp.92~94 (2010)
  6. C. Miller, "Remote exploitation of an unaltered passenger vehicle", Black Hat USA, pp.91~ (2015)
  7. Mathias Dehm, "Road Vehicles' LifeCycle: Mapping of relevant standards and regulations for automotive cybersecurity", ESCAR Europe (2019)
  8. H. Khattri, "Hsdl : A security development lifecycle for hardware technologies", 2012 IEEE International Symposium on HardwareOriented Security and Trust, pp.116~121 (2012)
  9. P. Salini, "Survey and analysis on security requirements engineering", Computers & Electrical Engineering, 38(6), pp.1785~1797 (2012)
  10. S. Khou, "A customizable framework for prioritizing systems security engineering processes, activities, and tasks", IEEE Access, 5, pp.12878~12894 (2017)
  11. N. M. Mohammed, "Exploring software security approaches in software development lifecycle : A systematic mapping study", Computer Standards & Interfaces, 50, pp.107~115 (2017)
  12. T. Loruenser, "CryptSDLC : Embedding cryptographic engineering into secure software development lifecycle", Proceedings of the 13th International Conference on Availability, Reliability and Security, pp.1~9 (2018)
  13. Ruggieri, "Security Considerations for the Development of Secure Software Systems", 2019 IEEE 10th Annual Ubiquitous Computing, Electronics & Mobile Communication Conference (UEMCON), pp.1187~1193 (2019)
  14. E. Venson, "Costing Secure Software Development : A Systematic Mapping Study", Proceedings of the 14th International Conference on Availability, Reliability and Security, pp.1~11 (2019)
  15. V. Casola, "A novel Security-by-Design methodology : Modeling and assessing security by SLAs with a quantitative approach", Jounal of Systems and Software, 163, pp.110537~ (2020)
  16. A. Avizienis, "Basic concepts and taxonomy of dependable and secure computing", IEEE Transactions on Dependable and Secure Computing, 1(1), pp.11~33 (2004)
  17. A. Michailidis, "Test front loading in early stages of automotive software development based on AUTOSAR", 2010 Design, Automation & Test in Europe Conference &Exhibition (DATE 2010), pp.435~440 (2010)
  18. R. Y. Takahira, "Scrum and Embedded Software development for the automotive industry", Proceedings of PICMET'14 Conference: Portland International Center for Management of Engineering and Technology; Infrastructure and Service Integration, pp.2664~2672 (2014)
  19. Young, "An integrated approach to safety and security based on systems theory", Communications of the ACM, 57(2), pp.31~35 (2014)
  20. S. Kriaa, "A survey of approaches combining safety and security for industrial control systems", Reliability Engineering & System Safety, 139, pp.156~178 (2015)
  21. C. Wolff, "AMALTHEA—Tailoring tools to projects in automotive software development", 2015 IEEE 8th International Conference on Intelligent Data Acquisition and Advanced Computing Systems: Technology and Applications (IDAACS), 2, pp.515~520 (2015)
  22. Schmittner, Christoph, "Combined safety and security development lifecylce", 2015 IEEE 13th International Conference on Industrial Informatics (INDIN), pp.1408~1415 (2015)
  23. Sabaliauskaite, Giedre, "A six-step model for safety and security analysis of cyberphysical systems", International Conference on Critical Information Infrastructures Security, pp.189~200 (2016)
  24. Pricop, Emil, "Recent Advances in Systems Safety and Security", pp.223~239 (2016)
  25. M. Brunner, "Towards an integrated model for safety and security requirements of cyber-physical systems", 2017 IEEE International Conference on Software Quality, Reliability and Security Companion (QRS-C), pp.334~340 (2017)
  26. Y. Zhang, "Test and Evaluation System for Automotive Cybersecurity", 2018 IEEE International Conference on Computational Science and Engineering (CSE), pp.201~207 (2018)
