KR101533020B1 - Apparatus and method for security policy management - Google Patents

Abstract

A security policy management apparatus and method for managing a network access policy to integrate and apply distributed security policies in a smart grid environment are disclosed. The security policy management apparatus according to the present invention includes a rule set generation unit that acquires a predetermined access policy security rule from at least one or more systems and converts the access policy security rule into a standard format document to generate a rule set, A topology extracting unit for extracting a work configuration diagram by a network topology, and a standard policy generator for generating a standard policy by merging the generated rule set and the extracted topology.

Description

[0001] APPARATUS AND METHOD FOR SECURITY POLICY MANAGEMENT [0002]

The present invention relates to an apparatus and method for managing a security policy. In particular, the present invention relates to a security policy management apparatus and method for managing a network access policy to integrate and apply distributed security policies in a smart grid environment.

As the smart grid evolves, the spread of various systems is also increasing in quantity. The systems have different access control policies, and the security importance levels are different for each system, and the access control policy is managed by the expression rules specific to the system administrator.

In this way, there are Firewall (Firewall) equipment in the boundary between different security class to manage minimum access control. In this system structure, the role of maintenance, operation, and system management, or access control policy corresponding to authority, must be managed to satisfy the system security, which is recognized as one of important management tasks. However, until now, It collects and reflects the access control policies between different systems, which takes a lot of time and money.

In addition, when a new access policy is announced by a government or an international standard organization, or a new system is added, it is troublesome to apply it to existing systems one by one.

In addition, it is difficult to grasp the problem until a security incident occurs if a policy change is missed when a system is changed, a manual error occurs, or a conflict occurs between policies.

The existing access control policy management consists of opening the policy file, setting the policy, storing and managing the policy file. Unauthorized access detection based on this security policy is performed by Pluggable Authentication Modules (PAM).

PAM is an industry standard authentication framework that allows system administrators to use on systems that perform authentication via PAM. Using PAM also has the advantage of managing access control policies without modifying existing applications such as login, rsh, su, ftp, and telnet.

However, the access control policy file must be created manually by the system administrator. In the Smart Grid environment where various operating systems and systems are integrated, the access control policy file for each system has been integrated to manage the access control policy between the different systems. Collecting and editing takes a lot of time and money.

Such a phenomenon often occurs when a single system policy is changed, such as a problem of missing policy, error, or collision on the integrated system. In such a situation, it is difficult to accurately grasp the actual situation. If the verification process does not involve security, it becomes a reputable security tool.

Recently, with the automation of power system, standardized communication technology has been applied for more efficient construction and operation, and the connection with external has started to increase, and interest in security has increased. In fact, The perception began to change.

Therefore, in order to secure the security of the power system based on IEC 61850, a device and a method for managing the network access policy for integrating and applying the distributed security policy in the smart grid environment based on IEC 61850 are needed . Korean Prior Art Patent Publication No. 2009-0035192 exists as a related art.

It is an object of the present invention to enable accurate analysis of collisions or errors between network access policies by automatically collecting various types of security rules for each system and integrating them in a standard format.

It is also an object of the present invention to maximize security in mutual operation of smart grid environment systems by integrating and applying distributed security policies in a smart grid environment based on IEC 61850.

According to an aspect of the present invention, there is provided a security policy management apparatus comprising: a rule set generation unit that acquires a predetermined access policy security rule from at least one or more systems and converts the acquired access policy security rule into a standard format document, A topology extracting unit for extracting a network topology for at least one or more systems in a network topology, and a standard policy generating unit for generating a standard policy by merging the generated topology and the generated rule set.

At this time, it may further include a consistency verification unit that determines whether the security rule of the new system or the security rule of the changed system can be included as part of the standard policy.

At this time, the rule set generation unit may acquire at least one or more security rules in the form of an access control server system, an environment setting in the PC, and a document file from at least one system.

In this case, the rule set generation unit may convert the acquired access policy security rules into XML format to generate a rule set, and store the converted rule set.

