KR101993648B1 - Method and apparatus for security in network device - Google Patents

Abstract

A security method in a network device is disclosed. According to another aspect of the present invention, there is provided a network security method comprising: receiving received data, which is data composed of a plurality of segments, from an external device in response to a data request signal, which is a signal for requesting transmission of data; Recovering a damaged segment of the plurality of segments based on a database in which the recovery unit includes at least one of header information and identification information for each of the plurality of segments; And the reassembling unit reassembles the plurality of segments to generate reassembly data.

Description

METHOD AND APPARATUS FOR SECURITY IN NETWORK DEVICE FIELD OF THE INVENTION [0001]

The present invention relates to a security method and apparatus in a network device, and more particularly, to a security method and apparatus in a network device, and more particularly, And more particularly, to a method and apparatus for improving security by detecting an external attack.

As network devices including industrial control systems are already closed, the recognition level of security such as software vulnerabilities is insufficient. However, as the connectivity of industrial control system environment such as IIoT (Industrial Internet of Things) increases, the need for security Is also increasing.

Especially, in Project Robus of Automatak, 31 vulnerabilities were found in software products that implemented communication protocols (eg DNP3, IEC 61850, Modbus, etc.) used in network devices. Or to prevent normal operation.

In order to do this, security firmware was provided by each product company, but it is difficult to stop the equipment due to the feature of the network device having the importance of availability, and there is a great risk of patching the new firmware that has no potential problem. Therefore, security patch I needed a plan.

In addition, there is a need for security measures against attacks using potential software and protocol vulnerabilities. In particular, an attack that manipulates the values of reassembly-related fields makes it impossible to reassemble the received data, Can be reduced.

Accordingly, there is a need for a method and apparatus for improving security by performing recovery against a reassembly attack against a network device such as an industrial control system and detecting an attack against a network device through a virtual patch without performing a direct patch There is a growing need for

A related prior art is Korean Registered Patent No. 10-1383069 entitled " Network abnormal status detection device and method, public date: April 2, 2014.

SUMMARY OF THE INVENTION The present invention provides a method and apparatus for improving security by performing restoration of a reassembly attack degrading the availability of a network device and detecting an attack on a network device through a virtual patch without performing a direct patch.

The problems to be solved by the present invention are not limited to the above-mentioned problem (s), and another problem (s) not mentioned can be clearly understood by those skilled in the art from the following description.

According to another aspect of the present invention, there is provided a network security method comprising: receiving received data, which is data composed of a plurality of segments, from an external device in response to a data request signal, which is a signal for requesting transmission of data; Recovering a damaged segment of the plurality of segments based on a database in which the recovery unit includes at least one of header information and identification information for each of the plurality of segments; And the reassembling unit reassembles the plurality of segments to generate reassembly data.

Advantageously, the step of recovering the damaged segment among the plurality of segments comprises: detecting a beginning segment among the plurality of segments using header information included in the database; Detecting an intermediate segment that is at least one segment of the plurality of segments excluding the start segment and the end segment using the identification information included in the database; Detecting the ending segment from among the plurality of segments based on the size of each of the plurality of segments; And at least one of a start segment identifier (FIR), an end segment identifier (FIN), and a serial number (SEQ) included in each of the plurality of segments, based on the start segment, the at least one intermediate segment, And recovering the information about the information.

Advantageously, said identification information may be information for identifying the order of said at least one intermediate segment.

Preferably, the step of receiving the received data may determine whether the end segment is received based on the total size of the at least one segment received so far, the size of the received data, and the maximum size per segment.

Preferably, the method may further include determining whether the reassembled data is abnormal data, based on at least one of the virtual patch attachment white list rule and the black list rule.

Preferably, the alarm unit may further include generating alarm information including information on the cause of the reassembled data being abnormal data if the reassembled data is abnormal data.

According to another aspect of the present invention, there is provided a network security apparatus comprising: a reception unit for receiving reception data, which is data composed of a plurality of segments from an external device, in response to a data request signal, which is a signal for requesting transmission of data; A restoration unit for restoring a damaged segment among the plurality of segments based on a database including at least one of header information and identification information for each of the plurality of segments; And a reassembly unit for reassembling the plurality of segments to generate reassembly data.

