본문 바로가기
KERD
논문KCI 등재

안전한 자동차용 SUMS 구축을 위한 보안성 평가기준 도출

A Study on Security Evaluation for Secure Software Update Management System in Automotive

조광수|홍바울|김승주|곽지원|서재완
한국정보보호학회 (Korea Institute Of Information Security And Cryptology)|2022.12|정보보호학회논문지 (Journal of The Korea Institute of Information Security and Cryptology)|제32권 제6호|pp. 1151-1163|DOI https://doi.org/10.13089/JKIISC.2022.32.6.1151

0

조회

0

다운로드

0

인용

0

참고문헌

키워드

Threat ModelingSoftware UpdateSecurity RequirementSUMSSecurity Evaluation.
주제분류컴퓨터학

초록

차량에 무선 통신 기능이 탑재되기 시작하면서 무선 통신 기능의 취약점을 악용한 차량의 사이버 공격이 증가하고 있다. 이에 대응하기 위해 UNECE는 차량 제조사가 무선 통신 기능을 활용하여 차량에 탑재되는 소프트웨어를 안전하게 배포할 수 있도록 UN R156 규정을 제정하였다. 해당 규정은 차량의 소프트웨어를 안전하게 배포하는데 필요한 보안 요구사항을 명시하고 있으나 해당 요구사항을 개발 및 구현하는데 필요한 구성요소와 세부 기능에 대한 정보가 생략된 채 추상적인 요구사항만이 제시되어 있다. 따라서 본 논문에서는 체계적으로 보안 위협을 분석하는 방법인 위협모델링을 활용하여 안전한 SUMS를 구축하는데 필요한 상세 보안 요구사항을 도출한다. 이후 해당 요구사항을 바탕으로 SUMS에 대한 보안성 평가기준을 제안한다.

Abstract

As wireless communication functions begin to be installed in vehicles, cyberattacks that exploit vulnerabilities in wireless communication functions are increasing. To respond to this, UNECE enacted the UN R156 regulation to safely distribute the software installed in the vehicle by using the wireless communication function. The regulations specify the requirements necessary to safely distribute the software for vehicles, but only the abstract requirements are presented without information on the components and detailed functions necessary to develop and implement the requirements. Therefore, in this paper, we propose a security evaluation standard that can evaluate whether a safe SUMS is built using threat modeling, a method for systematically analyzing security threats.

참고문헌 (49)

