KR102578983B1 - Security system of autonomous train system supporting ALM - Google Patents

Abstract

The present invention relates to a security system for an autonomous train driving system that supports ALM. The group member IP and port of the autonomous train system device are managed by a group key management server to hide the attack target from attackers, thereby causing DDoS attacks. It provides a security system for the autonomous train driving system that supports ALM, which can prevent attacks using network traffic and improve system availability in the event of expansion or change of the autonomous train driving system.

Description

Security system of autonomous train system supporting ALM {Security system of autonomous train system supporting ALM}

The present invention relates to a security system for an autonomous train driving system that supports ALM, and more specifically, to a train autonomous system that supports application layer multicast (ALM: Application Layer Multicast) for safe and efficient packet transmission and reception of the autonomous train driving system. It is about the security system of the driving system.

In general, railway vehicles are a large-scale means of transportation that transport a large number of cargo or passengers, and are equipped with various and complex train control systems to ensure safe operation along the tracks.

At this time, the train control system adopts a complex system configuration to enable various monitoring and control to ensure the safe operation of the train. Securing the safety distance and safe speed between the preceding and following trains is very important for the safe operation of the train. And, as an example for this purpose, Registration Patent No. 10-1449742 (Reference 1) has been proposed.

Meanwhile, the autonomous train driving system controls the safe operation of trains based on wireless communication technology. The autonomous train driving system uses the IP multicast address system to create groups, exchange driving messages between groups, and share information such as the train's route, stopping station, and driving speed. This ensures the train's own driving safety and ensures that the train is running. It is an intelligent train control system that freely configures trains and recognizes and controls unusual situations in real time. As prior art related to this, Registered Patent No. 10-1834854 (Reference 2), Registered Patent No. 10-1864340 (Reference 2), etc. have been proposed.

The security device of this conventional train autonomous system defines an IP multicast address as a group identifier, and each device participates in one or more groups to send and receive packets.

At this time, participation/leaving of each group utilizes IGMP, an existing IP multicast group management protocol. In inter-group packet transmission and reception, when a packet sender transmits a packet to the corresponding group IP address, it is routed by a network router and delivered to the router where the final recipient exists. IP multicast has the advantage that there is no need to consider packet delivery from the application perspective because multicast is operated by a router.

However, anyone can participate in the multicast group, and group members can receive all packets of the participating group, so there is a security risk that encrypted packets are exposed.

Additionally, there is a disadvantage in that packet transmission reliability cannot be secured due to network routers that do not support multicast.

Reference 1: Registered Patent No. 10-1449742 Reference 2: Registered Patent No. 10-1834854 Reference 3: Registered Patent No. 10-1864340

Therefore, the present invention is intended to solve these problems. The present invention is to overcome security risks by supporting application layer multicast (ALM) for safe and efficient packet transmission and reception of the autonomous train system. The purpose is to provide a security system for autonomous driving systems.

In order to solve this technical problem, the present invention;

A group key management server that performs group key allocation and group management functions for devices constituting the autonomous train driving system, and is connected to the device to encrypt and decrypt message packets of group members included in the device and group members of the autonomous train driving system. It provides a security system for an autonomous train driving system supporting ALM, which is comprised of a security module that performs subscription and withdrawal functions.

At this time, the message is characterized in that it includes commands for train control of the autonomous train driving control system.

In addition, the packet is a packet defined in the autonomous train driving system, and its destination address is an IP multicast group address.

Additionally, the device is characterized in that it includes a device provided on a train car and a device provided on the ground.

In addition, the group key management server and the security module are characterized in that a communication module for transmitting and receiving packets is connected to the device and the group key management server through a network.

In addition, the group key management server includes a white list including a group ID, a group IP address, and information on group members who can participate; Group members, group ID, source IP address, source port number, group key, and keep-alive timer information It is characterized in that a group key list containing it is stored.

In addition, when a packet is transmitted from a connected device, the security module uses the source IP (src IP), source port (src port), destination IP (dst IP), and destination port (dst port) information in the IP header of the packet to group A group key is requested from the key management server, and if the security module's group membership request is appropriate, the group key management server adds and updates the corresponding group member to the group key list, It is characterized by delivering the updated group key and the source IP address and source port number, which are group member information, to the group members of all devices connected to the network.

