KR102293155B1 - Remote monitoring and control system for industry equipment - Google Patents

Abstract

The present invention relates to a web-based industrial OT monitoring and control system with an OT security system, and more specifically, to a web-based industrial OT monitoring and control system with an OT security system applied, comprising: a security solution unit for a device control facility which controls a field device; and a web-based monitoring control unit which performs real-time monitoring and control of the device control facility, wherein the security solution unit and the web-based monitoring control unit are linked to each other so that a person in charge of a field can quickly respond to web attacks.

Description

Web-based industrial OT monitoring and control system with OT security system applied {REMOTE MONITORING AND CONTROL SYSTEM FOR INDUSTRY EQUIPMENT}

The present invention relates to a web-based industrial OT monitoring and control system to which an OT security system is applied. It relates to a web-based industrial OT monitoring and control system (hereinafter referred to as OT monitoring and control system) to which an OT security system is applied in which web-based monitoring and control units are linked to each other to enable field personnel to quickly respond to web attacks.

A PLC (Programmable Logic Controller) is a control device used to control an automatic machine in a factory or the like. Such a control apparatus is connected to various devices (equipment) such as sensors and actuators, and controls the operation of those devices by executing a control program.

DESCRIPTION OF RELATED ART In recent years, the technology of performing integrated information management has been put to practical use by cooperation with control devices, such as PLC, and an external information system. As such a technique, MES (Manufacturing Execution System) and ERP (Enterprise Resource Planning) are mentioned. In addition, large-scale plants such as water treatment plants and chemical plants handle high-speed, large-capacity data. In such a large-scale plant, a supervisory control system called SCADA (Supervisory Control And Data Acquisition) is generally used. As a function of SCADA, a data collection function, a user interface function, etc. are mentioned. The data collection function is a function of collecting device data from devices such as sensors in the plant and storing the collected device data in a database. The user interface function is a function of displaying device data on a display screen of a monitoring terminal or accepting data manipulation from a user. Based on the data displayed on the display screen of the monitoring terminal, the user can monitor the device control process in the plant and perform necessary data operation.

On the other hand, industrial control systems such as SCADA, DCS, and PLC are connected to an Internet-based network as the industry develops. is occurring frequently.

Therefore, there is an urgent need for an industrial OT monitoring and control system capable of protecting the industrial control system from external intrusion and monitoring/controlling it in real time.

The present invention has been devised to solve the above problems, and a security solution unit for a device control facility that controls a field device and a web-based monitoring control unit that performs real-time monitoring and control of the device control facility are linked to each other, The purpose of this is to provide a web-based industrial OT monitoring and control system with an OT security system that allows the person in charge to quickly respond to web attacks.

The web-based industrial OT monitoring and control system to which the OT security system according to the present invention is applied for the purpose of solving the above problems includes a web-based security solution unit that provides security information for device control facilities that control field devices; and a web-based monitoring and control unit for performing real-time monitoring and control of the device control facility based on the security information, wherein the monitoring and control unit includes a graphic display unit for graphically displaying the security information as graphic data .

In addition, the security information includes anomaly information, threat information, and operational behavior information, wherein the anomaly information is determined based on the I/O usage of the device control facility, the number of logins and the amount of packets, and the threat information is It is determined based on the difference from the set attack pattern, and the operation behavior information is determined based on the analysis of the control authority of the device control facility.

In addition, when it is determined that the attack on the device control facility is based on the security information, the attack information is transmitted to the person in charge in real time.

In addition, the display device further includes a screen division interface for dividing the screen representing the security information, wherein the screen division interface forms a division path along a boundary of a screen to be divided, and when a division icon is dragged along the division path, the first A request screen divided into a request screen and a second request screen, an input bar including a plurality of input icons for displaying different request contents for each request screen when dragged to the request screen, request contents displayed on the request screen and a collection bar in which a collection icon for collecting The divided path includes a straight path and a curved path, and when the screen to be divided and the divided screen is pressed for 2 seconds or more, the inside of the virtual icon is gradually filled, and the division is only performed when all the virtual icons are filled. An icon and a collection icon appear, and when the inside of the virtual icon is not filled or is excessively filled, the virtual icon disappears.

In the present invention having the above configuration and characteristics, a security solution unit for a device control facility that controls a field device and a web-based monitoring and control unit that performs real-time monitoring and control of the device control facility are linked to each other so that the person in charge of the field can attack the web It has the advantage of being able to respond quickly to

1 is a diagram illustrating a conceptual diagram of a web-based industrial OT monitoring and control system to which an OT security system according to the present invention is applied.