In this case, the topology extracting unit may extract the network topology in an XML format and store the extracted network topology.

At this time, the topology includes a type and configuration of a plurality of power facilities existing in the field, and may include network information between the plurality of power facilities.

In this case, the standard policy generator may generate the standard policy in an XML format and store the generated standard policy.

In this case, if it is determined that the security rule of the new system or the security rule of the changed system can not be included as a part of the standard policy, the consistency verification unit may change the security rule of the new system or the security rule of the changed system, And may include a standard policy correction unit that defines the standard policy as an exception and corrects the standard policy.

In this case, if it is determined that the security rule of the new system or the security rule of the changed system can not be included as part of the standard policy, the consistency verification unit may determine whether the security rule of the new system or the security rule of the changed system, And may include a violation display part for displaying a part that can not be included as a part and providing it to the manager.

In this case, the consistency verification unit may include a standard policy transmission unit for transmitting the standard policy to at least one or more systems when the security rule of the new system or the security rule of the changed system is determined to be included as a part of the standard policy .

According to another aspect of the present invention, there is provided a method for managing a security policy, the method comprising: acquiring a predefined access policy security rule from at least one system and converting the access policy security rule into a standard format document, A topology extracting step of extracting a network topology for the at least one or more systems into a network topology, and a standard policy creating step of merging the generated topology and the generated topology to generate a standard policy.

The method may further include a consistency verification step of determining whether the security rule of the new system or the security rule of the changed system can be included as part of the standard policy after the standard policy generation step.

At this time, the rule set generation step may acquire at least one or more security rules in the form of an access control server system, an environment setting in a PC, and a document file from at least one system.

In this case, the rule set generation step may convert the obtained access policy security rules into XML format to generate a rule set, and store the converted rule set.

In this case, the topology extracting step may extract the network topology in an XML format and store the extracted network topology.

At this time, the topology includes a type and configuration of a plurality of power facilities existing in the field, and may include network information between the plurality of power facilities.

In this case, the standard policy generation step may generate the standard policy in an XML format and store the generated standard policy.

If it is determined in the consistency verification step that the security rule of the new system or the security rule of the changed system can not be included as part of the standard policy, after the consistency verification step, the security rule of the new system or the modified system And a standard policy correction step of correcting the security policy of the standard policy as an exception of the standard policy.

If it is determined in the consistency verification step that the security rule of the new system or the security rule of the changed system can not be included as part of the standard policy, after the consistency verification step, the security rule of the new system or the modified system And displaying a portion of the security rules of the security policy that can not be included as part of the standard policy and providing the portion to the administrator.

If it is determined in the consistency verification step that the security rule of the new system or the security rule of the changed system can be included as a part of the standard policy, after the consistency verification step, And transmitting the standard policy transmission step.

According to the present invention, various types of security rules are automatically collected and integrated into a standard format for each system, so that conflicts or errors between network access policies can be accurately analyzed.

In addition, according to the present invention, by integrating and applying distributed security policies in a smart grid environment based on IEC 61850, it is possible to maximize security in mutual operation of smart grid environment systems.

1 is a block diagram of a security policy management apparatus according to the present invention.
2 is an embodiment of an access policy security rule obtained from at least one or more systems.
3 is an embodiment of an SCL (Substation Configuration Language) file (R.xml) converted into an XML (extensible Markup Language) format of the obtained access policy security rule.
4 is a diagram for explaining the types of SCL files.
Figure 5 is an embodiment of a network topology file (T.xml) extracted in XML format.
6 is a diagram for explaining the configuration of the consistency verifying unit of the security policy managing apparatus according to the present invention.
FIG. 7 is an embodiment for verifying consistency in the consistency verification unit of the security policy management apparatus according to the present invention.
FIGS. 8 and 9 show a first embodiment for explaining a procedure for verifying consistency in the consistency verification unit.
10 and 11 are a second embodiment for explaining a procedure for verifying consistency in the consistency verification unit.
12 is a first embodiment of a security policy management method according to the present invention.
13 is a second embodiment of a security policy management method according to the present invention.