  1. C. Miller, "Remote Exp loitation of an Unaltered Passenger Vehicle", Black Hat USA, ~ (2015)
  2. S. Nie, "Free-Fall : Hacking Tesla from Wireless to CANBus", Black Hat USA, ~ (2017)
  3. R. P. Weinmann, "T-BO NE: Drone vs. Tesla", CanSecWest Conference (2021)
  4. UNECE, "Uniform provisions concerning the approval of vehicles with regards to software update and software u pdates management system, UN R156", ~ (2021)
  5. A. Shostack, "Threat modeling: Designing for security" (2014), John Wiley & Sons
  6. A system theoretic approach to cybersecurity ris ks analysis of passenger autonomous vehicles, "C. W. Lee", MIT, 1~34, pp.MIT Sloan Research Paper, no. 5724-18 (2018)
  7. T. Placho, "Management of automotive software updates", Microprocessors and Microsystems, 78 (2020)
  8. A. Mukherjee, "Trusted Verification of Over-the-Air(OTA)Secure Software Updates on COTS Embedded Systems", Proceedings of the Third International Workshop on Automotive Vehicle Security (2021)
  9. C. Ponsard, "Towards Formal Security Verification of Over-the-Air Update Protocol : Requirem ents, Survey and UpKit Case Study", Proceedings of the 7th International Conference on Information Systems Security and Privacy : ForSE, 1, pp.800~808 (2021)
  10. Z. Wu, "Security design of OTA upgrade for intel ligent connected vehicle", Proceedin gs of the 1st International Conference on Control and Intelligent Robotics, pp.736~739 (2021)
  11. R. Kirk, "A forma l framework for security testing of au tomotive over-the-air update systems", Journal of Logical and Algebraic Methods in Programming, 130 (2023)
  12. A. Ghosal, "Secure Over-the-Air Software Update f or Connected Vehicles", Computer Net works, 218 (2022)
  13. J. Yu, "An STPA-based Approach for Systematic Security Analysis of In-vehicle Diagnostic and Software Update Systems", Computer Science (2020)
  14. M. Hamad, "A Multilayer Secure Framework for Vehicular Systems", Ph.D, pp.2020
  15. A. Lautenbach, "Securit y models", D2, HEAVENS, ~ (2016)
  16. "Security Threats&Mitigations"[URL]
  17. "Data Flow Diagrams Examples"[URL]
  18. "What is a Data Flow Diagram"[URL]
  19. "Checking Threat Modeling Data Flow Diagrams for Implementation Conformance and Security"[URL]
  20. "CVE"[URL]
  21. "CWE"[URL]
  22. Y. Ashibani, "Cyber physical systems security : Analysis, challenges and solutions", Compute rs & Security, 68, pp.81~97 (2017)
  23. C. Riggs, "A survey on connected vehicles vulnerabilities and countermeasures", Journal of Traffic and Logistics Engineering, 6(1), pp.11~16 (2018)
  24. M. L. Manna, "Performance Evaluation of Attribute-Based En cryption in Automotive Embedded Platform for Secure Software Over-The-Air Update", Sensors, 21(2) (2021)
  25. M. Zoppelt, "UnCle SA M : Modeling Cloud Attacks with the Automotive Security Abstraction Mode l", International Conference on Cloud Computing, GRIDs, and Virtualization, pp.67~72 (2019)
  26. Myoungsu Kim, "OTA Vulnerability on User Equipment in Cloud Services", International Conference on Information Technology Systems and Innovation, pp.425~428 (2018)
  27. A. M. K Nasser, "Embedded S ystems, Cyber-physical Systems, and Applications", pp.8~13 (2018)
  28. N. Weiss, "Extending Vehicle Attack Surface Through Smart Devices", International Conference on Emerging Security Information, Systems and Technologies, pp.131~135 (2017)
  29. M. Levi, "Advanced Analytics for Connected Car Cybersecurity", IEEE 87th Vehi cular Technology Conference (2018)
  30. T. Alladi, "Consumer IoT : Security Vulnerability Case Studies and Solutions", IEEE Consumer Electronics Magazine, 9(2), pp.17~25 (2020)
  31. P. Bajpai, "Ransomware Targeting Automobiles", ACM Workshop on Automotive an d Aerial Vehicle Security, pp.23~29 (2020)
  32. M. H. Eiza, "Driving with sharks : Rethinking connected vehicles with vehicle cybersecurity", IEEE Vehi cular Technology Magazine, 12(2), pp.45~51 (2017)
  33. P. Carsten, "A System to Recognize Intruders in Control ler Area Network(CAN)", International Symposium for ICS & SCADA Cyber Security Research, pp.111~114 (2015)
  34. T. Hoppe, "Security threats to automotive CANnetworks—Practical examples and sele cted short-term countermeasures", Reliability Engineering & System Safety, 96(1), pp.11~25 (2010)
  35. S. Nie, "Over-the-air: How we remotely compromised the gateway, BCM, and auto pilot ECUs of Tesla cars", Black Hat USA, ~ (2018)
  36. B. M. Luettmann, "Man-in-the-middle attacks on auto-updating software", Bell Labs Technical Journal, 12(3), pp.131~138 (2007)
  37. J. N. Brewer, "Evaluation of Attack Vectors and Risks in Automobiles and Road Infrastructure", International Conference on Computational Science and Computational Intelligence, pp.84~89 (2019)
  38. M. Dibaei, "Attacks and defences on intell igent connected vehicles : a survey", Digital Communications and Networks, 6(4), pp.399~421 (2020)
  39. P. Carsten, "In-Vehicle Networks : Attacks, Vulnerabilities, and Proposed Solutions", Cyber and Information Secu rity Research Conference, pp.1~8 (2015)
  40. H. Wen, "Plug-N-pwned : Comprehensive vulnerability analysis of OBD-II dongles as a new over-the-air attack surface in automotive IoT", Proceedings of the 29th USE NIX Security Symposium, pp.949~965 (2020)
  41. Kyong Tak Cho, "From Attack to Defense: Toward Secure In-vehicle Networks", Ph.D, pp.2018
  42. S. Checkoway, "Comprehensive Experimental Analyses of Automotive Attack Surfaces", Proceedings of the 20th US ENIX Security Symposium (2011)
  43. L. Moukahal, "Security vulnerability metrics for connect ed vehicles", IEEE International Confe rence on Software Quality, Reliability and Security Companion, pp.17~23 (2019)
  44. M. Charlie, "Characterization of potential security threats in modern automobiles: A c omposite modeling approach, DOT HS 812 074", National Highway Traffic Safety Administration, ~ (2014)
  45. M. Salfer, "Attack surface and vulnerability assessment of automotive Electronic Control Units", Proceedings of the 12th International Conference on Security and Cryptography, pp.317~326 (2015)
  46. V. LL. Thing, "Autonomous Vehicle Security : A Taxonomy of Attacks and Defences", IEEE International conference on internet of things (ithings) and IEEE green computing and co mmunications (greencom) and IEEE c yber, physical and social computing (c pscom) and IEEE smart data (smartdata), pp.164~170 (2016)
  47. ITU-T, "Secure software update capability for intelligent transportation system communication devices", ITU-T X. 1373, ~ (2017)
  48. FASTR Connectivity and Cloud Work Group, "Automotive Industry Guidelines for Secure Over-the-Air Updates", ~ (2018)
  49. V. K. Saini, "Threat Modeling Using Attack Trees", Journal of Computing Sciences in Colle ges, 23(4), pp.124~131 (2008)

