본문 바로가기
KERD
논문KCI 등재

공적 가치, 사적 기반 그리고 IoT : 자동차 사례를 중심으로

Public Values, Private Infrastructure and the Internet of Things : The Case of Automobiles

이성엽
법학연구소 (The Institute of Legal Studies Konkuk University)|2016.05|경제규제와 법|제9권 제1호|pp. 45-68

0

조회

0

다운로드

0

인용

0

참고문헌

키워드

프라이버시IoT사물인터넷privacycybersecurity사이버보안administrative law행정법privacy by design설계에 의한프라이버시 보호
주제분류법학

초록

2015년 7월, 두 명의 연구자는 지프 체로키의 대쉬보드연결시스템을 무선으로 해킹하여 그 차량의 통제권을 확보하였다. 이 사건으로 인해 피아트 크라이슬러 차량 140만여대가 리콜되었는데 이는 보안과 관련된 최초의 리콜 사태였다. 또한 다른 연구자들은 자동차를 원격 조정할 수 있다는 것을 보여주었다. 그리고 가을에는 GM이 수백만 대의차량의 보안 취약성을 개선하기 위한 원격 업데이트 프로그램을 사용하기 시작하였다. 이러한 몇몇 사건들은 자동차, 소위 연결된 차량 그리고IoT에 있어 보안 이슈의 중요성을 보여주고 있으며, 또한 생산, 그리고 운행 중인 차에서 보안취약성의 관리에 대한 관심을 유도하는 규제규조의 중요성을 강조하게 하였다. 특히, 이에 대한 관심을 어떻게 유도할 것인지 그리고 운행 중인 차에서 발견된 보안취약성을 어떻게 관리할 것인지에 대한 평가의 중요성을 보여주었다. 특히, 그것은 취약성을 개선하여안전과 보안을 지원하기 위한 원격업데이트 시스템의 발전의중요성을 보여주었다. 원격업데이트 시스템은 IoT 보안 그리고 거기에 의존하는 인간의 건강과 안전에 필수적이다. 오늘날 연결된 차량은 1억 개 이상의 소프트웨어 코드를가지고 있고 코드의 기초는 증가하고 있다. 이 코드는 규제의무의 이행에 있어 중요한 역할을 하고 있고 자동차의 안전과 보안시스템에 결정적 역할을 한다. 센서와 알고리듬은에어백 배치, 안전벨트 착용, 미끄럼방지 시스템, 잠금방지제동시스템을 작동시키고 조절한다. 또한 에어백과 안전벨트 행위를 알리기 위해 사람의 크기, 무게, 위치를 확인해준다. 자동차 안전에서 소프트웨어는 코드가 지배하는 안전시스템을 만드는 것은 물론 생명을 구하는데 중요한 보안에서의 역할이 증가하고 있다. 자동차 코드 예컨대 지프 해커에 의해 개발된 코드의 취약성을 드러내는 것이 자동차 안전 및 보안의 미래에서 필수적인 역할을 한다. 원격업데이트 시스템의 설계는 거버넌스, 다양한 공적, 사적 가치 간의 균형과 관련되어 있다. 자동차안전과 보안을 강화하는 시스템을 개발하는 것은 경쟁하는 보안의 비전 간의 선택과 그리고 그 과정에서 다른 가치를 어떻게 보호할 것인지를 결정하는 것과 관련되어 있다. 사이버보안 목표의 연결 그리고 다른 가치 간의 균형을 가져가는 방안은관련 공적, 사적 이해관계자들이 포함되는 대중적인 참여과정 속에서 만들어져야 한다. 이 연구는 IoT와 원격업데이트기능을 강화하는데 중요한역할을 하는 국가교통안전청과 같은 규제기관이 사이버보안과 안전위험을 대비하는 정책의제를 설정하기 위해 필요한원리를 검토한다. 자동차 산업에서 원격보안과 안전의 업데이트 기능의 중요성을 설명하고 그 발전의 장애물에 대해서설명한다. 원격업데이트 기능, 수리권과 프라이버시를 포함하는 소비자 보호, 경쟁간 상호작용에 의해 나타나는 도전에 대해 검토한다. 이러한 도전의 관점에서 원격업데이트, 자동차 사이버보안에서 있어 규제접근방법에 대한 원리를제안한다. 그 원리들은 사이버보안 전문성의 발전과 관련 이해관계자간 공유된 사이버보안 목표를 증진시키고 경쟁과 프라이버시 같은 다른 가치가 원격업데이트 기술의 설계에 반영될 수 있도록 하는 것이다. 결론적으로 우리는 자동차 사이버보안을 개선하기 위한 기존의 노력에 대한 개혁을 제안한다.