Since the present invention can have various changes and can have various forms, implementation examples (態樣, aspects) (or embodiments) will be described in detail in the text. However, this is not intended to limit the present invention to the specific disclosed form, it should be understood to include all modifications, equivalents and substitutes included in the spirit and scope of the present invention.

The terminology used herein is only used to describe a specific embodiment (aspect, aspect, aspect) (or embodiment), and is not intended to limit the present invention. The singular expression includes the plural expression unless the context clearly dictates otherwise. In the present application, terms such as comprises or consists of are intended to designate that the features, numbers, steps, operations, components, parts, or combinations thereof described in the specification exist, but one or more other features It is to be understood that it does not preclude the possibility of the presence or addition of numbers, steps, operations, components, parts, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical and scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with the meaning in the context of the related art, and should not be interpreted in an ideal or excessively formal meaning unless explicitly defined in the present application. does not

~1~, ~2~, etc. described in the present specification will be referred to only to distinguish that they are different components, and are not limited to the order of manufacture, and their names in the detailed description and claims of the invention are may not match.

The present invention relates to a web-based industrial OT monitoring and control system to which an OT security system is applied. It relates to a web-based industrial OT monitoring and control system (hereinafter referred to as OT monitoring and control system) to which an OT security system is applied in which web-based monitoring and control units are linked to each other to enable field personnel to quickly respond to web attacks.

As shown in FIG. 1, the OT monitoring and control system according to the present invention is largely composed of a web-based security solution unit and a web-based monitoring and control unit (hereinafter, a security solution unit and a monitoring control unit).

Here, as will be described later, the security solution unit and the monitoring and control unit are network-connected to the security target through a switch or hub, and are also network-connected to IT-related devices. Here, the IT-based device refers to devices connected to an external network and a network so as to be able to connect to the Internet. And here, the security target corresponds to the device control facility that controls the field device.

First, the web-based security solution unit provides security information on device control facilities that control field devices.

Field devices here refer to various types of analytical instruments, pressure sensors, capacitive pressure sensors, resistive temperature detectors, water levels, power switches, thermocouples, limit switches, on/off switches, flow transmitters, pressure transmitters, capacitance level switches, valves Includes valve positioners, valve controllers, actuators, solenoids and indicator lights.

And, as used herein, the term "field device" includes these field devices as well as any other device that performs a function in a distributed control system and is well known in the control art.

And the device control facility that controls the field device refers to supervisory control and data acquisition (SCADA) systems, distributed control systems (DCS), and industrial sectors and critical infrastructure. It refers to Programmable Logic Controllers (PLC) used in structures, and may also encompass some types of control systems used in industrial production.

And the device control facility may be implemented in various industries such as electricity, water, oil, gas, data, and the like.

And here, PLC is a control device used for automatic control and monitoring of an industrial plant, and the PLC logically processes the input sequentially by the program and controls the connected external device using the output result.

That is, it is a representative device used for sequential control, and PLC may be used alone or may be used together with the aforementioned SCADA system.

And DCS means a distributed control system, and more specifically, it means an industrial system or a monitoring and control system of an industrial process set capable of monitoring and controlling an industrial process using a controller element.

And DCS is implemented to monitor and control distributed equipment used in industrial processes in various industries, and is a dedicated system used to control manufacturing processes that are continuous or batch-oriented. In addition, the DCS is connected to a sensor and an actuator and can control the process using setpoint control.

And an input/output device (I/O) may be integrally configured with the controller or located in a remote location, and the entire system of the controller is connected by a network for communication and monitoring. Based on information received from the remote station, automated or operator-driven supervisory commands may be entered into the remote station control device, sometimes referred to as a field device. Field devices can monitor the local environment for local operations, such as opening and closing valves and breakers, starting and shutting down pumps, motors and other processes, collecting data from sensor systems, and alert conditions. control the work

And in general, SCADA (Supervisory Control And Data Acquisition) is a central control room, monitoring system, PLC (Programmable Logic Controller), RTU (Remote Terminal Unit), DCS (Distribution Control System), GP (Graphic Panel) and field control systems such as Including the same configuration, it means a configuration that collects information from various on-site devices such as motors, pumps, blowers, distributors, and temperature sensors in the field to enable inspection and analysis while monitoring the progress of the system, and also the above-described PLC , DCS, and SCADA may be employed that are commonly used in the relevant technical field.

And the above-described security information means data generated based on the field data extracted from the field device and device control facility, and includes a total of three types of abnormal symptom information, risk information, and operational behavior information.

