KR102190693B1 - Adaptive security profile-based network security apparatus and method for remote monitoring of energy storage systems - Google Patents

Abstract

An apparatus and method for network security in an energy storage system are provided. According to the present invention, the apparatus for network security in an energy storage system receives a profile including information on detection criteria and blocking behavior for a control message, determines a normal control message and an abnormal control message through a deep packet analysis method for the control message received using the profile, blocks the abnormal control message, and periodically updates the profile based on analysis information in the process of determining the normal control message and the abnormal control message.

Description

Network security device and method based on adaptive security profile for remote monitoring of energy storage system {ADAPTIVE SECURITY PROFILE-BASED NETWORK SECURITY APPARATUS AND METHOD FOR REMOTE MONITORING OF ENERGY STORAGE SYSTEMS}

The present invention relates to a network security device, and more specifically, detection and blocking of abnormal attack messages by combining a detection method based on a security profile (white list) and a detection method based on machine learning for network security of an energy storage system. It relates to a network security device and method of an energy storage system that performs a function.

Energy Storage System (ESS) is a major technology that is predicted to explosive market growth by creating added values such as stabilizing power supply and spreading new and renewable energy. It stores power during times when power demand is low and reserves due to high power demand. It is possible to equalize the load by using the power stored in the time when the power is insufficient, and to save the cost of the construction of power plants and system lines.

The energy storage system, demand response (DR), and the energy management system (EMS: Energy Management System) or the integrated operation center are linked using the IEC 61970 / IEC 61968 protocol.

There is a need for a means to detect and block abnormal control messages in the wired/wireless network section for performing communication between the energy storage system and the integrated operation center.

One technical problem to be solved by the present invention is energy that blocks abnormal control messages using deep packet inspection based on an adaptive security profile in a junction section between an energy storage system and a wired/wireless network. It is to provide an apparatus and method for network security of a storage system.

Another technical problem to be solved by the present invention is to perform an adaptive security profile initially by using a security profile input by an administrator to block abnormal control messages, and to use information accumulated in the process of blocking abnormal control messages. It is to provide an apparatus and method for network security of an energy storage system for periodically updating a security profile.

The technical problem to be solved by the present invention is not limited to the above.

A network security device for an energy storage system according to an embodiment of the present invention includes: one or more processors; And one or more memories storing instructions for causing the one or more processors to perform an operation when executed by the one or more processors, wherein the one or more processors include information on a detection criterion and blocking behavior for a control message. Receiving the security profile, determining a normal control message and an abnormal control message through a deep packet analysis method for a control message received using the security profile, blocking the abnormal control message, and blocking the normal control message and the The security profile may be periodically updated based on analysis information in the process of determining the abnormal control message.

According to an embodiment, the one or more processors include: Internet Protocol (IP), port, access node name, control message header information, time information, XML in the process of determining the normal control message and the abnormal control message. The security profile may be periodically updated based on the analysis information including at least one of a reception value and a reference value for each tag, a control message size, a control message reception rate, and a service name.

According to an embodiment, the security profile includes: a security profile for each layer of a kernel layer, a transport protocol layer, an application layer, and a user interface layer; Security profile for each node interlocked with BEMS (Building Energy Management System), FEMS (Factory Energy Management System) and HEMS (Home Energy Management System); And at least one of the entire security profile of the energy storage system.

According to an embodiment, the one or more processors form analysis data based on analysis information in the process of determining the normal control message and the abnormal control message, and form statistical data for each predetermined period based on the analysis data. In addition, learning data may be formed from the analysis data and the statistical data using a machine learning algorithm, and the security profile may be periodically updated using the learning data.

A network security method for an energy storage system according to an embodiment of the present invention includes: receiving a security profile including information on a detection criterion and blocking behavior for a control message; Determining a normal control message and an abnormal control message through a deep packet analysis method for a control message received using the security profile; Blocking the abnormal control message; And periodically updating the security profile based on the analysis information in the process of determining the normal control message and the abnormal control message.

According to an embodiment, the step of periodically updating the security profile includes: Internet Protocol (IP), port, access node name, and control message header information in the process of determining the normal control message and the abnormal control message. , Time information, a reception value and a reference value for each XML tag, a control message size (size), a control message reception rate (rate), the security profile is periodically based on the analysis information including at least one of the service name It may include the step of updating.

According to an embodiment, the security profile includes: a security profile for each layer of a kernel layer, a transport protocol layer, an application layer, and a user interface layer; Security profile for each node interlocked with BEMS (Building Energy Management System), FEMS (Factory Energy Management System) and HEMS (Home Energy Management System); And at least one of the entire security profile of the energy storage system.

According to an embodiment, the periodically updating the security profile may include: forming analysis data based on analysis information in the process of determining the normal control message and the abnormal control message; Forming statistical data for each predetermined period based on the analysis data; Forming learning data from the analysis data and the statistical data using a machine learning algorithm; And periodically updating the security profile using the learning data.