Abstract

In July 2015, two researchers gained control of a Jeep Cherokee by hacking wirelessly into its dashboard connectivity system. The resulting recall of over 1.4 million Fiat Chrysler vehicles marked the first-ever security-related automobile recall. In its wake, other researchers demonstrated the capacity for remote takeovers of automobiles. By September, it became public that GM had initiated a quiet over-the-air (OTA) update program to fix security vulnerabilities in millions of their vehicles. These incidents reveal the critical security issues of modern automobiles, so-called “connected cars,” and other Internet of Things (IoT) devices, and underscore the importance of regulatory structures that incentivize greater attention to security during production, and the management of security vulnerabilities discovered after connected devices are in circulation. In particular, it highlights the importance of incentivizing the development of OTA update systems to support safety and security critical updates to patch vulnerabilities. OTA update systems are essential to IoT security and the health and safety of humans who rely upon it. Today’s connected cars can have more than a 100 million lines of software code, and this code base is growing. This code plays a significant role in compliance with regulatory obligations, and a crucial role in automotive safety and security systems. Embedded sensors and algorithms trigger and modulate airbag deployment, seatbelt engagement, anti-skid systems, and anti-lock breaks, identify the size, weight, and position of people to inform airbag and seatbelt behavior, and inform parking assistance systems, anti-skid and anti-lock break systems, among others. Software’s role in automotive safety is growing making the assumptions and calibrations of the code governing critical safety systems, as well as its security, increasingly important to saving lives. Addressing the vulnerabilities in automotive code — such as the ones exploited by the Jeep hackers — and specifically the capacity for remote exploits, are an essential element of the future of automotive safety and security. The design of OTA update systems implicates crucial issues of governance, and the balance of a variety of values - both public and private. Developing systems intended to ensure automotive safety and security involves both choosing among competing visions of security, and determining how to protect other values in the process. The articulation of cybersecurity goals, and the way they are balanced against other values, must occur in a public participatory process beforehand that includes relevant public and private stakeholders. This paper sets forth principles that should inform the agenda of regulatory agencies such as the National Highway Transportation (NHTSA) that play an essential role in ensuring that the IoT, and specifically the OTA update functionality it requires, responds to relevant cybersecurity and safety risks while attending to other public values. It explains the importance of OTA security and safety update functionality in the automotive industry, and barriers to its development. It explores challenges posed by the interaction between OTA update functionality, consumer protections — including repair rights and privacy — and competition. It proposes a set of principles to guide the regulatory approach to OTA updates, and automobile cybersecurity, in light of these challenges. The principles promote the development of cybersecurity expertise and shared cybersecurity objectives across relevant stakeholders, and ensure that respect for other values, such as competition and privacy is built into the design of OTA update technology. In conclusion, we suggest reforms to existing efforts to improve automotive cybersecurity.

