KR20120074041A - Supervisory control and data acquisition system and security management method thereof - Google Patents

Abstract

PURPOSE: An SCADA(Supervisory Control and Data Acquisition) system and security management method thereof are provided to monitor the invasion of a network by accurately verifying data received from each RTU(Reinforcement Training Unit). CONSTITUTION: A data state estimation module(230) determines measurement errors on power state data values received from each RTU. A security state determination module(220) senses the invasion of a network included in a management server. In case the measurement error is existed, the security state determination module determines security states by confirming the invasion of the network. A security control module(210) creates repairing or recovering command according to determination results.

Description

SCADA system and security management method thereof {Supervisory Control and Data Acquisition System and Security management method}

The present invention relates to a SCADA system and a security management method thereof, and more particularly, to increase the security in operating the SCADA system built in the power system SCADA system and its security to enable accurate and stable power system operation can be achieved It is about a management method.

Supervisory Control and Data Acquisition (SCADA) system is a system for centrally monitoring and controlling devices and equipments installed in remote areas.The operation of remote terminal units (RTUs) and remote locations located in each area monitors the operation of RTUs. And a SCADA server to control and a communication link forming a data transmission path between remote devices such as the SCADA server and the RTU.

The remote equipment has the function of collecting data and diagnosing the status and sending the situation and details to the SCADA server accordingly. SCADA server monitors various information received from each remote device and displays it to the administrator.

This SCADA system is applied to railway management and control, water resource management, transmission and distribution work, flood alarm system because the central operator can monitor and control the remote device status in real time.

Currently, SCADA system in Korea has a closed network which is separate from the public internet network. Therefore, security awareness is relatively low compared to the public network. However, even if it is closed, communication security problems, such as information leakage, may occur, so that measurement information transmitted from remote devices or control information for the remote device may not be protected.

That is, the SCADA system as a control system requires a high level of availability (low frequency of failure and fast recovery) and a very high level of measurement accuracy. Therefore, it is necessary to prevent the verification of the received data or improper or incorrect control operation in advance. Accordingly, for stable operation of power system, accurate communication between RTU / Host must be premised in SCADA system.

However, there is always the possibility of artificial information distortion by external hacking, including measurement errors and communication errors, increasing the threat of hacking or terrorist acts on industrial and national infrastructure.

In particular, the Smart Grid, the next-generation power grid system, has two-way communication with servers over WANs and private networks, providing complete network connectivity and interoperability from energy generation management to end consumer energy use. As a result, the openness of the network is greatly enlarged, and thus, the security becomes very weak.

The present invention is to solve the above problems, SCADA system that not only verify the accuracy of the data received in each RTU, but also detects the intrusion in the network to respond more quickly to threats from the outside, such as hacking and Its purpose is to provide his security management method.

In addition, another object of the present invention is to provide a SCADA system and a security management method thereof that can securely control the system while securing high availability for operating the power system.

SCADA system according to an embodiment of the present invention for achieving the above object is composed of a management server for centrally controlling the RTU and the RTU provided in each node of the power system, the RTU and the management server is connected to the Security server that monitors the power status data measurement error received from the Remote Terminal Unit (RTU) and the security status of the network, and an intrusion that is connected to each of the RTUs to monitor the intrusion through the network and transmit the status information to the security server. Prevention device.

The security server is connected to an energy management server that monitors network intrusion into the management server, and determines whether there is an error in the power state data values received from each of the RTUs, and determines whether the measurement accuracy is correct. And a security state determination module for determining a network security state by checking whether an intrusion detection is received from each of the intrusion prevention apparatuses when receiving an error message for power state data.

In addition, the security management method of the SCADA system according to another embodiment of the present invention, the first step of determining whether the measurement status of the power state data received from the RTU and the intrusion into the SCADA network from the outside; A second step of determining a network state by any one of hacking, network failure, and physical damage according to the determination and monitoring result; And a third step of issuing a repair or repair command and notifying an administrator according to the determination result.

In the second step, when a measurement error occurs in the power state data but no intrusion into the SCADA network is detected, it is determined that there is a physical damage on the RTU side that transmits the power state data in which the measurement error occurs.

SCADA system and its security management method according to an embodiment of the present invention configured and operated as described above, by verifying the accuracy of the data received in each RTU of the power system and monitoring the network intrusion or threats from outside, such as hacking It can respond more quickly to the system, and thus has the effect of performing stable and reliable system control.

In addition, by accurately determining and recovering physical damages or temporary network failures of remote devices such as RTUs as well as hacking, it is possible to greatly increase the stability of the entire power system.