Preferably, the recovery unit detects a start segment from among the plurality of segments using the header information included in the database, and, using the identification information included in the database, extracts, from among the plurality of segments, Detecting an end segment of the plurality of segments based on the size of each of the plurality of segments, and detecting the start segment, the at least one intermediate segment, and the at least one intermediate segment, Based on the end segment, information about at least one of a start segment identifier (FIR), an end segment identifier (FIN), and a serial number (SEQ) included in each of the plurality of segments can be recovered.

Advantageously, said identification information may be information for identifying the order of said at least one intermediate segment.

Preferably, the receiver may determine whether to receive the end segment based on the total size of the at least one segment received so far, the size of the received data, and the maximum size per segment.

Preferably, based on at least one of the white list rule and the black list rule, the virtual patch unit may further include a virtual patch unit for judging whether the reassembled data is abnormal data.

Preferably, if the reassembled data is abnormal, the alarm unit may generate alarm information including information on the cause of the reassembled data being abnormal data.

The network security method and apparatus of the present invention can maximize the availability of the network device by improving the security of the network device through the virtual patch without directly patching the network device.

Further, the present invention has the effect of restoring the operation or the damaged segment even if the order of the data transmitted by being divided into a plurality of segments is manipulated or damaged.

In addition, the present invention has an effect of detecting abnormal data transmitted to a network device using a blacklist rule and a white list rule.

1 is a flowchart illustrating a network security method according to an embodiment of the present invention.
2 is a flowchart illustrating a network security method according to another embodiment of the present invention.
3 is a flow chart illustrating a method for recovering a damaged segment in accordance with an embodiment of the present invention.
4 is a block diagram illustrating a network security apparatus according to an embodiment of the present invention.
FIGS. 5 to 6 are diagrams for explaining damage occurring to the start segment whether or not the start segment (FIR), the end segment (FIN), and the serial number (SEQ) information of each segment according to an embodiment of the present invention.
7 to 9 are views for explaining a process of reassembling a plurality of segments according to an embodiment of the present invention.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention. Like reference numerals are used for like elements in describing each drawing.

The terms first, second, A, B, etc. may be used to describe various elements, but the elements should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component. And / or < / RTI > includes any combination of a plurality of related listed items or any of a plurality of related listed items.

It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, . On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between.

The terminology used in this application is used only to describe a specific embodiment and is not intended to limit the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In the present application, the terms "comprises" or "having" and the like are used to specify that there is a feature, a number, a step, an operation, an element, a component or a combination thereof described in the specification, But do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the contextual meaning of the related art and are to be interpreted as either ideal or overly formal in the sense of the present application Do not.

Hereinafter, preferred embodiments according to the present invention will be described in detail with reference to the accompanying drawings.

1 is a flowchart illustrating a network security method according to an embodiment of the present invention.

A virtual patch is not a patch applied directly to the inside of a network device (e.g., an industrial control system device), but is applied between an external network and the network device to detect an external attack on the network device It is a patch.

At this time, the security device including the restoration of the reassembly attack and the network security method such as the virtual patch is located between the external network and the network device to detect the external attack, thereby protecting the network device from external attack can do. To this end, the security device may include a receiving unit, a restoring unit, and a reassembling unit.

In addition, even when the virtual patch is updated, the availability of the network device can be ensured by updating only the security device without stopping the operation of the network device.

In step S110, the receiving unit receives received data, which is data composed of a plurality of segments, from an external device in response to a data request signal, which is a signal for requesting transmission of data.

At this time, the data request signal may be a signal predefined in the communication protocol defined between the network device and the external device, and may be a signal transmitted from the network device to the external device. In other words, the network device can transmit the data request signal to the external device in order to receive the specific data defined in the protocol from the external device.

Further, in accordance with the data request signal, the network device can receive the received data from the external device. At this time, the received data may reach the receiving unit located between the external network and the network device before reaching the network device.

