KR102494831B1 - Network intrusion detection system for information processing system of nuclear power plants - Google Patents

Abstract

Nuclear power plant information processing system network anomaly detection system according to the present invention detects unauthorized abnormal packets of vulnerable points from cyber threats of border points or non-safety network networks to protect nuclear power plant information processing systems and generates security alerts. It is characterized by including a packet detection unit with a built-in algorithm for detection, a whitelist management unit to set and manage whitelist-based detection policies, and a central monitoring server that can store and monitor information such as security logs and event logs. to be The packet detection unit of the nuclear power plant information processing system network anomaly detection system of the present invention uses a tap module to passively connect the information processing system network section of the existing system when a self-fault occurs due to power loss, so as not to affect the existing line. It has the effect of maintaining the communication line without interruption and is characterized in that it can simultaneously collect all packets and detect abnormal packets. The nuclear power plant information processing system network anomaly detection system of the present invention is a nuclear power plant dedicated security system that satisfies the safety and security regulatory requirements of nuclear power plants, and has an effect that can contribute to improving cyber security of nuclear power plants.

Description

Network intrusion detection system for information processing system of nuclear power plants}

The present invention relates to an anomaly detection system for a nuclear power plant information processing system network, and more specifically, to a whitelist-based network for detecting unauthorized abnormal packets infiltrating the nuclear power plant information processing system network and collecting all packets in the network section. It is about an anomaly detection system.

A computer-based system that provides operation means for power plant monitoring and control in a nuclear power plant is called an information processing system. The information processing system acquires power plant data, checks detected variables, executes nuclear steam supply system application programs, calculates the performance of auxiliary facility systems, monitors the safety status and general condition of the power plant, and displays calculation results and status on the operator console screen. It acquires power plant input/output data from other systems of the power plant through the control system and data communication network to perform functions such as providing operation records and determining alarm conditions.

As shown in the left block of FIG. 1, the information processing system network of a nuclear power plant includes a control and monitoring computer 10, an information processing system network switching hub 20, an information processing system network 30, and an information processing system server 40. ), a control system cabinet 50, a field sensor, and a control motor 60.

Since 2010, when Stuxnet, a cyberattack weapon against nuclear power plant control systems, appeared, infiltration paths, including insider threats, have diversified. After passing through the perimeter network and infiltrating, the detection and security measures for the internal behavior of the control system are insufficient.

A network anomaly detection system can be applied to detect anomalies of vulnerable points from cyber threats of a boundary point or non-safety system network to protect the safety system of the nuclear power plant information processing system and generate a security alert. This network anomaly detection system can detect malicious actions such as denial of service (DoS) attacks and port scans by monitoring network packets installed between network communication lines.

However, most network anomaly detection systems used in general industrial control systems are weak in countermeasures against self-faults that may occur during system operation, such as power loss or microprocessor failure, and packet analysis and detection policies in the collected detection section are software. Since it is implemented as , the analysis speed is slow. In addition, since it depends on software, countermeasures for the equipment's own security, such as external intrusion and tampering, are insufficient.

Unlike general control systems, nuclear power plants require a high level of safety and security, so it is exclusively for nuclear power plants that increase the reliability of packet analysis and detection policies of the detection system and take necessary measures not to affect the existing network in the event of a self-fault. A network anomaly detection system is required.

The purpose of the present invention is to detect abnormal packets that are unauthorized in the information processing system network of nuclear power plants, and based on a packet detection unit and whitelist for detecting abnormal packets in the network and transmitting all collected packets to the integrated security operation center. It is to provide a central monitoring server capable of storing and monitoring information such as a whitelist management unit, security log, and event log for setting detection policies of.

Nuclear power plant information processing system network anomaly detection system according to the present invention can install a packet detection unit for collecting packets and detecting abnormal packets in each network section to be detected inside the information processing system, and detecting from the packet detection unit It is characterized in that it includes a central monitoring server for storing and retrieving results of abnormal packets, and a whitelist management unit for setting a whitelist-based detection policy in the packet detection unit and managing the packet detection unit.