An apparatus and method for network security of an energy storage system according to an embodiment of the present invention combines a detection method based on a security profile (white list) and a detection method based on machine learning for network security of the energy storage system to provide an abnormal attack message. Detection and blocking functions can be performed. Accordingly, the confidentiality and security of control messages transmitted and received between the energy storage system and the integrated operation center can be guaranteed, and the energy storage system can be protected from external network attacks.

In addition, the network security device and method of an energy storage system according to an embodiment of the present invention may periodically update a security profile based on analysis information in a process of determining a normal control message and an abnormal control message. As a result, it is possible to minimize the false detection rate according to the detection criteria changing by season, time period, and weather.

In addition, the network security device and method of an energy storage system according to an embodiment of the present invention uses at least one of a security profile for each layer, a security profile for each interlocking node, and an entire security profile for the energy storage system. It can detect and block messages. As a result, it is possible to detect abnormal attack messages from multiple angles, thereby improving the detection rate for abnormal attack messages.

1 is an exemplary diagram showing the configuration of a network security environment of an energy storage system according to an embodiment of the present invention.
2 is an exemplary diagram showing the configuration of a network security device of an energy storage system according to an embodiment of the present invention.
3 is a conceptual diagram illustrating a configuration of a security profile for each layer according to an embodiment of the present invention.
4 is a conceptual diagram illustrating a process of detecting and blocking an abnormal control message according to an embodiment of the present invention.
5 is a conceptual diagram illustrating information obtained for updating a security profile according to an embodiment of the present invention.
6 is a conceptual diagram showing a process of updating a security profile according to an embodiment of the present invention.
7 is a conceptual diagram illustrating an analysis process for information generated in a deep packet analysis process according to an embodiment of the present invention.
8 is a conceptual diagram of data transmission of an energy storage system according to an embodiment of the present invention.
9 is a flowchart showing a procedure of a network security method of an energy storage system according to an embodiment of the present invention.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, the technical idea of the present invention is not limited to the embodiments described herein and may be embodied in other forms. Rather, the embodiments introduced herein are provided so that the disclosed content may be thorough and complete, and the spirit of the present invention may be sufficiently conveyed to those skilled in the art.

In the present specification, when a component is referred to as being on another component, it means that it may be formed directly on the other component or that a third component may be interposed between them.

In addition, in various embodiments of the present specification, terms such as first, second, and third are used to describe various components, but these components should not be limited by these terms. These terms are only used to distinguish one component from another component. Accordingly, what is referred to as a first component in one embodiment may be referred to as a second component in another embodiment. Each embodiment described and illustrated herein also includes its complementary embodiment. In addition, in the present specification,'and/or' is used to mean including at least one of the elements listed before and after.

In the specification, expressions in the singular include plural expressions unless the context clearly indicates otherwise. In addition, terms such as "comprise" or "have" are intended to designate the presence of features, numbers, steps, elements, or a combination of the features described in the specification, and one or more other features, numbers, steps, and configurations It is not to be understood as excluding the possibility of the presence or addition of elements or combinations thereof.

In addition, in the present specification, "connection" is used to include both indirectly connecting a plurality of constituent elements and direct connecting. In addition, "connection" is a concept including electrical connections as well as physical connections.

Further, in the following description of the present invention, when it is determined that a detailed description of a related known function or configuration may unnecessarily obscure the subject matter of the present invention, a detailed description thereof will be omitted.

1 is an exemplary diagram showing the configuration of a network security environment of an energy storage system according to an embodiment of the present invention.

As shown in FIG. 1, the network security environment 100 includes an energy storage system 110, a network security device 120, a virtual private network (VPN) server 130, an integrated operation server 140, and a network (N ) Can be included.

The energy storage system 110 may be connected to each other to enable communication with the integrated operation server 140 through the network security device 120, the network N and the VPN server 130. According to an embodiment, TCP/IP (Transmission Control Protocol/Internet Protocol) is used for communication between the energy storage system 110 and the network security device 120 and between the VPN server 130 and the integrated operation server 140 Communication can be performed. In addition, communication between the network security device 120 and the VPN server 130 may be performed using a tunneling method. In addition, the energy storage system 110 and the integrated operation server 140 may be interlocked using the International Electrotechnical Committee (IEC) 61970 and IEC 61968 protocols. According to an embodiment, the network security device 120 may include a VPN client, but is not limited thereto.

The network security device 120 may receive a security profile including information on a detection criterion and blocking behavior for a control message. According to an embodiment, the network security device 120 may receive a security profile including information on a detection criterion and blocking behavior for a control message according to an input request from an administrator.

In addition, the network security device 120 uses the received security profile to perform a normal control message and an abnormal control message through a deep packet inspection (DPI) method for the control message received from the energy storage system 110. Can be determined. For example, the control message may be a control message according to the IEC 61968 protocol, but is not limited thereto.

According to an embodiment, the network security device 120 provides security for each layer of a kernel layer, a transport protocol layer, an application layer, and a user interface layer. Normal control messages and abnormal control messages can be identified using a profile.

