스마트폰 전자금융서비스에서의 인증 과정에 관한 연구(앱카드를 중심으로)
A Study on Authentication Process in Smartphone Electronic Financial Services
1
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
14.5월 앱카드는 스미싱 기법과 전화번호 취득불가 취약점으로 명의도용사고를 당하였고, 그 후 카드사들은 해당 취약점을 보완하기 위해 인증수단을 추가 도입하는 등 보완하여 운영해 오고 있다. 하지만, 인증 적용환경, 목적및 인증수단에 대한 분석이 부족하여 기존 사고에서 나타난 취약점 및 리스크수준을 낮추지 못하고 있다. 본 연구는전자금융서비스 중 앱카드의 인증과정을 美NIST의 인증가이드라인을 적용하여 분석하고, 문제점을 파악하여 개선방향을 제안하고자 한다. 본 연구에서 분석한 방식은 앱카드외에도 인증수단의 분석에 전반적으로 적용할 수 있어활용가치가 높을 것이다.
Abstract
In May 2014, AppCard(Which is a smartphone application designed to register and use a credit card in a mobile phoneby credit card company.) was attacked by smshing and a vulnerability which could not obtainable phone number. After that,credit card companies have supplemented and operated by introducing additional authentication methods to supplement thevulnerability. However, The analysis of the authentication environments, purposes and methods is not enough to lower thelevel of vulnerability and risk from existing accidents. This study analyzes the authentication process of the AppCard in the electronic financial service by applying the NIST'sauthentication guidelines, identifies the problems and suggests improvement directions. The method analyzed in this study canbe applied to the analysis of the authentication method in addition to the application card, so that it will be highly utilized.
참고문헌 (34)
- 신용재, "국내 모바일 지급결제 서비스에 대한 역사적 고찰 및 시사점", 경영사연구, 31(2), pp.55~78 (2016), 한국경영사학회[DOI]
- TTA, "Information and communication terminology dictionary" (2018)
- TTA, "Framework for Cerificate Policy and Certification Practice Statement, TTAS.IF-RFC3267", 6~ (2004)
- "<TEX>$\S$<", TEX>2.6, Digital Signature Act, Act No. 14839, 2017
- "US. Rule 901. Requirement for Authentication or Identification (b)(9)", ~ (2011)
- Suitable Framework for Entity Authentication Assurance in The Local Environment, TTAK.KO-2.0248, "TTA", 11~ (2014)
- OECD, "OECD Guidance for Electronic Authenticaion", 7~ (2007)
- ITU-T, "Entity authentication assurance framework, X.1254", 1~ (2012)
- NIST, "Digital Identity Guidelines, SP800-63-3", 47~ (2017)
- NIST, "Digital Identity Guidelines, SP800-63-3", 8~ (2017)
- "<TEX>$\S$<", TEX>2.3, Specialized Credit Finance Business Act, Act No.15615, 2018
- FSS, "We will inform you of the credit card issuance criteria and issuance procedures" (2014)
- "Act On Real Name Financial Transactions And Confidentiality, Act No. 14242", ~ (2016)
- "Enforcement Decree Of Act On Real Name Financial Transactions And Confidentiality, Presidential Decree No. 28218", ~ (2017)
- "Act On Reporting And Using Specified Financial Transaction Information", Act No. 14839, ~ (2017)
- Enforcement Decree Of The Act On Reporting And Use Of Certain Financial Transaction Information, Presidential Decree No. 28687, , ~ (2018)
- "Electronic Financial Transactions Act, Act No. 14828", ~ (2017)
- "Regulation On Supervision Of Electronic Financial Transactions, FSC Public Notice No. 2016-37", ~ (2016)
- "Specialiezed Credit Finance Business Act, Act No. 15615", ~ (2018)
- "Enforcement Decree Of Specialiezed Credit Finance Business Act, Presidential Decree No. 28389", ~ (2017)
- "Regulation On Supervison Of Specialiezed Credit Finance Business Act, FSC Public Notice No. 2018-2", ~ (2018)
- "Credit Information Use And Protection Act, Act No. 14823", ~ (2017)
- "Enforcement Decree Of Credit Information Use And Protection Act, Presidential Decree No. 28387", ~ (2017)
- "Digital Signature Act, Act No. 14839", ~ (2017)
- "Enforcement Rules Of Digital Signature Act, Amended By Ordinance Of The Prime Minister No. 996", ~ (2012)
- NIST, "Digital Identity Guidelines, SP800-63-3", 16~ (2017)
- IMSAC, "Guidance Document: Electronic Authenticaiton", pp.10~ (2016)
- NIST, "Digital Identity Guidelines Enrollment and Identity Proofing, SP800-63A", 5~6 (2017)
- "Swift Developer Documentation "CTCarrier API""[URL]
- "Swift Developer Documentation "DeviceCheck API""[URL]
- TTA, "Requirements for E-authenticaion Method of Assurance Level, TTAK.KO-12.0247", 6~11 (2014)
- TTA, "Suitable Framework for Entity Authentication Assurance in The Local Environment, TTAK.KO-12.0248", 13~25 (2014)
- TTA, "Authentication Service Guideline for The Layered Risk Level in Online Transaction, TTAK.KO-12.0244", 3~14 (2014)
- TTA, "Guideline on Identity Proofing Management, TTAK.KO-12.0292", 5~10 (2016)