KR102571495B1 - Security system and method for optical transmission facilities - Google Patents

Abstract

According to the embodiment, an optical transmission equipment configured to form a mutual ring network through an optical cable dedicated line connected to a plurality of power facility servers to collect on-site data; an integrated management server that shares encryption keys and certificates with nodes connected to the optical cable dedicated line; and is provided between the power equipment server and the optical transmission equipment or between the integrated management server and the optical transmission equipment, and encrypts field data collected from the power equipment server using an MTPsec method and outputs the data to the ring network, and is dedicated to the optical cable. Provided is a security system for an optical transmission facility including a security device that decrypts data received through a circuit and transmits the data to the power facility server.

Description

Security system and method for optical transmission facilities}

One embodiment of the present invention relates to a security system and method for an optical transmission facility.

In the existing optical transmission system, an optical transmission service is operated by leasing a dedicated line. Leased-line segments do not provide their own encryption, but are VPNs, so they operate separately from the public Internet and are considered a relatively secure mode of transmission. However, as cases of hacking of optical cables have been continuously reported recently, there is a possibility of information leakage in the dedicated line section, and communication data being transmitted is 100% illegal even through optical signal detection of less than 1% in the dedicated line section including the optical cable. can receive In addition, a security threat that disrupts communication services by entering a hacking wave may occur.

The MPLS-TP protocol of optical transmission is still in the process of standardization for information protection, and since actual security technology is not applied, there is a possibility of information leakage in the event of a malicious attack. In addition, if an optical transmission section of national infrastructure such as power and power generation systems is attacked by a malicious attacker or internal information is leaked, it may be used for national terrorism or cause a wide-area power outage, which may cause a serious security threat. In addition, there is a need for high-speed encryption processing in a situation where processing and transmission of an increasing amount of data is required. Therefore, a highly reliable security technology capable of safely operating an optical transmission section is required.

A technical problem to be achieved by the present invention is to provide a security system and method for an optical transmission facility capable of high-speed encryption/decryption processing.

In addition, it is to provide a security system and method for an optical transmission facility capable of improving security in an optical transmission section.

Another object of the present invention is to provide a security system and method for an optical transmission facility in which each functional block can be easily replaced.

According to the embodiment, an optical transmission equipment configured to form a mutual ring network through an optical cable dedicated line connected to a plurality of power facility servers to collect on-site data; an integrated management server that shares encryption keys and certificates with nodes connected to the optical cable dedicated line; and is provided between the power equipment server and the optical transmission equipment or between the integrated management server and the optical transmission equipment, and encrypts field data collected from the power equipment server using an MTPsec method and outputs the data to the ring network, and is dedicated to the optical cable. Provided is a security system for an optical transmission facility including a security device that decrypts data received through a circuit and transmits the data to the power facility server.

When nodes greater than a predetermined standard are disposed in the ring network, the security device may be provided between the integrated management server and the optical transmission equipment.

The security device may receive on-site data collected from the power facility server from the optical transmission equipment, encrypt it through an ESP encryption method, and then output the data to the ring network.

When nodes less than a predetermined standard are disposed in the ring network, the security device may be provided between the power equipment server and the optical transmission equipment.

The security device may collect the on-site data from the power equipment server, encrypt the field data through a MACsec encryption method, and output the data to the ring network through the optical transmission equipment.

The security device may access the integrated management server, register an initial IP address and a node IP, and perform mutual authentication using the shared encryption key and certificate.

According to the embodiment, optical transmission equipment configuring a mutual ring network through an optical cable dedicated line; an integrated management server that shares encryption keys and certificates with nodes connected to the optical cable dedicated line; and a security device provided between the integrated management server and the optical transmission equipment, comprising: collecting, by a first optical transmission equipment, field data from the power equipment server; encrypting, by a first security device, on-site data collected from the first optical transmission equipment using an MTPsec method; outputting, by the first security device, encrypted field data to the ring network; receiving, by a second security device, the encrypted on-site data; decrypting the encrypted field data by the second security device; and transmitting, by the second security device, the field data decrypted to a second optical transmission device.