According to another embodiment, the network security device 120 uses a security profile for each interlocking node of a Building Energy Management System (BEMS), a Factory Energy Management System (FEMS), and a Home Energy Management System (HEMS) to generate a normal control message and Abnormal control messages can be identified.

According to another embodiment, the network security device 120 may determine a normal control message and an abnormal control message using the entire security profile of the energy storage system 110.

In addition, the network security device 120 may block the control message determined as the abnormal control message by deleting it.

In addition, the network security device 120 may periodically update the security profile based on analysis information in the process of determining the normal control message and the abnormal control message. A method of periodically updating the security profile in the network security device 120 will be described later.

2 is an exemplary diagram showing the configuration of a network security device of an energy storage system according to an embodiment of the present invention.

As shown in FIG. 2, the network security device 120 of the energy storage system 110 may include one or more processors 122, one or more memories 124, and a transceiver 126. As an embodiment, at least one of these components of the network security device 120 may be omitted, or another component may be added to the network security device 120. Additionally or alternatively, some components may be integrated and implemented, or may be implemented as singular or plural entities. At least some of the components inside and outside the network security device 120 are a system bus, general purpose input/output (GPIO), serial peripheral interface (SPI), or mobile industry processor interface (MIPI). They are connected to each other through the like, and can exchange data and/or signals. As an embodiment, the network security device 120 uses a deep reinforcement learning algorithm such as machine learning, in particular, deep learning, to analyze information in the process of determining normal control messages and abnormal control messages. Based on this, the security profile for determining the normal control message and the abnormal control message may be periodically updated.

The one or more processors 122 may control at least one component of the network security device 120 connected to the processor 122 by driving software (eg, commands, programs, etc.). In addition, the processor 122 may perform various operations related to the present invention, processing, data generation, and processing. In addition, the processor 122 may load data or the like from one or more memories 124 or store data in one or more memories 124.

The one or more processors 122 may receive a security profile including information on a detection criterion for a control message and information on a blocking action. According to an embodiment, the detection criteria for a control message are a range of valid values for an XML (Extensible Mark-up Language) tag, spam, a valid message header, a message allowance rate threshold (max count/sec), Information such as a protocol syntax error type and a service setting value may be included, but is not limited thereto. For example, the detection criteria for the control message may include information on the effective value range (10KW to 15KW) for the power generation tag, or information on the maximum number of requests per second (5). . According to another embodiment, the blocking action for the control message may include information such as an alarm, an event, a blocking, and a dynamic block insert, but is not limited thereto.

The one or more processors 122 may determine a normal control message and an abnormal control message through a deep packet analysis method for a control message received using the security profile. According to an embodiment, the one or more processors 122 may form analysis data by extracting main information for analysis and learning in a deep packet analysis process for a received control message.

One or more processors 122 may block a control message determined as an abnormal control message. According to an embodiment, when the at least one processor 122 is determined to be an abnormal control message at any one of the deep packet analysis process of the kernel layer, the transport protocol layer, the application layer, and the user interface layer, the It can be deleted to prevent transmission and reception of the corresponding control message.

The one or more processors 122 may periodically update the security profile based on the normal control message and analysis information in the process of determining the abnormal control message. According to an embodiment, one or more processors 122 form statistical data for each predetermined period based on the analysis data, form learning data from analysis data and statistical data using a machine learning algorithm, and use the learning data. Thus, the security profile can be periodically updated.

In addition, the one or more processors 122 may calculate a false detection rate of a control message using a periodically updated security profile, and maintain the calculated false detection rate below a threshold value. According to an embodiment, the one or more processors 122 determine the number of times when a normal control message is determined as an abnormal control message or an abnormal control message is determined as a normal control message for all received control messages. You can calculate the false positive rate. Further, the one or more processors 122 may set the calculated false positive rate to be less than or equal to a preset threshold (eg, 1%, 3%, 5%, etc.). In this way, the one or more processors 122 may improve the reliability of the network security device 120 by managing the false detection rate, and may also improve the speed of detecting abnormal control messages.

One or more memories 124 may store various types of data. The data stored in the memory 124 is data acquired, processed, or used by at least one component of the network security device 120, and may include software (eg, commands, programs, etc.). The memory 124 may include volatile and/or nonvolatile memory. In the present invention, commands or programs are software stored in the memory 124, so that an operating system, an application, and/or an application for controlling the resources of the network security device 120 can utilize the resources of the network security device 120. It may include middleware that provides various functions to the application.

One or more memories 124 may store the above-described security profile, analysis data, statistical data, and learning data. In addition, the one or more memories 124 may store instructions that cause the one or more processors 122 to perform an operation when executed by the one or more processors 122.

