위협모델링을 이용한 전기차 충전 인프라의 보안요구사항에 대한 연구
A Study on Security Requirements of Electric Vehicle Charging Infrastructure Using Threat Modeling
0
조회
0
다운로드
2
인용
0
참고문헌
키워드
초록
기차 충 인라에서는 충 결제 데이터를 포함하여 다양한 데이터가 송되기 때문에 안한 기차 충 인라를 구축하기 해서는 이에 한 보안 연구가 요구된다. 그지만 기존에 진행된 연구들은 기차 충을 한 충 인라 보다는 력 계통 인라와 같은 스마트 그리드 련 보안 연구가 주를 이루고 있다. 한 충 인라 련 연구는 아직 부족한 실이며, 모델링과 같은 체계인 방법론을 이용한 연구는 아직 진행되고 있 지 않다. 따라서 안한 기차 충 인라의 구축을 해 모델링을 용하여 보안 을 식별하고 보안요구 사항을 체계으로 분석하는 것이 필요하다. 본 논문에서는 Data Flow Diagram, STRIDE, Attack Tree를 활용한 모델링을 이용하여 충 인라에서 발생 가능한 을 정확히 식별하고 객인 보안요구사항을 도출 하여 기차 충 인라를 분석한다.
Abstract
In order to build a secure electric vehicle charging infrastructure, security research is required because various data including charging and payment data are transmitted in the electric vehicle charging infrastructure. However, previous researches have focused on smart grid related security research such as power system infrastructure rather than charging infrastructure for electric vehicle charging. In addition, research on charging infrastructure is still lacking, and research using a systematic methodology such as threat modeling is not yet under way. Therefore, it is necessary to apply threat modeling to identify security threats and systematically analyze security requirements to build a secure electric vehicle charging infrastructure. In this paper, we analyze the electric vehicle charging infrastructure by accurately identifying possible threats and deriving objective security requirements using threat modeling including Data Flow Diagram, STRIDE, and Attack Tree.
참고문헌 (38)
- "In the era of in ternal combustion engine"[URL]
- Oliver Kosut, "Malicious data attacks on the smart grid", IEEE Transactions on Smart Grid, 2(4), pp.645~658 (2011)
- Wenye Wang, "Cyber security in the Smart Grid : Survey and challenges", Computer Networks, 57(5), pp.1344~1371 (2013)
- Todd Baumeister, "Literature review on smart grid cyber security", Collaborative Software Development Laboratory, pp.2010
- "EV Charging Information System"[URL]
- Adam Shostack, "Experiences Threat Modeling at Microsoft" (2008), Microsoft
- P, Torr, "Demystifying the threat modeling process", IEEE Security &Privacy, 3(5), pp.66~70 (2005)
- Adam Shostack, "Threat Modeling:Designing for Security" (2014), John Wiley &Sons
- Paul Wang, "Data security and threat modeling for smart city infrastructure", 2015 International Conference on Cyber Security of Smart Cities, Industrial Control System and Communications(SSIC), IEEE (2015)
- Markus Tasch, "Security analysis of security applications for software defined networks", Proceedings of the AINTEC 2014 on Asian Internet Engineering Conference, ACM (2014)
- Tøndel, "Threat modeling of AMI", International Workshop on Critical Information Infrastructures Security (2012), Springer
- Threat Modeling in Embedded Systems, "Anthony Hadding", Florida Gulf Coast University, ~ (2012)
- Goncalo Martins, "Towards a systematic threat modeling approach for cyber-physical systems", Resilience Week(RWS), IEEE (2015)
- Tong Xin, "Online Banking Security Analysis based on STRIDE Threat Model", International Journal of Security and Its Applications, 8(2), pp.271~282 (2014)
- Hina Chaudhry, "Security concerns of a plug-in vehicle", 2012 IEEE PES Innovative Smart Grid Technologies(ISGT), IEEE (2012)
- Mustafa, "Smart electric vehicle charging : Security analysis", Innovative Smart Grid Technologies(ISGT), 2013 IEEE PES, IEEE (2013)
- 강성구, "전기자동차 충전 인프라에서의 보안위협 및 보안요구사항 분석", 정보보호학회논문지, 22(5), pp.1027~1037 (2012), 한국정보보호학회
- "Microsoft Threat Modeling Tool 2016"[URL]
- Michael Hutter, "RFID and its vulnerability to faults", Lecture Notes in Computer Science, 5154, pp.363~379 (2008)
- Ahmed Khattab, "RFID Security Threats and Basic Solutions", pp.27~41 (2017), Springer International Publishing
- When Firmware Modifications Attaack : A Case Study of Embedded Exploitation, "Ang Cui", NDSS, ~ (2013)
- Dorottya Papp, "Embedded systems security : Threats, vulnerabilities, and attack taxonomy", 2015 13th Annual Conference on Privacy, Security and Trust(PST), IEEE (2015)
- David Watts, "Security and vulnerability in electric power systems", 35th North American power symposium, 2, pp.559~566 (2003)
- Jin-bing Hou, "Research for Vulnerability Detection of Embedded System Firmware", Procedia Computer Science, 107, pp.814~818 (2017)
- Mathew, "A study of open ports as security vulnerabilities in common user computers", 2014 International Conference on Computational Science and Technology(ICCST), IEEE (2014)
- "RFID Securit y and Privacy White Paper"[URL]
- Yan Zhang, "Security in RFID and Sensor Networks" (2009), CRC Press
- S. W. Yi, "Technical Trends of DDos Attacks and Defense in Cellular Network", ETRI Electronics and telecommunications trend, 26(6) (2011)
- Lukas Grunwald, "New attacks against RFID-systems" (2006), BlackHat USA
- Gabi Nakibly, "TCP Injection attacks in the wild" (2016), BlackHat USA
- Brendan O’Connor, "Vulnerabilities in Not-So-Embedded Systems" (2006), BlackHat USA
- Mark Carey(PHORKUS), "Hacking Embedded Devices", DefCon 21, ~ (2013)
- "Exploiting Embedded Devices"[URL]
- "EV Charging Systems Security Requirements"[URL]
- "Who can hack an plug"[URL]
- "Vehicle -Grid Integration Cyber-security of P EVs"[URL]
- Smart grid cyber security potential threats, vulnerabilities and risks, "Isaac Ghansah", California Energy Commission, PIER Energy-Related Environmental Research Program, ~, pp.CEC-500-2012-047 (2009)
- "Common Vulnerabilities and Exposures"[URL]