GDPR 준수 가능한 블록체인 기반 접근제어 시스템
GDPR Compliant Blockhain Based Aces Control(GCBAC)
2
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
블록체인 기술은 탈중앙화된(decentralized) 분산원장(distributed ledger)과 합의 기반 구조를 바탕으로 높은 보안 수준을 제공할 수 있다는 장점이 있다. 이와 같은 블록체인 기술의 활용도 증진을 위해서는 헬스 케어, 전자상거래 등 개인정보 처리가 필요한 분야에서의 활용 방안 모색이 필요하다. 이를 위해서는, 블록체인 기반 시스템에서도 유럽 연합(EU) 개인정보보호 규정(GDPR, General Data Protection Regulation)으로 대표되는 개인정보보호 관련 법규 및 규정을 준수할 수 있어야 한다. 그러나, 블록체인의 자체 특성상 기록된 자료에 대한 불변성과 탈중앙성 때문에 기존 개인정보보호 규정의 요구사항을 블록체인상에서 기술적으로 구현함에 어려움이 있다. 본논문에서 우리는 카멜레온 해시(chameleon hash)와 속성 기반 암호화(Attribute Based Encryption, 이하ABE)를 활용하여 GDPR에서 요구하는 개인정보 주체의 권리를 보장 가능한 다중 체인(multi-chain)기반 접근제어 시스템을 제시한다. 끝으로 우리의 시스템에서는 기밀성과 무결성을 유지한 가운데, 개인정보 처리가 가능함을보안 분석을 통해 보인다.
Abstract
Blockchain technology can provide a high level security based on a decentralized distributed ledger and consensus-based structure. In order to increase the utilization of blockchain technology, it is necessary to find a way to use it in fields that require personal data processing such as health care and e-commerce. To achieve this goal, the blockchain based system should be able to comply with data privacy regulations represented by European Union(EU)’s GDPR(General Data Protection Regulation). However, because of the properties of the blockchain like the immutability and decentralized recorded data, it is difficult to technically implement the requirements of the existing privacy regulations on the blockchain. In this paper, we propose a multi-chain based access control system that can guarantee the rights of the personal data subject required by GDPR by utilizing Chameleon Hash and Attribute Based Encryption (ABE). Finally, we will show through security analysis that our system can handle personal data while maintaining confidentiality and integrity.
참고문헌 (25)
- Wirth Christian, "Privacy by blockchain design: a blockchain-enabled GDPR-compliant approach for handling personal data", Proceedings of 1st ERCIM Blockchain Workshop 2018. European Society for Socially Embedded Technologies (EUSSET) (2018)
- 최용혁, "블록체인 기술 적용과 개인정보 삭제 및 제3자 제공의 법적 문제에 관한 연구", 정보보호학회논문지, 28(6), pp.1607~1621 (2018), 한국정보보호학회[DOI]
- Jiguo Li, "User collusion avoidance CP-ABE with efficient attribute revocation for cloud storage", IEEE Systems Journal, 12(2), pp.1767~1777 (2017)
- 한세진, "GDPR에 기반한 블록체인 프라이버시 강화 방안", 한국인터넷방송통신학회 논문지, 19(5), pp.33~38 (2019), 한국인터넷방송통신학회[DOI]
- Kondapally Ashritha, "Redactable Blockchain using Enhanced Chameleon Hash Function", 2019 5th International Conference on Advanced Computing &Communication Systems (ICACCS) (2019), IEEE
- "Bitcoin: A Peer-to-Peer Electronic Cash System" (2008)[URL]
- "What-is-gdpr" (2020)[URL]
- "Google hit with £44m GDPR fine over ads" (2019)[URL]
- "British Airways faces record £183m fine for data breach" (2019)[URL]
- Nguyen Binh Truong, "Gdpr-Compliant Personal Data Management: A Blockchain-Based Solution", IEEE Transactions on Information Forensics and Security, 15, pp.1746~1761 (2019)
- Giuseppe Ateniese, "Redactable Blockchain–or–Rewriting History in Bitcoin and Friends", 2017 IEEE European Symposium on Security and Privacy (EuroS&P), pp.111~126 (2017)
- Gavin Wood, "Ethereum: A secure decentralised generalised transaction ledger", Ethereum project yellow paper, 151, pp.1~32 (2017)
- Christian Cachin, "Architecture of the hyperledger blockchain fabric", Workshop on distributed cryptocurrencies and consensus ledgers, 310(4) (2016)
- Guangsheng Yu, "Enabling Attribute Revocation for Fine-Grained Access Control in Blockchain-IoT Systems", IEEE Transactions on Engineering Management, pp.1~18 (2020)
- Hardt, Dick, "Rfc 6749: The oauth 2.0authorization framework", Internet Engineering Task Force (IETF) 10 :2070-1721, ~ (2012)
- Jones, Michael, "RFC 6750-The OAuth 2.0 Authorization Framework: Bearer Token Usage", Internet Engineering Task Force (IETF), ~ (2012)
- John Bethencourt, "Ciphertext-Policy Attribute-Based Encryption", SP'07, IEEE symposium on security and privacy, pp.321~334 (2007)
- Oscar Novo, "Blockchain Meets IoT:An Architecture for Scalable Access Management in IoT", IEEE Internet of Things Journal, 5(2), pp.1184~1195 (2018)
- Ke Huang, "Achieving Intelligent Trust-Layer for Internet-of-Things via Self-Redactable Blockchain", IEEE Transactions on Industrial Informatics, 16(4), pp.2677~2686 (2019)
- Aurelie Bayle, "When Blockchain Meets the Right to be Forgotten:Technology Versus Law in the Healthcare Industry", 2018IEEE, ACM International Conference on Web Intelligence (WI), pp.2018[DOI]
- Pradip Kumar Sharma, "Blockchain based hybrid network architecture for the smart city", Future Generation Computer Systems, 86, pp.650~655 (2018)
- Daniel Fett, "A comprehensive formal security analysis of OAuth 2.0", Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp.1204~1215 (2016)
- Giuseppe Ateniese, "On the Key Exposure Problem in Chameleon Hashes", International Conference on Security in Communication Networks, pp.165~179 (2004), Springer
- Miguel Castro, "Practical Byzantine Fault Tolerance and Proactive Recovery", ACM Transactions on Computer Systems (TOCS), 20(4), pp.398~461 (2002)
- Parth Thakkar, "Performance benchmarking and optimizing hyperledger fabric blockchain platform", 2018 IEEE 26th International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems(MASCOTS), pp.264~276 (2018)