참고문헌 (107)

  1. "Preparing for the convergence of IoT and automotive"[URL]
  2. Alderson, David, "The Role of Economic Incentives in Securing Cyberspace", Stanford University Center for International Security and Cooperation, ~ (2004)
  3. Alliance of Automobile Manufacturers, Inc, "Consumer Privacy Protection Principles: Privacy Principles for Vehicle Technologies and Services", ~ (2014)
  4. Key Research Findings on Consumers and Auto Safety Recalls, "Auto Alliance and Global Automakers", ~ (2015)
  5. "Automobile 'Black Boxes' - California Vehicle Code section 9951 section 17500", ~
  6. Bamberger, Kenneth A, "Regulation as Delegation:Private Firms, Decisionmaking, and Accountability in the Administrative State", DUKE L. J, 56, pp.377~ (2006)
  7. Bamberger, Kenneth A, "THE IMPACT OF GLOBALIZATION ON THE UNITED STATES: LAW AND GOVERNANCE Vol. 2" (2008)
  8. Bamberger, Kenneth A, "Privacy decisionmaking in administrative agencies", University of Chicago Law Review, 75(1), pp.75~ (2008)
  9. Bamberger, Kenneth A, "PRIVACY ON THE GROUND: DRIVING CORPORATE BEHAVIOR IN THE UNITED STATES AND EUROPE" (2015), MIT
  10. Bamberger, Kenneth A, "Technologies of Compliance: Risk and Regulation in a Digital Age", Tex. L. Rev, 88, pp.669~ (2010)
  11. "The End of the Cell Phone Unlocking Saga?" (2014)[URL]
  12. Bellissimo, A, "Secure software updates: Disappointments and new challenges", Proceedings of USENIX Hot Topics in Security (2006)
  13. Bento, Luís Conde, "Intelligent traffic management at intersections supported by v2v and v2i communications", Intelligent Transportation Systems (ITSC), 2012 15th International IEEE Conference on (2012), IEEE
  14. "Why the Internet of Things will be worse than a zombie apocalypse" (2015)[URL]
  15. "KORE,Tesla’s Over-the-Air Fix:Best Example Yet of the Internet of Things?" (2014)[URL]
  16. Buzan, Barry, "Security: a new framework for analysis" (1998), Lynne Rienner Publishers
  17. "California Constitution Article I, Section 1", ~
  18. "California v. Acceleron Corp" (2004)[URL]
  19. "Center for Democracy and Technology Before the Federal Communications Commission In the Matter of Petition of the Cellular Telecommunications Industry Association for a Rulemaking to Establish Fair Location Information Practices WT Docket No. 01-72 DA-01-696. The FCC never acted upon the petition. WT Docket No. 01-72 DA-01-696 Petition of the Cellular Telecommunications and Internet Association", ~
  20. "Chamberlain Group v. Skylink Technologies, 381 F.3d 1178 (Fed. Cir. 2004)", ~ (2004)
  21. Chandler, Jennifer A, "Harboring Data:Information Security, Law and the Corporation" (2009), Stanford University Press
  22. "This car runs on code. 2009" (2013)[URL]
  23. Checkoway, D. McCoy, "Comprehensive Experimental Analyses of Automotive Attack Surfaces", Proceedings of the USENIX Security Symposium (2011)
  24. Cirani, Simone, "IoT-OAS: An OAuth-Based Authorization Service Architecture for Secure Services in IoT Scenarios", Sensors Journal, 15(2), pp.1224~1234 (2015), IEEE
  25. Craigen, Dan, "Defining Cybersecurity", Technology Innovation Management Review, 4(10) (2014)
  26. "The Tesla Dividend: Better Internet Access" (2016)[URL]
  27. Denning, Tamara, "Computer security and the modern home", Communications of the ACM, 56(1), pp.94~103 (2013)
  28. "Tesla Model S Update Improves Safety of Its Summon Feature: In response to Consumer Reports’ concerns, Tesla updates software on its self-parking function" (2016)[URL]
  29. "Department of Homeland Security (DHS) Science and Technology Directorate (S&T), Press Release announcing 1.2 million dollar award to University of Michigan project, Secure Software Update Over-the-Air for Ground Vehicles Specification and Prototype" (2015)[URL]
  30. Doty, Nick, "Privacy issues of the W3C Geolocation API", ~ (2010)
  31. "Big Android Makers Will Now Push Monthly Security Updates" (2015)[URL]
  32. Durumeric, Zakir, "The matter of Heartbleed", Proceedings of the 2014 Conference on Internet Measurement Conference (2014), ACM
  33. "Unintended Consequences: 16 Years Under the DMCA"[URL]
