위협 모델링 기법을 이용한 펨토셀 취약점 분석에 대한 연구
Study on the Femtocell Vulnerability Analysis Using Threat Modeling
0
조회
0
다운로드
3
인용
0
참고문헌
키워드
초록
최근 스마트폰 사용의 증가 및 사물인터넷 시대에 다양한 기기들이 무선 통신을 지원한다. 이에 따라 기존 기지국의 포화 상태를 막기위한 기술로 일종의 소형 기지국인 펨토셀(Femtocell)을 보급하고 있다. 그러나 해킹 기술의 발전에 따라 펨토셀의 본래 목적과는 다르게, 관리자 권한 획득과 같은 취약점들이 발견되고 이를 통하여 펨토셀 사용자에 대한 개인정보 노출과 같은 심각한 문제가 발생할 수 있다. 따라서 펨토셀에서 발생할 수 있는 보안위협을 식별하고 체계적인 취약점 분석을 위한 방안이 필요하다. 본 논문에서는 위협 모델링(Threat Modeling) 기법을 이용하여 펨토셀에 발생할 수 있는 보안위협을 분석하고 취약점 점검을 위한 체크리스트를 도출한다. 그리고 도출한 체크리스트를 이용하여 실제 취약점 분석을 한 결과를 다루어 펨토셀의 위협과 취약점에 대한 분석 및 사례 연구를 통해 펨토셀의보안성을 향상시킬 수 있는 방안을 제안한다.
Abstract
Lately smartphone uasage is increasing and many Internet of Things (IoT) devices support wireless communications. Accordingly, small base stations which called femtocells are supplied to prevent saturation of existing base stations. However, unlike the original purpose of the femtocell with the advanced hacking technologies, Vulnerability such as gaining the administrator authority was discovered and this can cause serious problems such as the leakage of personal information of femtocell user. Therefore, identify security threats that may occur in the femtocell and it is necessary to ways for systematic vulnerability analysis. In this paper, We analyzed the security threats that can be generated in the femtocell and constructed a checklist for vulnerability analysis using the Threat Modeling method. Then, using the constructed checklist provides a scheme that can improve the safety of the femto cell through the actual analysis and taken the results of the femtocell vulnerabilities analysis.
참고문헌 (25)
- K. S. Lee., "The Current Status and Prospect of the Femtocell Market", ~ (2012)
- "Jammed data traffic fixer, Femtocell" (2012)[URL]
- Borgaonkar, Ravishankar., "Security analysis of a femtocell device", Proceedings of the 4th International Conference on Security of Information and Networks, ACM (2011), ACM
- Alexey Osipov., "ADVENTURES IN FEMTOLAND: 350 YUAN FOR INVALUABLE FUN", Black Hat Las Vegas, ~ (2015)
- Shostack. Adam, "Threat modeling : Designing for security" (2014), John Wiley & Sons
- "The threats to our products" (1999)[URL]
- "The STRIDE Threat Model" (2005)[URL]
- "Octave" (2001)[URL]
- The Common Vulnerability Scoring System, "Schiffman Mike.", National Infrastructure Advisory Council, Vulnerability Disclosure Working Group, Vulnerability Scoring Subgroup, ~ (2004)
- "Trike"[URL]
- "AS/NZS ISO 31000:2009" (2009)[URL]
- Tony UcedaVelez, "Risk Centric Threat Modeling: Process for Attack Simulation and Threat Analysis" (2015), John Wiley
- Klockwork, "Threat Modeling for Secure Embedded Software" (2011), Security Innovation & Klockwork
- M. Deng., "A Privacy Threat Analysis Framework : Supporting the Elicitation and Fulfillment of Privacy Requirements", Journal of Requirements Engineering (2011), Springer-Verlag
- D. Parker, "Our Excessively Simplistic Information Security Model and How to Fix It", ISSA Journal, pp.12~21 (2010)
- "Evaluating Security Threats"[URL]
- "LINDDUN privacy threat modeling"[URL]
- Deng, Mina, "A privacy threat analysis framework : supporting the elicitation and fulfillment of privacy requirements", Requirements Engineering, 16(1), pp.3~32 (2011)
- "Threat Modeling for Secure Embedded Software" (2014)[URL]
- "Cisco Visual Networking Index: Global Mobile Data Traffic Forecast Update 2014–2019 White Paper" (2015)[URL]
- I. S. Hwang, "Ultra-compact smart solutions led by evolution wireless network ‘Femtocell’", NETWORK TIMES, 2011.07, ~ (2011)
- Security Issues in HNB Deployment, "GSM Association", ~ (2008)
- 3GPP, "Security of Home Node B(HNB)", Home evolved Node B(HeNB), 2011
- R. Rajavelsamy., "Security and Communication Networks", pp.471~481 (2011), John Wiley & Sons Ltd
- Chan-Kyu Han., "Building Femtocell More Secure with Improved Proxy Signature", Proceedings of Global Telecommunications Conference, GLOBECOM 2009 (2009), IEEE