  27. S. Yi, "A safety-security assessment approach for communicationbased train control(cbtc)systems based on the extended fault tree", 2018 27th International Conference on Computer Communication and Networks (ICCCN), pp.1~5 (2018)
  28. H. Abdo, "A safety", security risk analysis approach of Industrial Control Systems : A cyber bowtie– combining new version of attack tree with bowtie analysis, 2018, pp.72, 175~195
  29. Skoglund, Martin, "In Search of Synergies in a Multi-concern Development Lifecycle: Safety and Cybersecurity", International Conference on Computer Safety, Reliability, and Security, pp.302~313 (2018)
  30. T. Chowdhury, "Safe and secure automotive over-the-air updates", International Conference on Computer Safety, Reliability, and Security, pp.172~187 (2018)
  31. F. Asplund, "Rapid Integration of CPS Security and Safety", IEEE Embedded Systems Letters, 11(4), pp.111~114 (2018)
  32. Lisova, Elena, "Safety and security co-analyses : A systematic literature review", IEEE Systems Journal, 13(3), pp.2189~2200 (2018)
  33. Geismann, Johannes, "Towards ensuring security by design in cyberphysical systems engineering processes", Proceedings of the 2018 International Conference on Software and System Process, pp.123~127 (2018)
  34. K. Huang, "Assessing the physical impact of cyberattacks on industrial cyber-physical systems", IEEE Transactions on Industrial Electronics, 65(10), pp.8153~8162 (2018)
  35. D. S. Fowler, "A Method for Constructing Automotive Cybersecurity Tests, a CAN Fuzz Testing Example", 2019IEEE 19th International Conference on Software Quality, Reliability and Security Companion (QRS-C), pp.1~8 (2019)
  36. Oka, Dennis Kengo, "Integrating Application Security Testing Tools into ALM Tools in the Automotive Industry", 2019 IEEE 19th International Conference on Software Quality, Reliability and Security Companion (QRS-C), pp.42~45 (2019)
  37. S. Verma, "Combined Approach for Safety and Security", International Conference on Computer Safety, Reliability, and Security, pp.87~101 (2019)
  38. Apvrille, Ludovic, "Harmonizing safety, security and performance requirements in embedded systems", 2019 Design, Automation & Test in Europe Conference & Exhibition (DATE), pp.1631~1636 (2019)
  39. J. Dobaj, "Towards Integrated Quantitative Security and Safety Risk Assessment", International Conference on Computer Safety, Reliability, and Security, pp.102~116 (2019)
  40. M. Koschuch, "Safety & Security in the Context of Autonomous Driving", 2019 IEEE International Conference on Connected Vehicles and Expo (ICCVE), pp.1~7 (2019)
  41. R. Bramberger, "Co-engineering of Safety and Security Life Cycles for Engineering of Automotive Systems", ACM SIGAda Ada Letters, 39(2), pp.41~48 (2020)
  42. B. De Win, "On the secure software development process : CLASP, SDL and Touchpoints compared", Information and software technology, 51(7), pp.1152~1171 (2009)
  43. Microsoft, "Security Development Lifecycle - SDL Process Guidance, Ver.5.2", ~ (2012)
  44. United States Congress, "NIST SP 800-64 - Security Considerations in the System Development Life Cycle, Rev.2", ~ (2019)
  45. "Comprehensive, lightweight application security process" (2006)[URL]
  46. SAE Vehicle Electrical System Security Committee, "Sae j3061-cybersecurity guidebook for cyber-physical automotive systems", SAE-Society of Automotive Engineers, ~ (2016)
  47. Schmittner, Christoph, "Automotive Cybersecurity Standards-Relation and Overview", International Conference on Computer Safety, Reliability, and Security, pp.153~165 (2019)
  48. UNECE, "Draft Cyber Security Regulation, final clean version", ~ (2020)
  49. H. Hunjan, "ISO", SAE 21434 Automotive Cyber-Security Engineering, 2018, ~
  50. Blyler, John, "Software-Hardware Integration in Automotive Product Development", SAE, 1~5 (2014)