The first security device may encrypt the field data through an ESP encryption method.

According to the embodiment, optical transmission equipment configuring a mutual ring network through an optical cable dedicated line; an integrated management server that shares encryption keys and certificates with nodes connected to the optical cable dedicated line; and a security device provided between the power facility server and the optical transmission device, comprising: collecting, by a first security device, field data from the power facility server; Encrypting, by the first security device, the on-site data using an MTPsec method; transmitting, by the first security device, encrypted on-site data to a first optical transmission device; outputting, by the first optical transmission equipment, encrypted field data to the ring network; receiving the encrypted on-site data by a second optical transmission device; transmitting the encrypted on-site data to a second security device by the second optical transmission device; decrypting the encrypted field data by the second security device; and transmitting, by the second security device, the decrypted field data to a power facility server.

The first security device may encrypt the field data through a MACsec encryption method.

According to the silsing example, a computer-readable 　recording medium in which a program for executing the above-described method on a computer is recorded.

A security system and method for an optical transmission facility according to the present invention can perform high-speed encryption/decryption processing by optimizing bandwidth and delay time.

In addition, it is possible to improve security by blocking malicious attacks in the optical transmission section.

In addition, it is easy to replace each functional block, and it is easy to link with various existing optical transmission equipment.

1 is a conceptual diagram of a security system for an optical transmission facility according to an embodiment.
2 is a diagram for explaining a security device according to an embodiment.
3 is a diagram for explaining an encryption processing unit according to an embodiment.
4 is a diagram for explaining an encryption method of an encryption processing unit according to an embodiment.
5 and 6 are flow charts of a security method for optical transmission equipment according to an embodiment.
7(a) is a diagram illustrating a dedicated line using an optical cable, and FIG. 7(b) is a diagram illustrating a case in which a security system for optical transmission facilities according to an embodiment is applied.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

However, the technical idea of the present invention is not limited to some of the described embodiments, but may be implemented in a variety of different forms, and if it is within the scope of the technical idea of the present invention, one or more of the components among the embodiments can be selectively implemented. can be used by combining and substituting.

In addition, terms (including technical and scientific terms) used in the embodiments of the present invention, unless explicitly specifically defined and described, can be generally understood by those of ordinary skill in the art to which the present invention belongs. It can be interpreted as meaning, and commonly used terms, such as terms defined in a dictionary, can be interpreted in consideration of contextual meanings of related technologies.

Also, terms used in the embodiments of the present invention are for describing the embodiments and are not intended to limit the present invention.

In this specification, the singular form may also include the plural form unless otherwise specified in the phrase, and when described as "at least one (or more than one) of A and (and) B and C", A, B, and C are combined. may include one or more of all possible combinations.

Also, terms such as first, second, A, B, (a), and (b) may be used to describe components of an embodiment of the present invention.

These terms are only used to distinguish the component from other components, and the term is not limited to the nature, order, or order of the corresponding component.

In addition, when a component is described as being 'connected', 'coupled' or 'connected' to another component, the component is not only directly connected to, combined with, or connected to the other component, but also with the component. It may also include the case of being 'connected', 'combined', or 'connected' due to another component between the other components.

In addition, when it is described as being formed or disposed on the "top (above) or bottom (bottom)" of each component, the top (top) or bottom (bottom) is not only a case where two components are in direct contact with each other, but also one A case in which another component above is formed or disposed between two components is also included. In addition, when expressed as "up (up) or down (down)", it may include the meaning of not only an upward direction but also a downward direction based on one component.

Hereinafter, the embodiments will be described in detail with reference to the accompanying drawings, but the same or corresponding components regardless of reference numerals are given the same reference numerals, and overlapping descriptions thereof will be omitted.

1 is a conceptual diagram of a security system for an optical transmission facility according to an embodiment.