On the other hand, a segment is a unit for dividing and transmitting data between computers, and can be defined in advance by the protocol and the like. In addition, it may be the same as a packet in which data transmitted between computers is divided according to a predetermined size (i.e., a maximum size of a packet).

In another embodiment, when the receiving unit receives the received data, it may determine whether to receive the ending segment based on the sum of the sizes of the at least one segment received so far, the size of the received data, and the maximum size per segment .

That is, the receiving unit can determine whether or not the end segment is received by using Equation (1). More specifically, when the inequality of Equation (1) holds, the receiving unit can determine that the received segment is the ending segment.

[Equation 1]

Where R is the sum of the sizes of at least one segment received so far and T is the size of the received data.

For example, the total size of the received data is 750 bytes, the total size of at least one segment received so far is 700 bytes, and the maximum size per segment can be 100 bytes. At this time, since the size of the data to be received is 50 bytes, which is smaller than the maximum size per segment of 100 bytes, the receiving unit can now judge that the received segment is the ending segment.

At this time, the total size of the received data may be determined in advance by a protocol or the like according to the type of the transmitted data request signal, and the sum of the sizes of the at least one segment received so far may be determined by summing the sizes of the received segments , And the maximum size per segment may be determined in advance by a protocol or the like.

In step S120, the recovery unit recovers the damaged segment among the plurality of segments based on the database including at least one of the header information and the identification information for each of the plurality of segments.

Here, the database can be generated by extracting information necessary for data reassembly from normal traffic composed of normal data transmitted from an external device to a network device. For example, the information required for data reassembly may include a field value included in a header of the data, a position of the field value, an identification value regularly used to identify the order of the segment, a position of the identification value, The total number of segments to be transmitted, and so on.

The header information may be information on the value and position of a field included in a header of data transmitted from an external device to a network device (e.g., a function code related to a function, a data type related to the type of data, and the like). Further, the identification information may be an identification value for identifying each segment and information on the position of the identification value. In addition, the database may include information on the total number of segments transmitted according to the type of data transmitted from the external device to the network device.

At this time, if the damaged segment is not detected as a result of analyzing the plurality of segments based on the database, the recovery unit can directly perform step S130 without restoring the segment.

On the other hand, a detailed method of restoring the damage by the restoring unit will be described later in detail with reference to FIG.

Finally, in step S130, the reassembly unit reassembles the plurality of segments to generate reassembly data.

For example, the reassembly unit may generate reassembly data by reassembly using the start segment, the end segment, and the remaining intermediate segments. At this time, the reassembling unit can generate reassembly data using the segment recovered in step S120.

However, if a particular segment is found to be missing in the reassembly process, the reassembly unit may not generate the reassembly data. Also, the reassembly unit can generate alarm information for the segment omission and transmit it to the manager of the network device.

As described above, the network security method according to an embodiment of the present invention has the effect of recovering a manipulated or damaged segment even if the order of data transmitted in a plurality of segments is manipulated or damaged.

2 is a flowchart illustrating a network security method according to another embodiment of the present invention.

In step S210, in response to the data request signal, which is a signal for requesting data transmission, the receiving unit receives received data, which is data composed of a plurality of segments from an external device.

In step S220, the recovery unit recovers the damaged segment among the plurality of segments based on the database including at least one of the header information and the identification information for each of the plurality of segments

In step S230, the reassembly unit reassembles the plurality of segments to generate reassembly data.

Finally, in step S240, based on at least one of the virtual patch section, the white list rule, and the black list rule, it is determined whether the reassembled data is abnormal data.

Here, the whitelist rule is based on a white list constructed by collecting information related to normal data transmitted from an external device to a network device, and when the reassembled data is included in the whitelist, May not be in violation of the rule.

On the other hand, the blacklist rule is based on a black list constructed by collecting information related to abnormal data transmitted from an external device to a network device, and when the reassembled data is included in the blacklist, It may be the rule that determines that the data violates the rule.

That is, when the reassembled data is not included in the whitelist or is included in the black list, the virtual patch unit can judge it as abnormal data. However, the virtual patch section can distinguish the case where the reassembled data is not included in the whitelist and the case in which the reassembled data is included in the black list, and can be processed differently.