  51. "Build Security Into The Connected Car Development Life Cycle" (2017)[URL]
  52. E. Schoitsch, "The need for safety and cyber-security co-engineering and standardization for highly automated automotive vehicles", Advanced Microsystems for Automotive Applications 2015, pp.251~261 (2016)
  53. Sabaliauskaite, Giedre, "Aligning cyber-physical system safety and security", Complex Systems Design & Management Asia, 41(53) (2015)
  54. "What is ASIL?"[URL]
  55. Schmittner, Christoph, "Towards a framework for alignment between automotive safety and security standards", International Conference on Computer Safety, Reliability, and Security, pp.133~143 (2014)
  56. Miller, Joseph D, "Automotive System Safety: Critical Considerations for Engineering and Effective Management" (2019), John Wiley & Sons
  57. Mellado, Daniel, "A common criteria based security requirements engineering process for the development of secure information systems", Computer Standards & Interfaces, 29(2), pp.244~253 (2007)
  58. Yin, Lei, "A novel method of security requirements development integrated common criteria", 2010 International Conference On Computer Design and Applications, 5, pp.V5~V531 (2010)
  59. D. Mellado, "A systematic review of security requirements engineering", Computer Standards & Interfaces, 32(4), pp.153~165 (2010)
  60. S. H. Houmb, "Eliciting security requirements and tracing them to design : An integration of Common Criteria, heuristics, and UMLsec", Requirements Engineering, 15(1), pp.63~93 (2010)
  61. Mesquida, "Implementing information security best practices on software lifecycle processes : The ISO", IEC 15504 Security Extension, 2015, pp.48, 19~34
  62. H. Li, "Fesr : A framework for eliciting security requirements based on integration of common criteria and weakness detection formal model", 2017 IEEE International Conference on Software Quality, Reliability and Security (QRS), pp.352~363 (2017)
  63. Barafort, Béatrix, "Integrating risk management in IT settings from ISO standards and management systems perspectives", Computer Standards & Interfaces, 54, pp.176~185 (2017)
  64. Barafort, Béatrix, "Integrated risk management process assessment model for IT organizations based on ISO 31000 in an ISO multistandards context", Computer Standards & Interfaces, 60, pp.57~66 (2018)
  65. Lee, Younghwa, "Integrating software lifecycle process standards with security engineering", Computers & Security, 21(4), pp.345~355 (2002)
  66. D. Horie, "A new model of software life cycle processes for consistent design, development, management, and maintenance of secure information systems", 2009 Eighth IEEE, 2009, 897~902
  67. Amara, Naseer, "Modelling Security Requirements for Software Development with Common Criteria", International Conference on Security, Privacy and Anonymity in Computation, Communication and Storage, pp.78~88 (2019)
  68. "MISRA C"[URL]

관련 논문AI추천

자율주행 자동차를 위한 자동차 사이버 보안 가이드라인 개선에 관한 연구 : 자동차 라이프사이클 중심으로고정민, 김경진, 박효정, 정효주한국산업보안연구학회 · 한국산업보안연구2022 · 제12권 제1호자동차 사이버보안 표준과 보안 기술 적용 사례이정재한국IT정책경영학회 · 한국IT정책경영학회 논문지2024 · 제16권 제4호차량 사이버보안 법규 준수를 위한 프레임워크 개발: Cybersecurity Requirement Finder권혁, 박경록, 송윤근, 오준희, 우사무엘한국ITS학회 · 한국ITS학회 논문지2023 · 제22권 제6호안전한 자동차용 SUMS 구축을 위한 보안성 평가기준 도출곽지원, 김승주, 서재완, 조광수, 홍바울한국정보보호학회 · 정보보호학회논문지2022 · 제32권 제6호사례 분석을 통한 IVN의 필수 보안 요구사항 도출송윤근, 이유식, 이정호, 우사무엘한국ITS학회 · 한국ITS학회 논문지2019 · 제18권 제2호국내 위협모델링 연구 동향 및 문제점 분석곽지원, 김승주, 김정현, 조광수한국정보보호학회 · 정보보호학회논문지2025 · 제35권 제2호

이 간행물의 다른 논문 (4건)

스킵연결이 적용된 오토인코더 모델의 클러스터링 성능 분석강윤희, 조인수, 최동빈, 박용범pp. 403-410네트워크 트래픽 데이터의 희소 클래스 분류 문제 해결을 위한 전처리 연구신동일, 신동규, 김진국, 박정찬, 류경준pp. 411-418Double Encoder-Decoder Model for Improving the Accuracy of the Electricity Consumption Prediction in Manufacturing고병길, 조영창, 조영식, 성종훈pp. 419-430다중 문턱치를 이용한 입술 윤곽 검출 방법김정엽pp. 431-438
원문 보기