According to an embodiment, the network security device 120 may further include a transceiver 126. The transceiver 126 may perform wireless or wired communication between the network security device 120 and the energy storage system 110, the VPN server 130, client devices, and/or other devices. For example, the transceiver 126 is eMBB (enhanced mobile broadband), URLLC (Ultra Reliable Low-Latency Communications), MMTC (Massive Machine Type Communications), LTE (long-term evolution), LTE-A (LTE Advance), UMTS (Universal Mobile Telecommunications System), GSM (Global System for Mobile communications), CDMA (code division multiple access), WCDMA (wideband CDMA), WiBro (Wireless Broadband), WiFi (wireless fidelity), Bluetooth (Bluetooth), NFC ( Near field communication), a global positioning system (GPS), or a global navigation satellite system (GNSS) may perform wireless communication. For example, the transceiver 126 may perform wired communication according to a method such as universal serial bus (USB), high definition multimedia interface (HDMI), recommended standard 232 (RS-232), or plain old telephone service (POTS). have.

According to an embodiment, the one or more processors 122 may obtain information from the VPN server 130 by controlling the transceiver 126. Information obtained from the VPN server 130 may be stored in one or more memories 124. As an embodiment, the information obtained from the VPN server 130 may include a security profile for detecting and blocking abnormal control messages.

According to an embodiment, the network security device 120 may be a device of various types. For example, the network security device 120 may be a portable communication device, a computer device, or a device according to a combination of one or more of the aforementioned devices. The network security device 120 of the present invention is not limited to the above-described devices.

Various embodiments of the network security device 120 according to the present invention may be combined with each other. Each of the embodiments may be combined according to the number of cases, and embodiments of the network security device 120 made by combining are also within the scope of the present invention. In addition, the internal/external components of the network security device 120 according to the present invention may be added, changed, replaced, or deleted according to embodiments. In addition, the internal/external components of the network security device 120 may be implemented as hardware components.

3 is a conceptual diagram illustrating a configuration of a security profile for each layer according to an embodiment of the present invention.

As shown in FIG. 3, a security profile for detecting a control message may include a kernel layer (L1), a transport protocol layer (L2), an application layer (L3), and a user interface layer (L4).

The kernel layer (L1) is a system OS (Linux Kernel) layer, which applies a security policy (Profile, Application Control Language) to a control message packet received through the network and filters it. , PM) and a virtual private network hook module (VPN Hook Module, VM). According to an embodiment, in the kernel layer L1, access control using a static/dynamic application control language (ACL) may be performed.

According to another embodiment, in the kernel layer L1, a distributed denial of service attack (DDos) using a TCP synchronous idle, Internet Control Message Protocol (ICMP), Address Resolution Protocol (ARP), etc. Attack) can be detected and blocked.

Attacks using TCP Synchronous Status Codes are one of Denial of Service Attacks (DoS), sending a large number of Synchronous Status Code (SYN) packets to the target device and responding using an address not in use on the Internet. If not, it is an attack method that causes a normal service failure by using a method such as requesting a request from the target device again.

ICMP is used to support error processing in an Internet environment, and may be encapsulated in a data portion of an IP packet and delivered to a sending host. When a problem occurs in the transmission process in a TCP/IP-based communication network, an ICMP message is automatically generated by the router and can be delivered to the packet sending host.

In a network environment, in order for an arbitrary host to transmit data to another host, it must know the MAC address as well as the IP address of the destination host. Since the IP address of the destination host is usually directly entered by the application program user in the process of executing the program, an additional task of obtaining the destination host MAC address from the IP address is required, and ARP can be used for this task.

DDoS attacks paralyze the service system by generating access traffic (traffic) of a scale that a specific Internet site cannot digest. After spreading the malicious computing code “Zombie” to a number of unspecified computers, it can be used for DDoS attacks. Numerous zombie-infected computers are mobilized for traffic to attack (access) specific sites at once, and do not secretly steal or delete data contained in the target computer.

According to another embodiment, the kernel layer L1 may detect and block a flooding attack using a hypertext transfer protocol (HTTP) packet and a flooding attack using a packet of a size that cannot be handled by the system. .

The transport protocol layer (L2) includes an IEC 61968 transport protocol HTTP stack (HS) and a time synchronization protocol NTP (Network Time Protocol) stack (NS), and provides a security policy (profile) for received control messages. A message level security module (MM) for applying and filtering may be further included. According to an embodiment, in the transport protocol layer L2, an attack using an HTTP protocol, an HTTP message, an NTP protocol, or the like may be detected and blocked.

The application layer L3 may include a security block of the IEC 61968 stack (IS) and service logic (SL). In addition, the application layer (L3) applies a security policy (profile) to the IEC 61970/61968 protocol and filters a protocol level security module (PLM) and a security policy (profile) for each service scenario or access node. ) May further include a Service Level Security Module (SLM) for filtering.

According to an embodiment, the protocol level security module (PLM) is an IEC 61968 XML malformed message, message spam, invalid header, invalid tag, invalid time, invalid value type for each tag, value range for each tag, message length, etc. Can be detected and blocked.

According to an embodiment, the service level security module (SLM) is based on the IEC 61968 XML characteristics (valid header, valid tag, spam, maximum length, max rate, etc.) set in the interworking node and security profile for each service. Attack messages can be detected and blocked.

