KR20120074040A - Security system and its operating method for supervisory control and data acquisition system - Google Patents

Abstract

PURPOSE: A security system for an SCADA(Supervisory Control and Data Acquisition) system and operation method thereof are provided to embody safe and high reliable communication by encrypting and decrypting control and measurement information transmitted to a network of the SCADA system and received from the network of the SCADA system. CONSTITUTION: An SCADA server(20) is arranged at the center of a network constituted at a power system. The SCADA server monitors the operation control and state of a lower node. A security apparatus(50) respectively contacts to the SCADA server and the lower node. The security apparatus detects invasion in the network. The security apparatus encrypts data by changing the security key of the transmitted and received data according to detecting results.

Description

Security system and its operating method for SCADA system {Security system and its operating method for Supervisory Control and Data Acquisition system}

The present invention relates to a security system for a SCADA system and a method of operation thereof, and more particularly, to an end-to-end network of a supervisory control and data acquisition (SCADA) network (hereinafter referred to as SCADA). The present invention relates to a security system for a SCADA system that can improve security against an external attack that may occur in end-to-end communication, and a method of operating the same.

In general, SCADA system collects, receives, records, and displays status information data of a remote device to a remote terminal unit (RTU) using analog or digital signals on a communication path. Say the system.

The SCADA system can monitor and control the remote situation and the equipment on the remote site in real time. SCADA system has automatic control, monitoring and information processing functions and is widely used in a wide range of fields. It is applied to the centralized monitoring and control of various types of remote facilities such as facilities, petrochemical plants, steel processing facilities, factory automation facilities, railway management and control, water resource management, and flood alarm management.

However, unlike other countries, Korea is operating a SCADA system of a private network system separate from the public internet network, so security awareness is still weak.

In foreign countries, there have been studies on encryption algorithms and encryption key technologies for SCADA protocols in general, but they remain in the application of local systems such as distribution networks. Etc.) is mixed, which makes it difficult to apply overall key management.

Since Korea is not aware of the security of SCADA system, research on general security algorithm and key management technique for internet public network is actively underway, but detailed study on encryption and key management algorithm for SCADA system is also insufficient. to be.

On the other hand, the encryption method includes a symmetric key (secret key) method and an asymmetric key (public key) method.

1 is a diagram illustrating the principle of a general symmetric key method and an asymmetric key method.

Referring to FIG. 1, in the symmetric key method, two communication terminals share two identical keys secretly and perform encryption and decryption operations with the same key. Although fast, encryption strength is relatively weak.

The asymmetric key method encrypts with a public key transmitted through a communication channel and decrypts it with a secret key held by a receiver at the time of decryption. A typical example of such a public key is Internet banking, which has a strong encryption strength, thereby increasing security. As the capacity of the key increases, the processing speed is delayed, which may result in communication delay.

The present invention has been proposed to solve the above problems, SCADA system that can enhance the security against external intrusion in the symmetric key encryption process currently applied in the end-to-end communication of the SCADA network It is an object of the present invention to provide a security system and a method of operation thereof.

Security system for a SCADA system according to an embodiment of the present invention for achieving the above object, SCADA server located in the central network in the power grid to control the operation of the lower node and monitor the status; And a security device connected to each stage of the SCADA server and the lower node to detect whether an intrusion is detected in the network, and encrypt and replace a security key of data transmitted and received according to the detection result.

The security device includes a key management module for generating a new security key according to the detection result of the intrusion detection module and distributing the new security key generated to the security device connected to the lower node when connected to the SCADA server.

In this case, the key management module may update the security key according to a setting cycle, and if the security key is replaced with a new security key according to a detection result, the key management module may update the security key again according to the setup cycle.

In addition, the security method for the SCADA system according to another embodiment of the present invention, in the security method for the SCADA system for encrypting and decrypting data transmitted and received in a symmetric key method, intrusion by analyzing the data transmitted and received in the SCADA network Detecting a first step; And a second step of distributing security keys for encryption and decryption and distributing them to each node if it is detected that there is an intrusion in the first step.

In the third step, after the second step, the security key may be updated and distributed according to a period set based on the replacement point. When the number of times of intrusion is detected and calculated is more than a predetermined reference number, the security key update period Can be shortened and distributed.