관련 논문AI추천

위협모델링과 공통평가기준을 활용한 인포테인먼트의 안전한 업데이트 보안요구사항 분석강수영, 김승주한국정보보호학회 · 정보보호학회논문지2019 · 제29권 제3호차량 사이버보안 법규 준수를 위한 프레임워크 개발: Cybersecurity Requirement Finder권혁, 박경록, 송윤근, 오준희, 우사무엘한국ITS학회 · 한국ITS학회 논문지2023 · 제22권 제6호자동차 개발 프로세스에서의 보안 내재화 방법론강수영, 김승주, 정승연한국정보처리학회 · 정보처리학회 논문지2020 · 제9권 제12호자율주행 자동차를 위한 자동차 사이버 보안 가이드라인 개선에 관한 연구 : 자동차 라이프사이클 중심으로고정민, 김경진, 박효정, 정효주한국산업보안연구학회 · 한국산업보안연구2022 · 제12권 제1호자동차 사이버보안 표준과 보안 기술 적용 사례이정재한국IT정책경영학회 · 한국IT정책경영학회 논문지2024 · 제16권 제4호사고 유발 관점에서의 무인지상차량 보안 요구사항에 관한 연구김동훈, 이상진한국정보보호학회 · 정보보호학회논문지2024 · 제34권 제5호

이 간행물의 다른 논문 (14건)

CUDA GPGPU 상에서 경량 블록 암호 PIPO의 최적 구현엄시우, 서화정, 김현준pp. 1035-1043PQC 표준화 알고리즘 CRYSTALS-KYBER에 대한 비프로파일링 분석 공격 및 대응 방안장세창, 하재철pp. 1045-1057양자내성암호 NTRU에 대한 전력 부채널 공격 및 대응방안하재철, 장재원pp. 1059-1068제로 트러스트를 위한 소프트웨어 정의 경계(SDP) 인증 메커니즘 제안 및 ECC 암호 구현김정녀, 이윤경pp. 1069-1080얼굴 인식 모델에 대한 질의 효율적인 블랙박스 적대적 공격 방법윤주범, 손배훈, 서성관pp. 1081-1090
원문 보기