한국전기연구원 전문가 자문 발표전력 계통망에 있어서 보안일반 및 이슈와 기술 그리고 정책 방향-소셜네트워크 서비스 등 차세대 기술 환경 맥락으로-발표일:2009년 10월 20일발표장소 : 한국전기연구원발표자 : 강장묵(세종대 정보통신공학과)redsea@sejong.ac.kr

Who is kang, JM?연구 분야웹 2.0 중 소셜 네트워크 서비스유비쿼터스 컴퓨팅 중 증강현실디지털컨텐츠 중 UCC정보보호 중 개인정보학제간 연구(정보 소통 및 사회문화의 기술사회구성론적 분석)공학박사(정보보호 전공)정보보호진흥원 등 자문 활동(현)세종대학교 정보통신공학과 교수-유비쿼터스 컴퓨팅 사업단-미디어 다음 열린사용자 위원회 위원2

공학박사(정보보호 전공)

정보보호진흥원 등 자문 활동

(현)세종대학교 정보통신공학과 교수

미디어 다음 열린사용자 위원회 위원

생각할 문제3방송과 통신 융합은 서비스간 경계를 허물었다. 트위터와페이스북은OPEN환경에서 연동 및 공유된다. 유비쿼터스 컴퓨팅기술로 공간 융합, 서비스 통합, mash-up으로 정보 공유는 취약점을 키우는가? 편리함만 주는가?서비스간 보안 규칙과 보안 대상 수준과 다루는 정보의 민감도도 허물어지지 않는가?개인화된 서비스와 광고로 수익을 얻는 비즈니스는 개인정보 더 나아가 프라이버시에 치명적 위협이지 않은가?전력기반 통신에 적용 가능한 유연한 기술은 새로운 보안 취약점을 야기하지 않는가?

발표 내용 및 보안 토픽PGP S/MIMESSL TLSIPSecCryptographySymmetric KeyPublic KeyAlgorithmsEncryptionDigital SignaturesCertificatesAlgorithmsEncryptionKey Mgmt발표내용간략한 보안 이슈 중 선별한 개론 수준의 개념 소셜 네트워크 환경에서 보안 이슈와 적용전력계통망에서 새로운 비즈니스에 대한 플랫폼 차원의 보안 발표자가 관심 갖는 보안 관련 연구 내용(기관 요청)

Platform Security5Protecting your information, technology, property, products and people, thus protecting your business. The Information Security Triad is the foundation for Information Security and is based on concepts and principles known as CIA.ConfidentialityIntegrityAvailability

Confidentiality

Integrity

Availability

보안 기술 소개 1.IPSec – IP SecuritySecures the IP packet by adding additional header Selection of encryption, authentication and hashing methods left to the userIt requires a logical connection between two hosts, achieved using Security Association (SA)An SA is defined by:A 32-bit security parameter index (SPI)Protocol type: Authentication Header (AH) Or Encapsulating Security Payload (ESP)The source IP addressTransport ModeIP HeaderIPSec HeaderRest of the PacketORTunnel ModeIP HeaderIPSec HeaderRest of the PacketNew IP Header

보안 기술 소개 2.Pretty Good Privacy (PGP)One-time secret keySender siteAlice3+EncryptBob’s public key4Message plus Signed Digest1Alice’s private keyHash FunctionEncrypt5EncryptDigestSigned Digest2+6The message and digest are encrypted using one time secret key created by AliceEncrypted (secret key & message + digest) to Bob

보안 기술 소개 2.PGP (contd.)Receiver siteBob’s private keyOne-time secret key7Encrypted (secret key & message + digest)DecryptBobDecryptEncrypted (message + digest)8910DecryptHash FunctionAlice’s public keyThe two digests are compared, thus providing authentication and integrity11DigestDigestXCompare

보안 기술 소개 3.S/MIMEWorking principle similar to PGPS/MIME uses multipart MIME type to include the cryptographic information with the messageS/MIME uses Cryptographic Message Syntax (CMS) to specify the cryptographic information Creating S/MIME message:MIME EntityCMS ObjectS/MIMECertificatesMIME WrappingCMS ProcessingAlgoidentifiers

Working principle similar to PGP

S/MIME uses multipart MIME type to include the cryptographic information with the message

S/MIME uses Cryptographic Message Syntax (CMS) to specify the cryptographic information

Creating S/MIME message:

보안 기술 소개 4.Transport Layer Security (TLS)Server decrypts secret key with its private key. Uses secret key to decode message ad sends encrypted ackDesigned by IETF; derived from SSLLies on top of Transport layerUses two protocols:Handshake ProtocolHelloCertificateSecret keyEnd HandshakingEncrypted AckClientServer Data exchange protocol Uses secret key to encrypt data. Secret key already shared during handshake10

Designed by IETF; derived from SSL

Lies on top of Transport layer

Uses two protocols:

Handshake Protocol

Data exchange protocol

Uses secret key to encrypt data.