The present invention will now be described in detail with reference to the accompanying drawings. Hereinafter, a repeated description, a known function that may obscure the gist of the present invention, and a detailed description of the configuration will be omitted.

Embodiments of the present invention are provided to more fully describe the present invention to those skilled in the art.

Accordingly, the shapes and sizes of the elements in the drawings and the like can be exaggerated for clarity.

1 is a block diagram of a security policy management apparatus according to the present invention.

Referring to FIG. 1, the security policy management apparatus 100 according to the present invention acquires a predetermined access policy security rule from at least one or more systems and converts the security policy rule into a standard format document, thereby generating a rule set A topology extracting unit 120 for extracting a network topology of the entire system to which security rules are to be integrated in a network topology, a rule set generation unit 110 for generating a rule set, And a standard policy generation unit 130 for merging the topology extracted by the unit 120 and generating a standard policy.

At this time, the security policy management apparatus 100 according to the present invention may further include a consistency verification unit 140 for determining whether the security rule of the new system or the security rule of the changed system can be included as part of the standard policy have.

The rule set generation unit 110 generates a rule set by acquiring predetermined access policy security rules from at least one system and converting the access policy security rules into a standard format document.

More specifically, the access policy security rule of at least one of the access control server system, the environment setting in the PC, and the document file is obtained from at least one system.

That is, since various types of access policy security rules are provided for each system, the rule set generation unit 110 acquires various types of security rules from a plurality of systems when acquiring the access policy security rules.

The form of the access policy security rule is mainly a natural language form or a form defined by a manager arbitrarily in each system.

2 is an embodiment of an access policy security rule obtained from at least one or more systems.

Referring to FIG. 2, an example of the access policy security rule will be described. The '+' symbol is used as an access allowance marker, and the '-' symbol is used as a discretionary access control rule.

Specific users and user groups are described in the second element, and the authority name or function name used in the policy is described in the third element.

The rule set generation unit 110 also converts the obtained access policy security rules into an XML format to generate a rule set and stores the converted rule set.

3 is an embodiment of an SCL (Substation Configuration Language) file (R.xml) converted into an XML (extensible Markup Language) format of the obtained access policy security rule. 4 is a diagram for explaining the types of SCL files.

Access policy security rules obtained from at least one system are composed of natural language rule sets, which are converted into XML standard format documents and stored in a rule set (R.xml).

Referring to FIG. 4, the IEC 61850 system basically uses a substation configuration information language called SCL (Substation Configuration Language), and is divided into various types such as SSD, SCD, ICD, and CID according to a moving path of a file.

All of these SCL files are described in a language based on the XML format by applying the method established by the IEC international standard. Therefore, the core of the present invention is to add a verified standard policy file (P.xml) to the bottom of the existing system-specific SCL file.

The topology extracting unit 120 extracts a network topology of the entire system in which the security rules are to be integrated into a network topology.

In this case, the topology extracting unit 120 may extract the network topology in an XML format and store the extracted network topology.

Also, the topology includes a type and configuration of a plurality of power facilities existing in the field, and includes network information between the plurality of power facilities.

Figure 5 is an embodiment of a network topology file (T.xml) extracted in XML format.

More specifically, referring to FIG. 5, the topology describes the detailed interface of the device, the IP address, etc. in the <node> field according to the XML standard format.

Also, the network information between devices is described in the <link> field, and the <from> and <to> fields are used to indicate the network direction. There are many cases in which there is a one-way network flow between power facilities having different security levels, and a field indicating a direction is specified.

The standard policy generation unit 130 merges the generated rule set and the extracted topology to generate a standard policy.

In this case, the standard policy generation unit 130 may generate the standard policy in an XML format and store the generated standard policy.

The rule set R.xml generated by the rule set generation unit 110 and the topology T.xml extracted by the topology extraction unit 120 are merged into one standard policy file P.xml).