The user interface layer L4 may perform various statistics such as an Admin Web page in charge of setting up a system and security service and statistical data formation using analysis data. According to an embodiment, a control message packet can be monitored in real time, an attack detection status can be monitored in real time, and a graphic that can monitor the state of the energy storage system 110 and the network (N) state in real time. A user interface (GUI: Graphic User Interface) can be developed and applied to the integrated operation server 140.

4 is a conceptual diagram illustrating a process of detecting and blocking an abnormal control message according to an embodiment of the present invention.

As shown in FIG. 4, the network security device 120 receiving the control message packet from the energy storage system 110 may perform access control to filter the abnormal control message.

According to an embodiment, when it is determined that a control message received using an application control language (ACL) or the like is an abnormal control message such as a DDoS attack message, the network security device 120 deletes the control message. Can be blocked. In addition, when it is determined that the received control message is a normal control message, the ID (ID) and time (Time) are added to the corresponding control message packet, and a timer for a predetermined time (for example, 1ms ~ 5ms) is set, and then deep packet analysis The procedure can be carried out. In addition, by adding an ID and a time to a control message packet determined as a normal control message, the queue may wait for a detection result in the deep packet analysis procedure.

The network security device 120 may perform a deep packet analysis procedure while sequentially removing headers with respect to the control message packet. According to an embodiment, the control message packet may include a payload including information to be transmitted and a header including information on the payload.

The network security device 120 removes the HTTP header from the control message packet, and determines whether an abnormal control message exists by using the security profile (security policy) of the transport protocol layer (L2) stored in the DMB. can do. If the control message is determined to be an abnormal control message, no further deep packet analysis procedure is performed, and the corresponding control message packet is received by the network security device 120, including the ID and detection result (abnormal control message). It can be delivered to the kernel layer (L1). The network security device 120 deletes the control message packet waiting in the queue using the ID and the detection result (abnormal control message) given upon reception by the network security device 120 to the VPN server 130. You can prevent it from being delivered.

In addition, when the detection result using the HTTP security profile is determined as a normal control message, the network security device 120 removes the XML header from the control message packet, and stores the XML payload information in the security profile of the application layer (L3). It is possible to determine whether an abnormal control message exists by using (Security Policy). If the control message is determined to be an abnormal control message, no further deep packet analysis procedure is performed, and the corresponding control message packet is received by the network security device 120, including the ID and detection result (abnormal control message). It can be delivered to the kernel layer (L1). The network security device 120 deletes the control message packet waiting in the queue using the ID and the detection result (abnormal control message) given upon reception by the network security device 120 to the VPN server 130. You can prevent it from being delivered.

The network security device 120 removes the IEC header from the control message packet when it is determined as a normal control message as a result of detection using the XML security profile, and stores the information of the IEC payload in the DMB security profile (security profile) of the application layer (L3). Policy) can be used to determine whether an abnormal control message exists. If the control message is determined to be an abnormal control message, no further deep packet analysis procedure is performed, and the corresponding control message packet is received by the network security device 120, including the ID and detection result (abnormal control message). It can be delivered to the kernel layer (L1). The network security device 120 deletes the control message packet waiting in the queue using the ID and the detection result (abnormal control message) given upon reception by the network security device 120 to the VPN server 130. You can prevent it from being delivered.

In addition, when the detection result using the IEC security profile is determined as a normal control message, the network security device 120 removes the Service header from the control message packet, and stores the service payload information in the security profile of the application layer (L3) stored in the DMB. It is possible to determine whether an abnormal control message exists by using (Security Policy). When it is determined that the corresponding control message is an abnormal control message, an ID assigned when the corresponding control message packet is received by the network security device 120 and a detection result (abnormal control message) may be transmitted to the kernel layer L1. The network security device 120 deletes the control message packet waiting in the queue using the ID and the detection result (abnormal control message) given upon reception by the network security device 120 to the VPN server 130. You can prevent it from being delivered.

When the detection result using the service security profile is determined to be a normal control message, the network security device 120 includes an ID assigned when receiving a corresponding control message packet to the network security device 120 and a detection result (normal control message). This can be delivered to the kernel layer (L1). The network security device 120 transmits a control message packet waiting in the queue to the VPN server 130 using an ID and a detection result (normal control message) given at the time of reception to the network security device 120. can do.

In addition, the network security device 120 may periodically check the queue and delete the corresponding control message packet when a timer set in the waiting control message packet expires so that it is not transmitted to the VPN server 130.

As described above, by periodically updating the security profile, the network security device 120 can maintain the false detection rate that may occur in the security detection process of the received control message packet to be less than a predetermined value, and threshold the received control message packet. By performing the security detection process within a time within the value, communication can be performed without a large delay in the control message packet.

For example, since the power generation amount of a solar power plant changes by season, time zone, and weather, the false detection rate for the IEC 61968 XML Tag value for the changing power generation amount with the initially set profile may increase. In this case, if the range of the effective power generation value of the profile is periodically updated, the false detection rate for the IEC 61968 XML Tag value can be greatly reduced.

5 is a conceptual diagram illustrating information obtained for updating a security profile according to an embodiment of the present invention.