The field data here means data acquired from the device control facility, and as will be described later, these may be I/O usage, number of logins, packet volume, and the like.

First, in the case of anomaly information, it refers to information generated when an abnormality occurs in the device control facility, and there is a predetermined deviation between the reference value information serving as a reference value for determining whether an abnormality is present and the above-described field data. In this case, it will be judged as an abnormal symptom.

Here, reference value information serving as a reference value to determine whether there is an abnormality may include I/O usage, the number of logins, and the amount of packets. Of course, here, the I/O usage means the I/O usage of the device control facility, the number of logins means the number of logins to the device control facility, and the packet amount means the amount of packets processed by the device control facility.

And in the case of risk information, it refers to information generated when an attack pattern known based on a signature occurs in the device control facility, and when it matches with a preset attack pattern that is a reference value to determine whether there is a risk, Analyzed as illegal intrusion.

Here, a technique for performing comparison between a preset attack pattern serving as a reference value and a detected attack pattern and a preset attack pattern serving as the reference value can be easily performed by a person skilled in the art with reference to a known technology. is to be omitted.

In addition, the operating behavior information means information generated when there is an abnormality as a result of analysis of the control authority of the device control facility or when a value set in the device control facility is different from a preset value.

Next, it includes a web-based monitoring and control unit that performs real-time monitoring and control of the device control facility based on the security information.

The real-time monitoring and control here utilizes the real-time monitoring and control function, which is a function of the existing SCADA. The difference from the existing one is that it is also connected to the external network (Internet connection), so the device control facility, which is usually composed of the internal network, can be operated in real time even outside the internal network. Control and monitoring can be performed.

In addition, the monitoring and control unit includes a graphic display unit for displaying the security information as graphic data or by graphicizing the intrusion area in which the security information is generated as graphic data. And in order to display the intrusion area like this, device control facilities located in each area must be connected to an external network. And as described above as a method for realizing this, the present invention includes a web-based security solution and a web-based monitoring and control unit.

And here, the graphicization may include graphing the number of times the security information is generated with time as the x-axis as an embodiment.

In another embodiment, it may include graphing the change in I/O usage with time as the x-axis.

As another embodiment, it may include graphing a change in the number of logins with time as the x-axis.

In another embodiment, it may include graphing a change in the amount of packets using time as an x-axis.

In another embodiment, the amount of generation of threat information or generation of operational behavior information may include graphing the amount of time as the x-axis.

And when it is determined that the attack on the device control facility is based on the security information, it is configured to transmit the attack information to the person in charge in real time, so that the person in charge of the field can quickly respond to the web attack.

On the other hand, the present invention includes a screen representing security information so that an operator can view the security information, and further includes a screen division interface for dividing the screen representing the security information. In the conventional case, different screens are displayed for each request content, and unnecessary screen switching has to be performed throughout the work for comparison between requested content. There was a disadvantage that there was a limitation in the increase of work efficiency because it was required.

The web-based industrial OT monitoring and control system to which the OT security system according to the present invention is applied further includes a screen division interface that displays different requests while comparing them to a single screen to overcome the above disadvantages. Here, the requested content may be anomaly information, threat information, and operational behavior information.

The screen division interface forms a division path P3 along the boundary of the screen to be divided, and when the division icon P2 is dragged along the division path P3, the first request screen D21 and the second request screen and a request screen (D2) divided into (D22). Here, as an embodiment, the boundary of the screen to be divided may be formed in a horizontal direction as shown in FIG. 2 , and is not limited in any one direction, such as a vertical direction or a diagonal direction. Therefore, when the horizontal frame is required to be larger, as shown in FIG. 2 , it is preferable that the division path P3 is formed in the horizontal direction, and when the vertical frame is required to be larger, the division path P3 in the vertical direction is required. ) would be preferred.

And the dividing path P3 includes a straight path and a curved path. As shown in FIG. 2 , the straight path is formed to cross the starting point and the ending point of the screen to be divided, and the curved path is the end point of the straight path. It is formed so as to connect the center of the straight path in a curved form. Accordingly, as shown in FIG. 2, a 'P' shape is formed. Accordingly, it is possible to prevent screen division due to erroneous contact.

And when the screen to be divided and the divided screen is pressed for 2 seconds or more, the inside of the virtual icon is gradually filled, and the divided icon (P2) and the number of times (P12) are configured such that only when all the virtual icons are filled . Therefore, if the screen is to be divided, the virtual icon is first displayed by pressing the screen to be divided for 2 seconds or more, and the screen is divided by dragging it along the division path including the aforementioned straight path and curved path. In addition, if the inside of the virtual icon cannot be filled or is excessively filled, the virtual icon is configured to disappear, thereby preventing screen division due to erroneous contact.