In the present invention, the packet detection unit of the nuclear power plant information processing system network anomaly detection system is characterized by including a function for collecting all packets in the network section and transmitting them to the integrated security operation center.

In the present invention, a plurality of packet detection units are configured to correspond to each network section to be installed in the information processing system of a nuclear power plant, and the central monitoring server encrypts and transmits abnormal packet detection results through a plurality of packet detection units through a switching hub. It is received through control protocol/internet protocol (TCP/IP) communication, and the whitelist management unit can connect to the switching hub to set and manage policies for a plurality of packet detection units.

In the present invention, the packet detection unit can receive dual DC +24V power supplied from a nuclear power plant, and connect connectors (NET1, NET2) for collecting packets in the network section of the information processing system, central monitoring server, and whitelist management It consists of a connector (CON2) for communicating with the unit and a connector (CON1) for transmitting all collected packets to the integrated security operation center, and is characterized by having a light emitting diode (LED) for status display. can

In the present invention, the packet detection unit may be characterized in that a tap module for collecting packets is built in so that the packet detection unit does not affect the existing network section when a self-fault occurs due to power loss.

In the present invention, the packet detection unit is composed of a packet analysis module and an embedded microprocessor equipped with a real time operating system (RTOS). The packet analysis module provides protocol header information such as source Media Access Control, destination Media Access Control, source Internet Protocol, destination Internet Protocol, and source port. , destination port and protocol type, and the embedded microprocessor performs DPI (Deep Packet Inspection) on the function code, which is the payload information of the protocol. can do.

In the present invention, the central monitoring server of the network anomaly detection system includes a communication module for interface with a packet detection unit and a white list management unit, a time synchronization module, an alarm log, a security log, an event log, a status log, system information, and user information. The whitelist management unit may include a packet detection unit and a communication module for interface with the central monitoring server, packet detection unit management, asset management, and security management functions.

The network anomaly detection system according to the present invention is installed at a boundary point for protecting the safety system of the nuclear power plant instrumentation and control system or at a vulnerable point from cyber threats in a non-safe system network to prevent and detect infringement from infringement. have an effect The present invention has an effect of easily detecting abnormal packets containing information other than the functions allowed between devices by reflecting the functions allowed between devices in a nuclear power plant as packet header information and payload information in whiteless and comparing them in parallel. there is.

The network anomaly detection system according to the present invention can detect non-human abnormal packets in the network section of the nuclear power plant information processing system, collect all packets, and transmit them to the integrated security operation center, so that all packets can be collected and abnormal packets detected at the same time. have an effect

The packet detection unit according to the present invention has an effect of not affecting the existing network when a self-fault occurs due to power loss.

The present invention has an effect that the operator of the power plant can check the obtained network anomaly detection result in real time to determine the abnormal state and take appropriate security measures.

The nuclear power plant information processing system network anomaly detection system according to the present invention is a nuclear power plant dedicated security system that satisfies the safety and security regulatory requirements of nuclear power plants, and has the effect of contributing to the improvement of cyber security of nuclear power plants.

1 is a schematic diagram of a nuclear power plant information processing system network and a structural conceptual diagram of a nuclear power plant information processing system network anomaly detection system.
2 is an external view of a packet detection unit according to the present invention.
3 is an internal block diagram of a packet detection unit according to the present invention.
4 is a conceptual diagram of a packet signal flow of a tap module during normal operation of a packet detection unit according to the present invention.
5 is a conceptual diagram of a packet signal flow of a tap module when power is lost in a packet detection unit according to the present invention.
6 is a conceptual diagram of a logic diagram implemented in a packet analysis module inside a packet detection unit according to the present invention.
7 is a software block diagram of a whitelist management unit and a central monitoring server according to the present invention.

