臺灣博碩士論文加值系統

應智慧城市的發展需要，路燈型態除了一般照明功用之外，出現各種不同應用領域的功能，包括交通、環境及公共安全等功能；換句話說，路燈基於其分布範圍與密度的特性，儼然成為智慧城市物聯網應用的重要基礎設施，然而也隨之衍生許多可能遭遇、但影響後果甚鉅的資安風險。擬定一個智慧路燈網路安全項目，供作相關業者據以依循、防患於未然已是刻不容緩之事。
揆諸國際上已出現多起智慧城市物聯網應用發生的駭客攻擊事件，為了預防我國智慧路燈受到網路攻擊造成癱瘓城市運作的情況發生，本研究透過智慧路燈系統的架構定義，以智慧路燈閘道器、附掛設備及後臺伺服器作為探討網路安全的核心標的，以物聯網設備安全的角度，擬訂智慧路燈系統之網路安全要求，協助智慧路燈業者提升智慧路燈系統之網路安全能力。本研究以弱點評估方法建構智慧路燈系統的威脅模型(Threat Model)，利用國際標準組織針對漏洞、網路攻擊等安全事件公布的防範方法，歸納整理出智慧路燈系統之網路安全威脅緩解對策(Threat Mitigation)，提出本研究之智慧路燈系統網路安全要求項目。以焦點團體訪談法，針對本研究提出之智慧路燈系統網路安全要求項目是否足以提升智慧路燈系統之網路安全能力進行訪問，歸納專家的見解與看法，透過本研究智慧路燈系統網路安全要求，可以幫助業者在開發設計智慧路燈設備時，達到安全風險控制進而提升設備網路安全能力。

In response to the need to develop smart cities, besides general lighting, types of streetlights have other different functions in various application fields, including transportation, environment, and public safety. In other words, based on its distribution and density, streetlights have become important infrastructure of the IoT applications for the smart city. However, along come many potential security risks that might have huge impacts. Thus, it is imperative to formulate Smart Lighting network security requirements for the related industries to follow and prevent forthcoming problems.
Recently, there have been quite a few hacker attacks in the smart city of the IoT application in the world. In order to prevent our country's Smart Lighting from cyber-attacks, causing the city to stop operating or become paralyzed, under the definition of the Smart Lighting System, utilizing Smart Lighting gateway, attached equipment and back-end server as the core of network security, this study is aimed to formulate network security requirements for Smart Lighting System from the perspective of IoT device security and to assist related businesses to enhance the network security capabilities of Smart Lighting system.
This study adopts the Vulnerability Assessment Method to establish the Threat Model of the Smart Lighting System. By using precautionary measures issued by the International Standards Organization that target security incidents, such as vulnerabilities and cyber-attacks for security incidents, the Threat Mitigation of the Smart Lighting System is summarized and the Smart Lighting System network security requirements are proposed. Using focus group method, experts are interviewed to address the issue whether the Smart Lighting System network security requirements proposed in this study are sufficient enough to enhance the network security capability of the Smart Lighting System. Afterwards, the opinions and insights of the experts are organized and concluded. Through the network security requirements of the Smart Lighting System recommended in the study, businesses are expected to gain security risk control and improve the network security capability of the equipment when developing and deigning Smart Lighting equipment.

中文摘要 III
英文摘要 IV
誌　　謝 V
目錄 VI
表目錄 VIII
圖目錄 IX
第壹章 緒論 1
第一節 研究背景 1
第二節 研究目的 5
第貳章 文獻探討 6
第一節 國際標準現況 6
第二節 智慧路燈系統 9
第三節 物聯網安全 13
第參章 研究方法 18
第一節 研究方法與設計 18
第二節 資料收集 19
第三節 焦點團體 23
第肆章 研究結果 25
第一節 網路安全威脅分析與緩解對策 25
第二節 網路安全要求項目 34
第三節 焦點團體 40
第伍章 結論與建議 45
第一節 討論與發現 45
第二節 研究貢獻與政策建議 46
第三節 研究限制與後續研究建議 47
參考文獻 49
附錄一：安全通道版本使用要求 55

