Browse > Article
http://dx.doi.org/10.13089/JKIISC.2014.24.2.397

A Proposal of Personal Information DB Encryption Assurance Framework  

Ko, Youngdai (Korea University)
Lee, Sang-Jin (Attorneys at Law Yulchon)
Publication Information
Journal of the Korea Institute of Information Security & Cryptology / v.24, no.2, 2014 , pp. 397-409 More about this Journal
Abstract
According to the Personal Information Protection Act(PIPA) which is legislated in March 2011, the individual or company that handles personal information, called Personal information processor, should encrypt some kinds of personal information kept in his Database. For convenience sake we call it DB Encryption in this paper. Law enforcement and the implementation agency accordingly are being strengthen the supervision that the status of DB Encryption is being properly applied and implemented as the PIPA. However, the process of DB Encryption is very complicate and difficult as well as there are many factors to consider in reality. For example, there are so many considerations and requirements in the process of DB Encryption like pre-analysis and design, real application and test, etc.. And also there are surely points to be considered in related system components, business process and time and costs. Like this, although there are plenty of factors significantly associated with DB Encryption, yet more concrete and realistic validation entry seems somewhat lacking. In this paper, we propose a realistic DB Encryption Assurance Framework that it is acceptable and resonable in the performance of the PIPA duty (the aspect of the individual or company) and standard direction of inspection and verification of DB Encryption (the aspect of law enforcement).
Keywords
Personal Information Protection Act; DB Encryption; Verification; Assurance; Framework;
Citations & Related Records
연도 인용수 순위
  • Reference
1 NIS, "Security Requirements for DB Encryption Product," 2010.04
2 KISA, "The Guide and Standard of Private Information Risk Analysis," 2012.03
3 FSA, "The Technical Analysis Report of Recent Trend DB Encryption and Security Technique," 2012.09
4 Ministry of Government Legislation, http://www.law.go.kr, Act on Promotion of Information and Communication Network Utilization and Information Protection
5 Ministry of Government Legislation, http://www.law.go.kr, Personal Information Protection Act
6 NIA, "The guide of Information System Audit and Check," V2.0, 2007.2
7 KISA, "The Guide to Using Encryption," 2010. 01
8 KISA, "The Guide to Using Cryptographic Algorithm and Key Sizes," 2010.01
9 KISA, "The Guide to Managing of Private Information DB Encryption," 2010.01
10 KISA, "The Guide to Establishment of Encryption Policy in order to Protect IT Information Assets of Company," 2010.01