20 여상수(763~772).hwp

Size: px

Start display at page:

Download "20 여상수(763~772).hwp"

진수 제갈
7 years ago
Views:

1 사전검증을통한행정정보보호시스템도입방안 여상수 *, 이동범 **, 곽진 ** Sang-Soo Yeo *, Dong-Bum Lee ** and Jin Kwak ** 요약,...,. Abstract According as information-oriented society is propelled, development of various information security systems is achieved, and introduction of information security system is increasing for service offer securing from nation and public institution. In particular, government information system is increasing interest about security assessment service of government information system because verification about security is weighed first of all. Accordingly, study about various security assessment services is preceded in domestic and overseas. In this paper, analyze security assessment service of Britain and Canada, and we proposed about pre-qualification introduction plan of government information system that can offer user of nation and public institution reliability. Key words : Government Information Security System, Pre-qualification I. 서론,.. (CMVP : Cryptographic Module Validation Program), (CC : Common Criteria), * (Division of Computer Engineering, Mokwon University) ** (Department of Information Security Engineering, Soonchunhyang University) (Corresponding Auther) : : () : ( : ) :

2 (ISMS : Information Security Management System) IT., [1-3].,. [4-5].,.,.. 2, 3. 4, 5. Ⅱ. 관련연구 2-1 국내평가서비스 ,., [6]. 1. 표 1. 정보보호제품평가 인증관련기관의역할 Table 1. Role of information security product assessment and certification relevant organization ㆍ,, 27( )., IT.,,, /, / /.

,, ; 765..,, [7]. 1. 2-2-2 FTA FTA CESG fast track.,.. FTA 2001 CESG IA. 그림 1. 암호검증체계 Fig. 1. Korea Cryptographic Module Validation Program (KCMVP) 2-2-3 CHECK.,,,. CHECK. FTA CC.

3 ,, ; 765..,, [7] FTA FTA CESG fast track.,.. FTA 2001 CESG IA. 그림 1. 암호검증체계 Fig. 1. Korea Cryptographic Module Validation Program (KCMVP) CHECK.,,,. CHECK. FTA CC. 2-2 영국평가서비스 SYS SYS IT (MOD) (CESG : Communications Electronics Security Group),. IT,. SYS 2002 IT (UK IT Security Evaluation Criteria (ITSEC) method) [8] CAPS CAPS CESG. CAPS, CAPS. CAPS. CAPS "Baseline", "Enhanced", "High Grade" 3. Baseline Restricted Private" FIPS FIPS

4 CAPS CC [9] CCTM (CSIA : Central Sponsor for Information Assurance) / (CCTM : CSIA Claims Tested Mark) (CESG : Communication Electronics Security Group) (CCTM : CESG Claims Tested Mark). 표 2. 정보보증방식의요구사항 Table 2. Information Assurance Method Requirements CC SYS FTA CHECK CAPS CCTM / -- / / /. ISO/IEC (UKAS : United Kingdom Accreditation Service)., / - (claims testing)., / [10] 캐나다평가서비스 IPPP (IPPP : ITS Product Pre-qualification Program).. (IPPL : ITS Pre-qualification Product List). [11-12]. FIPS FIPS 140-2

5 ,, ; 767 IT.. FIPS FIPS CMVP,,,.,.,. 3. 표 3. 정보기술보안사전자격제품목록분류표 Table 3. ITS Pre-qualified Product List Categories Ⅲ. 사전검증을통한행정정보보호시스템 표 4. 공통평가기준의보안기능클래스 Table 4. Security function class of Common Criteria FAU 도입방안. 3-1 공통평가기준의보안기능클래스, 2. ISO/IEC TOE(Target of Evaluation), PP(Protection Profile) ST(Security Target)., TOE TOE. TOE,. 4,, [13-15].,,, FCO () FCS FDP FIA