WEF members (2015), The Future of Financial Services How disruptive innovations are reshaping the way financial services are structured, provisioned and consumed. Retrieved from https://ppt.cc/fbiddx

Northeast Group. (2017, November). Global LED and Smart Street Lighting: Market Forecast (2017 - 2027). Retrieved from https://www.researchandmarkets.com/reports/4456402/global-led-and-smart-street-lighting-market

WEF members (2016, April). Inspiring Future Cities & Urban Services: Shaping the Future of Urban Development & Services Initiative. Retrieved from http://www3.weforum.org/docs/WEF_Urban-Services.pdf

Tham, I. (2017, August 20). National Day Rally 2017: 'Smart' lamp posts to become key nodes for surveillance and data collection. Retrieved from https://tinyurl.com/y5haqtke

'Smart lamp posts' in Singapore won't shine light into people's lives. (2018, May 13). Retrieved from https://tinyurl.com/y8p7hwes

Ronen, E., O’flynn, C., Shamir, A., Weingarten, A. (2017). IoT Goes Nuclear: Creating a ZigBee Chain Reaction. 2017 IEEE Symposium on Security and Privacy (SP). doi:10.1109/sp.2017.14

Said, S. (2017, April 09). Hacker sets off emergency alarms, frightening Dallas residents. Retrieved from https://www.cnn.com/2017/04/08/us/dallas-alarm-hack/index.html

Jin, D., Hannon, C., Li, Z., Cortes, P., Ramaraju, S., Burgess, P., Shahidehpour, M. (2016). Smart street lighting system: A platform for innovative smart city applications and a new frontier for cyber-security The Electricity Journal, 29(10), 28-35. doi:10.1016/j.tej.2016.11.011

Kuzin, M., Shmelev, Y., & Kuskov, V. (2018, September 18). New trends in the world of IoT threats. Retrieved from https://securelist.com/new-trends-in-the-world-of-iot-threats/87991/

U.S. DHS.(2016, November 15). STRATEGIC PRINCIPLES FOR SECURING THE INTERNET OF THINGS (IoT). Retrieved from https://www.dhs.gov/sites/default/files/publications/Strategic_Principles_for_Securing_the_Internet_of_Things-2016-1115-FINAL_v2-dg11.pdf

5 Possible Attacks on the IoE and How to Prevent Them. (2015, March 04). Retrieved from https://blog.trendmicro.com/5-possible-attacks-on-the-ioe-and-how-to-prevent-them/

S. Bromander, A. Josang, M. Eian(2016). Semantic Cyberthreat Modelling. STIDS,74-78

3 Approaches to Threat Modeling. (2013, July 26). Retrieved from https://tinyurl.com/yxmrekbr

FIPS(2019). Approved Security Functions for FIPS PUB 140-2, Security Requirements for Cryptographic Modules. Retrieved 2019, June 5, from https://csrc.nist.gov/CSRC/media/Publications/fips/140/2/final/documents/fips1402annexa.pdf

Top 10-2017 Top 10. (2017). Retrieved 2019, May 1, from https://www.owasp.org/index.php/Top_10-2017_Top_10

OECD Privacy Guidelines. Retrieved 2019, May 1, from https://www.oecd.org/internet/ieconomy/privacy-guidelines.htm

IEC TC34 STRATEGIC BUSINESS PLAN. (2011, November). Retrieved from https://www.iec.ch/public/miscfiles/sbp/34.pdf

Harpreet Passi(2018, August 29). What is a Sniffing attack and How can you defend it?. Retrieved from https://www.greycampus.com/blog/information-security/what-is-a-sniffing-attack-and-how-can-you-defend-it

OWASP(2014). Internet of Things Project 2014. Retrieved 2019, May 2, from https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project#tab=IoT_Top_10

OWASP. IoT Vulnerabilities Project. Retrieved 2019, May 2, from https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project#tab=IoT_Vulnerabilities

OWASP Top 10 2013. Retrieved 2019, May 2, from https://www.owasp.org/index.php/Top_10_2013-A9-Using_Components_with_Known_Vulnerabilities

IEC (2019). 62443-4-2 Ed.1: Security for industrial automation and control systems - Part 4-2: Technical security requirements for IACS components. International Electrotechnical Commission(IEC)