At this time, when updating the group key list, the group key management server stores the unicast IP address of the security module in the Source IP Address and the corresponding IP address in the Source Port number. It is characterized by storing the port number of the security module.

Additionally, the group key management server is characterized in that it updates the group key according to changes in group members.

In addition, the security module encrypts the original packet received from the group member using the group key received from the group key management server and transmits it to the group members of all devices connected to the network.

In addition, the security module is characterized in that the original packet encrypted using the group key is unicast transmitted n times according to the number of group members (n).

Additionally, when a packet is received through the network, the security module identifies which group it is and decrypts the packet using the corresponding group key.

In addition, the security module is characterized in that when the autonomous train driving system device is normally terminated, a request to withdraw from all joined groups is transmitted to the group key management server.

In addition, the security module periodically transmits alive packets to the group key management server to initialize the keep-alive timer for reception of the group key list, and the group key management server receives each item of the group key list. It is characterized by monitoring the keep-alive timer and updating the group key if there is no response from the security module until the set time of the reception wait timer (keep-alive timer) is exceeded.

According to the present invention, the IP and port of group members can be managed in the group key management server to hide the attack target from attackers, thereby preventing attacks using network traffic, such as DDoS attacks.

In particular, according to the present invention, external attacks on group key exposure can be prevented by managing group members in real time in the group key management server and updating group keys according to group member changes.

In addition, according to the present invention, white list-based group management is possible in the security system of the autonomous train driving system, so if there is an expansion or change in the autonomous train driving system, the changes are reflected in real time by applying the changes to the white list. System availability can also be improved.

Figure 1 is a security system configuration diagram of an autonomous train navigation system supporting ALM according to the present invention.
Figure 2 is a diagram showing an example of a white list managed by the group key management server of the present invention.
Figure 3 is a flowchart of the operation of the security system according to the present invention.
Figure 4 is a diagram showing an example of a group key list managed by the group key management server of the present invention.
Figure 5 is a diagram illustrating an example of a group member being added to a white list managed by the group key management server of the present invention.

Hereinafter, the features of the security system of the autonomous train driving system supporting ALM according to the present invention will be described in detail with reference to the attached drawings.

Prior to this, the terms or words used in this specification and claims should not be construed as limited to their usual or dictionary meanings, and the inventor should appropriately define the concept of terms in order to explain his or her invention in the best way. It must be interpreted as meaning and concept consistent with the technical idea of the present invention based on the principle of definability.

Therefore, the embodiments described in this specification and the configurations shown in the drawings are only one of the most preferred embodiments of the present invention and do not represent the entire technical idea of the present invention, so at the time of filing this application, they can be replaced. It should be understood that various equivalents and variations may exist.

Referring to Figure 1, the security system of the autonomous train driving system supporting ALM according to the present invention is a security system that supports application layer multicast (ALM) for safe and efficient packet transmission and reception of the autonomous train driving system. am.

The security system of the present invention is connected to the autonomous train driving system and is responsible for transmitting and receiving packets between the autonomous train driving systems.

At this time, the autonomous train navigation system includes a device 10a installed on the train and a device 10b installed on the ground, and the individual device 10 includes one or more group members 11. Accordingly, an autonomous train driving system is formed by connecting devices 10 individually provided on a plurality of trains and on the ground.

And, the group member 11 provided in the individual device 10 includes, for example, a ground control device and an onboard control device.

This security system includes a group key management server 100 that performs group key allocation and group management functions for the device 10 constituting the autonomous train driving system, and a group member connected to the device 10 and included in the device ( It includes a security module 200 that encrypts and decrypts the message packet in 11) and performs the group joining and leaving functions of the autonomous train driving system.

At this time, the message is a message for operating the autonomous train control system and includes, for example, train control messages such as commands for train control.