Hereinafter, specific embodiments according to the present invention are described. However, the present invention can be implemented by modifying in various forms and is not limited to the embodiments described herein. The drawings accompanying the present invention have been simplified for convenience of explanation, and parts irrelevant to the description have been omitted in order to clearly describe the present invention.

As conceptually shown in FIG. 1, the embodiment of the nuclear power plant information processing system network anomaly detection system according to the present invention includes an information processing system server 40 and a control system cabinet of a nuclear power plant information processing system network (Network 1) The packet detection unit 100 can be installed for the purpose of collecting packets and detecting abnormal packets at the boundary point for protecting the safety system such as (50) or at a point vulnerable to cyber threats in the non-safe network section, and the network section ( It is possible to operate a plurality of packet detection units 100 by installing packet detection units 100 to correspond between networks 1...N. In order to collect packets in the network section, the field cables are connected to the NET1 RJ45 connector 110 and the NET2 RJ45 connector 120, which are the RJ45 ports (100Mbps) of the packet detection unit 100, and the information processing system server 40 and control Packets (eg, TCP/IP, UDP, Modbus packets) transmitted in both directions or in one direction between system cabinets 50 may be collected. And the whitelist management unit 200 for setting and managing a whitelist-based policy connected to the switching hub 400 for security network through the CON2 Fiber Optic connector 140 of the packet detection unit 100 and abnormal packets. It is configured to include a central monitoring server 300 and a database 310 for storing and retrieving detection results. In addition, since all packets collected in the network section of the present invention can be transmitted to the integrated security operation center 800 through the CON1 RJ45 connector 130 of the packet detection unit 100, all packets can be collected and abnormal packets can be monitored simultaneously. have possible effects.

2 schematically shows the external appearance of the front of the packet detection unit 100 for better understanding, NET1 RJ45 connector 110, NET2 RJ45 connector 120, CON1 RJ45 connector 130, CON2 Fiber Optic connector ( 140), a redundant power supply connection connector 180, and an LED status display unit 190 may be configured to have visibility. The redundant power connection connector (180) consists of a 4-pin screw terminal and can receive dual voltage +24DC power. When dual power is supplied, both +24V (P1) and +24V (P2) are supplied. In case of supplying single power, power can be supplied to either +24V(P1) or +24V(P2). The light emitting diode (LED) status display unit 190 is a light emitting diode for displaying the status of PWR1 (supply status of power 1), PWR2 (supply status of power 2), ALARM (detection of network anomalies), NET1, NET2, CON1, and CON2 (LED).

3 shows a block diagram of the packet detection unit 100, which can be composed of a tap module 150, a packet analysis module 160, and an embedded microprocessor 170.

In the present invention, packets collected through the tap module 150 of the packet detection module 100 detect abnormal packets in the packet analysis module 160 and the embedded microprocessor 170. In the packet analysis module 160, the OSI ( Open System Interconnection) performs Stateful Packet Inspection (SPI) that detects an error in the header information of the protocol between layer 1 and layer 4 of the 7th layer, and the embedded microprocessor 170 performs page It is possible to build an algorithm that performs DPI (Deep Packet Inspection) to detect anomalies in load information.