6 FMT FPR TSF(TOE),, FPT TSF TSF FRU TOE FTA TOE TOE FTP -TSF/TSF-TSF 3-2 행정정보보호시스템의제품목록표,,.,,,,,,. 5, 6 [16]. 표 5. 제품분류기준 Table 5. Standard of classification for product // VOIP SSO, EAM, IM/IAM DRM // /COS PKI DB SMIME/PGP PC PC USB 표 6. 제안하는제품목록표 Table 6. Proposing checklist o o, o (, ) o (, ), o : Triple DES, AES, ARIA, RSA o : RSA, DSA o : Diffie-Hellman, RSA o : SHA-1, SHA-256, SHA-384, SHA-512, o : o : o Windows XP Professional / 9X / ME / NT/ Server 2003 o HP-UX 11i v3, AIX v6.1, Solaris 9 / 10 o Fedora 9 / 10, Red Hat Enterprise Linux 4 / 5 o,

7 ,, ; 769 그림 2. 행정정보보호시스템도입절차 Fig. 2. Introduction procedure of government information system 3-3 행정정보보호시스템도입절차.,,, [17]. 표 7. 검증시험평가항목 Table 7. Evaluation items of verification test,,,,,, IT,

8 ,,,., [18] , /.,., ,,.,, ,.,.,, ,,,. [19].,.,,

9 ,, ; 771.,.,.,, ,. Ⅳ. 분석 4-1 인증기관 평가기관. 4-3 개발업체 국가및공공기관,.. Ⅴ. 결론.,.,. 참고문헌 [1] [2] [3]

772 13 5 2009 10 [4] http://www.cse-cst.gc.ca/ [5] http://www.cesg.gov.uk/ [6] IT, " ", 2008. [7] http://www.kecs.go.kr [8] http://www.stsc.hill.af.mil [9] http://www.cesg.gov.uk [10] CESG, "Government Quality Mark-Directory of CESG Claims Tested Mark(CCTM) Awards for Products and Services", March 2009.

[12] CSEC, Canadian Common Criteria Evaluation and Certification Scheme(CCS) Scheme Description, May 2000.

[14] ISO/IEC 15408, "Common Criteria for Information Technology Security Evaluation", version 3.1, Parts 2, 2007.

10 [4] [5] [6] IT, " ", [7] [8] [9] [10] CESG, "Government Quality Mark-Directory of CESG Claims Tested Mark(CCTM) Awards for Products and Services", March [11] NIST, "FIPS Publication 140-3(Draft) : Security Requirements for Cryptographic Modules", July [12] CSEC, Canadian Common Criteria Evaluation and Certification Scheme(CCS) Scheme Description, May [13] ISO/IEC 15408, "Common Criteria for Information Technology Security Evaluation", version 3.1, Parts 1, [14] ISO/IEC 15408, "Common Criteria for Information Technology Security Evaluation", version 3.1, Parts 2, [15] ISO/IEC 15408, "Common Criteria for Information Technology Security Evaluation", version 3.1, Parts 3, [16] NIST, "Special Publication : Security Configuration Checklists Program for IT products - Guidance for Checklists Users and Developers", May [17] CESG, "CESG CLAIMS TESTED MARK SCHEME : VENDOR GUIDE", March [18] CESG, "CESG CLAIMS TESTED MARK SCHEME : TEST LABORATORY GUIDE", March [19] CESG, "CESG CLAIMS TESTED MARK SCHEME : DECISION AUTHORITY GUIDE", February 여상수 ( 呂相壽 ) : ~ : ~ : ~ : () ~ : 관심분야 :,, 이동범 ( 李東範 ) 곽진 ( 郭鎭 ) : () ~ : 관심분야 :,, 1994~2006 : (,, ) : : : ~ : 관심분야 :, RFID,,, u-city

목 차 1. 정보보호시스템평가 인증제도 2. 국내외평가 인증제도비교 3. 국제공통평가기준 (CC: Common Criteria) 4. 국외 CC 활용동향 5. CC 수용효과 2

CC(Common Criteria) 와정보보호시스템 평가 2001. 6.. 이경구 kglee@kisa.or.kr 한국정보보호센터 1 목 차 1. 정보보호시스템평가 인증제도 2. 국내외평가 인증제도비교 3. 국제공통평가기준 (CC: Common Criteria) 4. 국외 CC 활용동향 5. CC 수용효과 2 1. 정보보호시스템평가 인증제도 평가 인증제도란?