Megas, K.(2019). Considerations for a Core IoT Cybersecurity Capabilities Baseline. Retrieved from https://www.nist.gov/sites/default/files/documents/2019/02/01/final_core_iot_cybersecurity_capabilities_baseline_considerations.pdf

Mohamed, S. A. (2013). Smart Street Lighting Control and Monitoring System for Electrical Power Saving by Using VANET. International Journal of Communications, Network and System Sciences, 06(08), 351-360. doi:10.4236/ijcns.2013.68038

Castro, M., Jara, A. J., & Skarmeta, A. F. (2013). Smart Lighting Solutions for Smart Cities. 2013 27th International Conference on Advanced Information Networking and Applications Workshops. doi:10.1109/waina.2013.254

Mary, M. C. V. S., Devaraj, G. P., Theepak, T. A., Pushparaj, D. J., & Esther, J. M. (2018). Intelligent Energy Efficient Street Light Controlling System based on IoT for Smart City. 2018 International Conference on Smart Systems and Inventive Technology (ICSSIT). doi: 10.1109/icssit.2018.8748324

黃孟嬌（2016年9月14日)。 全球智慧路燈發展趨勢. 檢索自https://tinyurl.com/yxz33ee5

台北市智慧城市辦公室。智慧城市專案。檢索日期2019年5月6日。檢索自https://smartcity.taipei/project/120

陳佳滎 (2017年9月2日)。智慧節能發展 路燈扮演要角。檢索自https://www.chinatimes.com/newspapers/20170903000087-260204

祝碧衡(2018年5月21日)。全球各地智慧路燈桿建設現狀。檢索自http://www.istis.sh.cn/list/list.aspx?id=11387

應曉波、李文鵬、楊樾（2016)。智慧路燈標準體系框架研究。照明工程學報，第27卷第4期，頁12-20。

廖家陞(2017年9月14日)。關注物聯網技術發展。 檢索自https://smartauto.ctimes.com.tw/DispArt-cn.asp?O=170914132754

車都（2014)。城市路燈智慧照明系統的設計與實現。軟體工程系，哈爾濱，哈爾濱工業大學。
劉永（2018)。基于智慧路燈建設的思考。建築工程技術與設計，第16期，頁2993。

五種物聯網上可能的攻擊及防範的方法(2015年 3月26日)。Trend Labs趨勢科技資安趨勢部落格。 檢索自https://blog.trendmicro.com.tw/?p=11690

Mirai 變種 Miori 再進化：IoT殭屍網路透過ThinkPHP遠端程式碼執行漏洞散播(2019年1月1日)。Trend Labs趨勢科技資安趨勢部落格。 檢索自 https://blog.trendmicro.com.tw/?p=58459

《IOT》Mirai 變種利用13種漏洞攻擊路由器等裝置(2019年 5月29日)。Trend Labs趨勢科技資安趨勢部落格。 檢索自https://blog.trendmicro.com.tw/?p=60735#more-60735

林妍溱(2019年5月15日)。華碩網路硬碟服務遭中間人攻擊散布後門程式. 檢索自 https://www.ithome.com.tw/news/130650

CNS 15652-1(2013年3月29日)。智慧照明系統標準 第一部：系統功能。

彭建盛、藍忠武(2010)。基于無線傳感網絡的智能路燈系統。河池學院學報，第30卷第5期，頁52-57。

劉子聞(2019)。智慧路灯布局城市物聯網。上海信息化，2019年07期，頁54-57。

王飛(2019)。淺析”智慧燈杆”的發展和應用。智能城市，2019年09期，頁17-18。

馬浩浩(2018)。智慧路灯解决方案。中國公共安全，2018年08期，頁142-144。

李霄柏、卜少偉(2019)。路灯杆共享5G通信微站。城鄉建設，2019年10期，頁19-21。

林子傑(2017)。美國國土安全部保護物聯網策略原則簡介。科技法律透析，第29卷第2期，頁42-48。

台灣資通產業標準協會認驗證區。檢索日期2019年5月28日，檢索自https://www.taics.org.tw/Validation01.aspx?validateType_id=1