For example, if the reassembled data is included in the blacklist, the virtual patch unit can discard the reassembled data and prevent it from being transmitted to the network device. This is because the reassembled data may be an attack that may cause a fatal problem to the network device.

On the other hand, when the reassembled data is not included in the black list and the whitelist, the virtual patch section can transmit the reassembled data to the network device. This is because although the reassembly data is not included in the whitelist, it is not included in the blacklist and may not be dangerous data.

In another embodiment, if the alarm section is abnormal data, the reassembly data may generate alarm information including information about the cause of the reassembly data being abnormal data.

On the other hand, if the reassembled data is abnormal, the alarm unit can generate alarm information including information on the cause of the abnormal data, and transmit the generated alarm information to the manager of the network device. At this time, the cause of the abnormal data may be that the reassembled data is included in the blacklist or not included in the whitelist.

More specifically, when the reassembled data is included in the blacklist, the virtual patch unit discards the reassembled data and does not deliver the reassembled data to the network device. On the other hand, the alarm unit causes the abnormal data included in the blacklist to be received Can be generated.

When the reassembled data is not included in the black list and the whitelist, the virtual patch unit transfers the reassembled data to the network device. On the other hand, the alarm unit causes the abnormal patch data not included in the whitelist to be received So that alarm information can be generated.

As described above, the network security method according to another embodiment of the present invention is capable of detecting whether data transmitted to the network device is abnormal data for attack using the blacklist rule and the white list rule.

3 is a flow chart illustrating a method for recovering a damaged segment in accordance with an embodiment of the present invention.

For example, referring to FIG. 6, the FIR, FIN, and Seg # (i.e., SEQ) values are normal (Normal) for a total of four segments. Also, the case where the FIN and FIR values are damaged from 0 to 1 or from 1 to 0 is also shown.

In step S310, the recovery unit detects the start segment from the plurality of segments using the header information included in the database.

For example, referring to FIG. 7, a network device may transmit a data request signal corresponding to the specific data to an external device in order to receive specific received data. At this time, if the value of the function code field included in the header information of the received data corresponding to the specific data request signal is 0x81, the recovering unit can detect the start segment by searching for a segment having a function code field value of 0x81 among a plurality of segments .

At this time, the recovery unit can improve the detection accuracy of the start segment by using the information of various field values included in the header information as well as the function code.

In addition to the expected response after the transmission of the request message, the recovery unit can receive and process the main message such as a spontaneous response (i.e., asynchronous response) before the expected response. This can be handled by checking the function code in step S310 and accepting the message in the case of a message to be processed, and ignoring the segment if the response is not a response corresponding to the data request signal in other cases.

In step S320, the recovery unit detects the intermediate segment, which is at least one of the plurality of segments, excluding the start segment and the end segment, from among the plurality of segments, using the identification information included in the database.

That is, the restoring unit can use the identification information stored in the database to determine the order of each of the at least one intermediate segment. 8, the restoring unit can continuously detect the middle segment and determine the order thereof while the total size of the received start segment and the middle segment is smaller than the total size of the received data minus the maximum size per segment have.

The detailed method for determining the order of each of the at least one intermediate segment will be described later in detail in the description of the embodiments below.

In another embodiment, the identification information may be information for identifying the order of at least one intermediate segment.

That is, since at least one intermediate segment other than the start segment and the end segment is a data sequence to be transmitted in order according to a predetermined size, it may be difficult to distinguish the segment among the at least one intermediate segment. Thus, each intermediate segment may contain a particular identification value that is used regularly to distinguish it. It may also be more desirable to design the protocol such that each intermediate segment includes an identification value that can all be sequenced.

For example, each intermediate segment may include serial number information that sequentially increases at a predetermined position, and information about the serial number may be included in the identification information. Also, some intermediate segments may include a specific value at a predetermined position according to a rule determined for each segment, and information about the predetermined rule may be included in the identification information.

At this time, the recovery unit can identify the order of the at least one intermediate segment using the identification information stored in the database.

In step S330, the restoring unit detects the ending segment among the plurality of segments based on the size of each of the plurality of segments.