Referring to FIG. 1 , a security system 1 for an optical transmission facility according to an embodiment may include an optical transmission equipment 10 , an integrated management server 20 and a security device 30 .

The optical transmission equipment 10 is connected to a plurality of power facility servers 2 to collect on-site data, and can configure a mutual ring network through an optical cable dedicated line. The optical transmission equipment 10 may be connected to the power facility server 2 and the integrated management server 20 through an optical cable dedicated line (MPLS-TP). The optical transmission equipment 10 may collect on-site data by communicating with a plurality of power facility servers 2 . The plurality of optical transmission devices 10 may form a ring network with each other to perform data communication.

The integrated management server 20 may share an encryption key and a certificate with a node connected to an optical cable dedicated line. The integrated management server 20 may refer to a server that integrates functions of an authentication server and a management server. In the integrated management server 20, KCMVP (Korea Cryptographic Module Validation Program) module can be applied depending on whether the security system 1 for optical transmission facilities is applied to public institutions and national key industries according to the network environment and security requirements. . When it is decided to use the KCMVP verification module, the integrated management server 20 applies a KCMVP verified cryptographic module to use its own random number generator. Then, the integrated management server 20 may generate an encryption key pair and a certificate. The certificate can then be injected into the secure device 30 either online or offline. Thereafter, the security device 30 may access the integrated management server 20, register an initial IP address and a node IP, and perform mutual authentication.

Alternatively, in the case of introducing the security system 1 for optical transmission facilities in the private sector, the integrated management server 20 can perform mutual authentication by linking an external quantum key distribution server (not shown) with the security device 30. . In this case, the integrated management server 20 may use its own random number generator.

When mutual authentication is completed, control signal processing (EAR: Encryption At Rest) in communication between nodes of the security system 1 for optical transmission equipment may be performed through TLS (Transport Layer Security) encrypted communication.

On the other hand, after completion of mutual authentication, main signal processing (EIF: Encryption in Flight) may be selectively performed according to the field network environment in which the security system 1 for optical transmission facilities is introduced. A detailed description thereof will be described later.

The security device 30 is provided between the power facility server 2 and the optical transmission equipment 10 or between the integrated management server 20 and the optical transmission equipment 10, and field data collected from the power facility server 2 may be encrypted using MTPsec (Message Transfer Part security) method and output to a ring network, and data received through an optical cable dedicated line may be decoded and transmitted to the power facility server 2.

For example, when nodes greater than a preset standard are deployed in the ring network, the security device 30 may be provided between the integrated management server 20 and the optical transmission equipment 10 . At this time, the security device 30 receives the field data collected from the power facility server 2 from the optical transmission equipment 10, encrypts it through an ESP (Encapsulating Security Payload) encryption method, and then outputs it to the ring network. there is.

Alternatively, when nodes less than a predetermined standard are disposed in the ring network, the security device 30 may be provided between the power equipment server 2 and the optical transmission equipment 10 . At this time, the security device 30 collects on-site data from the power facility server 2, encrypts it through MACsec (Media Access Control security) encryption, and outputs it to the ring network through the optical transmission equipment 10. can

That is, the application method of the security device 30 may be different depending on the environment and scale condition of the ring network. For example, when introduction of a large-scale security system 1 is required in an optical cable dedicated line section, the security device 30 may be provided between the integrated management server 20 and the optical transmission equipment 10 . At this time, the security device 30 may perform communication in the MPLS-TP method and encrypt the generated password and LSP (Label Switched Path) layer with the ESP encryption method and transmit them in the MPLS-TP section. Encrypted data can be decrypted in the receiving side security device 30 and transmitted to each power facility server 2 via the optical transmission equipment 10 .