Secret key already shared during handshake

11보안 기술 소개 5.Chain of TrustQuery propagation similar to DNS queries At any level, the CA can certify performance of CAs in the next level i.e. level-1 CA can certify level-2 CAs.Thumb-rule: Everyone trusts Root CARoot CALevel-1CA 1Level-1CA 2Level-2CA 3Level-2CA 4Level-2CA 5Level-2CA 6Level-2CA 2Level-2CA 1

Query propagation similar to DNS queries

At any level, the CA can certify performance of CAs in the next level i.e. level-1 CA can certify level-2 CAs.

Thumb-rule: Everyone trusts Root CA

12최근 분산공격 사례DDoS Attack Scenario공격자Step 1.Probing vulnerable computers to make them zombiesStep 2.Install attack program in Compromised zombiesZombieiZombienZombie1. . . . . .. . . . . .Step 3.Send attack commands to zombies to launch DDoS* Source: Random Spoofed Address* Destination: Victim AddressStep 4.Victim network capacity was Saturated by DDoS attack traffic희생자

13The Components of Information SecurityThe Information Security Triad is the foundation for Information Security and is based on concepts and principles known as CIA.PeopleProcessesTechnology

The Information Security Triad is the foundation for Information Security and is based on concepts and principles known as CIA.

People

Processes

Technology

Need for message securityPrivacyAm I sure no body else knows this?AuthenticationAm I sure that the sender is genuine and not an imposter?IntegrityAm I sure that the message has not been tampered on its way?Non-repudiationWhat will I do if the sender denies sending the message?

15XML의 발전과 위협

16Web 2.0 기반 언어 체계의 위협

17정책의 유연성 : 융합 환경에서 이기종 간 정책의 일관성 유지 수준에서

Study Group Organization(WTSA)(TSAG)ITU-TTelecommunicationstandardization ofnetwork and serviceaspectsITU-DAssisting implementationand operation oftelecommunications indeveloping countriesITU-RRadiocommunicationstandardization andglobal radio spectrummanagementWhat is International Telecommunication Union (ITU) ?SG 17, Security, Languages and Telecommunication SoftwareLead Study Group on Telecommunication Security SG 2, Operational Aspects of Service Provision, Networks and Performance SG 4, Telecommunication Management SG 5, Protection Against Electromagnetic Environment Effects SG 9, Integrated Broadband Cable Networks and Television and Sound Transmission SG 11, Signalling Requirements and Protocols SG 13, Next Generation Networks SG 15, Optical and Other Transport Network Infrastructures SG 16, Multimedia Terminals, Systems and Applications SG 19, Mobile Telecommunication NetworksHeadquartered in Geneva, is the UN specialized agency for telecom

SG 17, Security, Languages and Telecommunication Software

Lead Study Group on Telecommunication Security

SG 2, Operational Aspects of Service Provision, Networks and Performance

SG 4, Telecommunication Management

SG 5, Protection Against Electromagnetic Environment Effects

SG 9, Integrated Broadband Cable Networks and Television and Sound Transmission

SG 11, Signalling Requirements and Protocols

SG 13, Next Generation Networks

SG 15, Optical and Other Transport Network Infrastructures

SG 16, Multimedia Terminals, Systems and Applications

SG 19, Mobile Telecommunication Networks

Federal Information Security Management Act19Roles & ResponsibilitiesAgency HeadCIOAgency Security OfficerSecurity ProgramPeriodic risk assessmentsPolicies and proceduresSecurity plansSecurity awareness trainingPeriodic testing & evaluationRemediation activitiesIncident response capabilitiesContinuity of operationsAnnual Security ReviewDetermine sufficiency of security programIndependent Evaluation (e.g., IG)Safeguard evaluation dataAnnual ReportingReports from CIO & IGReport material weaknessesProvide performance plans§§ 3544(c), 3545 (e)§3544(a)§§ 3544(c), 3545 (e)§3544(b)

Agency Head

CIO

Agency Security Officer

Determine sufficiency of security program

Independent Evaluation (e.g., IG)