For example, when the received data is composed of 10 segments in total, and the maximum size of one segment is 100 bytes, the size of nine segments may be 100 bytes and the size of one segment may be 50 bytes. At this time, the recovery unit can detect the segment of the size of 50 bytes as the end segment.

This is because, in general, a segment is generated so as to have a maximum size in order to minimize the number of segments to be transmitted, and data is transmitted, so a segment smaller than the maximum size can be regarded as an end segment .

Referring to FIG. 9, the recovery unit may determine that the reception of the received data is completed when the sum of the sizes of the received data and the received plurality of segments becomes equal.

Finally, in step S340, the recovery unit determines whether the start segment (FIR), the end segment (FIN), and the serial number (SEQ) included in each of the plurality of segments based on the start segment, the at least one intermediate segment, Restores information about at least one.

For example, data of 1 byte (8 bits) including information on start segment existence (FIR), end segment existence (FIN) and serial number (SEQ) may be included in a predetermined position of each segment. At this time, the FIR indicates a start segment when it is 1, and it can indicate that it is not a start segment when it is 0. In addition, FIN indicates a termination segment when it is 1, and it can indicate that it is not a termination segment when it is 0. [ Also, the SEQ may indicate how many segments are transmitted among the plurality of segments.

Also, referring to FIG. 5, there is shown a method in which a general network device receives and operates data using FIR, FIN, and SEQ values. That is, according to the FIR, FIN and SEQ values, a general network device operates according to a predetermined rule as shown in FIG. 5. If the FIR, FIN, and SEQ values are manipulated or damaged even if 1 bit is used, It can become impossible.

However, the recovery unit may analyze the FIR, FIN, and SEQ values for each of the detected start segment, intermediate segment, and end segment, and recover the corrupted value if the FIR, FIN, and SEQ values are corrupted.

For example, if the FIR value of the start segment is 1, the FIN value is 0, and the SEQ value is not 1, the recovery unit can restore the FIR value to 1, FIN value to 0, and SEQ value to 1. [ If the FIR value of the intermediate segment is 0, the FIN value is 0, and the SEQ value is not N (N is a natural number), the recovery unit can recover the FIR value to 0, the FIN value to 0, and the SEQ value to N . In this case, N may be a value indicating the order of the segments determined according to the identification information. If the FIR value of the ending segment is 0, the FIN value is 1, and the SEQ value is not M (M is the total number of segments), the recovery unit may be configured such that the FIR value is 0, the FIN value is 1, can do.

As described above, the network security method according to an embodiment of the present invention has the effect of recovering a manipulated or damaged segment even if the order of data transmitted in a plurality of segments is manipulated or damaged.

4 is a block diagram illustrating a network security apparatus according to an embodiment of the present invention.

Referring to FIG. 4, the network security apparatus 400 includes a receiving unit 410, a restoring unit 420, and a reassembling unit 430 according to an embodiment of the present invention. In addition, it may further include a virtual patch unit (not shown) and an alarm unit (not shown).

The receiving unit 410 receives received data, which is data composed of a plurality of segments, from an external device in response to a data request signal, which is a signal for requesting data transmission.

In another embodiment, the receiver 410 may determine whether to receive the end segment based on the sum of the sizes of the at least one segment received so far, the size of the received data, and the maximum size per segment.

The restoring unit 420 restores the damaged segment among the plurality of segments based on the database including at least one of the header information and the identification information for each of the plurality of segments.

In another embodiment, the restoring unit 420 detects the start segment among the plurality of segments using the header information included in the database, and uses the identification information included in the database to identify the start segment and the start segment Detecting an end segment of the plurality of segments based on the size of each of the plurality of segments, and detecting an end segment of the start segment, at least one of the intermediate segment and the end segment , Information on at least one of the start segment existence (FIR), the end segment existence (FIN), and the serial number (SEQ) contained in each of the plurality of segments can be restored.

In another embodiment, the identification information may be information for identifying the order of at least one intermediate segment.

The reassembling unit 430 reassembles the plurality of segments to generate reassembly data.

