• Convergence Security Journal
• /
• v.23 no.5
• /
• pp.9-19
• /
• 2023

Smart cars, which incorporate information and communication technologies (ICT) to improve driving safety and convenience for drivers, have recently emerged. However, the increasing risk of automotive cybersecurity due to the vulnerability of electronic control units (ECUs) and automotive networks, which are essential for realizing the autonomous driving functions of smart cars, is a major obstacle to the widespread adoption of smart cars. Although there have been only a few real-world cases of smart car hacking, drivers' concerns about the security of smart cars can have a negative impact on their proliferation. Therefore, it is important to understand the risk factors perceived by drivers and the trust in smart cars formed through them in order to promote the future diffusion of smart cars. This study examines the risk factors that affect the formation of trust in smart cars, focusing on security and privacy, and analyzes how these factors affect safety perceptions and trust in smart cars.

• Journal of IKEEE
• /
• v.24 no.2
• /
• pp.665-668
• /
• 2020

When a node in automotive CAN bus is hacked, such node should be blocked to prevent severe danger in the car. In order to do that, such node should be uniquely identified. However, there is no way to identify individual nodes in a CAN bus. In this paper, a physical layer security method is proposed where individual nodes are identified by assigning unique ID to the nodes during booting process. The proposed method was implemented in a CAN controller using Verilog HDL, and it is verified that the node ID auto-setting and internal attack defense are successfully performed.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.14 no.5
• /
• pp.19-26
• /
• 2014

The advent of smart phones brought adverse effect between devices recently. For example, adverse effects of info-communication with advent of computer. Also, hacking threat aiming cyber space that is getting more advanced is spreading in terms of range and danger, so that it reaches the level that the nation has to concern. In this circumstance, crimes involving info-technology is now problem in society. As internet technology advances, it enlarges the range of hacker's threat to not only smart phones, but ships, aircrafts, buildings, and cars. It could be seen as social threat of between human and human, between machine and machine, and between human and machine. This study discuss these problems.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2021.11a
• /
• pp.791-794
• /
• 2021

범죄차량 판독 시스템, 지능화된 CCTV 등 차량과 관련된 시각지능에 관한 연구가 큰 관심을 받고 있다. 이 중 차량 분류 기술은, 특정 차량을 인식하는 핵심기술이다. 이와 관련한 기존 연구들은 큰 차종으로만 분류하거나, 분류 가능한 차종의 수, 정확도 등이 낮아 실용성 및 신뢰성이 떨어진다는 단점이 있다. 따라서, 본 논문에서는 차종을 정확하게 분류할 수 있는 2단계 차종 분류 알고리즘을 제안한다. 제안 시스템은 CNN으로 학습된 모델을 기반으로 1차로 차량의 유형을 분류하고, 2차로 정확한 차종을 분류한다. 실험 결과, 52개의 차종을 분류함에 있어 단일 분류 모델에 비해 5.3%p 더 높은 90.2%의 분류 정확도를 보였다. 이를 통해, 더욱 정확한 차종 분류가 가능하다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.32 no.2
• /
• pp.279-287
• /
• 2022

With the advancement of cyber threats and the development of hacking technologies, cyber security is being emphasized in various fields such as automobiles and ships. According to this trend, various industrial fields are demanding cybersecurity, and related certifications. In this paper, cybersecurity type approval is compared with the RMF stage under the premise that there are common elements with RMF in that cybersecurity elements must be reflected in the entire system development cycle. For comparison, type approval of maritime cyber security of the Korean Register of Shipping was selected. In conclusion, although type approval of maritime cyber security acquisition procedure is not divided by development stage like the RMF, there are the commonalities in the procedure to apply the cybersecurity element to the System development lifecycle like the RMF. Accordingly, the possibility of determining that the cybersecurity element was applied to the entire development cycle was confirmed.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.30 no.5
• /
• pp.909-928
• /
• 2020

From the early 1970s, the US government began to recognize that penetration testing could not assure the security quality of products. Results of penetration testing such as identified vulnerabilities and faults can be varied depending on the capabilities of the team. In other words none of penetration team can assure that "vulnerabilities are not found" is not equal to "product does not have any vulnerabilities". So the U.S. government realized that in order to improve the security quality of products, the development process itself should be managed systematically and strictly. Therefore, the US government began to publish various standards related to the development methodology and evaluation procurement system embedding "security-by-design" concept from the 1980s. Security-by-design means reducing product's complexity by considering security from the initial phase of development lifecycle such as the product requirements analysis and design phase to achieve trustworthiness of product ultimately. Since then, the security-by-design concept has been spread to the private sector since 2002 in the name of Secure SDLC by Microsoft and IBM, and is currently being used in various fields such as automotive and advanced weapon systems. However, the problem is that it is not easy to implement in the actual field because the standard or guidelines related to Secure SDLC contain only abstract and declarative contents. Therefore, in this paper, we present the new framework in order to specify the level of Secure SDLC desired by enterprises. Our proposed CIA (functional Correctness, safety Integrity, security Assurance)-level-based security-by-design framework combines the evidence-based security approach with the existing Secure SDLC. Using our methodology, first we can quantitatively show gap of Secure SDLC process level between competitor and the company. Second, it is very useful when you want to build Secure SDLC in the actual field because you can easily derive detailed activities and documents to build the desired level of Secure SDLC.

• The Journal of the Institute of Internet, Broadcasting and Communication
• /
• v.21 no.2
• /
• pp.15-26
• /
• 2021

Recently, as the introduction of cloud, mobile, and IoT has become active, there is a growing need for technology development that can supplement the limitations of traditional security solutions based on fixed perimeters such as firewalls and Network Access Control (NAC). In response to this, SDP (Software Defined Perimeter) has recently emerged as a new base technology. Unlike existing security technologies, SDP can sets security boundaries (install Gateway S/W) regardless of the location of the protected resources (servers, IoT gateways, etc.) and neutralize most of the network-based hacking attacks that are becoming increasingly sofiscated. In particular, SDP is regarded as a security technology suitable for the cloud and IoT fields. In this study, a new access control system was proposed by combining SDP and hash tree-based large-scale data high-speed signature technology. Through the process authentication function using large-scale data high-speed signature technology, it prevents the threat of unknown malware intruding into the endpoint in advance, and implements a kernel-level security technology that makes it impossible for user-level attacks during the backup and recovery of major data. As a result, endpoint security, which is a weak part of SDP, has been strengthened. The proposed system was developed as a prototype, and the performance test was completed through a test of an authorized testing agency (TTA V&V Test). The SDP-based access control solution is a technology with high potential that can be used in smart car security.

• Asia-pacific Journal of Multimedia Services Convergent with Art, Humanities, and Sociology
• /
• v.8 no.6
• /
• pp.835-844
• /
• 2018

Recently, as the number of smartphone users has been increasing worldwide, various services such as electronic payment, internet use, and financial settlement are being used as a smartphone. In addition, researches for home appliance control and automobile control using smartphone are conducted. As such, smartphone users can enjoy a more convenient life, but by hacking smartphones, tapping texts and conversations on smartphones, tracking location through spy apps, DDoS attacks using smartphones, and malicious apps When a message is received at a specific telephone number when using a micropayment, the corresponding text message is transmitted to a remote server, thereby increasing the risk of leakage of personal information and the like. Therefore, in this paper, we define the risk factors of the smartphone that are caused by the internal and external environmental, physical, contents (apps) of the smartphone through the smartphone that we use in real life, We propose a method to check vulnerability of smartphone security solution such as CC evaluation and the most effective response technique for each risk of smartphone by defining the technique.