The embedded microprocessor 170 may include a packet parsing module 171, a detection module 172, a whitelist storage module 173, and a detection result transmission module 174. The policies received from the whitelist management unit 200 are stored in the whitelist storage module 173, and protocol header information such as source media access control, destination media access control, and source Internet protocol (Internet Protocol), destination Internet Protocol (Internet Protocol), source port (Port), destination port (Port), whitelist for the protocol type is transferred to the packet analysis module 160 to perform Stateful Packet Inspection (SPI). The whitelist for the function code, which is used and is the payload information of the protocol, can be used to perform Deep Packet Inspection (DPI) in the detection module 172. After the packets collected through the tap module 150 are parsed into headers and payloads in the packet parsing module 171, the detection module 172 compares them with the policies stored in the whitelist storage module 173, and the DPI ( Deep Packet Inspection), and the abnormal packets detected by the detection module 172 are transferred to the detection result transmission module 174 and the database 310 of the central monitoring server 300 through the CON2 Fiber Optic connector 140. ) is stored in In addition, the embedded microprocessor 170 may transmit all packets collected through the tap module 150 from the detection module 172 to the integrated security operation center 800 through the CON1 RJ45 connector 130. In the case of a nuclear power plant, since functions permitted between devices are explicitly established, they are integrated and reflected as packet header information and payload information in whitelist, and based on this, header information and payload function codes are compared side by side, There is an effect of easily detecting an abnormal packet containing information other than the permitted function. Therefore, the embedded microprocessor 170 of the packet detection unit 100 can detect abnormal packets of the nuclear power plant information processing system network, collect all packets in the network section, and transmit them.

As shown in FIG. 4, the packet detection unit 100 uses the tap module 150 to copy data packets transmitted and received in the network section between the information processing system server 40 and the control system cabinet 50. and transmit/receive data packets to the packet analysis module 160 and the embedded microprocessor 170. When the packet detection unit 100 operates normally, the tap module 150 supports Far-End Loopback for packets transmitted and received in either bidirectional or unidirectional direction, and transmits and receives data packets to the information processing system server without interfering with the network section. (40) and the control system cabinet (50). When the packet detection unit 100 generates a self-fault due to power loss, the relay circuit is operated as shown in FIG. It has the effect of maintaining the communication line.

As shown in FIG. 6, the packet analysis module 160 includes a top module 161 (Top Module), a block random access memory module 164 (Block Random Access Memory Module), and a serial peripheral interface module 165 (Serial Peripheral Interface Module). has the structure of First, Ethernet packets coming in both directions from the tap module 150 are received in the Ethernet frame (Ethernet Frame 162), and the Media Access Control address, Internet Protocol address, port number, and protocol type are received. Information is extracted and transmitted to a comparator module (163; Comparator Module). The comparator module (163; Comparator Module) uses a MAC Comparator, an Internet Protocol Comparator, a Port Comparator, and a Protocol Comparator to match each piece of whitelist information. It compares and checks whether there is a policy and stores the result in the block random access memory module 164. Through the interface implemented in the serial peripheral interface module 165, the external embedded microprocessor 170 can edit and check the whitelist policy stored in the block random access memory module 164 and check the result of packet inspection.

As shown in FIG. 6, the Ethernet frame 162 collects Ethernet packets and extracts the Media Access Control address, Internet Protocol address, port number, and protocol type information included therein. As a module, packets are parsed to be transmitted to the comparator module (163; Comparator Module).

As shown in FIG. 6, the comparator module 163 compares the information extracted from the Ethernet frame 162 with the white list stored in the block random access memory module 164, and is used for controlling source media access (Media Access Control), destination Media Access Control, source Internet Protocol, destination Internet Protocol, source port, destination port, and protocol type. Each of 256 (8x32) whitelists can be compared and checked simultaneously. The test results are stored in the Statistics register and the Interrupt register. In addition, it is connected to the block random access memory module 164 in which the whitelist policy is stored.

As shown in FIG. 7, the white list management unit 200 and the central monitoring server 300 may each constitute a block diagram. It can be connected through a plurality of packet detection units 100 installed in each network section to be detected and a security network switching hub 400, and the security network TCP/IP (Transmission Control Protocol/Internet Protocol) communication protocol 500 is a dedicated protocol It can be designed and used as an encryption module, and encryption communication can be performed using an encryption module verified by the National Intelligence Service.