The standard policy file is the final result to be derived through the present invention, and when the consistency verification described later is completed, the standard policy file (P.xml) is distributed to the distributed systems. This file is generally used as a document describing security policies that comply with government policies and international standards. In the present invention, however, the role of this file is to extend the final policy of the security department that includes all security policies of distributed systems It is defined as a signature. Thus, the standard policy can be expressed by Equation 1 below.

이 반영되고, 네트워크 토폴로지

가 생성된다고 가정한다 이 때 표준 정책

는 두집합의 합집합으로써 표현된다.
Security policy for i-th time security policy management

And the network topology

It is assumed that the standard policy

Is expressed as the union of two sets.

The consistency verifying unit 140 performs a function of determining whether the security rule of the new system or the security rule of the changed system can be included as part of the standard policy.

6 is a diagram for explaining the configuration of the consistency verifying unit of the security policy managing apparatus according to the present invention.

Referring to FIG. 6, the consistency verifying unit 140 includes a standard policy correcting unit 141 and a violation display unit 142.

If it is determined that the security rule of the new system or the security rule of the changed system can not be included as a part of the standard policy, the standard policy corrector 141 updates the security rule of the new system or the security rule of the changed system to the standard And performs the function of correcting the standard policy by defining it as an exception of the policy.

If it is determined that the security rule of the new system or the security rule of the changed system can not be included as part of the standard policy, the violation item display unit 142 displays the security rule of the new system or the security rule of the changed system, And displays the portion that can not be included as a part of the message and provides the message to the administrator.

The consistency verification unit 140 will be described in detail with reference to the following equations (2) and (3).

이 표준 정책의 일부로 포함 가능한지 검증하는 기능을 수행한다.When a new system (n + 1) occurs, the consistency verification operation can be expressed by Equation (2). This task is performed by the security rules

As part of this standard policy.

이 표준 정책의 일부로 포함 가능한지 검증하는 기능을 수행한다.
If a changed system occurs, the consistency verification operation for each of the systems can be expressed by Equation (3). This is done by changing the security rules of the changed system

As part of this standard policy.

FIG. 7 is an embodiment for verifying consistency in the consistency verification unit of the security policy management apparatus according to the present invention.

Referring to FIG. 7, it is verified whether or not merge is performed as part of the existing standard policy, and a new item or a changed item is added to a place where a 100% matching or a highest similarity policy is described.

At this time, if policy violation is not found, standard policy (P.xml) is distributed to distributed systems. The standard policy once distributed is eventually distributed as a combination of the first rule set and the network topology in the form of Equation (1).

The distributed standard policy (P.xml) is merged into the existing SCL file and managed.

FIGS. 8 and 9 show a first embodiment for explaining a procedure for verifying consistency in the consistency verification unit.

Referring to FIGS. 8 and 9, if there is a new or changed Smart Grid system in a situation where there is a standard policy P.xml already created once, the new or changed system 1 may be configured to have a network topology T. xml), and receives the changed access policy from the standard policy server 2. That is, the rule set of the individual system is transmitted in the form of R.xml, and the standard policy is transmitted in the form of P.xml.

10 and 11 are a second embodiment for explaining a procedure for verifying consistency in the consistency verification unit.

10 and 11, a topology T already loaded and a changed rule set R are transmitted in the new or changed system 1, and the changed standard access policy is transmitted from the standard policy server 2 Receive. That is, the rule set of the individual system is transmitted in the form of R.xml, and the standard policy is transmitted in the form of P.xml.

If a policy violation is detected, two tasks can be performed. This is a part where the administrator and the security officer need to confirm directly. First, indicate to the administrator or the security officer the location and the rationale to coordinate the specific terms in the rule set (R.xml).

Second, we end up including a rule set (R.xml) that can not be merged with the existing policy as a policy exception and including it in the standard policy (P.xml).

및

에서 대응 작업이 필요한 영역을 알려주고, 위반 사항에 대한 근거를

에서 찾아 그 위치를 표시하는 작업이 이루어 진다.
Referring to Fig. 11,

And

To identify the areas that need to be addressed, and to provide a basis for

And the position is displayed.