Meanwhile, in a small-scale environment, the security device 30 may be provided between the power equipment server 2 and the optical transmission equipment 10 . This method can be applied as it is to a pre-configured MPLS-TP network by applying only necessary places in an end-to-end method. At this time, the security device 30 may encrypt the data using the MACsec encryption method. The encrypted data is transmitted to the MPLS-TP section through the optical transmission equipment 10, and the data received by the optical transmission equipment 10 of each power facility server 2 is decrypted through the receiving side security device 30 It can be delivered to each power utility server 2 . In an embodiment, the MACsec encryption scheme may refer to an "IEEE" MAC security standard that defines "IEEE 802.1AE" integrity for connectionless data confidentiality and medium access independent protocols.

In addition, the security device 30 may access the integrated management server 20, register an initial IP address and a node IP, and perform mutual authentication using a shared encryption key and certificate. At this time, the security device 30 may perform encryption key transfer and authentication through an initial TLS communication process using the integrated management server 20 . The control signal may perform encrypted communication with TLS through an EAR (Encryption At Rest) control signal processing unit. The security device 30 may change and store the certificate and operation information of the power facility into a hash function. For example, the security device 30 may process and store a private key, secret key, important data value, identification information, password, and device-specific value using a hash function such as SHA 256 or 512. That is, there is no actual data in the security device 30, and only hash values and result values may be stored.

In an embodiment, the security device 30 can be mounted in a 1U, 19 "rack in the form of an independent module, so that it can be easily fixed and detached. The security device 30 can be linked to various existing optical transmission devices 10 by providing an encryption communication function, and can be operated by minimizing changes to existing system programs and system configurations.

In addition, in addition to the NNI (Network-to-Network Interface) section (communication section between the optical transmission equipment 10), which is an optical transmission section, the UNI (User to Network Interface) section (with the power equipment server 2) before data is exported Encryption is possible even in the communication section between the optical transmission equipments 10), so that encryption for each layer can be applied.

In addition, the security system 1 for optical transmission facilities enables integrated operation of a management program and an authentication center program, and can block malicious attacks by safely managing security information such as encryption/decryption keys and authentication information.

The hardware of the security system 1 for optical transmission facilities is separated into a control unit, an O&M processing unit, and a cryptographic module unit, so that it is easy to upgrade by functional block, add new functions, reduce operation and maintenance costs, and replace by block. In addition, through the separated cryptographic module unit, it is possible to apply the KCMVP-certified cryptographic module unit to national infrastructure industries such as its own cryptographic module, external quantum key distribution server, domestic power and power generation system, and public institutions.

The security system 1 for optical transmission facilities according to the embodiment encrypts the PE (Provider Edge Router) section of the MPLS section using the ESP method for reliable communication of MPLS-TP communication, which is still being standardized, to reduce bandwidth and delay time. An optimized optical transmission network security system 1 can be provided.

2 is a diagram for explaining a security device 30 according to an embodiment. Referring to FIG. 2 , the security device 30 according to the embodiment may perform communication with a plurality of optical transmission facilities using a standardized encryption protocol and an MPLS-TP security protocol.

In this specification, the MPLS-TP security protocol may mean a security protocol that encrypts a specific layer of the protocol with a specific method using a new MTPsec. The security device 30 may include a database 31, a device control unit 32, an encryption processing unit 33, and an auxiliary processing unit 34.

The database 31 may store useful information among certificates and operation information of power facilities as values changed by a hash function.

The device control unit 32 may control the security system 1 for the optical transmission facility according to a preset control algorithm. In addition, the device control unit 32 may perform control necessary for exchanging data between the integrated management server 20 and different optical transmission devices 10 . To this end, the device control unit 32 may perform an authentication procedure through the integrated management server 20 using unique identification information and security authentication information (private key, certificate).

In addition, in the case of communication with other optical transmission equipment 10, access can be authorized only when unique identification information and security authentication information are stored in the integrated management server 20. Due to this, malicious attacks by unauthorized users or devices can be prevented in advance. In addition, the device control unit 32 registers the accessible optical transmission equipment 10 and users in advance, but restricts the number of registrations or periodically changes the password to prevent access by unauthorized users or devices.