The virtual patch unit (not shown) determines whether the reassembled data is abnormal based on at least one of the whitelisting rule and the blacklist rule.

If the reassembled data is abnormal, the alarm unit (not shown) generates alarm information including information on the cause of the reassembled data being abnormal data.

The above-described embodiments of the present invention can be embodied in a general-purpose digital computer that can be embodied as a program that can be executed by a computer and operates the program using a computer-readable recording medium.

The computer readable recording medium includes a magnetic storage medium (e.g., ROM, floppy disk, hard disk, etc.), optical reading medium (e.g., CD ROM, DVD, etc.).

The present invention has been described with reference to the preferred embodiments. It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. Therefore, the disclosed embodiments should be considered in an illustrative rather than a restrictive sense. The scope of the present invention is defined by the appended claims rather than by the foregoing description, and all differences within the scope of equivalents thereof should be construed as being included in the present invention.

Claims (12)

A security device located between an external network and a network device, the security method comprising:
Receiving received data, which is data composed of a plurality of segments, from an external device in response to a data request signal, which is a signal for requesting transmission of data by the receiving unit;
Recovering a damaged segment of the plurality of segments based on a database in which the recovery unit includes at least one of header information and identification information for each of the plurality of segments;
Reassembling the plurality of segments to generate reassembly data; And
Wherein the virtual patch unit detects an external attack on the network device using the reassembled data
The method comprising the steps of: The method according to claim 1,
The step of recovering the damaged segment of the plurality of segments
Detecting a start segment among the plurality of segments using header information included in the database;
Detecting an intermediate segment that is at least one segment of the plurality of segments excluding the start segment and the end segment using the identification information included in the database;
Detecting the ending segment from among the plurality of segments based on the size of each of the plurality of segments; And
(FIR), end segment (FIN), and serial number (SEQ) contained in each of the plurality of segments based on the start segment, the at least one intermediate segment, and the end segment. Steps to recover information
The method comprising the steps of: 3. The method of claim 2,
The identification information
Wherein the information is information for identifying the order of the at least one intermediate segment. The method according to claim 1,
The step of receiving the received data
Determining whether to receive the end segment based on the total size of at least one segment received so far, the size of the received data, and the maximum size per segment. The method according to claim 1,
The step of detecting an external attack on the network device
Determining whether the reassembled data is abnormal data, based on at least one of a whitelist rule and a blacklist rule. 6. The method of claim 5,
Generating alarm information including information on a cause that the reassembled data is abnormal data if the reassembled data is abnormal;
Further comprising the steps of: 1. A network security device located between an external network and a network device,
A receiving unit for receiving received data, which is data composed of a plurality of segments from an external device, in response to a data request signal, which is a signal for requesting transmission of data;
A restoration unit for restoring a damaged segment among the plurality of segments based on a database including at least one of header information and identification information for each of the plurality of segments;
A reassembly unit for reassembling the plurality of segments to generate reassembly data; And
A virtual patch unit for detecting an external attack on the network device using the reassembled data;
The network security device comprising: 8. The method of claim 7,
The recovery unit
Detecting a start segment among the plurality of segments by using header information included in the database,
Detecting an intermediate segment that is at least one segment from the plurality of segments excluding the start segment and the end segment using the identification information included in the database,
Detecting the end segment among the plurality of segments based on the size of each of the plurality of segments,
(FIR), end segment (FIN), and serial number (SEQ) contained in each of the plurality of segments based on the start segment, the at least one intermediate segment, and the end segment. Wherein the information is recovered. 9. The method of claim 8,
The identification information
Wherein the information is information for identifying the order of the at least one intermediate segment. 8. The method of claim 7,
The receiving unit
Wherein the determination unit determines whether to receive the end segment based on the total size of the at least one segment received so far, the size of the received data, and the maximum size per segment. 8. The method of claim 7,
Wherein the virtual patch section determines whether the reassembled data is abnormal data based on at least one of a whitelist rule and a blacklist rule. 12. The method of claim 11,
If the reassembled data is abnormal, generating an alarm information including information on a cause that the reassembled data is abnormal data,
The network security device further comprising:

Images