Hereinafter, a security policy management method according to the present invention will be described.

The description of the technology common to the above-described security policy management apparatus 100 according to the present invention will be omitted.

12 is a first embodiment of a security policy management method according to the present invention. 13 is a second embodiment of a security policy management method according to the present invention.

Referring to FIG. 12, a first embodiment of a security policy management method according to the present invention will be described. In the security policy management method according to the present invention, first, a security rule is acquired from systems and a rule set is generated (S100) .

Specifically, in step S100, the access policy security rule is retrieved from at least one or more systems and converted into a standard format document to generate a rule set.

At this time, the step S100 acquires at least one or more security rules of at least one of the access control server system, the environment setting in the PC, and the document file from the at least one system, converts the obtained access policy security rule into XML format, You can create a set, and save the converted rule set.

Thereafter, the network configuration diagram is extracted to the topology (S110).

Specifically, in step S110, the network topology of the entire system in which the security rules are to be integrated is extracted.

In this case, in step S110, the network topology may be extracted in XML format and the extracted network topology may be stored. The topology may include a type and configuration of a plurality of power facilities existing in the field, And may include network information between power facilities.

Thereafter, a standard policy is generated by merging the rule set generated in step S100 and the topology extracted in step S110 (S120).

In this case, in step S120, the standard policy may be generated in an XML format and the generated standard policy may be stored.

Thereafter, in step S130, it is verified whether or not the security rule of the new / change system can be included in the standard policy. If it is determined that it can be included, the standard policy is transmitted to the systems in step S140, If so, in step S150, an exception of the standard policy is specified to correct the standard policy, and the security policy management method according to the present invention is terminated.

A security policy management method according to a second embodiment of the security policy management method according to the present invention will now be described with reference to FIG. 13. First, a security rule is acquired from systems and a rule set is generated (S200) .

More specifically, in step S200, the access policy security rule is retrieved from at least one or more systems and converted into a standard format document to generate a rule set.

At this time, the step S200 acquires at least one or more security rules in the form of an access control server system, an environment setting in the PC, and a document file from at least one system, converts the obtained access policy security rule into an XML format, You can create a set, and save the converted rule set.

Thereafter, the network configuration diagram is extracted to the topology (S210).

More specifically, the step S210 extracts a network topology of the entire system in which the security rules are to be integrated.

In this case, in step S210, the network topology may be extracted in an XML format and the extracted network topology may be stored. The topology may include a type and configuration of a plurality of power facilities existing in the field, And may include network information between power facilities.

Thereafter, the standard policy is generated by merging the rule set generated in step S200 and the topology extracted in step S210 (S220).

At this time, in step S220, the standard policy may be generated in an XML format and the generated standard policy may be stored.

Thereafter, in step S230, it is verified whether the security rule of the new / change system can be included in the standard policy. If it is determined that it can be included, the standard policy is transmitted to the systems in step S240, If it is determined in step S250, the part that can not be included in the standard policy is displayed and provided to the administrator in step S250, and the security policy management method according to the present invention ends.

As described above, in the existing Smart Grid environment, there are many difficulties in integrated management by applying only some access control policies by hand, without the system, to apply policies of distributed systems. However, in the security policy management apparatus 100 ) And method, it is possible to accurately analyze collision or error between network access policies, thereby maximizing security in mutual operation of smart grid environment systems.

In addition, the present invention can be applied to the security threat detection function of the smart grid environment of the IEC 61850 standard. Defines the whole threat detection rule by using security policy violation detection as header of rule and body detection as signature detection. This result is highly applicable as a rule to be detected when an unauthorized user or system illegally attempts to access the control system.

