• Proceedings of the Korea Information Processing Society Conference
• /
• 2013.11a
• /
• pp.684-687
• /
• 2013

빅데이터 환경은 수많은 데이터의 조합으로 가치를 발견하여 이를 활용하는 것이다. 이러한 환경의 전제조건은 데이터의 공개 및 공유 개방이 될 것이다. 하지만 데이터 공개 시 개인정보와 같은 정보가 포함되어 법적 도덕적인 문제나 공개된 정보의 범죄 활용 등 2차적인 피해가 발생할 수 있어 데이터 공개 시 개인정보에 대한 익명화가 반드시 필요하다. 하지만 익명화된 데이터는 다른 정보와 결합을 통하여 재식별되어 비익명화 될 가능성이 항상 존재한다. 따라서 본 논문에서는 데이터 공개 시 익명화된 데이터를 공개하기 전에 재식별성에 대한 위험을 평가하는 테스트 방법론을 제안한다. 제안하는 방법론은 실제 테스트를 수행하는 3가지 과정 및 테스트 레벨 설정과 익명화 시 고려해야 할 부분으로 이루어져 있다. 제안하는 방법론을 통하여 안전한 데이터 공개 환경이 조성되어 빅데이터 시대에 개인정보에 안전한 데이터 공유와 개방이 이루어질 것으로 기대한다.

• Convergence Security Journal
• /
• v.18 no.2
• /
• pp.3-10
• /
• 2018

The existing smart grid, which is centered on the power grid, is rapidly spreading to new energy and renewable energy such as heat and gas, which are expressed as smart energy. Smart Energy interacts with electric energy and is connected to wired / wireless network based on IoT sensor based on energy analysis using AI to rapidly expand ecosystem with various energy carriers and customers. However, smart energy based on IoT is lacking in technological and institutional preparation for security compared to efforts to activate the market according to the interests of government and business operators. In this study, we will present Smart Energy 's privacy policy in terms of value system(CPND) of convergence ICT.

• The Korean Society of Law and Medicine
• /
• v.22 no.4
• /
• pp.117-157
• /
• 2021

This research reviewed the HIPAA/HITECH, 21st Century Cures Act, Common Law, and private Guidances from the perspectives in protecting and utilitizing the medical data, while implications were followed. First, the standards for protection and utilization are relatively clearly regulated through single law on personal medical information in the United States. The HIPAA has been introduced in 1996 as fundamental act on protection of medical data. Medical data was divided into personally identifiable information, non-identifying information, and limited dataset under HIPAA. Regulations on de-identification measures for medical information, objects for deletion of limited data sets, and agreement on prohibition of data re-identification were stipulated. Moreover, in the 21st Century Cures Act regulated mutual compatibility for data sharing, prohibition of data blocking, and strengthening of accessibility of data subjects. Common Law introduced comprehensive consent system and clearly stipulates procedures. Second, the regulatory system is relatively simplified and clearly stipulated in the United States. To be specific, the expert consensus and the safe harbor system were introduced as an anonymity measure for identifiable medical information, which clearly defines the process while increasing trust. Third, the protection of the rights of the data subject is specified, the duty of explanation is specified in detail, while the information right of the consumer (opt-out procedure) for identification information is specified. For instance, the HHS rule and FDA regulations recognize the comprehensive consent system for human research, but the consent procedure, method, and requirements are stipulated through the common rule. Fourth, in the case of the United States, a trust-based system is being used throughout the health and medical data legislation. To be specific, Limited Data Sets are allowed to use in condition to the researcher's agreement to prohibit re-identification, and de-identification or consent process is simplified under the system.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.25 no.2
• /
• pp.395-410
• /
• 2015

This research defines the degree of the threat caused by the leakage of personal information in a quantitative way. The proposed definition classifies the individual items in a personal data, then assigns a risk value to each item. The proposed method considers the increase of the risk by the composition of the multiple items. We also deals with various attack scenarios, where the attackers seek different types of personal information. The concept of entropy applies to associate the degree of the personal information exposed with the total risk value. In our experiment, we measured the risk value of the Facebook users with their public profiles. The result of the experiment demonstrates that they are most vulnerable against stalker attacks among four possible attacks with the personal information.