  34. "Electronic Frontier Foundation In the matter of Exemption to Prohibition on Circumvention of Copyright Protection Systems for Access Control Technologies Under 17 U.S.C. 1201 Docket No. 2014-07 U.S", Copyright Office, Library of Congress, ~ (2015)
  35. "Electronic Surveillance in Rental Cars - California Civil Code section 1936"[URL]
  36. European Commission, "Article 29 Data Protection Working Party Opinion 8", 2014 on the Recent Developments on the Internet of Things, 2014
  37. "Commission adopts revised competition rules for motor vehicle distribution and repair" (2010)[URL]
  38. "Exemption to Prohibition on Circumvention of Copyright Protection Systems for Wireless Telephone Handsets", 79 FR 50552, ~ (2014)
  39. Fagan, Michael, "A study of users’ experiences and beliefs about software update messages", Computers in Human Behavior, 51(2015), pp.504~519 (2015)
  40. Federal Bureau of Investigation, "Motor Vehicles Increasingly Vulnerable to Remote Exploits", Alert Number I-031716-PSA, ~ (2016)
  41. "Federal Motor Vehicle Safety Standards; Event Data Recorders", 77 Fed. Reg. 74144, 74150-51, ~ (2012)
  42. "Federal Trade Commission Staff Report, Internet of Things: Privacy & Security in a Connected World" (2015)[URL]
  43. "An Internet of Treacherous Things" (2015)[URL]
  44. Foster, I., "Fast and vulnerable: a story of telematic failures", 9th USENIX Workshop on Offensive Technologies (2015)
  45. Giles, Keir, "Divided by a common language: Cyber definitions in Chinese, Russian and English", Cyber Conflict (CyCon), 2013 5th International Conference on (2013), IEEE
  46. "Hackers Remotely Kill a Jeep on the Highway—With Me in It" (2015)[URL]
  47. "GM Took 5 Years to Fix a Full-Takeover Hack in Millions of OnStar Cars" (2015)[URL]
  48. Gustafsson, Fredrik, "Automotive safety systems", Signal Processing Magazine, 26(4), pp.32~47 (2009), IEEE
  49. Hansen, Lene, "Digital disaster, cyber security, and the Copenhagen School", International Studies Quarterly, 53(4), pp.1155~1175 (2009)
  50. "Under Threat: Competition in the Automotive Service Aftermarket" (2008)[URL]
  51. "GM fixes, refixes OnStar RemoteLink hack, ExtremeTech" (2015)[URL]
  52. "Institute of Electrical and Electronics Engineers Vehicular Technology Society (IEEE", VTS), comments to the National Highway Traffic Safety Administration (NHTSA) regarding Automotive Electronic Control Systems Safety and Security in light vehicles
  53. "Intellectual Property & Technology Law Clinic, University of Southern California In the matter of Exemption to Prohibition on Circumvention of Copyright Protection Systems for Access Control Technologies Under 17 U.S.C. 1201 Docket No. 2014-07 U.S", Copyright Office, Library of Congress, ~ (2015)
  54. "Internet Engineering Taskforce, RFC 7452 Architectural Considerations in Smart Object Networking March 2015", ~ (2015)
  55. "In the Matter of Petition of the Cellular Telecommunications Industry Association for a Rulemaking to Establish Fair Location Information Practices", WT Docket No. 01-72 DA-01-696, ~
  56. "The zombie apocalypse of smart devices is coming" (2012)[URL]
  57. "Johnson v. Microsoft Corporation, No. C06-0900RAJ (W.D. Wash. June 23, 2009)", ~ (2009)
  58. "Microsoft’s WGA Sued As ‘Spyware’" (2006)[URL]
  59. "Microsoft: We Took Out Storm Botnet" (2008)[URL]
  60. "Obama administration to fast-track 'talking' car mandate" (2015)[URL]
  61. Koscher, A. Czeskis, "Experimental security analysis of a modern automobile", Proceedings of the IEEE Symposium and Security and Privacy (2010)
  62. Exemption to Prohibition on Circumvention of Copyright Protection Systems for Access Control Technologies, Final Rule, 65944 Federal Register, "Vol. 80, No. 208", ~ (2015)
  63. "Lexmark v. Static Control Components, 387 F.3d 522 (6th Cir. 2004)", ~ (2004)
  64. Exemption to Prohibition on Circumvention of Copyright Protection Systems for Access Control Technologies, Final Rule, 65944 Federal Register, "Vol. 80, No. 208", ~ (2015)
  65. A summary of cybersecurity best practices, "McCarthy, C.", National Highway Traffic Safety Administration, ~, pp.Report No. DOT HS 812 075 (2014)
  67. "How Will Talking Cars Change Our Roads?" (2016)[URL]
  68. Mulligan, Deirdre K, "Doctrine for Cybersecurity", Daedalus, 140(4), pp.70~92 (2011)