Safeguard evaluation data

Reports from CIO & IG

Report material weaknesses

Provide performance plans

인증과 인가:IT Security in the SDLC--NIST SP 800-64

Security Control Automation Protocol—SCAPXML and protocols to exchange technical security information between products“Glue Code” between the following data sets:Common Vulnerabilities and Exposures (CVE) Common Configuration Enumeration (CCE) Common Platform Enumeration (CPE) Common Vulnerability Scoring System (CVSS) Extensible Configuration Checklist Description Format (XCCDF) Open Vulnerability and Assessment Language (OVAL)More products certified weekly21

Observations and Truthinesses(보안 방식의 결정)Control v/s audit burdensSkill of the constituencyNeed a security professional at each layerIs it all just a matter of centralized v/s decentralized?22

ApplicationsService UserProfilesANIApplication Support Functions & Service Support FunctionsService ControlFunctionsTransport User ProfilesNetwork Attachment Control Functions Service stratumManagement FunctionsEnd-UserFunctionsResource and Admission Control Functions OtherNetworksTransport Control FunctionsTransport FunctionsUNINNITransport stratumControlMediaNGN architecture overview (Y.2012)Packet-based network with QoS supportand SecuritySeparation between Services and Transport Access can be provided using many underlying technologiesShould be reflected in policy Decoupling of service provision from networkSupport wide range of services/applications Converged services between Fixed/MobileBroadband capabilities with end-to-end QoS Compliant with regulatory requirementsEmergency communications, security, privacy, lawful interceptionENUM Resources, Domain Names/ Internet Addresses

Packet-based network with QoS supportand Security

Separation between Services and Transport

Access can be provided using many underlying technologies

Should be reflected in policy

Decoupling of service provision from network

Broadband capabilities with end-to-end QoS

Compliant with regulatory requirements

Emergency communications, security, privacy, lawful interception

ENUM Resources, Domain Names/ Internet Addresses

Provider B fromProvider A’s point of viewProvider ATrustedZoneTrusted butVulnerableZoneUntrustedZoneDomainBorderElements(DBE)DomainBorderElements(DBE)NGNnetworkElementsNGNnetworkElementsNGN Peering Trust Model

PDACellularAt your DeskIn the AirManaged OfficeOn the RoadIn TownAt HomeIdentityConnecting users with services and with others (Federation)People have multiple identities, each within a specific context or domainWork – me@company.comFamily – me@smith.familyHobby – me@icedevils.teamVolunteer – me@association.orgCollaborationPCVideo Voice TelephonySmart PhoneWhatever you’re doing(applications)Whatever you’re using(devices)Web Apps ERPWherever you are(across various access types)Network Identity is essentialNeed end-to-end trust model

Network Identity is essential

Need end-to-end trust model

노드-허브-클러스트 등 네트워크 계층26At what layer do you address a specific problem?Can a specific solution “scale up” to the Federation/ Community Layer?How do I get “clueful” people at each layer?How do I communicate between layers?

At what layer do you address a specific problem?

Can a specific solution “scale up” to the Federation/ Community Layer?

How do I get “clueful” people at each layer?

How do I communicate between layers?

Trusted Internet Connections—TICReduce Government Internet connections to 50Lowers the demand for skilled personnelUses models from DoD and DHSAgencies share Internet connectionsIn theory: simplifies protecting Internet connections Government-widehttp://www.whitehouse.gov/omb/memoranda/fy2008/m08-05.pdf27

The Cybertastic Future: ManagementUse the Enterprise, Project, and Integration LayersStart in bite-sized pieces and consolidate wherever possibleNeed “clueful” people at all layersOrganization at the Federation Layer for self-regulation—some people are already doing it28

Some useful web resourcesITU-T Home page http://www.itu.int/ITU-T/Security Roadmap http://www.itu.int/ITU-T/studygroups/com17/ict/index.htmlSecurity Manual http://www.itu.int/publ/T-HDB-SEC.03-2006/enCybersecurity Portal http://www.itu.int/cybersecurity/Cybersecurity Gateway http://www.itu.int/cybersecurity/gateway/index.htmlRecommendations http://www.itu.int/ITU-T/publications/recs.htmlITU-T Lighthouse http://www.itu.int/ITU-T/lighthouse/index.phtmlITU-T Workshops http://www.itu.int/ITU-T/worksem/index.htmlLSG on Security http://www.itu.int/ITU-T/studygroups/com17/tel-security.html

30질의와 토론

최근 특허 사례 (출원인:세종대,동국대, 발명가:강장묵 외)효율적인 개인정보 유통경로의 안전관리를 위한 개인 정보 보호 장치 및 방법{PERSONAL INFORMATION PROTECTION APPARATUS AND METHOD FOR MANAGING DISTRIBUTION CHANNEL OF PERSONAL INFORMATION EFFICIENTLY AND SAFELY}