Security system for the SCADA system and its operation method according to an embodiment of the present invention configured and operated as described above, the stable and reliable communication by encrypting / decrypting the control / measurement information transmitted and received in the network of the SCADA system There is an effect that can be implemented.

In addition, the security key replacement cycle can be flexibly adjusted according to the network intrusion detection to encrypt the symmetric key algorithm, which greatly enhances network security in the symmetric key method and minimizes the traffic burden due to the security key replacement. .

And when local system intrusion or security threat is detected, it proactively blocks the spread to the whole system to ensure reliable system operation.

1 is a view showing the principle of the general symmetric key method and asymmetric key method,
2 is a block diagram showing the configuration of the SCADA system according to an embodiment of the present invention,
3 is a view showing the operating principle of the security system for the SCADA system according to the present invention;
4 is an exemplary view showing a security device according to an embodiment of the present invention;
5 is a block diagram showing the configuration of the security device according to FIG. 4, and
6 is a flow chart illustrating a flow of a security method for a SCADA system according to an embodiment of the present invention.

Hereinafter, exemplary embodiments of the present invention will be described with reference to the accompanying drawings.

2 is a block diagram showing the configuration of a SCADA system according to a preferred embodiment of the present invention.

SCADA system according to a preferred embodiment of the present invention, as shown in Figure 2, the top of the SCADA server 20 located at the top of the individual regional control center (RCC: Regional Control Center) and sub-regional distribution center (SCC: Sub-regional) It has a hierarchical structure including a master terminal unit (MTU) installed in a control center and an RTU 10 installed in various substations as sub-nodes of the MTU.

The remote terminal unit (RTU) 10 measures the power state information from the connected grid device and transmits the measured information to the MTU. The measured information is encrypted through the security device 50 of the present invention which is linked with the RTU, and the MTU. Is sent to.

The MTU decrypts the information transmitted from the RTU 10 through a separate security device 50 connected to the MTU, collects the power state information measured by the at least one RTU 10, and then collects the security device 50. Encrypted through the SCADA server 20 to be transmitted. Hereinafter, a security management method for transmitting and receiving data between RTU-SCADA servers 20 will be described as an example. However, in the SCADA network, since the SCADA server 20 is configured as the top node and the RTU 10 is configured as the lowest node, For convenience of description, it can be applied to the process of data transmission and reception between the SCADA server-MTU, MTU-RTU.

Like the RTU 10 or the MTU, the SCADA server 20 decrypts the power state information received from the MTU through the security device 50 interworking with the SCADA server 20, reads the MTU and the RTU 10. ) Status can be monitored and motion control commands can be issued.

The RTU 10, the MTU, and the SCADA server 20 transmit and receive data through a SCADA communication port. The communication port may include, but is not limited to, an RS-232, RS-485, or IP port. Connection can be made via a secure communication port.

On the other hand, the security system in the SCADA system according to the present invention can be significantly enhanced security compared to the conventional symmetric key method by interlocking the network intrusion detection function and the encryption function.

3 is a view showing the operating principle of the security system for the SCADA system according to the present invention.

The security system for the SCADA system according to the present invention, if the data transmitted from the RTU or SCADA server is input to the security device through the secure communication port, the input data is encrypted according to the set security key and transmitted to the destination device. The data is encrypted using a symmetric key method. The security key is replaced at regular intervals in order to enhance the security of the symmetric key method, which is relatively less secure than the asymmetric key method.

In particular, when intrusion into the network is detected for a time until the next period after replacing the security key as shown in FIG. 3, the security key is updated to perform encryption using the new security key even if it is within the replacement period.

Intrusion detection into the network is designed to detect various types of malicious network traffic and computer usage that traditional firewalls cannot detect. Network attacks on vulnerable services, data driven attacks on applications, and Detects privilege escalation and intruder logins / key file access by intruders / host-based attacks such as malware (computer viruses, Trojans, worms).

Specifically, as shown in FIG. 3, the received data may be analyzed by a pattern analysis and compared with various attack pattern information stored in a database, and it may be determined that an invasion occurs when a matching pattern exists or data of a different pattern is input. As a matter of course, specific techniques for intrusion detection may be easily modified by those skilled in the art as described above.