As shown in FIG. 5, when a control message packet (RCM) is received, the network security device 120 performs a deep packet analysis procedure (DPI) according to ACL, DDoS flood, HTTP, IEC, and Service security profile. .

According to an embodiment, in the deep packet analysis procedure (DPI) according to the ACL security profile, information such as IP (Internet Protocol), port, packet size (Pkt Size), and time (time) are analyzed and machine learning. It can be obtained as information used for.

According to another embodiment, in the deep packet analysis procedure (DPI) according to the DDoS flood security profile, information such as a reception rate of a control message packet may be obtained as information used for the analysis process (AP) and machine learning.

According to another embodiment, in the deep packet analysis procedure (DPI) according to the HTTP security profile, information such as header, value, message (Msg), size, and reception rate (Rate) of an HTTP packet May be obtained as information used in the analysis process (AP) and machine learning.

According to another embodiment, in the deep packet analysis procedure (DPI) according to the IEC security profile, information such as a tag, value, and size (xml Size) of an IEC packet is analyzed during the analysis process (AP) and machine learning. It can be obtained as information used for.

According to another embodiment, in a deep packet analysis procedure (DPI) according to a service security profile, information such as a service node and a service name may be obtained as information used for an analysis process (AP) and machine learning.

However, information obtained for use in the analysis process (AP) and machine learning in the deep packet analysis procedure (DPI) is not limited thereto, and various pieces of information may be obtained and used.

6 is a conceptual diagram showing a process of updating a security profile according to an embodiment of the present invention.

As shown in FIG. 6, when a control message packet (RCM) is received, the network security device 120 performs a deep packet analysis procedure (DPI).

The analysis process (AP) may be performed on the information IA generated in the deep packet analysis procedure (DPI), and the adaptive security profile (ASP) may be periodically updated through machine learning (ML). The periodically updated adaptive security profile (ASP) can be used in a later deep packet analysis procedure (DPI).

Meanwhile, a deep packet analysis procedure (DPI) is performed using an adaptive security profile (ASP) on the received control message packet (RCM), and if it is determined as an abnormal control message, a drop is performed, and a normal control message When it is determined as, the received control message packet may be transmitted to the VPN server 130.

7 is a conceptual diagram illustrating an analysis process for information generated in a deep packet analysis process according to an embodiment of the present invention.

As shown in FIG. 7, when a control message packet is received, the network security device 120 performs a deep packet analysis procedure (DPI), which analyzes information generated in the deep packet analysis procedure (DPI) ( AP) can be performed. According to an embodiment, the network security device 120 analyzes information (eg, info1, info2, info3, info4,...) generated in a deep packet analysis procedure (DPI) as a function for each analysis data (eg For example, data1=info1 + info2) is used to perform a primary analysis process, and analysis data (eg, data1, data2,...) can be formed as a result and stored in one or more memories 124. have.

In addition, the network security device 120 stores analysis data stored in one or more memories 124 for a period (eg, minutes, hours, days, weeks, months, years, etc.) set for each security profile as a function for each statistical data ( For example, stat1=data3 + data2/data3) is used to perform a secondary analysis process, and statistical data (eg, stat1, stat2,...) is formed as a result of the at least one memory 124 Can be saved on.

The network security device 120 stores statistical data stored in one or more memories 124 for a period set for each security profile (for example, minutes, hours, days, weeks, months, years, etc.). For example, lern1=stat2 Ⅹ stat5 + 3 Ⅹ stat1-stat8) is used to perform a third-order analysis process, and as a result, learning data (e.g., lern1, lern2,...) is formed to form one or more memories ( 124).

In addition, the network security device 120 performs a fourth analysis process using a security profile-specific function (for example, prof1=lern2 + lern5) on learning data stored in one or more memories 124, and as a result Security profile data (eg, prof1, prof2, ...) may be formed and stored in one or more memories 124. According to an embodiment, the network security device 120 may form adaptive security profile data for a security profile that needs to be updated by using the formed security profile data. The network security device 120 may be automatically applied to the security profile through the administrator's web page, or may be applied to the security profile according to the administrator's request.

For example, the network security device 120 may perform an analysis process using the following function. The state of charge (SOC) of the battery management system (BMS) is used in a currently charged state compared to the maximum capacity (FCC: Full Charge Capacity) that can be stored by fully charging the battery. The percentage of possible storage capacity can be expressed in SOC (%). In this case, the network security device 120 may use Min SOC and Max SOC values as SOC-related security profiles. In addition, the network security device 120 may measure an integral value of a discharge amount for a unit time (eg, 1 hour) and a temperature average value for a unit time. Factors that influence the formation of the adaptive SOC security profile may include an amount of current, a temperature, and the number of times of charging and discharging.

