위협 모델링 분석 및 국제공통평가기준을 통한 스마트홈 허브의 보안요구사항에 관한 연구
Study of Security Requirement of Smart Home Hub through Threat Modeling Analysis and Common Criteria
0
조회
0
다운로드
3
인용
0
참고문헌
키워드
초록
주거 환경에 IoT 기술을 융합한 스마트홈 환경에서 스마트홈 허브는 다양한 IoT 기기들을 네트워크로 연결하여사용자에게 편의 기능을 제공한다. 스마트홈 허브는 IoT 기기들을 연결하여 활용하는 과정에서 다양한 데이터가 오고가는 통로의 역할을 하는데, 이 데이터에는 사용자의 생활환경과 밀접한 관련이 있어 개인정보로써 악용될 수 있다. 이러한 개인정보의 악용으로 사용자의 신원 노출 등 피해가 발생할 수 있다. 따라서 본 논문은 스마트홈 허브에대해 기존에 국내에서 사용하지 않았던 개인정보보호 측면의 위협 모델링 기법인 LINDDUN을 사용하여 위협을분석하였다. 분석한 위협과 대응하는 보안요구사항을 국제표준인 common criteria를 사용하여 스마트홈 허브에대한 평가 기준을 제시한다.
Abstract
In a smart home environment that integrates IoT technology into a residential environment, the smart home hub providesconvenience functions to users by connecting various IoT devices to the network. The smart home hub plays a role as agateway to and from various data in the process of connecting and using IoT devices. This data can be abused as personalinformation because it is closely related to the living environment of the user. Such abuse of personal information maycause damage such as exposure of the user's identity. Therefore, this thesis analyzed the threat by using LINDDUN, whichis a threat modeling technique for personal information protection which was not used in domestic for Smart Home Hub. We present evaluation criteria for smart home hubs using the Common Criteria, which is an international standard, againstthreats analyzed and corresponding security requirements.
참고문헌 (28)
- [URL]
- [URL]
- "SAMSUNG CLASS ACTIO N LAWSUIT SAYS SMART TVS SPY ON CONSUMERS, TOP CLASS ACTIONS"[URL]
- "How Easy Is It to Hack Your Baby's Monitor? Very Easy!"[URL]
- "They take pictures with a peek at their private lives... 30 Prosec utions for hacked IP Camera"[URL]
- Ministry of the Interior and Safety, "Personal Information Protection Act, Act No. 14107", ~ (2017)
- Dae-man Han, "Smart Home Energy Management System using IEEE 802.15.4 and Zigbee", IEEE Transactions on Consumer Electronics, 56(3), pp.1403~1410 (2010)[DOI]
- Rosslin John Robles, "Application, Systems and Methods in Smart Home Technology: A Review", International Journal of Advanced Science and Technology, 15, pp.37~48 (2010)
- [URL]
- [URL]
- H. Strese, "Smart Home in deutschland", pp.8~11 (2010)
- Michael Schiefer, "Smart Home definition and security Threats", 2015 9th IEEE International Conference on IT Security Incident Management & IT Forensics(IMF), pp.114~118 (2015)
- A. Tekeoglu, "Investigating Security and Privacy of a Cloud-Based Wireless IP Camera : NetCam", 2015 24th IEEE International Conference on Computer Communication and Networks (ICCCN), pp.1~6 (2015)
- [URL]
- [URL]
- [URL]
- "(IN)SECURITY IN BUILDING AUTOMATION : HOW TO CREATE DARK BUILDINGS WITH LIGHT SPEED"[URL]
- Dimitris Geneiatakis, "Security and Privacy Issues for an IoT based Smart Home", 2017 40th IEEE Internatioal Convention on Information and Communication Technology, Electronics and Microelectronics (MIPRO), pp.1292~1297 (2017)
- Kristian Beckers, "Comparing Privacy Requirements Engineering Approaches", 2012 7th IEEE International Conference on Availability, Reliability and Security(ARES), pp.574~581 (2012)
- Annanda Thavymony Rath, "Strengthening Access Control in case of Compromised Accounts in Smart Home", 2017 IEEE Wireless and Mobile Computing, Networking and Communications (WiMob), pp.1~8 (2017)
- Adam Shostack, "Threat Modeling : Designing for Security" (2014), John Wiley & Sons
- Kim Wults, "LINDDUN privacy threat modeling : a tutorial, CW685" (2015)
- Mina Deng, "A privacy threat analysis framework : supporting the elicitation and fulfillment of privacy requirements", Requirement Engineering - Special Issue on Digital privacy : theory, policies and technologies, 16(2), pp.3~32 (2011)
- LINDDUN privacy threat tree catalog, CW675, "Kim Wults", Department of Computer Science, ~ (2014)
- [URL]
- Common Criteria for Information Technology Security Evaluation Part 1 : Introduction and general model, CCMB-2017-04-001, "Common Criteria Recognition Arrangement", ~ (2017)
- Common Criteria for Information Technology Security Evaluation Part 2 : Security functional components, CCMB-2017-04-002, "Common Criteria Recognition Arrangement", ~ (2017)
- Common Criteria for Information Technology Security Evaluation Part 3 : Security assurance components, CCMB-2017-04-003, "Common Criteria Recognition Arrangement", ~ (2017)