다기능 주변기기에 대한 보호프로파일에 관한 연구
A Study on Protection Profile for Multi-function Devices
0
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
다기능 주변기기는 원래 이미지 처리 작업을 중심으로 수행하는 장치였지만 팩스 기능이 결합하여 전자화된 이미지 데이터를 전송하는 기능과 네트워크 기능이 추가되어 비약적으로 발전하였다. 또한, 다기능 주변기기는 인터넷응용, 애플리케이션 확장, 원격 공유, 이미지 처리의 기능이 추가되었다. 하지만 다기능 주변기기는 네트워크 연결로인한 위협으로 발생하는 데이터 노출 및 도청 등의 보안 취약점이 발생할 수 있다. 따라서 다기능 주변기기에 대한평가 기준이 필요하지만, 현재는 다기능 주변기기에 대한 공통된 보호프로파일이 존재하지 않아서 제품에 대한 안전성을 평가하는데 구체적인 평가 기준을 적용하지 않아 평가 품질의 균일성을 유지하는 것이 어려웠다. 따라서 본 논문에서는 다기능 주변기기에 대한 위협을 분석하여 안전한 다기능 주변기기를 사용하기 위해서 공통평가기준을 기반으로 다기능 주변기기에 대한 보호프로파일을 개발하였다.
Abstract
Multi-functional devices was originally an equipment performing image processing, but function transmitting image data digitized by combining fax function and function of network are added and it was rapidly developed. Also, functions of internet application, application expansion, remote sharing and image treatment were added to multi-functional devices. But, multi-functional devices can cause security vulnerability such as data exposure, eavesdropping, etc. because of the threatening by network connection. Therefore, common criteria of multi-functional devices are necessary, but there is no protection profile for multi-functional devices now. Therefore, concrete standards of evaluation are not applied to evaluate secure for products, so it was difficult to maintain uniformity of evaluation quality. Therefore, this paper developed protection profile for multi-functional devices based on common criteria of evaluation so as to analyze threats of multi-functional devices and use secure multi-functional devices.
참고문헌 (33)
- Xu, L., "Providing Users with Suitable Services of Information Security Engineering Cloud based on ISO", IEC 15408, 2013, 321~325
- CCRA, "Vision statement for the future direction of the application of the CC and the CCRA", Common Criteria Recognition Arrangement Common Criteria Management Committee Vision Statement, 1~4 (2012)
- CCRA, "Common Criteria for Information Technology Security Evaluation, Part 1 : Introduction and general model", 29~47 (2012)
- CCRA, "Common Criteria for Information Technology Security Evaluation, Part 2 : Security functional components", 13~184 (2012)
- CCRA, "Common Criteria for Information Technology Security Evaluation, Part 3 : Security assurance components", 9~17 (2012)
- IEEE, "IEEE Standard for a Protection Profile in Operational Environment A", 33~49 (2009)
- IEEE, "IEEE Standard Protection Profile for Hardcopy Devices in IEEE Std. Operational Environment B", 35~52 (2010)
- IEEE, "US Government Protection Profile for Hardcopy Devices", 5~14 (2010)
- Taguchi, K., "Aligning security requirements and security assurance using the common criteria", Fourth International Conference on Secure Software Integration and Reliability Improvement, pp.69~77 (2010)
- Canon, "Canon image RUNNER ADVANCE C5200 Series 2600. 1 model Security Target", 13~24 (2012)
- Research Report on the Security of MFPs, "IPA", 20~32 (2013)
- FUJI XEROX, "Xerox Multi-Function Device Security Target", 18~26 (2014)
- Hewlett-Packard, "LaserJet Enterprise MFP M525, M725, and M830 Series and Color LaserJet Enterprise MFP M575, M775, and M880 Series Firmware with Jetdirect Inside Security Target", 12~30 (2014)
- TOSHIBA, "Loops", e-STUDIO306LP Multifunctional Digital Systems Security Target, 2014, pp.4~16
- FUJI XEROX, "Xerox D136Copier", Printer Security Target, 2013, pp.21~27
- FUJI XEROX, "Xerox Work Centre 7232", 7242 Security Target, 2008, pp.8~17
- RICOH, "RICOH MP 1601", 1301 Security Target, 2013, pp.11~23
- KONICA MINOLTA, "bizhub C253", bizhub C203, ineo+203Control Software Security Target, 2007[DOI]
- National Cyber Security Center, "Smart Card Open Platform Protection Profile", 13~20 (2010)
- National Cyber Security Center, "Network Intrusion Prevention System Protection Profile", 11~20 (2010)
- National Cyber Security Center, "Software-based Secure USB System Protection Profile", 11~17 (2010)
- TOSHIBA, "e-STUDIO 2555c", 3055c. 3555c, 5055c, pp.2555cse, 3055cse[DOI]
- RICOH, "MP 1601", 1301 Security Target, 2013, pp.35~39
- RICOH, "MP 2001", 2501 series Security Target, 2013, pp.34~31
- Cannon, "Canon image RUNNER ADVANCE 8200 Series 2600. 1 model Security Target", 19~23 (2013)
- Cannon, "Canon image RUNNER ADVANCE 6200 Series 2600. 1 model Security Target", 29~44 (2013)
- Cannon, "Canon image RUNNER ADVANCE C2200 Series 2600. 1 model Security Target", 48~51 (2013)
- KONICA MINOLTA, "bizhub C554e", bizhub C454e, bizhub C284e, pp.bizhub C224e PKI Card System Control Software Security Target[DOI]
- RICOH, "Canon image RUNNER ADVANCE C9200 PRO Series", C7200Series 2600. 1 model Security Target, 2013, pp.29~44
- RICOH, "MP C4503", C4503G, C5503G, pp.C6003G, MP C4503A, C5503A, MP C6003(Ricoh[DOI]