Equation 1

SOCinit = 100%

BMS SOC = SOCprev-(((M+K+1) * Asum) / (A * 3600))

= SOCprev-((((Mc * 0.005)+(-1.5 * Kdiff * | Kdiff | / 1000)+1) * (Wd / Vavg)) / (A * 3600))

Adaptive SOC Security Profile = Min SOC (BMS SOC-15) ~ Max SOC (BMS SOC + 15)

In Equation 1, SOCprev represents the previous SOC during the unit time, Asum represents the integral value of the battery current during discharge during the unit time, A represents the rated capacity of the battery, and K represents the temperature-related weight, -1.5 * Kdiff * Can be calculated as an absolute value of Kdiff. In addition, M represents the weight related to the number of times of charging and discharging the battery (the number of changes down to less than 50% SOC), Wd represents the integral value of the amount of discharge during the unit time, Vavg represents the average voltage during the unit time, and Kdiff is the unit Represents the difference between the average value of the current temperature and the previous temperature over time, Mc represents the number of changes to less than 50% SOC, and Asum can be calculated as Wd / Vavg.

In addition, in the network security device 120, the BMS charge amount can be used as a security profile. The charging amount (KWH) represents the amount of power charged during a unit time, and Min KWH and Max KWH values can be used as a charging amount related profile. The network security device 120 may measure a voltage average for a unit time, a current average for a unit time, a temperature average value for a unit time, a humidity average value for a unit time, etc., and affect the adaptive charge amount security profile. Giving factors may include voltage, current, temperature, humidity, and the like.

Equation 2

KWH = (W-(W * (Kd+Bd)) / 1000) * 3600

= ((Vavg * Aavg)-((Vavg * Aavg) * ((| Kavg-23 | )+(| Bavg-60 |))) / 1000) * 3600

Adaptive KWH Security Profile = Min KWH (KWH-10) ~ Max KWH (KWH + 10)

In Equation 2, W denotes a power value, and can be calculated as Vavg * Aavg, where Vavg denotes an average voltage value for a unit time, and Aavg denotes an average current value for a unit time. In addition, Kavg represents the average temperature during unit time, Bavg represents the average humidity during unit time, Kd represents the absolute value of subtracting 23 from the average temperature during unit time, and Bd represents humidity during unit time. It can represent the absolute value of the value subtracting 60 from the average value.

8 is a conceptual diagram of data transmission of an energy storage system according to an embodiment of the present invention.

As illustrated in FIG. 8, the energy storage system 110 may transmit a control message packet to the network security device 120. According to an embodiment, the security method for the control message packet may include IP Security Protocol (IPsec) and Transport Layer Security (TLS), which are security methods of the IEC 61968 standard. That is, the network security device 120 and the VPN server 130 may support the tunneling mode of the IPSec international standard to guarantee the confidentiality of data.

In addition, the energy storage system 110, the network security device 120, and the VPN server 130 may encrypt and decrypt a control message packet using various encryption/decryption algorithms such as SEED, ARIA, and AES. In addition, the energy storage system 110, the network security device 120, and the VPN server 130 may detect and block an abnormal IPSec session connection and termination.

9 is a flowchart showing a procedure of a network security method of an energy storage system according to an embodiment of the present invention. Although process steps, method steps, algorithms, and the like have been described in a sequential order in the flow chart of FIG. 9, such processes, methods, and algorithms may be configured to operate in any suitable order. In other words, the steps of the processes, methods and algorithms described in the various embodiments of the present invention need not be performed in the order described in the present invention. Further, although some steps are described as being performed asynchronously, in other embodiments, some of these steps may be performed simultaneously. Further, the illustration of the process by description in the drawings does not imply that the illustrated process excludes other changes and modifications thereto, and the illustrated process or any of its steps is one of the various embodiments of the present invention. It does not mean that it is essential to the above, and it does not mean that the illustrated process is desirable.

As shown in Fig. 9, in step S910, a security profile is received. For example, referring to FIGS. 1 to 8, the transceiver 126 of the network security device 120 is a detection criterion and blocking behavior for a control message used in the energy storage system 110 according to a request from an administrator or the like. A security profile including information on may be received.

In step S920, a normal control message and an abnormal control message are determined through a deep packet analysis method for the control message received using the security profile. For example, referring to FIGS. 1 to 8, at least one processor 122 of the network security device 120 uses a security profile received in step S910 to provide an in-depth view of a control message received by the transceiver 126. Normal control messages and abnormal control messages can be identified through the packet analysis method.

In step S930, the abnormal control message is blocked. For example, referring to FIGS. 1 to 8, one or more processors 122 of the network security device 120 may block a control message from being transmitted or received by deleting a control message determined as an abnormal control message in step S920. .

In step S940, the security profile is periodically updated based on the analysis information in the process of determining the normal control message and the abnormal control message. For example, referring to FIGS. 1 to 8, one or more processors 122 of the network security device 120 may provide a security profile based on analysis information in the process of determining the normal control message and the abnormal control message in step S920. Can be updated periodically. According to an embodiment, the one or more processors 122 include Internet Protocol (IP), port, access node name, control message header information, time information, received value and reference value for each XML tag, and control The security profile may be periodically updated based on analysis information including at least one of a message size, a control message reception rate, and a service name, but is not limited thereto.