That is, the conventional key management function only replaces the key periodically to enhance the security of the symmetric key cryptography, the security system for the SCADA system according to the present invention, as shown in Figure 3, in addition to such periodic replacement If an intrusion detection system detects an abnormal communication pattern, the key can be updated even if it is within the replacement cycle. As a result, the possibility of intrusion that may occur within a period can be minimized, and too frequent key exchange periods can be set to increase communication traffic, thereby preventing the risk of deteriorating communication efficiency and reliability.

Figure 4 is an exemplary view showing a security device according to an embodiment of the present invention, Figure 4 (a) is an exemplary view showing a case where the encryption function and the intrusion detection function is implemented in the security device, Figure 4 (b ) Is an example in which the intrusion detection function is embedded in the SCADA server, and the encryption device is implemented in the security device so that the intrusion detection function and the encryption function interwork.

The security device according to an embodiment of the present invention is connected to each stage of the SCADA server, MTU and RTU to encrypt data transmitted to the network, and decrypt the received data so that the decrypted data can be read by the corresponding device. . In particular, the security device can detect whether an intrusion in the network, the security device can be distributed to other security devices by replacing the security key of the data transmitted and received according to the type of the device to which the security device is linked.

In this case, the intrusion detection function may be implemented in the security device or SCADA server. When the intrusion detection function and the encryption function are implemented together in the external security device as shown in FIG. It can detect whether or not it can enhance security.

As shown in Figure 4 (b), the intrusion detection function is implemented in the SCADA server is an example of the SCADA system built in Korea is due to the situation that technically impossible to be embedded in the SCADA server or RTU encryption function external type In the security device of the encryption function, the communication port of the security device and the communication port of the SCADA server is connected to be interlocked.

FIG. 5 is a block diagram showing the configuration of the security device according to FIG. 4. In the present specification, an intrusion detection function and an encryption function are both implemented as shown in FIG. 4A. In the configuration of FIG. 5, if the intrusion detection module is included in the SCADA server, the configuration of the security apparatus illustrated in FIG. 4B may be derived.

Security apparatus 50 according to an embodiment of the present invention, as shown in Figure 5, includes an encryption processing module 150 and a key management module 200, and further includes an intrusion detection module 100 Can be configured.

The encryption processing module 150 encrypts the data transmitted from the connected RTU or SCADA server according to a predetermined security algorithm and a security key, decrypts the encrypted data received from the network according to the security algorithm, and reads the intrusion detection. The module 100 detects intrusion into the network from the data transmitted and received as described above with reference to FIG. 3.

The key management module 200 may have a slightly different operation depending on which device is connected to the SCADA server or the RTU. When the key management module 200 is connected to the SCADA server, the key management module 200 may provide a security key for a security algorithm applied according to a preset cycle. The data is transmitted by the encryption processing module 150 to be encrypted according to the security algorithm and the updated security key. In addition, the updated new security key is transmitted to each RTU connected to the network so that the encryption processing module of the other security device can encrypt or decrypt the data.

When the intrusion detection module 100 detects an intrusion, a new security key is immediately generated and applied to data encryption even if the intrusion detection time is not updated according to a cycle, and the generated new security key is notified to each RTU to secure the security associated with each RTU. The device can be encrypted / decrypted with the same updated security key.

In particular, the key management module 200 of the security device connected to the SCADA server accumulates the number of times detected by the intrusion detection module 100 as an intrusion, and shortens the update cycle of updating the security key when the number of times more than a preset reference number At shorter time intervals, each piece of data can be encrypted with a new security key, and after a shorter update cycle, the number of intrusion detections can be accumulated again for continuous monitoring.

The key management module 200 of the security device connected to the RTU may be modified according to the settings of the SCADA system administrator, but basically does not perform the operation of generating the security key and transmitting to each RTU according to a set cycle, and intrusion detection. According to the detection result in the module 100, a new security key may be generated and notified to the security device and the SCADA server connected to the lower node.

In addition, the security device is a key storage unit 220 for storing the generated security key or received security key information, the algorithm storage unit 240 for storing the security algorithm to encrypt the data in the encryption processing module 150 and the security It may be configured to include a communication module 300 having a communication port.

