베이즈 네트워크를 이용한 탈중앙화 암호화폐 지갑의 정량적 위험성 평가
Quantitative Risk Assessment on a Decentralized Cryptocurrency Wallet with a Bayesian Network
0
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
2009년 비트코인 블록체인이 처음 생성된 이후 암호화폐 사용자는 꾸준히 증가하고 있다. 하지만 이러한 사용자들의 암호화폐 지갑에 보관된 자산을 노리는 해킹 공격도 증가하고 있다. 따라서 우리는 시중에 나와 있는 암호화폐 지갑들이 안전하게 만들어졌는지를 점검하기 위해 각 지갑에 내재된 위험성을 평가한다. 우리는 위협 모델링을 통해 암호화폐 지갑에 내재된 위협을 식별하고 보안 요구사항을 도출한다. 그리고 도출된 보안 요구사항을 바탕으로 실제 지갑들의 보안성을 분석하고 공격트리와 베이즈 네트워크 등을 활용하여 각 지갑의 위험성을 정량적으로 측정한다. 위험성 평가 결과, 하드웨어 지갑보다 소프트웨어 지갑의 평균적인 위험성이 1.22배 높은 것으로 나타났다. 그리고 하드웨어 지갑 간 비교에서는 secure element를 내장한 Ledger Nano S 지갑보다 범용 MCU를 내장한 Trezor One 지갑의 위험성이 1.11배 높은 것으로 나타났다. 하지만 secure element를 사용하는 것은 암호화폐 지갑의 위험성을 낮추는 데에는 상대적으로 효과가 낮은 것으로 나타났다.
Abstract
Since the creation of the first Bitcoin blockchain in 2009, the number of cryptocurrency users has steadily increased. However, the number of hacking attacks targeting assets stored in these users’ cryptocurrency wallets is also increasing. Therefore, we evaluate the security of the wallets currently on the market to ensure that they are safe. We first conduct threat modeling to identify threats to cryptocurrency wallets and identify the security requirements. Second, based on the derived security requirements, we utilize attack trees and Bayesian network analysis to quantitatively measure the risks inherent in each wallet and compare them. According to the results, the average total risk in software wallets is 1.22 times greater than that in hardware wallets. In the comparison of different hardware wallets, we found that the total risk inherent to the Trezor One wallet, which has a general-purpose MCU, is 1.11 times greater than that of the Ledger Nano S wallet, which has a secure element. However, use of a secure element in a cryptocurrency wallet has been shown to be less effective at reducing risks.
참고문헌 (26)
- "Bitcoin: A peer-to-peer el ectronic cash system" (2008)[URL]
- "Ethereum: a secure decentr alised generalised transaction ledger" (2020)[URL]
- "A next-generation smart contract and decentralized application platform" (2014)[URL]
- A. R. Sai, "Privacy and security analysis of cryptocurrency mobile applications", 2019 Fifth Conference on Mobile and Secure Services (MobiSecServ), pp.1~6 (2019)
- Er-Rajy, L., "Blockchain:bitcoin wallet cryptography security, challenges and countermeasures", Journal of Internet Banking and Commerce, 22(3), pp.1~29 (2017)
- E. Almutairi, "Usability and security analysis of the KeepKey wallet", 2019 IEEE International Conference on Blockchain and Cryptocurrency (ICBC), pp.149~153 (2019)
- D. He, "Security analysis of cryptocurrency wallets in Android-based applications", IEEE Network, 34(6), pp.114~119 (2020)
- M. Guri, "BeatCoin: leaking Private keys from air-gapped cryptocurrency wallets", 2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData), pp.1308~1316 (2018)
- "Wallet app t hreat model" (2019)[URL]
- "Cryptocurrency hardware w allet: threat model" (2020)[URL]
- "Invariant-centric threat modeling" (2019)[URL]
- M. Guri, "Bridgeware:the air-gap malware", Commun. ACM, 61(4), pp.74~82 (2018)
- D. Nedospasov, "wallet.fail", 35th Chaos Communication Congress (2018)
- G. Miraje, "Trustzone-backed bitcoin wallet", Proc. The Fourth Workshop on Crypto graphy and Security in Computing Systems, pp.25~28 (2017)
- W. Dai, "SBLWT : a secure blockchain lightweight wallet based on Trustzone", IEEE Access, 6, pp.40638~40648 (2018)
- Y. Liu, "An efficient method to enhance bitcoin wallet security", 2017 11th IEEE International Conference on Anti-counterfeiting, Security, and Identification (ASID), pp.26~29 (2017)
- "BIP 39: Mnemonic c ode for generating deterministic keys" (2013)[URL]
- "BIP 32: Hierarchical deter ministic wallets" (2012)[URL]
- B. Schneier, "Attack trees", Dr. Dobb’s journal, 24(12), pp.21~29 (1999)
- B. Joachim, "Biased nonce sense: lattice attacks against weak ECDSA signatures in cryptocurrencies", International Conference on Financial Cryptography and Data Security, pp.3~20 (2019), Springer
- "Extracting the private k ey from a TREZOR" (2018)[URL]
- A. Bobbio, "Improving the analysis of dependable systems by mapping fault trees into Bayesian Networks", Reliability Engineering and System Safety, 71(3), pp.249~260 (2001)
- Pappaterra, M. J., "Bayesian networks for online cybersecurity threat detection", Machine Intelligence and Big Data Analytics for Cybersecurity Applications, 919, pp.129~159 (2020)
- G. Marco, "Exploiting bayesian networks for the analysis of combined attack trees", Electronic notes in theoretical computer science, 310, pp.91~111 (2015)
- N. Poolsappasit, "Dynamic security risk management using bayesian attack graphs", IEEE Transactions on Dependable and Secure Computing, 9(1), pp.61~74 (2012)
- H. Zhang, "A conditional probability computation method for vulnerability exploitation based on CVSS", 2017 IEEE Second International Conference on Data Science in Cyberspace (DSC), pp.238~241 (2017)