The encryption processing unit 33 may perform authentication or encryption/decryption processing for performing data communication of the optical transmission equipment 10 . In particular, the independent encryption processing unit 33 can select and apply its own encryption module, external quantum key distribution server, or KCMVP encryption module according to the business to which the security system 1 is applied (private or public institution). The encryption processing unit 33 may encrypt data by selecting a block operation mode capable of parallel processing using an FPGA for high-speed encryption/decryption processing of data. In addition, mutual authentication between the optical transmission devices 10 may be performed using the TLS encryption protocol. The encryption processing unit 33 may receive random numbers from its own random number generator 35 or quantum key distribution server 40, and perform subsequent authentication after initial authentication with other optical transmission devices 10 using the random numbers. there is.

In the asymmetric key encryption processing method of the cryptographic module, the operation mode of the block cipher can be selectively applied. Operation modes applicable to the security system for optical transmission facilities (1) include stability for the same repeated block, use of main signal processing data, impossibility of retransmission attack, encryption parallel processing, and encryption/decryption to enable high-speed processing of FPGA. Conditions such as the same structure and a structure that does not require padding are required. Therefore, applicable operating modes include a counter-type CTR that satisfies this requirement, and a GCM mode in which HASH is included in the cipher text to identify data tampering attacks through man-in-the-middle attacks. The requirements of this operating mode can enhance the security of the security system 1 for an optical transmission facility and improve the reliability of the security system 1 for an optical transmission facility by minimizing the delay time.

The auxiliary processing unit 34 assists the device control unit 32 to perform system monitoring, external control signal processing, and to provide storage and inquiry functions for environment information of optical transmission communication. The auxiliary processing unit may store software and application images, provisioning, performance information, alarm information, switching information, and the like of the device control unit.

3 is a diagram for explaining an encryption processing unit according to an embodiment. In the embodiment, a separate FPGA-based encryption processing unit 33 is applied to speed up the encryption processing speed. An example of asymmetric key encryption in which the encryption processing logic is different according to the block operation mode and encryption key value is as follows. At this time, the device control unit 32 may set an operation mode and an encryption key value for data encryption processing, and instruct the encryption processing unit 33 to process the encryption logic according to the operation mode. The encryption processing unit 33 designed as a separate FPGA performs encryption logic in parallel by designing an internal circuit that meets the requirements in advance, and performs operation mode, encryption logic, and repetitive logic in conjunction with the CPU encryption module, and data It can be encrypted and transmitted. At this time, the FPGA may set the round processing of the default value as an initial value and perform processing logic suitable for the environment according to the user's function selection.

Referring to FIG. 3, the encryption processing unit 33 includes an MGMT FPGA 331 that controls the security system 1 for optical transmission facilities, ENCRYPTION FPGAs 332 and 333 that perform encryption processing for each port group, and peripheral circuits 334 ~ 338). The MGMTFPGA 331 updates and manages the ENCRYPTION FPGA IMAGE through the MCU, which is the device control unit 32, and may be connected to the FLASH MEMORY 334 for this purpose. In addition, it can be in charge of controlling the ENCRYPTION FPGAs 332 and 333 at the time of initial booting or when the updated ENCRYPTION IMAGE is applied. In addition, it is possible to separate the area accessed by the MCU through address decoding and manage the state of the security system 1 for the optical transmission facility.

The ENCRYPTION FPGAs 332 and 333 are core parts of the operation of the security system 1, and may be divided into separate FPGAs for each port group and composed of two FPGAs. Also, RAMs 335 and 336 may be arranged for packet servers. Each FPGA can be configured by connecting ports such as Clint (decryption period), Trunk (encryption period), and HSR application (High-Availability Seamless Redundancy). In addition, encryption/decryption processing may be performed by applying the encryption key received from the MCU.

