COVID-19 동선 추적에서의 프라이버시 보호를 위한 Exposure Notification 기술에 대한 보안성 평가 및 대응 방안 연구
A Study on the Security Evaluations and Countermeasure of Exposure Notification Technology for Privacy-Preserving COVID-19 Contact Tracing
0
조회
0
다운로드
4
인용
0
참고문헌
키워드
초록
COVID-19 감염자의 동선을 파악함과 동시에 개인의 프라이버시를 보호하기 위한 방법들이 다양하게 제시되고있다. 그 중에서 애플과 구글에서 발표한 ‘Exposure Notification’은 블루투스를 사용한 탈중앙화 방식을 따르고있다. 하지만 이 기술을 사용하려면 항상 블루투스 기능을 켜 놓아야 하며 이를 통해 다양한 보안 위협이 발생할 수있다. 본 논문에서는 보안 위협 모델링 기법 중 ‘STRIDE’와 ‘LINDDUN’을 적용하여 Exposure Notification기술의 보안성을 평가하여 발생 가능한 모든 위협을 도출하였다. 또한 보안성 평가 결과를 가지고 대응 방안을 도출하고 이를 바탕으로 보안성을 향상시킨 새로운 모델을 제시한다.
Abstract
Various methods are being presented to identify the movements of COVID-19 infected persons and to protect personalprivacy at the same time. Among them, 'Exposure Notification' released by Apple and Google follows a decentralizedapproach using Bluetooth. However, the technology must always turn on Bluetooth for use, which can create a variety ofsecurity threats. Thus, in this paper, the security assessment of 'Exposure Notification' was performed by applying 'STRIDE'and 'LINDDUN' among the security threat modeling techniques to derive all possible threats. It also presented a new Dellthat derived response measures with security assessment results and improved security based on them.
참고문헌 (16)
- ROBERT:ROBust and privacy-presERving proximity Tracing, "Claude Castelluccia", ~, pp.HAL-Inria hal-02611265 (2020)
- "Exposure Notification - Bluetooth Specification" (2020)[URL]
- Adam Shostack, "Threat Modeling:Designing for Security", pp.109~160 (2014), WILEY
- Michael Howard, "The security development lifecycle" (2006), Microsoft Press
- "Threat Tree Catalog" (2020)[URL]
- Yaron Gvili, "SECURITY ANALYSIS OF THE COVID-19 CONTACT TRACING SPECIFICATIONS BY APPLE INC. AND GOOGLE INC", IACR ePrint 2020-428, ~ (2020)
- Serge Vaudenay, "Analysis of DP3T Between Scylla and Charybdis", IACR ePrint 2020-399, ~ (2020)
- BleedingBit: The hidden attack surface within ble chips, "Ben Seri", Armis, ~ (2020)
- Myoungsu Kim, "OTA Vulnerability on User Equipment in Cloud Services", 2018International Conference on Information Technology Systems and Innovation(ICITSI), pp.425~428 (2018)
- Oskari Teittinen, "Analysis of cheat detection and prevention techniques in mobile games", Master, pp.2018
- Angela M. Lonzetta, "Security vulnerabilities in Bluetooth technology as used in IoT", Journal of Sensor and Actuator Networks, 7(3) (2018)
- BlueBorne Technical White Paper, "Ben Seri", Armis, ~ (2020)
- Veelasha Moonsamy, "Mitigating man-in-the-middle attacks on smartphones – a discussion of SSL pinning and DNSSec", Proceedings of the 12th Australian Information Security Management Conference, pp.5~13 (2014)
- "Experiences Threat Modeling at Microsoft" (2020)[URL]
- KISA, "Cryptographic Algorithm and Key Length User Guide", KISA-GD-2018-0034, ~ (2018)
- Sheikh Tahir Bakhsh, "Dynamic load balancing through backup relay in Bluetooth scatternet", Proceedings of the 8th International Conference on Frontiers of Information Technology, pp.1~6 (2010)