KR102195758B1 - Method and apparatus for executing authentication of nuclear digital controller based on one time password - Google Patents

Abstract

The OTP-based nuclear digital controller authentication method according to the present invention is a method for authenticating a connection between an engineering work station (EWS) and a nuclear digital controller, in response to execution of a first application program mounted on the EWS. When the second application program is executed, requesting authentication of a password; if the password is authenticated, requesting a first OTP authentication; and connecting with the nuclear digital controller after the first OTP authentication is successful. Monitoring whether or not an attempt is made; requesting a second OTP authentication when the connection login is attempted; and connecting the first application program and the nuclear digital controller if the second OTP authentication is successful. can do.

Description

OTP-based nuclear digital controller authentication method and its device {METHOD AND APPARATUS FOR EXECUTING AUTHENTICATION OF NUCLEAR DIGITAL CONTROLLER BASED ON ONE TIME PASSWORD}

The present invention relates to a technique for authenticating a nuclear digital controller, and more particularly, to a control system (e.g., PLC) used as a safety system of a nuclear digital system, challenge-response authentication required by preset requirements. It relates to an OTP-based nuclear digital controller authentication method and apparatus to which the method can be applied.

As is known, in accordance with the US Regulatory Guide 5.71 related to nuclear facilities and RS-015 "Technical Standards for Computer and Information System Security for Nuclear Facilities, etc." announced in 2014 by the Korea Institute of Nuclear Control and Technology (KINAC) Measures should be taken to ensure that computers and information systems, such as nuclear facilities, are not adversely affected from cyber attacks that may cause sabotage of computers and nuclear facilities.

In fact, this means that most of the digital assets (controllers) applied to nuclear power plants must be applied with technical measures to protect them from cyber attacks.

This means that a company that develops and supplies digital assets to nuclear power plants should determine what requirements should be applied at the device level and what requirements should be satisfied based on the technical security measures presented in KINAC RS-015.

B.4.2 of the U.S. Regulatory Guide 5.71 and 1.4 identification and authentication of the Korea Institute of Nuclear Control and Technology (KINAC) regulatory document RS-015 use the strongest Challenge-Response Authentication method in relation to authentication. Authentication is required.

In the nuclear power plant system, the authentication technique required by the above requirements must be satisfied, but there is currently no applied technology capable of satisfying the challenge response technique.

Korean Patent Registration No. 10-1825486 (announcement date: 2018. 02. 06.)

The present invention is to provide an OTP-based nuclear digital controller authentication method and apparatus capable of satisfying the application regulation guidelines of nuclear power plant cyber security requirements through OTP-based Challenge Response Authentication.

The problem to be solved by the present invention is not limited to the ones mentioned above, and another problem to be solved that is not mentioned can be clearly understood by those of ordinary skill in the art from the following descriptions. will be.

The present invention, according to one aspect, is a method for authenticating a connection between an engineering work station (EWS) and a nuclear digital controller, wherein the second application program is in response to the execution of the first application program mounted on the EWS. When executed, requesting authentication of a password; if the password is authenticated, requesting a first OTP authentication; and connecting with the nuclear digital controller after the first OTP authentication is successful; monitoring whether connection login attempts OTP-based nuclear power including the step of, when the connection login is attempted, requesting a second OTP authentication, and if the second OTP authentication is successful, connecting the first application program and the nuclear digital controller A digital controller authentication method can be provided.

According to another aspect, the present invention is a device for authenticating the connection between an engineering work station (EWS) and a nuclear digital controller, and a second application program is executed in response to the execution of the first application program mounted on the EWS. When the password is authenticated, the password authentication unit performs the authentication of the password, the first OTP authentication unit performs the primary OTP authentication when the password is authenticated, and the connection with the nuclear digital controller after the first OTP authentication is successful. A login management unit that monitors whether or not the attempt is made; a second OTP authentication unit in the nuclear digital controller that executes a second OTP authentication when the connection login is attempted; It is possible to provide an OTP-based nuclear digital controller authentication device including a connection control unit connecting the nuclear digital controller.