The device control unit 32 prepares for the connection requirements of various networks and is designed to be used for on-site image update, backup, or direct input of an external encryption key through the USB ports 337 to 338. That is, the device control unit may perform operations and management of an integrated management server port for external interface access, a communication network port between optical transmission devices 10, and a USB port for important data update/backup.

In addition, the device control unit 32 may provide various functions such as operation control of the encryption processing unit, performance management, encryption key seed (SEED) generation for a quantum random number generator, encryption key acquisition from an external server, authentication management, and the like.

4 is a diagram for explaining an encryption method of an encryption processing unit according to an embodiment. 4 shows a packet structure obtained by analyzing data before and after the MTPsec encryption method. Referring to FIG. 4, it can be seen that the encryption method and packet structure are different according to the basic packet structure, transmission mode ESP and tunnel mode ESP during MPLS-TP communication in the dedicated line section.

When configuring MPLS (Multiprotocol Label Switching) communication, PW shim header and LSP shim header are generated in the general packet header. The encryption processing unit according to the embodiment may apply ESP encryption of IPsec to a packet structure of a PW layer of a provider edge (PE) section in order to encrypt an original packet and perform authentication.

In the transmission mode ESP (Transmission mode ESP), the ESP header is located between the PW and the user traffic to protect traffic in a mode that provides end-to-end security.

In addition, in the tunnel mode ESP, an ESP header and a NEW PW are placed before the PW header to protect traffic in a partial path between tunnel endpoints.

Security System for Optical Transmission Facilities According to Embodiments For optimized encrypted communication of MPLS communication, it is possible to optimize a bandwidth problem by selectively encrypting a PW-Layer generated during MPLS communication.

When encrypting data in the MPLS section, which is still being standardized, for optimized encrypted communication, encryption of the LSP layer and PW layer occurring in MPLS communication must be considered. At this time, if the LSP layer is encrypted, bandwidth may be wasted due to overhead. Accordingly, for encryption communication of the PW layer, encryption can be performed by applying the ESP method of IPsec to the PW header generated during MPLS communication. At this time, the security system for an optical transmission facility according to the embodiment may perform encryption by selectively applying a tunnel mode and a transmission mode according to the network environment.

Tunnel mode performs authentication and encryption on the entire original MPLS packet except for the new MPLS header, but since the new MPLS header is inserted, more bandwidth can be used compared to transport mode.

Therefore, considering the transmission delay and bandwidth issues, the tunnel mode that provides security functions is basically used in the security gateway located between each headquarters, and the transmission mode is selectively used when providing terminal security functions to both hosts according to the communication section environment. can be used as In addition, confidentiality and integrity can be provided by applying an ESP encryption method for encrypting and authenticating inner MPLS packets.

In an embodiment, the transport mode may provide a host-to-host security association function. The transport mode may protect only the payload of the IP packet excluding the IP header, rather than protecting the entire IP packet. In transport mode, IP headers are not encrypted, so traffic paths can be exposed. Therefore, the transport mode can be used to protect IP packets in the end node section.

In an embodiment, the tunnel mode may provide a gateway-to-gateway or host-to-gateway security association function. Tunnel mode protects the entire IP packet, and routing can be performed by adding an IPSec header to the encrypted IP packet. Since the IPSec header has only information about movement between sections, it can protect end information (originating point, destination) and traffic path. In general, tunnel mode can be used when traffic traverses an untrusted network.

Through this, MPLS encrypted communication is possible in the PE section of the optical transmission section.

Fig. 5 is a flow chart of a security method for optical transmission equipment according to an embodiment.

5 illustrates a security process in the case where a security device is provided between the integrated management server and the optical transmission equipment. Referring to Fig. 5, the first light transmission equipment collects on-site data from the first power facility server (S501).

Next, the first optical transmission device transmits the collected field data to the first security device (S502).

Next, the first security device encrypts the on-site data collected from the first optical transmission equipment using the MTPsec method. At this time, the first security device may encrypt the field data through an ESP encryption method (S503).