  69. Mulligan, Deirdre K, "The Coming Design Wars (forthcoming)", ~
  70. "Apple v. FBI: Just One Battle in the ‘Design Wars’ THE RECORDER" (2016)[URL]
  71. Mulligan, Deirdre K, "Revised Papers(Lecture Notes In Computer Science), Joan Feigenbaum, ed", Digital Rights Management: ACM CCS-9 Workshop (2002)
  72. Mulligan, Deirdre K., "How DRM-based content delivery systems disrupt expectations of personal use", Proceedings of the 3rd ACM workshop on Digital rights management (2003), ACM
  73. Mulligan, Deirdre K, "Privacy in the smart grid: an information flow analysis", SSRN 1815605, ~ (2011)
  74. Mulligan, Deirdre K, "The magnificence of the disaster:Reconstructing the Sony BMG rootkit incident", Berkeley Technology Law Journal, 22(3), pp.1157~1232 (2007)
  75. "Interdisciplinary Pathways towards a More Secure Internet, A report on the NSF-sponsored Cybersecurity Ideas Lab held in Arlington" (2014)[URL]
  76. National Telecommunications and Information Administration, "Docket 150224183 -5183-01 Privacy, Transparency and Accountability in Regards to the Commercial and Private use of Unmanned Aircraft Systems", ~
  77. "National Traffic and Motor Vehicle Safety Act, 49 U.S.C. Chapter 301", ~
  79. Nissenbaum, Helen, "Where Computer Security Meets National Security1", Ethics and Information Technology, 7(2), pp.61~73 (2005)
  80. "NIST Lightweight Cryptography project description"[URL]
  81. "ATI Downgrades Its Tuners and its Customers" (2007)[URL]
  82. Tracking and Hacking: Security & Privacy Gaps put American Drivers at Risk, "Office of Senator Edward J. Markey", ~ (2015)
  83. "Trust Framework—Security, Privacy & Sustainability"[URL]
  84. "Updating Car ECUs Over-The-Air (FOTA)" (2011)[URL]
  85. "More OTA updates coming to a car near you" (2016)[URL]
  86. Scheibel, Michael, "Design and implementation of an architecture for vehicular software protection", Embedded Security in Cars Workshop (ESCAR’06) (2006)
  87. Silomon, Jantje AM, "Cybersecurity’s Can of Worms", Journal of Information Warfare, 11(1), pp.1~14 (2012)
  88. "Creative Labs 'Upgrade' Removes FM Radio Recording" (2006)[URL]
  89. "Amazon Erases Orwell Books From Kindle" (2009)[URL]
  90. "Storage Technology v. Custom Hardware Engineering, 421 F.3d 1307 (Fed. Cir. 2005)", ~ (2005)
  91. Network Security Architecture for Demand Response, "Sensor Networks", Subrahmanyam, P.A, 2008
  92. Surden, Harry, "Structural Rights in Privacy", SMU Law Review, 60, pp.1605~ (2007)
  93. "Your Autopilot has arrived" (2015)[URL]
  94. "How Does a Tesla Over-the-Air Software Update Work?" (2014)[URL]
  95. Thaw, David, "The Efficacy of Cybersecurity Regulation 30 Georgia State", University Law Review, 1 (2014)
  96. "The Security and Privacy in Your Car (SPY Car) Act of 2015", ~ (2015)
  97. Thomson, J. R, "High Integrity Systems and Safety Management in Hazardous Industries" (2015), Butterworth-Heinemann
  98. "Unlocking Consumer Choice and Wireless Competition Act Public Law 113-144, 128 Stat. 1751", ~ (2014)
  99. Vaniea, Kami E, "Betrayed by updates: how negative experiences affect future security", Proceedings of the 32nd annual ACM conference on Human factors in computing systems (2014), ACM
  100. "Google Uses Remote Delete to Remove Android Apps from Smartphones" (2010)[URL]
  101. "Convert to MP3 BEFORE Upgrading to iTunes 7.2!" (2007)[URL]
  102. Wash, Rick, "Out of the Loop: How Automated Software Updates Cause Unintended Security Consequences", Symposium on Usable Privacy and Security (2014)
  103. "Presidential Memorandum: Promoting Economic Competitiveness While Safeguarding Privacy, Civil Rights, and Civil Liberties in Domestic Use of Unmanned Aircraft Systems" (2015)[URL]
  104. "General Motors developing wireless download of new features Detroit" (2015)[URL]
  105. Williams, Kristy L, "Updates are Not Available:FDA Regulations Deter Manufacturers from Quickly and Effectively Responding to Software Problems Rendering Medical Devices Vulnerable to Malware and Cybersecurity Threats", ~ (2013)
  106. "Security In The Internet Of Things: Lessons from the Past for the Connected Future"[URL]
  107. "Cyber hack triggers mass Fiat Chrysler car recall" (2015)[URL]