In addition, the group key management server 100 and the security module 200 of the autonomous train driving system are connected to communication modules 110 and 210 for packet transmission and reception, respectively. The communication modules 110 and 210 perform a function of connecting the device 10 and the group key management server 100 through a network (N), and the communication modules 110 and 210 are connected to each other wirelessly or wired.

The security system of the present invention performs a group key request function, group management function, group identification function, group key management function, and packet encryption/decryption function to encrypt and decrypt packets of the autonomous train driving system.

To this end, the group key management server 100 includes a group ID, a group IP address, and information on group members available for participation according to the security policy, as shown in FIG. 2. A white list is being saved.

Additionally, the group key management server 100 stores a group key list that is updated according to group member changes, as shown in FIG. 4. The group key list includes group members, group ID, source IP address, source port number, group key, and waiting timer (Keep- alive timer) information.

Hereinafter, the operation process of the group key management server 100 and the security module 200, which constitute the security system according to the present invention, will be described with reference to FIGS. 3 to 5.

First, in the case of a group key request, when a packet is transmitted from the train or ground device 10 constituting the autonomous train system to the security module 200 direction (S1), the security module 200 sends the source IP of the IP header of the packet ( src IP), source port (src port), destination IP (dst IP), and destination port (dst port) information are used to send a group key to the group key management server 100 through the communication modules 210 and 110. request.

At this time, the packet is a packet defined in the autonomous train driving system and the destination address is an IP multicast group address.

The security module 200 of the device 10 requests group membership (S2) from the group key management server 100 to obtain a group key.

Accordingly, the group key management server 100 processes group membership in real time (S3). Here, the group management of the group key management server 100 requests the security module 200 of the device 10 to join the group based on white list information including group ID, group member, and group key. It is checked whether it is an appropriate group member (11), and if appropriate, an update is performed to add the corresponding group member (11) to the group key list (S4).

At this time, the unicast IP address of the security module 200 is stored in the source IP address of the group key list, and the unicast IP address of the security module 200 is stored in the source port number. The port number is stored.

Meanwhile, the group key management server 100 updates the group key according to a change in the group member 11 (S5). This is because if the group key is not updated despite a change in group members 11, members who have withdrawn from the group can continue to encrypt and decrypt group messages, which poses a security risk.

In this way, the group key management server 100, which updates the group key (S5) according to the change in the group member 11, updates the updated group key and the source IP address (Source), which is information on the group member. The IP address and source port number are delivered (S6) to the group members (11) of all train autonomous system devices (10) connected to the network (N).

Here, the group key list managed by the group key management server 100 is as shown in FIG. 4 as described above.

To explain this processing procedure as an example, if a packet is generated from Device1_app1, a group member 11 of a specific device 10 constituting the autonomous train system, and is transmitted to the security module 200 of the device 10, the security The module 200 requests group membership to the group key management server 100 through the communication modules 210 and 110.

Accordingly, if the group membership request of the security module 200 is normal, the group key management server 100 updates the group key for group A to which a new group member has been added (GK _A -> GK _A1 ).

Then, the group key management server 100 delivers the updated information to all group members 11 connected through the network N (S6). In this case, the members of group A have updated information [(unicast IP address(1), port number(1), GK _A1 ), (unicast IP address(2), port number(1), GK _A1 ), ( Receive unicast IP address(3), port number(1), GK _A1 )].

Meanwhile, the security module 200 encrypts the original packet received from the group member 11 using the group key received from the group key management server 100, and all autonomous train system devices connected to the network (N) Send (S7) to group member (11) of (10). N unicast transmissions (S7) are performed according to the number (n) of group members 11.

In this case, when the security module 200 of the autonomous train navigation system device 10 receives a packet (S7), it identifies which group it is and decrypts the packet with the corresponding group key (S8). If a packet of an unidentified group is received, the security module 200 performs a step (S2) of requesting information such as group ID, source IP address, source port number, and group key from the group key management server 100. If a normal response (S4) is received from the group key management server 100, the packet is decrypted. Otherwise, the packet is discarded. The decrypted packet (S8) is delivered to the destination group member (11).

In this way, there is nothing to change in the application layer of the device, which is the end-to-end stage, to increase packet security, and the security module 200 performs all roles in the middle.

