• Annual Conference of KIPS
• /
• 2015.10a
• /
• pp.832-834
• /
• 2015

최근 CCRA(Common Criteria Recognition Arrangement) 협정서 개정에 따라 공통평가기준인 CC(Common Criteria) 평가제도에 변화가 생기고 있다. 현재의 CC 평가제도가 가지는 한계를 보완하고자 PP(protection profile)를 대신하는 cPP(collaborative protection profile)가 개발되었는데, 기존의 폐쇄적으로 운영되던 PP 개발 프로세스와 달리 cPP 개발에는 CCRA 회원국의 여러 기관 및 기업이 적극적으로 개발에 참여할 수 있다. 따라서 현재 세계 각국에서 cPP 개발에 관한 논의가 활발히 진행되고 있으며 세분화된 연구도 요구되고 있다. 본 논문에서는 기존의 CC 평가제도가 가지는 한계를 살펴보고 이러한 한계를 극복하기 위한 cPP의 등장 및 개정되는 새로운 CC 평가제도의 운영을 분석한다.

• Convergence Security Journal
• /
• v.3 no.2
• /
• pp.57-65
• /
• 2003

A protection profile is the required specification document by consumer groups to specify what security purpose they would like to have in their specialized products. A protection profile assumption is the document that specifies consumer environment in the physical, artificial, network perspective and the contents of intended usage which include usage limitation, the value of latent asset, and additional applications for a TOE (Target of Evaluation). In this paper, we compare the assumptions of the NSA IDS PP and the IDS PP for government.

• The Journal of Society for e-Business Studies
• /
• v.8 no.3
• /
• pp.69-86
• /
• 2003

A Protection Profile(PP) is a common security and assurance requirements for a specific class of Information Technology security products such as firewall and smart card. A PP should be included "TOE(Target of Evaluation) Security Environment", which is consisted of subsections: assumptions, treat, organizational security policies. This paper presents a new threats statement generation method for developing TOE security environment section of PP. Our survey guides the statement of threats in CC(Common Criteria) scheme through collected and analysed hundred of threat statements from certified and published real PPs and CC Tool Box/PKB that is included a class of pre-defined threat and attack statements. From the result of the survey, we present a new asset classification method and propose a threats statement generation model. The former is a new asset classification method, and the later is a production rule for a well formed statement of threats.

• Convergence Security Journal
• /
• v.3 no.2
• /
• pp.67-70
• /
• 2003

Since IT industries grew, The information security of both individual and company has come to the front. But, nowadays, It is very hard to satisfy the diversity of security Protection Profile with simple Intrusion Detection System, because of highly developed Intrusion Skills. The Intrusion Detection System is the system that detects, reports and copes with of every kind of Intrusion actions immediately. In this paper, we compare the concept of IDS PPs and analyze the threat of PP.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.13 no.4
• /
• pp.13-28
• /
• 2003

The Protection Profile(PP) is a common security function and detailed statement of assurance requirements in a specific class of Information Technology security products such as firewall and smart card. The parts of TOE security environment in the PP have to be described about assumption, treat and security policy through analyzing purpose of TOE. In this paper, we present a new security policy derivation among TOE security environment parts in the PP. Our survey guides the organizational security policy statements in CC scheme through collected and analyzed hundred of real policy statements from certified and published real PPs and CC Toolbox/PKB that is included security policy statements for DoD. From the result of the survey, we present a new generic organizational policy statements list and propose a organizational security policy derivation method by using the list.

• Proceedings of the KIEE Conference
• /
• 2003.07d
• /
• pp.2744-2746
• /
• 2003

ISO/IEC 15408 requires the TOE(Target of Evaluation) Security Environment section of a Protection Profile(PP) or Security Target(ST) to contain a list of assumptions about the TOE security environment or the intended usage of the TOE. This paper presents a specific conditions should be assumed to exist in the smart card environment and the analysis of those conditions developer of smart card PP must consider.

• Proceedings of the KIEE Conference
• /
• 2003.07d
• /
• pp.2747-2749
• /
• 2003

Security is concerned with the protection of assets from threats, where threats are categorised as the potential for abuse of protected assets. All categories of threats should be considered, but in the domain of security greater attention is given to those threats that are related to malicious or other human activities ISO/IEC 15408 requires the TOE(Target of Evaluation) Security Environment section of a Protection Profile(PP) or Security Target(ST) to contain a list of threats about the TOE security environment or the intended usage of the TOE. This paper presents a specific physical threats should be considered in the smart card PP which developers of smart card PP must consider.

• Journal of Internet Computing and Services
• /
• v.5 no.2
• /
• pp.17-31
• /
• 2004

This paper presents a new assumptions statement generation method for developing TOE security environment section of PP. We surveyed on guides on the assumption statement in CC scheme, and collected and analyzed hundred of assumption statements which are in 26 certified and published real PPs and CC Toolbox/PKB. The CC Toolbox/PKB is included a class of pre-defined assumption statements. From the result of the survey, we developed a new generic assumption statement list, and proposed a assumption derivation method by using the list.

• Convergence Security Journal
• /
• v.3 no.1
• /
• pp.1-6
• /
• 2003

Virtual Private Network (VPN) is the technology that can reduce the cost revolutionary and maintain the security like an private line, and the demand is increased more and more. Two kinds of current VPN Protection Profiles(PP) for the national organ are used on development, but it is considered by being several problems. In this paper we consider the VPN's PP problems that has been used currently, and describe to an improvement direction.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.17 no.1
• /
• pp.109-113
• /
• 2007

With increasing the mont of processed information over the network, the importance of database system increases rapidly. There are two types of security system for database, access control and data encryption. However, it is hard to evaluate security of database systems using the Common Criteria(CC) as there is no protection profile(PP) for these systems. In this paper, we propose a protection profile for secure database systems which can be used in formal evaluation using the Common Criteria. The proposed protection profile can be used by both developer and consumer to evaluate security of database systems.