As shown in FIG. 7, the white list management unit 200 includes a communication module 210, packet detection unit management 220, asset management 230, protocol management 240, and security management 250. A program is configured, and a user interface screen can be provided so that a user having an administrator or engineer account can access and use it. The communication module 210 communicates with the packet detection unit 100 using a TCP/IP-based dedicated protocol for input/output data processing, and can transmit identification and authentication information, system settings, and whitelist-based detection policy information. . The packet detection unit management 220 searches and displays (Search/Display) a plurality of packet detection units 100 connected to the whitelist management unit 200, creates and deletes packet detection units, and provides information It can perform input (Information Input), log (alarm, event), and policy setting (Rule Set-White List) functions. The asset management 230 includes an asset template for managing information corresponding to the information processing system server 40 and the control system cabinet 50 of the information processing system network 30 section to be detected, You can perform the function of asset creation and deletion (Asset Create/Delete). The protocol management 240 may function as a predefined protocol corresponding to a section of the information processing system network 30 to be detected, and protocol creation and deletion (Protocol Create/Delete). Security management (250) includes Account Management, Log Record/Search, Account Lock, Pre-connection Record Notice, Software and Information Integrity (Software & Information Integrity), Data Movement Control, Session Lock, System Use Notice, Unnecessary Service/Program Delete, Action on Error ) can perform the function of In addition, the white list management unit 200 separates security and non-security functions of an administrator and an engineer to access the packet detection unit 100 and performs account management through an account setting procedure.

The packet detection unit management 220 of the white list management unit 200 may generate stateful packet inspection (SPI) and deep packet inspection (DPI) detection rules to perform a policy setting function. Creation of SPI detection rules is source Media Access Control, destination Media Access Control, source Internet Protocol, destination Internet Protocol, source port, destination port ( Port), a function to create detection rules using protocol type information, and the selection and input method of detection information for detection rule creation is Any (when selecting Any, all packets using the protocol of the corresponding detection rule are allowed), IP address (When selecting an IP address and entering IP address information, the corresponding IP address is allowed) and MAC address (when selecting a MAC address and entering MAC address information, the corresponding MAC address is allowed). DPI detection rule creation is a function of creating SPI detection rules and generating payload detection rules of packets corresponding to the corresponding detection rules. Methods for creating DPI detection rules include adding an allowed field, field start address (field start address (Byte) of the packet data area to be detected), length (length (Byte) of the field), and setting the allowed value of the field. can

As shown in FIG. 7, the central monitoring server 300 has a database 310, a server communication module 320, and a time synchronization module 330, and the program is composed of security and non-security of administrators and engineers. Functions can be separated and account management can be performed through account setup procedures. In addition, the central monitoring server 300 may provide a user interface screen so that a user having an administrator or engineer account can access and use it. Users connected with an administrator account can monitor security logs and event logs, set device authentication, set alarms, search security logs and event logs, set time synchronization, and manage encryption keys. Users connected with an engineer account can monitor event logs. , device authentication setting, alarm setting, event log inquiry, and time synchronization setting can be performed. The database 310 may store alarm logs, event logs, status logs, security logs, system information, user information, and the like, and retrieve and display recorded contents. The server communication module 320 has a packet detection unit 100 interface function and a whitelist management unit 200 interface function that communicates with the packet detection unit 100 using a dedicated protocol based on TCP/IP for input and output data processing. can be done The time synchronization module 330 receives the standard time and synchronizes the time of the packet detection unit 100, the white list management unit 200, and the central monitoring server 300. Periodic time synchronization is performed at 00:00 every day. It is transmitted at 00 seconds and can perform manual time synchronization function.

The event log stored in the database 310 of the central monitoring server 300 is the detection result according to the SPI detection rule through the monitoring screen, the detection time (Time), the ID information of the packet detection unit, and the source where the detected packet is allowed. Check mark when different from IP address, check mark when detected packet is different from allowed source MAC address, check mark when detected packet is different from allowed source port number, check mark when detected packet is different from allowed destination IP address Check mark, if the detected packet is different from the allowed destination MAC address, check mark, if the detected packet is different from the allowed destination port number, check mark, if the detected packet is different from the allowed protocol type, check mark, detected packet source IP/MAC/Port information, destination IP/MAC/Port information of detected packets, and protocol information of detected packets. In addition, the detection result according to the DPI detection rule may indicate an anomaly occurrence field number of the detected packet, an allowable value in the corresponding field of the detection rule, and information on the actual detection value in the corresponding field of the detected packet.