According to an embodiment of the present invention, by satisfying the regulation guidelines for applying cyber security requirements of nuclear power plants through OTP-based Challenge Response Authentication, facility operators and developers of nuclear power plants can use them to satisfy regulatory requirements. In addition, the regulatory agency may specifically suggest a regulatory direction through the present invention.

1 is a physical configuration diagram showing a connection state between an EWS and a nuclear digital controller to which an OTP-based nuclear digital controller authentication technique can be applied according to an embodiment of the present invention.
2 is a block diagram of an OTP-based nuclear digital controller authentication apparatus according to an embodiment of the present invention.
3 is a flowchart showing a main process of authenticating a nuclear digital controller based on challenge response authentication according to an embodiment of the present invention.

First, the advantages and features of the present invention, and a method of achieving them will become apparent with reference to embodiments to be described later in detail together with the accompanying drawings. Here, the present invention is not limited to the embodiments disclosed below, but may be implemented in a variety of different forms, and only these embodiments are intended to complete the disclosure of the present invention, and are generally used in the technical field to which the present invention belongs. It is provided by way of example in order to allow those skilled in the art to clearly understand the scope of the invention, so the technical scope of the invention should be defined by the claims.

In addition, in the following description of the present invention, if it is determined that a detailed description of known functions or configurations may unnecessarily obscure the subject matter of the present invention, a detailed description thereof will be omitted. In addition, terms to be described later are terms defined in consideration of functions in the present invention, which may vary according to intentions or customs of users and operators. Therefore, the definition should be made based on the technical idea described throughout the description of the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

First, according to the present invention, there are two types of authentication targets using the Chanllege-Response Authentication method. The pSET-II program linked with a nuclear digital controller (eg, PLC) uses two password authentication.

The first is when the pSET-II program is executed, and the second is when the connection between the pSET-II program and the nuclear digital controller is attempted.

That is, according to the present embodiment, for the two cases described above, a one-time password (OTP) technique can be applied for strong challenge response authentication.

1 is a physical configuration showing a connection state between an EWS (Engineering Work Station) to which an OTP-based nuclear digital controller authentication technique can be applied and a nuclear digital controller (eg, PLC: Programmable Logic Controller) according to an embodiment of the present invention Is also.

Here, the EWS 110 may be defined as an engineering work device or an engineering work computer, and the nuclear digital controller 120 may be defined as a nuclear digital controller. At this time, the nuclear digital controller 120 may include a verification module 122 for the secondary OTP authentication executed according to the present invention, such a verification module 122, for example, as shown in Figure 2 to be described later. It may be defined as the OTP authentication unit 220.

Referring to FIG. 1, the EWS 110 may be connected to the nuclear digital controller 120 through serial communication using, for example, RS-232C communication protocol, and pSET (POSAFE-Q Software Engineering Tool)-II program Functions such as application program download, firmware update, PLC maintenance, and the like may be provided through a user interface through execution of, or the like. In this case, the pSET-II program may be collectively referred to as a pSET program.

Here, the pSET-II program mounted on the EWS 110 may refer to a program used for application program development tool and application program download of the nuclear digital controller 120, PLC maintenance, and the like.

In addition, the EWS 110 is equipped with a POSAFE-Q Computer Emergency Response Team (pCERT) program, which records the execution of the pSET-II program in log information when the execution service of the pSET-II program is recognized. It can provide the function of and can be equipped with a two-step authentication OTP (One Time Password) function.

Here, pCERT may mean a program operated by a security incident response team such as a computer, for example, and pCERT records the execution and operation status information of the pSET-II program, and displays it through a monitor. Function can be provided. In addition, when the pSET-II program interlocked with the pCERT program is executed, the two-step authentication OTP process may be implemented.

When two password authentication programs running in the pSET-II program are executed, the pCERT program manages these two services, records log and status information, and requires OTP authentication to be completed, but authentication is completed.