관련 논문AI추천

Public Values, Private Infrastructure and the Internet of Things : The Case of AutomobilesDeirdre K. Mulligan, Kenneth A. Bamberger법학연구소 · 경제규제와 법2016 · 제9권 제1호자동차 사이버보안 표준과 보안 기술 적용 사례이정재한국IT정책경영학회 · 한국IT정책경영학회 논문지2024 · 제16권 제4호사이버 공격으로부터 첨단 교통 시스템 보호 – 관련 입법례를 중심으로 –류병운법학연구소 · 홍익법학2023 · 제24권 제3호자동차 통신 네트워크 해킹의 위험 및 대책손정아, 허경미한국경찰연구학회 · 한국경찰연구2013 · 제12권 제1호사례 분석을 통한 IVN의 필수 보안 요구사항 도출송윤근, 이유식, 이정호, 우사무엘한국ITS학회 · 한국ITS학회 논문지2019 · 제18권 제2호자율주행 자동차를 위한 자동차 사이버 보안 가이드라인 개선에 관한 연구 : 자동차 라이프사이클 중심으로고정민, 김경진, 박효정, 정효주한국산업보안연구학회 · 한국산업보안연구2022 · 제12권 제1호

이 간행물의 다른 논문 (9건)

Public Values, Private Infrastructure and the Internet of Things : The Case of AutomobilesDeirdre K. Mulligan, Kenneth A. Bambergerpp. 7-44Clouds of Things : Data Protection and Consumer Law at the Intersection of Cloud Computing and the Internet of Things in the United KingdomGuido Noto La Diegapp. 69-93사물클라우드 : 클라우드 컴퓨팅과 사물인터넷의교차점에서의 영국의 정보보호와 소비자법이범수pp. 94-117The Internet of Things : Remarks from the German PerspectiveHans-Heinrich Trutepp. 118-139사물인터넷(IoT) : 독일적 관점에서의 논평Hans-Heinrich Trute, 김태오pp. 140-159
원문 보기