• The Korean Society of Law and Medicine
• /
• v.17 no.2
• /
• pp.315-346
• /
• 2016

With the development of big data processing technology, the potential value of healthcare big data has attracted much attention. In order to realize these potential values, various research using the healthcare big data are essential. However, the big data regulatory system centered on the Personal Information Protection Act does not take into account the aspect of big data as an economic material and causes many obstacles to utilize it as a research purpose. The regulatory system of healthcare information, centered on the primary purpose of patient treatment, should be improved in a way that is compatible with the development of technology and easy to use for public interest. To this end, it is necessary to examine the trends of overseas legal system reflecting the concerns about the balance of protection and utilization of personal information. Based on the implications of the overseas legal system, we can derive improvement points in the following directions from our legal system. First, a legal system that specializes in healthcare information and encompasses protection and utilization is needed. De-identification, which is an exception to the Privacy Act, should also clearly define its level. It is necessary to establish a legal basis for linking healthcare big data to create synergy effects in research. It is also necessary to examine the introduction of the opt-out system on the basis of the discussion on the foreign debate and social consensus. But most importantly, it is the people's trust in these systems.

• Information Systems Review
• /
• v.17 no.2
• /
• pp.77-100
• /
• 2015

This study examined the factors that influence the smartphone user's decision to accept the personalized mobile advertisement. As a theoretical basis, we applied the privacy calculus model (PCM) that illustrates how consumers are engaged in a dynamic adjustment process in which privacy risks are weighted against benefits of information disclosure. In particular, we investigated how smartphone users make a risk-benefit assessment under which personalized service as benefit-side factor and information privacy risks as a risk-side factor accompanying their acceptance of advertisements. Further, we extend the current PCM by considering advertisement fatigue as a new factor that may influence the user's acceptance. The research model with five (5) hypotheses was tested using data gathered from 215 respondents through a quasi-experimental survey method. During the survey, each participant was asked to navigate the website where the experimental simulation of a mobile advertisement service was provided. The results showed that three (3) out of five (5) hypotheses were supported. First, we found that the intention to accept advertisements is positively and significantly influenced by the perceived value of personalization. Second, perceived advertisement fatigue was also found to be a strong predictor of the intention to accept advertisements. However, we did not find any evidence of direct influence of privacy risks. Finally, we found that the significant moderating effect between the perceived value of personalization and advertisement fatigue. This suggests that the firms should provide effective tailored advertisement that can increase the perceived value of personalization to mitigate the negative impacts of advertisement fatigue.

• The Korean Society of Law and Medicine
• /
• v.22 no.4
• /
• pp.3-35
• /
• 2021

Inmitten der Flut der privaten und öffentlichen Information gilt die riesige Informationsmenge als Schlüsselressource im Zeitalter der 4. industriellen Revolution, repräsentiert durch Big-Data. Das Interesse an diesen wächst weltweit. Es gibt eine aktive Diskussion darüber, wie man Daten sichert und akkumuliert und wie man die gesammelten Daten sicher und effektiv nutzt. Gesundheitsdaten werden vor allem als die wertvollste Ressource bewertet, für die Big-DataTechnologie eingesetzt wird. Um Gesundheitsdaten sinnvoll zu nutzen, müssen verteilte Gesundheitsdaten integriert und den Benutzern in einer Form zur Verfügung gestellt werden, die für Forschung oder Inspektion verwendet werden kann. In einer Situation, in der große Länder um den Aufbau bzw. die Führung der Datenwirtschaft konkurrieren, wurden im August 2020 auch in Südkorea die sog. „3-Daten-Gesetze" geändert, die das Datenschutzgesetz(DSG) enthälten. Das DSG führte das Konzept der pseudonymen Informationen ein und baute eine Rechtsgrundlage für deren Verwendung auf. Als Folgemaßnahme kündigte die, Kommission für den Schutz personenbezogener Daten(Personal Information Protection Commission: PIPC)' die „Richtlinien für die Bahandlung mit pseudonymen Informationen" und, Ministerium für Gesundheit und Wohlfahrt' die „Richtlinien für die Verwendung von Gesundheitsdaten" an. Gesundheitsdaten stehen direkt in Zusammenhang mit Leben und Körper des Menschen und damit enthalten viele sensible Daten. Es handelt sich also um ein System, das aus einer vorsichtigeren und konservativeren Sicht unter der Voraussetzung verwendet werden kann, personenbezogene Daten sicherer zu schützen. Um die Hauptinhalte der „Richtlinien für Verwendung von Gesundheitsdaten" zu analysieren, überprüften wir zunächst die Hauptinhalte des überarbeiteten DSG. Danach durch die Analyse der wesentlichen Inhalte der „Richtlinien für Verwendung von Gesundheitsdaten" wurden Probleme wie Konflikte mit anderen Gesetzen und Verbesserungsmaßnahmen überprüft.