In addition, the pSET program may be defined as a first application program, and the pCERT program may be defined as a second application program.

2 is a block diagram of an OTP-based nuclear digital controller authentication apparatus according to an embodiment of the present invention.

2, the nuclear digital controller authentication device of this embodiment may include an EWS side device 210 and a second OTP authentication unit 220 mounted on the nuclear digital controller side, and the like, the EWS side device 210 May include a password authentication unit 212, a first OTP authentication unit 214, a connection login management unit 216, a connection control unit 218, and the like.

First, when the pCERT program is executed according to a user interface using a keyboard, mouse, etc., the password authentication unit 212 executes the pSET program mounted on the EWS 110 in response to this, thereby authenticating passwords well known in the technical field. It may provide a function such as performing.

Here, the pCERT program may recognize the pSET program execution service and record it in log information, and may recognize whether the password authentication service is performed and record it in the log information.

Next, when the password authentication by the password authentication unit 212 is successful, the first OTP authentication unit 214 may provide a function of performing primary OTP authentication, for example, through execution of the pKey program.

Here, the pKey program may perform primary OTP authentication in a manner that generates n random numbers (eg, 6, etc.) every preset time period (eg, 30 seconds, etc.) using time information of the operating system. . For example, a random number is generated every 30 seconds, and the first OTP authentication may be performed using a one-time password (OTP) technique in which a random number used once is not used again.

Here, the kit value used as the value of the OTP may be generated by applying the OTP implementation algorithm specified in the RFC (Request For Comments) 4426 standard with, for example, 6 digits. The key value used as the OTP value can be used as a valid authentication value for the before and after values generated based on the currently generated value.

In addition, the connection login management unit 216 monitors whether a connection login for connection (network connection) with the nuclear digital controller 120 is attempted according to the user interface after the first OTP authentication is successful, and the nuclear digital controller 120 When a connection login attempt to connect with) is detected, a function such as notifying the connection control unit 218 may be provided.

Then, the connection control unit 218 generates a message informing that a connection login is being attempted through serial communication and transmits it to the second OTP authentication unit 220 of the nuclear digital controller 120, and a series of authentication processes to be described later When the success of the second OTP authentication is transmitted from the second OTP authentication unit 220, for example, the pSET program of the EWS 110 and the nuclear digital controller 120 are connected using the RS-232C communication protocol. It can provide functions such as.

In more detail, the connection control unit 218 transmits the value input for the secondary OTP authentication and the time information value of the operating system to the second OTP authentication unit 220 in the nuclear digital controller 120 through RS-232 serial communication. do. Here, the second OTP authentication unit 220 refers to the verification module 122 of FIG. 1.

In response to this, the second OTP authentication unit 220 in the nuclear digital controller 120 generates a one-time password (OTP) using the time information after receiving the value transmitted from the connection control unit 218, and the generated By comparing the password result value and the received key value, it is determined whether authentication succeeds or fails, and transmits the determination result value to the connection control unit 218 of the EWS 110 side.

Here, the verification module 122 for generating a one-time password is executed as an application program of a PLC. Such an application program is developed in C language using the existing pSET program, and can be installed and operated in the PLC.

That is, the second OTP authentication unit 220 performs verification in conjunction with the two-step authentication procedure of the pCERT program when executing the pSET program. When the two-step authentication is performed with the nuclear digital controller 120 in the pCERT program, the connection The controller 218 simultaneously transmits the time information seed value and the key value to the nuclear digital controller 120 through RS-232 serial communication.

In addition, the nuclear digital controller 120 generates a key value with the seed value received through the second OTP authentication unit 220 and then verifies whether the key value received from the EWS 110 is the same as the second OTP authentication. And transmits the result of the secondary OTP authentication to the connection control unit 218 of the EWS 110 using the RS-232C communication protocol.