And, group withdrawal of the security module 200 occurs in two cases.

First, when the autonomous train driving system device 10 is terminated according to the normal system shutdown procedure, the security module 200 connected to the autonomous train driving system device 10 sends a request to leave all joined groups through the group key. Transmitted to the management server 100.

Second, in an environment where the autonomous train driving system and security module 200 do not operate normally due to abnormal system termination, the group key management server 100 uses a keep-alive timer for each item in the group key list. monitor. If there is no response from the security module 200 until the set time of the keep-alive timer is exceeded, the corresponding group key is updated and delivered to all group members 11 except those who have withdrawn. To this end, the security module 200 must periodically transmit alive packets to the group key management server 100 to initialize the keep-alive timer for the group key list.

The above description is merely an illustrative explanation of the technical idea of the present invention, and various modifications and variations can be made by those skilled in the art in the technical field to which the present invention pertains without departing from the essential characteristics of the present invention. The scope of protection shall be interpreted in accordance with the claims below, and all technical ideas within the equivalent scope shall be construed as being included in the scope of rights of the present invention.

10: Train autonomous driving system device 11: Group member
100: Group key management server 110: Communication module
200: security module 210: communication module
N: network

Claims (14)

A group key management server that performs group key allocation and group management functions for devices constituting the autonomous train driving system;
It includes a security module that is connected to the device and encrypts and decrypts message packets of group members included in the device and performs group joining and leaving functions of the autonomous train driving system,
When a packet is transmitted from a connected device, the security module manages group keys using the source IP (src IP), source port (src port), destination IP (dst IP), and destination port (dst port) information in the IP header of the packet. Request a group key from the server,
If the security module's request for group membership is appropriate, the group key management server updates the corresponding group member in the group key list and adds the updated group key and group member information. The source IP address and source port number are delivered to group members of all devices connected to the network.
When updating the group key list, the group key management server stores the unicast IP address of the corresponding security module in the Source IP Address and the corresponding security module in the Source Port number. A security system for an autonomous train driving system that supports ALM, characterized by storing the port number.
According to clause 1,
The security system of the autonomous train driving system supporting ALM, characterized in that the message includes commands for train control of the autonomous train driving control system.
According to clause 1,
The packet is a packet defined in the autonomous train driving system and the destination address is an IP multicast group address. A security system for the autonomous train driving system supporting ALM.
According to clause 1,
The security system of the autonomous train driving system supporting ALM, characterized in that the device includes a device installed on the train and a device installed on the ground.
According to clause 1,
The group key management server and the security module are a security system for an autonomous train system supporting ALM, wherein a communication module for transmitting and receiving packets is connected to the device and the group key management server through a network.
According to clause 1,
The group key management server includes a white list including a group ID, a group IP address, and information on group members who can participate; Group members, group ID, source IP address, source port number, group key, and keep-alive timer information A security system for an autonomous train driving system supporting ALM, characterized in that a group key list containing the key is stored.
delete delete According to clause 1,
The group key management server is a security system for an autonomous train driving system supporting ALM, wherein the group key is updated according to changes in group members.
According to clause 1,
The security module encrypts the original packet received from the group member using the group key received from the group key management server and transmits it to the group members of all devices connected to the network. Security system.
According to clause 1,
The security module is a security system for an autonomous train system supporting ALM, wherein the original packet encrypted using a group key is unicast transmitted n times according to the number of group members (n).
According to clause 1,
The security module is a security system for an autonomous train system supporting ALM, characterized in that when a packet is received through the network, it identifies which group it is and decrypts the packet with the corresponding group key.
According to clause 1,
The security module is a security system for an autonomous train system supporting ALM, characterized in that when the autonomous train system device is normally terminated, a request to leave all joined groups is sent to the group key management server.
According to clause 1,
The security module periodically transmits alive packets to the group key management server to initialize the keep-alive timer of the group key list,
The group key management server monitors the keep-alive timer of each item in the group key list, and if there is no response from the security module until the set time of the keep-alive timer is exceeded, the A security system for an autonomous train driving system that supports ALM, characterized by updating group keys.