위협 모델링을 통한 스마트밴드 보안 요구사항 분석
Trustworthy Smart Band: Security Requirements Analysis with Threat Modeling
0
조회
0
다운로드
2
인용
0
참고문헌
키워드
초록
스마트밴드가 삶을 보다 편리하게 만들고 긍정적인 생활 습관을 들일 수 있도록 도와주게 되면서 많은 사람들이현재 스마트밴드를 사용하고 있다. 또한, 스마트밴드는 사용자의 개인 정보를 다루기 때문에 스마트밴드 시스템에대한 안전한 보안 설계 및 구현이 필요하게 되었다. 신뢰할 수 있는 스마트밴드를 만들기 위해서는 먼저 시스템의보안 요구사항을 도출한 다음 이를 충족하도록 시스템을 설계해야 한다. 본 논문에서는 Data Flow Diagram,STRIDE, Attack Tree와 같은 위협 모델링 기술을 스마트밴드 시스템에 적용하여 위협을 식별하고 이에 따라 보안 요구사항을 도출하였다. 위협 모델링을 통해 식별한 위협을 이용하여 실제로 스마트폰을 스마트밴드에 연결하는과정에서의 취약점을 발견하였고 이를 통해 스마트밴드의 제어 권한을 획득하는 공격을 수행할 수 있었다. 발견된취약점과 위협에 대응하기 위해 보안 대책을 제안하였으며 보안 프로토콜 자동 검증 도구인 Scyther를 사용하여 제안한 보안 대책에 대한 안전성을 검증한다.
Abstract
As smart bands make life more convenient and provide a positive lifestyle, many people are now using them. Sincesmart bands deal with private information, security design and implementation for smart band system become necessary. Tomake a trustworthy smart band, we must derive the security requirements of the system first, and then design the systemsatisfying the security requirements. In this paper, we apply threat modeling techniques such as Data Flow Diagram,STRIDE, and Attack Tree to the smart band system to identify threats and derive security requirements accordingly. Throughthreat modeling, we found the vulnerabilities of the smart band system and successfully exploited smart bands with them. Todefend against these threats, we propose security measures and verify that they are secure by using Scyther which is a toolfor automatic verification of security protocol.
참고문헌 (27)
- W. Zhou, "Security", privacy of wearable fitness tracking IoT devices, 2014, 1~5
- M. LEE, "Security threat on wearable services: empirical study using a commercial smartband", Consumer Electronics-Asia (ICCE-Asia), IEEE International Conference, pp.1~5 (2016), IEEE
- R. Goyal, "Mind the tracker you wear: A security analysis of wearable health trackers", Proc. ACM Symp. Appl. Comput, pp.131~136 (2016)
- S. Seneviratne, "A survey of wearable devices and challenges", IEEE Commun. Surveys Tuts, 19(4), pp.2573~2620 (2017)
- "Trustworthy information system"[URL]
- H.F. Tipton, "Information Security Management Handbook" (2007), CRC Press
- A. Shostack, "Threat Modeling:Designing for Security" (2014), John Wiley & Sons
- A. Shostack, "Experiences Threat Modeling at Microsoft", Modeling Security Workshop (2008)
- "STRIDE threat model of Microsoft"[URL]
- I. Williams, "Evaluating Effectiveness of Microsoft Treat Modeling Tool", ISCD Conference (2015)
- B. Schneier, "Attack trees: Modeling security threats", Dr. Dobb's Journal (1999)
- C. Cremers, "The Scyther Tool:Verification, falsification, and analysis of security protocols", Computer Aided Verification (CAV), ser. LNCS, 5123, pp.414~418 (2008), Springer
- M. Rahman, "Fit and vulnerable: Attacks and defenses for a health monitoring device", arXiv 1304.5672, ~ (2013)
- H. Fereidooni, "Fitness Trackers: Fit for Health but Unfit for Security and Privacy", Connected Health:Applications, Systems and Engineering Technologies (CHASE), 2017 IEEE, 2017, 19~24[DOI]
- P.K. Akshay Dev, "STRIDE Based Analysis of the Chrome Browser Extensions API", Proceedings of the 5th International Conference on Frontiers in Intelligent Computing: Theory and Applica- tions : FICTA 2016, 2, pp.169~178 (2017), Springer
- "Adapting Threat Modeling M ethods for the Automotive Industry"[URL]
- M. Cagnazzo, "Threat Modeling for Mobile Health Systems", Wireless Communications and Networking Conference Workshops (WCNCW), 2018 IEEE, pp.314~319 (2018), IEEE
- 강태운, "VR 기기와 게임 시스템의 정보보증을 위한 VR 위협 분석", 정보보호학회논문지, 28(2), pp.437~447 (2018), 한국정보보호학회[DOI]
- 김혜민, "Threat Modeling을 이용한 PS4와 PC간의 Remote Play 상황 속 위험 분석", 정보보호학회논문지, 28(1), pp.135~143 (2018), 한국정보보호학회[DOI]
- D. Basin, "Provably Repairing the ISO", IEC 9798Standard for Entity Authentication, 2012, pp.7215, 129~148
- C. Cremers, "Key exchange in IPsec revisited: formal analysis of IKEv1and IKEv2", European conference on research in computer security (ESORICS) (2011)
- "SDL Threat Modeling Tool"[URL]
- B. Potter, "Microsoft SDL threat modelling tool", Network Security, 2009(1), pp.15~18 (2009)
- A.K. Das, "Uncovering privacy leakage in BLE network traffic of wearable fitness trackers", Proc. 17th Int. Workshop Mobile Comput. Syst. Appl. (HotMobile), pp.99~104 (2016)
- "Smart band attack demo video"[URL]
- W. Diffie, "Authentication and authenticated key exchanges", Designs, Codes, Cryptography, 2(2), pp.107~125 (1992)
- "Scyther verification code for connection and communication protocol"[URL]