Next, a main process of performing authentication control based on challenge response authentication according to an embodiment of the present invention using the nuclear digital controller authentication apparatus of the present embodiment having the above-described configuration will be described in detail.

3 is a flow chart showing a main process of authenticating a nuclear digital controller based on challenge response authentication according to an embodiment of the present invention.

Referring to FIG. 3, when the pCERT program mounted in the EWS 110 is executed according to a user interface using a keyboard, mouse, or the like (step 302), the pSET program is executed in conjunction therewith (step 304).

Then, the password authentication unit 212 requests (requests) the user for password authentication (step 306). Here, the pCERT program may recognize the pSET program execution service and record it in log information, and may recognize whether the password authentication service is performed and record it in the log information.

Thereafter, the password authentication unit 212 checks whether the password authentication is successful (step 308). If the check result here, password authentication fails, the process proceeds to step 322 to be described later, and as a result, password authentication The unit 212 generates a password authentication failure message and displays (displays) it on the monitor of the EWS 110.

As a result of the check in step 308, if the password authentication is successful, the password authentication unit 212 notifies the first OTP authentication unit 214, and as a result, the first OTP authentication unit 214 Request authentication (step 310).

Here, the primary OTP authentication may be performed, for example, through the execution of the pKey program. The pKey program uses time information of the operating system to generate n random numbers (e.g., 30 seconds, etc.) , 6, etc.), the primary OTP authentication can be performed. For example, a random number is generated every 30 seconds, and the first OTP authentication may be performed using a one-time password (OTP) technique in which a random number used once is not used again.

Then, the first OTP authentication unit 214 checks whether the first OTP authentication succeeds or fails (step 312). If the check results here, the first OTP authentication fails, the process goes to step 322 to be described later. As a result, the first OTP authentication unit 214 generates an authentication failure message of the primary OTP and displays (displays) it on the monitor of the EWS 110.

As a result of the check in step 312, if the first OTP authentication is successful, the first OTP authentication unit 214 notifies the connection log-in management unit 216.

In response to this, the connection login management unit 216 monitors whether or not a connection login attempt for connection with the nuclear digital controller 120 is attempted (steps 314 and 316). When the monitoring result here, the connection login attempt is detected This is notified to the connection control unit 218.

Therefore, the connection control unit 218 generates a message indicating that a connection login is being attempted through serial communication using, for example, RS-232C protocol, and transmits it to the second OTP authentication unit 220 of the nuclear digital controller 120 side. In response, the second OTP authentication unit 220 requests the second OTP authentication (step 318).

Thereafter, the second OTP authentication unit 220 checks whether the second OTP authentication succeeds or fails (step 320). If the second OTP authentication fails as a result of the check here, the process proceeds to step 322. As a result, the second OTP authentication unit 220 generates an authentication failure message of the second OTP and transmits it to the connection control unit 218 of the EWS 110. Accordingly, the second OTP is displayed on the monitor of the EWS 110. An authentication failure message is displayed (displayed).

Here, the secondary OTP authentication is performed by generating a one-time password (OTP) using the key value and time information received from the connection control unit 218, and comparing the generated password result value with the received key value. I can.

As a result of the check in step 320, if the second OTP authentication is successful, the second OTP authentication unit 220 notifies the connection control unit 218 of the EWS 110 side, and accordingly, the connection control unit 218 In the connection between the pSET program of the EWS 110 and the nuclear digital controller 120 (step 324).

Meanwhile, combinations of each block of the attached block diagram and each step of the flowchart may be performed by computer program instructions. Since these computer program instructions can be mounted on a processor of a general purpose computer, special purpose computer, or other programmable data processing equipment, the instructions executed by the processor of the computer or other programmable data processing equipment are shown in each block or flow chart of the block diagram. Each step creates a means to perform the functions described.

These computer program instructions can also be stored on a computer-usable or computer-readable recording medium that can be directed to a computer or other programmable data processing equipment to implement a function in a specific manner, so that the computer-readable or computer-readable medium. It is also possible to produce an article of manufacture in which the instructions stored on the recording medium contain instruction means for performing the functions described in each block of the block diagram or each step of the flowchart.