As described above, the apparatus and method for managing security policy according to the present invention are not limited to the configuration and method of the embodiments described above, but the embodiments may be modified in various ways, All or some of them may be selectively combined

100: security policy management device
110: rule set generation unit 120: topology extraction unit
130: standard policy generation unit 140: consistency verification unit
141: Standard policy corrector 142: Violation indicator

Claims (20)

A rule set generation unit for generating a rule set by acquiring predefined access policy security rules from one or more systems and converting them into a standard format document;
A topology extractor for extracting a network topology for the one or more systems; And
A standard policy for creating a standard policy by summing all the combinations of a rule set applied to each system and a network topology when a system has a plurality of sets of rule sets and a network topology, Wherein the security policy management unit comprises: The method according to claim 1,
Further comprising a consistency verifying unit for determining whether the security rule of the new system or the security rule of the changed system is included as part of the standard policy. The method according to claim 1,
The rule-
Acquires security rules of at least one of an access control server system, an environment setting in a PC, and a document file from at least one system. The method according to claim 1,
The rule-
Converting the acquired access policy security rule into an XML format to generate a rule set, and storing the converted rule set. The method according to claim 1,
The topology-
Extracts the network topology in an XML format, and stores the extracted network topology. The method of claim 5,
The network topology includes:
The type and configuration of a plurality of power facilities existing in the field,
And network information between the plurality of power facilities. The method according to claim 1,
The standard policy generation unit may include:
Generates the standard policy in an XML format, and stores the generated standard policy. The method of claim 2,
The consistency verification unit may include:
If it is determined that the security rule of the new system or the security rule of the changed system can not be included as part of the standard policy,
And a standard policy revising unit for revising the security policy of the new system or the security rule of the changed system as an exception of the standard policy and correcting the standard policy. The method of claim 2,
The consistency verification unit may include:
If it is determined that the security rule of the new system or the security rule of the changed system can not be included as part of the standard policy,
And displaying a part of the security rule of the new system or the security rule of the changed system that can not be included as part of the standard policy and providing the part to the administrator. The method of claim 2,
The consistency verification unit may include:
If it is determined that the security rule of the new system or the security rule of the changed system can be included as part of the standard policy,
And a standard policy transmission unit transmitting the standard policy to one or more systems. A rule set generation step of acquiring a predetermined access policy security rule from at least one system and converting the security rule into a standard format document to generate a rule set;
A topology extracting step of extracting a network topology for the one or more systems; And
And a standard policy creation step of creating a union of a rule set applied to the system and the network topology as a standard policy,
The standard policy generation step includes:
Wherein when a plurality of systems exist, a standard policy is generated by summing both the rule set applied to each system and the unions of the network topology. The method of claim 11,
After the standard policy generation step,
Further comprising a consistency verification step of determining whether the security rule of the new system or the security rule of the changed system can be included as part of the standard policy. The method of claim 11,
The rule set generation step includes:
And acquiring security rules of at least one of an access control server system, an environment setting in a PC, and a document file from at least one system. The method of claim 11,
The rule set generation step includes:
Converting the acquired access policy security rules into an XML format to generate a rule set, and storing the converted rule set. The method of claim 11,
In the topology extracting step,
Extracting the network topology in an XML format, and storing the extracted network topology. 16. The method of claim 15,
The network topology includes:
The type and configuration of a plurality of power facilities existing in the field,
And network information between the plurality of power facilities. The method of claim 11,
The standard policy generation step includes:
Generating the standard policy in XML format, and storing the generated standard policy. The method of claim 12,
In the consistency verification step,
If it is determined that the security rule of the new system or the security rule of the changed system can not be included as part of the standard policy,
After the consistency verification step,
Further comprising a standard policy correcting step of correcting the security policy of the new system or the security rule of the changed system as an exception of the standard policy to correct the standard policy. The method of claim 12,
In the consistency verification step,
If it is determined that the security rule of the new system or the security rule of the changed system can not be included as part of the standard policy,
After the consistency verification step,
And displaying a portion of the security rule of the new system or the security rule of the changed system that can not be included as a part of the standard policy and providing the portion to the administrator. The method of claim 12,
In the consistency verification step,
If it is determined that the security rule of the new system or the security rule of the changed system can be included as part of the standard policy,
After the consistency verification step,
Further comprising a standard policy transfer step of transferring the standard policy to one or more systems.

Images