• Information and Communications Magazine
• /
• v.34 no.3
• /
• pp.15-22
• /
• 2017

핀테크 시대가 본격화 되면서 결제/송금, 인터넷전문은행, 클라우드 펀딩 등 모든 분야의 핀테크 서비스는 금융 소비자의 개인 정보를 활용해야 하는 비대면 거래로 이뤄지는 만큼 보안 대책은 필수적이다. 핀테크에서 보안의 중요성은 아무리 강조해 다 지나치지 않는다. 금융사고 발생시 기업의 브랜드 가치는 물론 기업의 존폐 위기 까지 발생한다. 하루에도 악성코드가 수백만개씩 발생하고 있는 상황에서 금전적 이득을 노리는 피싱/파밍/스미싱/랜섬웨어 등 보안 위협은 날로 조직화되고 지능화되고 있다. 이렇게 지능화되고 조직화되고 있는 보안 위협으로 부터 소비자를 보호하고 안정적인 서비스를 제공하기 위해서는 보안 활동에 대해 알아본다.

• Review of KIISC
• /
• v.31 no.4
• /
• pp.29-33
• /
• 2021

암호학을 세대로 구분하면 단순 패스워드 인증을 1 세대, 송수신 및 데이터 저장 암호를 2 세대, 서명 및 키 공유에 활용하는 암호를 3세대, 키를 사용하지 않는 암호를 4 세대라고 분류 할 수 있다. 현재 암호는 3 세대에 있으며, 암호키를 많이 사용함으로 인하여, 키의 노출로 인한 안전성의 문제를 해결하고자 연구가 있었으며, 4세대 암호로 동형암호가 제시되고 있다. 동형암호는 종대종(End-to-End) 암호의 신뢰성을 보장하며, 중간 과정에서 데이터 처리를 위하여 복호하지 않고서도 가공이 가능하도록 가단성(Malleability)을 제공한다. 이러한 속성을 기반으로 비식별화 처리하지 않고서 원데이터를 처리할 수 있어서, 데이터의 가치가 보존되고, 신뢰성 있는 데이터를 체득할 수 있다. 더욱이 중간단계에서 복호하지 않고서 데이터를 처리는 개인정보보호를 원천적으로 제공할 수 있는 메커니즘으로 파악된다. 본 고에서 동형암호 관련 산업동향 및 국제표준화 동향을 살펴본다.

• Journal of the Korean Society for information Management
• /
• v.36 no.4
• /
• pp.253-277
• /
• 2019

In the era of the 4th Industrial Revolution, the importance of data is intensifying, but there are many cases where it is not easy to use data due to personal information protection. Although criminal justice information is expected to have various useful values such as crime prediction and prevention, scientific investigation of criminal investigations, and rationalization of sentencing, the use of criminal justice information is currently limited as a matter of legal interpretation related to privacy protection and criminal justice information. This study proposed to convert criminal justice information into 'crime data' and use it as big data through the structuralization and categorization of criminal justice information. And when using "crime data," legal issues, value in use, considerations for data generation and use were verified by experts, and future strategic development plans were identified. Finally we found that 'crime data' seems to have solved the privacy problem, but it is necessary to specify in the criminal justice information related law and it is urgent to be organized in a standardized form for analysis to use big data. Future directions are to derive data elements, construct a dictionary thesaurus, define and classify personal sensitive information for data grading, and develop algorithms for shaping unstructured data.