In addition, since computer program instructions can be mounted on a computer or other programmable data processing equipment, a series of operation steps are performed on a computer or other programmable data processing equipment to create a process that is executed by a computer, It is also possible for the instructions to perform possible data processing equipment to provide steps for executing the functions described in each block of the block diagram and each step of the flowchart.

In addition, each block or each step may represent a module, segment, or part of code including at least one or more executable instructions for executing the specified logical function(s). In addition, it should be noted that in some alternative embodiments, functions mentioned in blocks or steps may occur out of order. For example, two blocks or steps shown in succession may in fact be performed substantially simultaneously, or the blocks or steps may sometimes be performed in the reverse order depending on the corresponding function.

The above description is merely illustrative of the technical idea of the present invention, and those of ordinary skill in the art to which the present invention pertains, various substitutions, modifications, and changes, etc., within the scope not departing from the essential characteristics of the present invention. It will be easy to see that this is possible. That is, the embodiments disclosed in the present invention are not intended to limit the technical idea of the present invention, but to explain the technical idea, and the scope of the technical idea of the present invention is not limited by these embodiments.

Accordingly, the scope of protection of the present invention should be interpreted by the claims to be described later, and all technical thoughts within the scope equivalent thereto should be interpreted as being included in the scope of the present invention.

110: Engineering work device (EWS)
120: nuclear digital controller
122: verification module
212: password authentication unit
214: 1st OTP authentication unit
216: connection login management unit
218: connection control unit
220: 2nd OTP authentication unit

Claims (7)

An OTP-based nuclear digital controller authentication device authenticates the connection between an engineering work station (EWS) and a nuclear digital controller,
In response to the execution of the first application program mounted on the EWS, checking whether a second application program to be recorded in log information among the application programs installed in the nuclear digital controller is executed;
When the second application program is executed, requesting the EWS to authenticate the password;
When the password is authenticated, requesting the EWS for primary OTP authentication; and
Monitoring whether a connection login attempt to connect with the nuclear digital controller is attempted after the first OTP authentication is successful,
When the connection login is attempted, requesting a second OTP authentication from the nuclear digital controller;
If the second OTP authentication is successful, connecting the first application program and the nuclear digital controller
OTP-based nuclear digital controller authentication method comprising a. The method of claim 1,
The first application program is a pCERT program, and the second application program is a pSET program.
OTP-based nuclear digital controller authentication method. The method of claim 2,
The pCERT program,
When the pSET program is executed, it recognizes the pSET program execution service and records it in the log information.
OTP-based nuclear digital controller authentication method. The method of claim 1,
The primary OTP authentication and the secondary OTP authentication,
performed through the pKey program
OTP-based nuclear digital controller authentication method. The method of claim 4,
The pKey program,
Generates n random numbers every preset time period using the operating system time
OTP-based nuclear digital controller authentication method. The method of claim 2,
The pSET program and the nuclear digital controller,
Connected based on RS-232 communication protocol
OTP-based nuclear digital controller authentication method. A device that authenticates the connection between an engineering work station (EWS) and a nuclear digital controller,
In response to the execution of the first application program mounted on the EWS, when the second application program that the first application program must record in log information among the application programs installed in the nuclear digital controller is executed, authentication of the password for the EWS A password authentication unit to perform,
When the password is authenticated, a first OTP authentication unit that performs primary OTP authentication for the EWS,
A login management unit that monitors whether a connection login attempt to connect with the nuclear digital controller is attempted after the primary OTP authentication is successful,
When the connection login is attempted, a second OTP authentication unit in the nuclear digital controller that performs a second OTP authentication for the nuclear digital controller,
When the second OTP authentication is successful, a connection control unit that connects the first application program and the nuclear digital controller
OTP-based nuclear digital controller authentication device comprising a.

Images