Next, as shown in FIG. 2, when dragged to the request screen D2, the input bar D11 including a plurality of input icons P11 for displaying different request contents for each request screen D2. ) is included. The plurality of input icons (P11) are a first input icon (P111), a second input icon (P112) and a third input icon (P113) each including a first request content, a second request content, and a third request content. can be composed of Here, the first to third requests may be abnormal symptom information, threat information, and operational behavior information.

Next, a recovery icon (P12) for recovering the requested contents displayed on the request screen (D2) includes a recovery bar (D12) in which the recovery icon (P12) is displayed on the request screen (D2). It is configured so that the request content is retrieved when it is dragged to the recovery bar D12. As described above, when any one of the divided screens (the first request screen D21 or the second request screen D22) is pressed for more than 2 seconds, the virtual icon appears first, and it follows the recovery path P5. By dragging, it becomes possible to remove the request content that was displayed on the divided screen.

And the characteristic point here is that the arrangement order of the input icon P11 is changed according to the arrangement order of the collection icon P12. As shown in FIG. 2, the first collection icon containing the first request When dragging (P121) to the position of the second recovery icon (P122), the first input icon (P111) and the second input icon (P112) that appear when the screen is divided afterwards are also configured to change their positions do. This has the advantage that by changing the location of the input icon P11 according to the user's criteria, such as by region or group, it is possible to more conveniently call up and arrange the requested contents for each request screen D2. In particular, since the contents contained in this are all different depending on the monitored/controlled device, system, etc., the effect thereof may be further emphasized.

And, obviously, the first recovery icon P121 or the third recovery icon P123 corresponds to the icon corresponding to the first input icon P111 or the third input icon P113. In addition, the input path P4 corresponding to the path to which the input icon P11 is dragged and the recovery path P5 corresponding to the path to which the recovery icon P12 is dragged are curved in different directions. It is preferable, but this is to prevent all of them from being executed according to a erroneous contact when they are configured in the same direction.

As used throughout this specification, '~ unit' is a unit that processes at least one function or operation, and may refer to, for example, a hardware component such as software, FPGA, or ASIC. However, '~part' is not meant to be limited to software or hardware. The '~ unit' may be configured to reside on an addressable storage medium or may be configured to refresh one or more processors.

As an example, '~ part' denotes components such as software components, object-oriented software components, class components, and task components, processes, functions, properties, procedures, and sub It may include routines, segments of program code, drivers, firmware, microcode, circuitry, data, databases, data structures, tables, arrays, and variables. A function provided by a component and '~ unit' may be performed separately by a plurality of components and '~ unit', or may be integrated with other additional components.

The present invention described above with reference to the accompanying drawings is capable of various modifications and changes by those skilled in the art, and such modifications and changes should be construed as being included in the scope of the present invention.

Claims (4)

a web-based security solution unit that provides security information on device control facilities that control on-site devices;
a web-based monitoring and control unit that performs real-time monitoring and control of the device control facility based on the security information;
including,
The monitoring and control unit includes a graphic display unit for displaying the security information as graphic data,
The security information includes anomaly information, threat information, and operational behavior information,
The anomaly information is determined based on the I/O usage of the device control facility, the number of logins, and the amount of packets,
The threat information is determined based on a difference from a preset attack pattern,
The operation behavior information is determined based on the analysis of the control authority of the device control facility,
When it is determined that the attack on the device control facility is based on the security information, the attack information is transmitted to the person in charge in real time,
Further comprising a screen division interface for dividing the screen representing the security information,
The screen split interface,
A request screen that forms a split path along the boundary of the screen to be split, and is divided into a first request screen and a second request screen when a split icon is dragged along the split path;
An input bar including a plurality of input icons for displaying different request contents for each request screen when dragged to the request screen; and
and a recovery bar in which a recovery icon for recovering the requested content appearing on the request screen is settled, wherein the request is recovered when the recovery icon is dragged to the recovery bar from the request screen,
The arrangement order of the input icon is changed according to the arrangement order of the collection icon,
The dividing path includes a straight path and a curved path,
When the screen to be divided and the divided screen are pressed for more than 2 seconds, the inside of the virtual icon is gradually filled, and the divided icon and the recovery icon appear only when all the virtual icons are filled,
Web-based industrial OT monitoring and control system, characterized in that the virtual icon disappears when the inside of the virtual icon is not filled or is excessively filled. delete delete delete

Images