The invention disclosed above is capable of various modifications within a range that does not impair the basic idea. Therefore, all of the above embodiments should be interpreted as illustrative and not limited. Therefore, the protection scope of the present invention is determined according to the appended claims rather than the above-described embodiments. Substitutions of equivalents in the appended claims shall fall within the scope of protection of the appended claims.

10: Control and monitoring computer
20: information processing system network switching hub
30: information processing system network
40: information processing system server
50: control system cabinet
60: field sensor and control motor
100: packet detection unit
110: NET1 RJ45 connector
120: NET2 RJ45 connector
130: CON1 RJ45 connector
140: CON2 Fiber Optic connector
150: tap module
160: packet analysis module
161: Top Module
162: Ethernet Frame
163: Comparator Module
164: Block Random Access Memory Module
165: Serial Peripheral Interface Module
170: embedded microprocessor
171: packet parsing module
172: detection module
173: whitelist storage module
174: detection result transmission module
180: redundant power connector
190: light emitting diode (LED) status display unit
200: white list management unit
210: communication module
220: packet detection unit management
230: Asset Management
240: protocol management
250: security management
300: central monitoring server
310: database
320: server communication module
330: time synchronization module
400: secure network switching hub
500: secure network TCP/IP communication protocol
600: switching hub for integrated security operation center
700: transmission of collection packet
800: integrated security operation center

Claims (4)

A packet detection unit that collects packets between sections of the information processing system network, detects abnormal packets, and transmits the collected packets to the integrated security operation center;
a whitelist management unit configured to set and manage a whitelist-based policy in the packet detection unit; and
A central monitoring server including a database capable of storing and querying event logs and security logs by receiving the detected results from the packet detection unit;
The packet detection unit includes a tap module for collecting packets, a packet analysis module for performing header information analysis on the collected packets, and an embedded microprocessor for performing payload information analysis,
The tap module performs copying of transmitted/received data packets and operates a relay circuit when a self-fault occurs due to power loss to maintain a communication line without interfering with the network.
The packet analysis module includes an Ethernet frame, a comparator module, a block random access memory module, and a serial peripheral device interface module, and includes protocol header information received from the whitelist management unit, such as source media access control (Media Access Control), destination Media Access Control, Source Internet Protocol, Destination Internet Protocol, Source Port, Destination Port, and Protocol Type List are compared and if unmatched, an error packet is found. and transmits the result to the embedded microprocessor,
The embedded microprocessor includes a packet parsing module, a detection module, a whitelist storage module, and a detection result transmission module, and compares the function code, which is the payload information of the protocol received from the whitelist management unit, In case of matching, it is detected as an abnormal packet and the result is transmitted to the central monitoring server.
The packet detection unit can be installed in a plurality so as to correspond to a plurality of information processing system network sections, respectively, a connection connector provided to receive power in redundancy, a connector for connection of a section to be detected, a white list management unit, and A connector for connection to communicate with the central monitoring server, a connector for connection to transmit all packets collected to the integrated security operation center, and an LED status display unit. Nuclear power plant information processing system network anomaly detection system. delete According to claim 1,
The whitelist management unit generates information such as identification and authentication information, system settings, and whitelist-based detection rules, and provides a user interface screen for transmitting to the packet detection unit Nuclear power plant information processing system network anomaly detection system. According to claim 1,
The central monitoring server includes a database for storing and querying information such as event logs and security logs from packet detection units and whitelist management units, receives standard time, and periodically adjusts the time of packet detection units and whitelist management units. Nuclear power plant information processing system network anomaly detection system, characterized in that synchronization.

Images