Various embodiments of the present invention may be implemented as software in a machine-readable storage medium. The software may be software for implementing various embodiments of the present invention. Software can be inferred from various embodiments of the present invention by programmers in the technical field to which the present invention belongs. For example, software may be a program including instructions (eg, code or code segment) that the device can read. The device is a device capable of operating according to a command called from a storage medium, and may be, for example, a computer. As an embodiment, the device may be the network security device 120 according to embodiments of the present invention. As an embodiment, the processor of the device may execute a called command, so that components of the device may perform a function corresponding to the command. As an embodiment, the processor may be one or more processors 122 according to embodiments of the present invention. The storage medium may mean any type of recording medium in which data is stored, which can be read by a device. The storage medium may include, for example, ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage device, and the like. As an embodiment, the storage medium may be one or more memories 124. As an embodiment, the storage medium may be implemented in a distributed form in a computer system connected through a network. The software can be distributed and stored and executed in a computer system or the like. The storage medium may be a non-transitory storage medium. The non-transitory storage medium refers to a tangible medium irrespective of whether data is semi-permanently or temporarily stored, and does not include a signal propagated in a transient manner.

In the above, the present invention has been described in detail using preferred embodiments, but the scope of the present invention is not limited to specific embodiments, and should be interpreted by the appended claims. In addition, those who have acquired ordinary knowledge in this technical field should understand that many modifications and variations can be made without departing from the scope of the present invention.

100: network security environment 110: energy storage system
120: network security device 130: VPN server
140: integrated production server 122: processor
124: memory 126: transceiver
N: network

Claims (8)

In the network security device of the energy storage system,
One or more processors; And
When executed by the one or more processors, the one or more processors include one or more memories storing instructions for performing an operation,
The one or more processors,
Receiving a security profile including information on detection criteria and blocking behavior for control messages,
For control messages received using the security profile, a normal control message and an abnormal control message are determined through a deep packet analysis method,
Block the abnormal control message,
Periodically updating the security profile based on analysis information in the process of determining the normal control message and the abnormal control message,
Calculate the false detection rate of the control message using the periodically updated security profile, but determine the number of times when a normal control message is determined as an abnormal control message or an abnormal control message is determined as a normal control message for all received control messages. Count to calculate the false positive rate of the control message,
The calculated false detection rate is set to be less than or equal to a preset threshold,
The one or more processors,
Forming analysis data based on analysis information in the process of determining the normal control message and the abnormal control message,
Statistical data is formed for each predetermined period based on the analysis data,
Forming learning data from the analysis data and the statistical data using a machine learning algorithm,
Periodically updating the security profile using the learning data,
Network security devices in energy storage systems.
The method of claim 1,
The one or more processors,
IP (Internet Protocol), port, access node name, control message header information, time information, received value and reference value for each XML tag, control in the process of determining the normal control message and the abnormal control message Periodically updating the security profile based on the analysis information including at least one of a message size, a control message reception rate, and a service name,
Network security devices in energy storage systems.
The method of claim 1,
The security profile,
Security profiles for each layer of the kernel layer, transport protocol layer, application layer, and user interface layer;
Security profile for each node interlocked with Building Energy Management System (BEMS), Factory Energy Management System (FEMS), and Home Energy Management System (HEMS); And
Including at least one of the energy storage system overall security profile,
Network security devices in energy storage systems.
delete In the network security method of the energy storage system,
Receiving a security profile including information on a detection criterion for a control message and a blocking action;
Determining a normal control message and an abnormal control message through a deep packet analysis method for a control message received using the security profile;
Blocking the abnormal control message; And
And periodically updating the security profile based on analysis information in the process of determining the normal control message and the abnormal control message,
Further comprising the step of calculating a false positive rate of the control message using the periodically updated security profile,
For all received control messages, the number of times when a normal control message is determined as an abnormal control message or an abnormal control message is determined as a normal control message is counted to calculate the false detection rate of the control message, and the calculated false detection rate is determined in advance. It is set to be less than the set threshold,
The step of periodically updating the security profile,
Forming analysis data based on analysis information in the process of determining the normal control message and the abnormal control message;
Forming statistical data for each predetermined period based on the analysis data;
Forming learning data from the analysis data and the statistical data using a machine learning algorithm; And
Including the step of periodically updating the security profile using the learning data,
Network security method of energy storage system.
The method of claim 5,
The step of periodically updating the security profile,
IP (Internet Protocol), port, access node name, control message header information, time information, received value and reference value for each XML tag, control in the process of determining the normal control message and the abnormal control message Including the step of periodically updating the security profile based on the analysis information including at least one of a message size (size), a control message reception rate (rate), and a service name,
Network security method of energy storage system.
The method of claim 5,
The security profile,
Security profiles for each layer of the kernel layer, transport protocol layer, application layer, and user interface layer;
Security profile for each node interlocked with Building Energy Management System (BEMS), Factory Energy Management System (FEMS), and Home Energy Management System (HEMS); And
Including at least one of the energy storage system overall security profile,
Network security method of energy storage system.
delete

Images