Next, the first security device outputs encrypted field data to the ring network (S505).

Next, the second security device receives the encrypted field data and decrypts the encrypted field data (S505).

Next, the second security device transmits the decrypted field data to the second optical transmission device (S506).

Next, the second optical transmission equipment transmits the decrypted on-site data to the second power facility server (S507).

Fig. 6 is a flow chart of a security method for optical transmission equipment according to an embodiment.

6 shows a security process in the case where security devices are provided in the power equipment server and the optical transmission equipment. Referring to FIG. 6 , the first security device collects on-site data from the first power facility server (S601).

Next, the first security device encrypts the on-site data using the MTPsec method. At this time, the first security device may encrypt the on-site data through the MACsec encryption method (S602).

Next, the first security device transmits the encrypted field data to the first optical transmission device (S603).

Next, the first optical transmission equipment outputs the encrypted field data to the ring network (S604).

Next, the second optical transmission device receives the encrypted field data and transmits the encrypted field data to the second security device (S605).

Next, the second security device decrypts the encrypted field data (S606).

Next, the second security device transmits the decrypted field data to the power facility server (S607).

7(a) is a diagram illustrating a dedicated line using an optical cable, and FIG. 7(b) is a diagram illustrating a case in which a security system for optical transmission facilities according to an embodiment is applied.

Referring to FIG. 7 (a), the optical cable of the optical line can be easily hacked anywhere, and if a simple hacking device such as an optical signal bending device is used without damaging the optical cable, even an optical signal of less than 1% can be 100% hacked. You can confirm that data can be received. On the other hand, referring to FIG. 7(b), it can be seen that the security system for optical transmission facilities can effectively prevent the above-described hacking case by encrypting and transmitting all data in the dedicated line section.

The security system for an optical transmission facility according to the embodiment can effectively prevent access by hackers due to malicious attacks. In addition, security can be improved by changing and storing all key information such as encryption keys and certificates in hash values. In addition, communication can be performed through equipment and devices verified through a mutual authentication process, and a certificate can be generated only on the designated EMS of the integrated management server. In addition, the generated certificate must be systematically managed and discarded, and in order to create a certificate used for TLS encrypted communication, it must be accessed and executed in administrator mode. In addition, authority is restricted by setting system settings and password functions according to levels. In addition, it uses its own random number generator (hardware method) and optionally uses an external quantum cryptographic distribution system server. Also, limit the number of registered IDs and designate IPs to allow remote access. In addition, by restricting commands that can be set for each account, only users of specific accounts can input key commands. In addition, if user authentication fails a set number of consecutive times, identification and authentication functions may be deactivated, and all remote services provided by the equipment may be activated/deactivated.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer readable recording medium. In this case, the medium may continuously store a program executable by a computer or temporarily store the program for execution or download. In addition, the medium may be various recording means or storage means in the form of a single or combined hardware, but is not limited to a medium directly connected to a certain computer system, and may be distributed on a network. Examples of the medium include magnetic media such as hard disks, floppy disks and magnetic tapes, optical recording media such as CD-ROM and DVD, and magneto-optical media such as floptical disks. , and ROM, RAM, flash memory, etc. configured to store program instructions. In addition, examples of other media include “recording media” or storage media managed by an app store that distributes applications, a site that supplies or distributes various other software, and a server.

The term '~unit' used in this embodiment means software or a hardware component such as a field-programmable gate array (FPGA) or ASIC, and '~unit' performs certain roles. However, '~ part' is not limited to software or hardware. '~bu' may be configured to be in an addressable storage medium and may be configured to reproduce one or more processors. Therefore, as an example, '~unit' refers to components such as software components, object-oriented software components, class components, and task components, processes, functions, properties, and procedures. , subroutines, segments of program code, drivers, firmware, microcode, circuitry, data, databases, data structures, tables, arrays, and variables. Functions provided within components and '~units' may be combined into smaller numbers of components and '~units' or further separated into additional components and '~units'. In addition, components and '~units' may be implemented to play one or more CPUs in a device or a secure multimedia card.

