• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.31 no.1
• /
• pp.31-49
• /
• 2021

IoT devices refer to embedded devices that can communicate with networks. Since there are various types of IoT devices and they are widely used around us, in the event of an attack, damages such as personal information leakage can occur depending on the type of device. While the security team analyzes IoT devices, they should target firmware as well as software interfaces since IoT devices are operated by both of them. However, the problem is that it is not easy to extract and analyze firmware and that it is not easy to manage product quality at a certain level even if the same target is analyzed according to the analyst's expertise within the security team. Therefore, in this paper, we intend to establish a vulnerability analysis process for the firmware of IoT devices and present available tools for each step. Besides, we organized the process from firmware acquisition to analysis of IoT devices produced by various commercial manufacturers, and we wanted to prove their validity by applying it directly to drone analysis by various manufacturers.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.20 no.12
• /
• pp.76-82
• /
• 2019

The development of Internet technology and the deployment of smart devices provide a convenient environment for people, and this is becoming common with the technology called the Internet of Things (IoT). But the development of, and demand for, IoT technology is causing various problems, such as personal information leaks due to the attacks of hackers who exploit it. A number of devices are connected to a network, and network attacks that have been exploited in the existing PC environment are occurring in the IoT environment. When it comes to IP cameras, security incidents (such as distributed denial of service [DDoS] attacks, hacking someone's personal information, and monitoring without consent) are occurring. However, it is difficult to install and implement existing security solutions because memory space and power are limited owing to the characteristics of small devices in the IoT environment. Therefore, this paper proposes a security protocol that can look at and prevent IoT security threats. A security assessment verified that the proposed protocol is able to respond to various security threats that could arise in a network. Therefore, it is expected that efficient operation of this protocol will be possible if it is applied to the IoT environment.

• Journal of Internet of Things and Convergence
• /
• v.9 no.3
• /
• pp.55-60
• /
• 2023

The IoT environment is very vulnerable to security threats, and if an intrusion occurs, it can cause great damage. In order to strengthen the security of the IoT environment, a curriculum that considers the characteristics of the IoT environment is needed. In this paper, we propose a curriculum model for cyber incident response in the Internet of Things environment. The proposed curriculum model was designed as a model for security threats in the IoT environment, types of intrusion incidents, and incident response procedures. The proposed curriculum model is expected to contribute to improving security awareness in the IoT environment and fostering cyber incident response experts in the IoT field. The proposed curriculum model strengthens the security of the IoT environment and is expected to be safe through security incident response in the IoT.

• The Journal of the Korea institute of electronic communication sciences
• /
• v.12 no.4
• /
• pp.671-678
• /
• 2017

Recent advances in Internet of Things (IoT) encourage us to use IoT devices in daily living areas. However, as IoT devices are being ubiquitously used, concerns onsecurity and privacy of IoT devices are getting grown. Key management is an important and fundamental task to provide security services. For better security, we should restrict reusing a same key in sequential authentication sessions, but it is difficult to manually update and memorize keys. In this paper, we propose a hardware security module(HSM) for automated key management in IoT devices. Our HSM is attached to an IoT device and communicates with the device. It provides an automated, secure key update process without any user intervention. The secure keys provided by our HSM can be used in the user and device authentications for any internet services.

• Convergence Security Journal
• /
• v.21 no.1
• /
• pp.79-92
• /
• 2021

In a society where ICT technology is converged, the use of various network-connected devices such as IoT is spreading. Network-connected devices are inevitably exposed to the threat of hacking such as information leakage, and countermeasures need to be prepared to respond. Security certification system for IoT devices has been introduced to promote security of IoT products, and for this purpose, legalization and standardization of certification standards and methods are in progress. In line with this, in Korea, as the Information and Communication Network Act was revised in 2020, ICT convergence devices connected to the network were newly defined as "information and communication network connected devices," and the basis for the security certification system is being established. We summarized related domestic and foreign trends and suggest specific considerations for implementing the security certification system for IoT devices in South Korea.

• International Journal of Computer Science & Network Security
• /
• v.22 no.2
• /
• pp.153-158
• /
• 2022

The Internet of Things (IoT) has gotten a lot of research attention in recent years. IoT is seen as the internet's future. IoT will play a critical role in the future, transforming our lifestyles, standards, and business methods. In the following years, the use of IoT in various applications is likely to rise. In the world of information technology, cyber security is critical. In today's world, protecting data has become one of the most difficult tasks. Different type of emerging cyber threats such as malicious, network based and abuse of network have been identified in the IoT. These can be done by virus, Phishing, Spam and insider abuse. This paper focuses on emerging threats, various challenges and vulnerabilities which are faced by the cyber security in the field of IoT and its applications. It focuses on the methods, ethics, and trends that are reshaping the cyber security landscape. This paper also focuses on an attempt to classify various types of threats, by analyzing and characterizing the intruders and attacks facing towards the IoT devices and its services.

• The Journal of the Convergence on Culture Technology
• /
• v.3 no.4
• /
• pp.185-189
• /
• 2017

According to the rapid growth of Internet of Things (IoT) technology, we are able to connect between human and objects and between objects through network, allowing transmission and reception of information beyond the limits of space. These days, Low Power Wide Area (LPWA) technologies becomes popular more and more, to implement IoT infrastructure effectively. In this paper, this study aims to analyze LoRa, one of LPWA technologies, and suggest IoT security technology using LoRa to minimize threats to security.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.27 no.1
• /
• pp.97-102
• /
• 2023

IoT is being used in a lot of industry domain such as smart home, smart ocean, smart energy, and smart farm, as well as legacy information services. For a server, an IoT device using the same protocol is a trusted object. Therefore, a malicious attacker can use an unauthorized IoT device to access IoT-based information services and access unauthorized important information, and then modify or extract it to the outside. In this study, to improve these problems, we propose an IoT device authentication system used in IoT-based information service. The IoT device authentication system proposed in this study applies identifier-based authentication such as MAC address. If the IoT device authentication function proposed in this study is used, only the authenticated IoT device can access the server. Since this study applies a method of terminating the session of an unauthorized IoT device, additional research on the access deny method, which is a more secure authentication method, is needed.

• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2015.10a
• /
• pp.973-976
• /
• 2015

Inernet of Things(IoT) is interaction with each other, collecting, sharing, and analysing the data. IoT has been noted in combining the fields of medical service in particular. However, the security issue is caused, while IoT is receiving attention. U-Health and medical devices, which deal mainly the personal health information, is required to a high level of privacy and security of health information. This study analyzes cases of leakage of personal medical information, security of IoT, privacy flow, and the response strategies.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2015.10a
• /
• pp.587-590
• /
• 2015

IoT 환경에서 서로 다른 사양을 갖는 기기 간 통신에서의 보안 취약성, 사용자의 프라이버시 데이터 유출, 인가 받지 않은 기기나 사용자로 인한 기기 위 변조, 기기 오작동 등의 보안 위협 발생 가능성이 증가할 것이라는 예측과 더불어 다양한 보안 위협에 대응할 수 있는 보안 기술에 대한 관심이 높아지고 있다. 본 논문에서는 신뢰 보안 모듈과 클라우드 서버를 이용한 기기 간 원격 인증 및 기기 관리 방법에 대해 기술한다. 수 많은 기기가 인터넷으로 연결되어 운용되는 IoT 환경에서 신뢰 보안 모듈을 활용한 IoT 기기 간 원격 인증, 기기 보안 업데이트 및 안전한 기기 관리 기능 등을 통해 보다 안전하고 신뢰할 수 있는 IoT 서비스 제공이 가능해짙 수 있을 것이다.