The security method for the SCADA system according to an embodiment of the present invention configured as described above operates as follows.

FIG. 6 is a flowchart illustrating a security method for a SCADA system according to an embodiment of the present invention, and will be described using an example of a security device connected to a SCADA server.

First, an encrypted power state data of a grid device connected to an RTU is received from an RTU provided in each lower node connected to the SCADA network, and an operation control command for the RTU is encrypted and transmitted to the corresponding RTU.

After a certain time elapses, a new security key used for encryption is generated and notified to each RTU. (S20)

Analyzing the pattern or traffic of the data received from the SCADA server or the data transmitted from the SCADA server, if an abnormal data pattern or traffic is detected, it is determined that an intrusion has occurred.

When an intrusion occurs, a new security key is generated immediately and distributed to each RTU for data encryption or decryption through the new security key (S50, S60).

After the new security key is applied, the security key is renewed according to the cycle again.When the security key is renewed due to the intrusion, the security key is renewed according to the previous preset replacement cycle based on when the new security key is generated. The RTU can be notified.

In particular, if an intrusion is detected more than a certain number of times, a security key replacement cycle may be shortened so that a new security key may be set and applied at a shorter time interval. You can also lengthen it.

As described above, the security system for SCADA system and the operation method thereof according to the present invention have been described with reference to the illustrated drawings, but are not limited to the embodiments and drawings disclosed herein, and the security key for data encryption is periodically It is apparent that the present invention can be easily modified by those skilled in the art within the scope of protection, while the network idea of replacing a network intrusion is detected and immediately updating the security key to enhance the security of the SCADA system.

10: RTU 20: SCADA Server
50: security device 100: intrusion detection module
150: encryption processing module 200: key management module
220: key storage unit 240: algorithm storage unit

Claims (10)

SCADA server located in the central network in the power grid to control the operation of the lower node and monitor the status; And
Security device connected to each stage of the SCADA server and lower nodes to detect the intrusion in the network, and encrypts by replacing the security key of the data transmitted and received according to the detection result
Security system for the SCADA system comprising a. The method of claim 1,
The security apparatus may include an encryption processing module configured to encrypt data transmitted from a connected RTU or SCADA server according to a security key, and to decrypt and read encrypted data received from a network; And
Intrusion detection module that detects intrusion into network from data sent and received
Security system for the SCADA system comprising a. The method of claim 2,
When the security device is connected to the SCADA server, the security device generates a new security key according to the detection result of the intrusion detection module and distributes the new security key generated to the security device connected to the lower node.
Security system for the SCADA system further comprising. The method of claim 3, wherein
And the key management module updates the security key according to a setting cycle, and renews the security key according to the setup cycle when it is replaced when it is replaced with a new security key according to a detection result. The method of claim 4, wherein
And the key management module shortens a security key replacement cycle when the number of times detected as an intrusion by the intrusion detection module is greater than or equal to a predetermined reference number. The method of claim 1,
The SCADA server includes an intrusion detection module for detecting whether intrusion into the network from the data transmitted and received,
The security device connected to the SCADA server includes an encryption processing module for encrypting data transmitted from a connected RTU or SCADA server according to a security key, and decrypting and reading encrypted data received from a network; And
Key management module for generating a new security key according to the detection result in the intrusion detection module and distributes the new security key generated to the security device connected to the lower node
Security system for the SCADA system comprising a. A security method for a SCADA system for encrypting and decrypting data transmitted and received by a symmetric key method,
A first step of detecting an intrusion by analyzing data transmitted and received in the SCADA network; And
A second step of distributing security keys for encryption and decryption to each node if it is detected that an intrusion exists in the first step
Security method for a SCADA system comprising a. The method of claim 7, wherein
A third step of updating and distributing a security key according to a period set based on a replacement time point after the second step;
Security method for a SCADA system comprising a. The method of claim 8,
The third step is a security method for a SCADA system that calculates the number of times the intrusion is detected and the number of times calculated is more than a predetermined reference number, the security key update period is shortened and distributed to each node. The method of claim 9,
The first step is a security method for a SCADA system that determines that there is an intrusion when an abnormal pattern appears by analyzing the pattern of the data transmitted and received.

Images