Although the above has been described with reference to preferred embodiments of the present invention, those skilled in the art will variously modify and change the present invention within the scope not departing from the spirit and scope of the present invention described in the claims below. You will understand that it can be done.

1: Security systems for optical transmission facilities
10: optical transmission equipment
20: integrated management server
30: security device

Claims (11)

Optical transmission equipment constituting a mutual ring network through an optical cable dedicated line connected to a plurality of power facility servers to collect on-site data;
an integrated management server that shares encryption keys and certificates with nodes connected to the optical cable dedicated line; and
It is provided between the power equipment server and the optical transmission equipment or between the integrated management server and the optical transmission equipment according to a node preset in the ring network, and encrypts field data collected from the power equipment server using the MTPsec method to perform the ring network operation. A security system for an optical transmission facility comprising a security device that outputs data to a dedicated optical cable line, decrypts data received through the dedicated optical cable line, and transmits the data to the power facility server.
According to claim 1,
The security system for an optical transmission facility, wherein the security device is provided between the integrated management server and the optical transmission equipment when nodes greater than or equal to a preset standard are disposed in the ring network.
According to claim 2,
Wherein the security device receives field data collected from the power facility server from the optical transmission equipment, encrypts it through an ESP encryption method among the MTPsec methods, and then outputs the data to the ring network.
According to claim 1,
The security system for an optical transmission facility, wherein the security device is provided between the power facility server and the optical transmission equipment when nodes less than a preset standard are disposed in the ring network.
According to claim 4,
Wherein the security device collects the on-site data from the power facility server, encrypts it through a MACsec encryption method among the MTPsec methods, and outputs the data to the ring network through the optical transmission device.
According to claim 1,
wherein the security device accesses the integrated management server, registers an initial IP address and a node IP, and performs mutual authentication using the shared encryption key and certificate.
Optical transmission equipment constituting a mutual ring network through an optical cable dedicated line connected to a plurality of power facility servers to collect on-site data;
an integrated management server that shares encryption keys and certificates with nodes connected to the optical cable dedicated line; and
A security method for an optical transmission facility comprising a security device provided between the integrated management server and the optical transmission equipment when nodes greater than or equal to a predetermined standard are disposed in the ring network,
collecting field data from the power facility server by a first optical transmission device;
encrypting, by a first security device, on-site data collected from the first optical transmission equipment using an MTPsec method;
outputting, by the first security device, encrypted field data to the ring network;
receiving, by a second security device, the encrypted on-site data;
decrypting the encrypted field data by the second security device; and
and transmitting, by the second security device, the field data decrypted to a second optical transmission device.
According to claim 7,
wherein the first security device encrypts the on-site data through an ESP encryption method among the MTPsec methods.
Optical transmission equipment constituting a mutual ring network through an optical cable dedicated line connected to a plurality of power facility servers to collect on-site data;
an integrated management server that shares encryption keys and certificates with nodes connected to the optical cable dedicated line; and
A security method for an optical transmission facility comprising a security device provided between the power facility server and the optical transmission device when nodes less than a preset standard are deployed in the ring network,
collecting, by a first security device, on-site data from the power facility server;
Encrypting, by the first security device, the on-site data using an MTPsec method;
transmitting, by the first security device, encrypted on-site data to a first optical transmission device;
outputting, by the first optical transmission equipment, encrypted field data to the ring network;
receiving the encrypted on-site data by a second optical transmission device;
transmitting the encrypted on-site data to a second security device by the second optical transmission device;
decrypting the encrypted field data by the second security device; and
and transmitting, by the second security device, the decrypted on-site data to a power facility server.
According to claim 9,
The first security device encrypts the field data through a MACsec encryption method among the MTPsec methods.
A computer-readable 　recording medium in which a program for executing the method of any one of claims 7 to 10 is recorded on a computer.

Images