1 (a) and 1 (b) is a block diagram showing the configuration of a SCADA system according to an embodiment of the present invention,
2 is a block diagram showing the configuration of a security server in the SCADA system according to an embodiment of the present invention,
3 is a diagram illustrating a network intrusion determination principle in an embodiment of the present invention, and
Figure 4 is a flow chart illustrating the operation of the security management method of the SCADA system according to an embodiment of the present invention.

Hereinafter, exemplary embodiments of the present invention will be described with reference to the accompanying drawings.

1 (a) and 1 (b) is a block diagram showing the configuration of a SCADA system according to an embodiment of the present invention.

SCADA system according to an embodiment of the present invention is applied to the power system, largely comprises a RTU (Remote Terminal Unit) and the management server 100.

The RTU is installed in each substation, which is the lower end of the power system, measures the amount of power supplied from the feeder side, that is, the data such as voltage, current, phase difference, or the like, and the amount of power distributed to the customer side, and the management server 100 as power state data. The management server 100 reads the power state data received from the RTU, monitors the power supply status at each node to which the RTU is connected, and issues an operation command to each RTU.

At this time, the MTU may be configured as an intermediate stage between the management server 100 and the RTU, the MTU is installed in the individual regional power supply station and the regional power distribution station, collects the data received from the RTU and delivers to the management server 100. Done. One embodiment of the present invention described later in this specification will be described the configuration and operation of omitting the MTU, it is specified that operations performed between the RTU-management server can be made the same between the MTU-management server.

SCADA system according to an embodiment of the present invention is connected to the RTU and the management server 100 includes a security server 200 for monitoring the measurement status of the power state data received from the RTU and the security status of the network.

In addition, it is connected to each of the RTU includes an intrusion prevention device 250 for monitoring the intrusion through the network and transmits the status information to the security server 200.

At this time, the management server 100 is connected to the energy management system (EMS, Energy Management System, 300) as shown in Figure 1 (b) of the power state data received from each RTU from the energy management system 300 Data regarding the measurement accuracy may be received, which will be described later with reference to FIG. 2.

2 is a block diagram showing the configuration of a security server in the SCADA system according to an embodiment of the present invention, Figure 2 (a) is a block showing the configuration of a security server according to a first embodiment of the present invention 2 (b) is a block diagram showing the configuration of a security server according to a second embodiment of the present invention.

Referring to FIG. 2 (a), an embodiment of the present invention will be described. The security server 200 may determine a data state estimation module 230 for determining whether there is a measurement error in power state data values received from each of the RTUs. Determination of the security state determination module 220 and the security state determination module 220 to detect the network intrusion into the management server 100, and to determine the security state by checking whether the network intrusion if there is a measurement error According to the security control module 210 to generate and issue a repair or repair command.

The data state estimation module 230 determines whether the power state data value is correct from the data redundancy received from the RTU.

This is caused by measurement error in each RTU measuring the amount of power, current value, and voltage value at each point. In many cases, the error occurs in the voltage value received from the RTU and the actual voltage value. In particular, the voltage value received at the RTU is within the rated range, but if the actual voltage value at the node exceeds the rated range, it may lead to a grid fault.

The data state estimation module 230 is a component to compensate for this, and checks the redundancy of the total power state data received from each RTU to determine the accuracy of the corresponding power state data value, and determine that there is an error If it is, it is corrected to approximate the actual value.

Data redundancy is a redundant measurement of surrounding data that is not essential. For example, suppose that measurement point A3 has a relationship of 2 + 3 = 5 with surrounding measurement points A1 and A2, and 2 is measured at A1, 3 at A2, and 5 at A3. The required data is 5 values at point A3, but if you check up to the values at points A1 and A2, even if the received data value at point A3 is 7, the value is a measurement error due to the relationship between the values at points A1 and A2 and the point to point. The actual measured value can be estimated by 5 and corrected.

The data state estimation module may be provided in the energy management system 300 instead of the security server 200.

In the security server according to the second embodiment of the present invention, as shown in FIG. 2 (b), the data state estimation module 350 is separately included in the energy management server 300 in the first embodiment. As shown, the security state determination module 220 is a data state estimation module 350 provided in the energy management server 300 to determine whether there is an error in the power state data value received from each of the RTU data measurement data or not Received through the management server 100. In addition, the network security state is determined by receiving and reading intrusion detection status data from each intrusion prevention device 250 together with the received measurement accuracy determination data.

Meanwhile, the security state determination module 220 determines a security state such as hacking, temporary network failure or physical damage according to whether the data received from the data state estimation module 230 or 350 is correct or whether the network is invaded at each node. .

The security server 200 is connected to the intrusion prevention device 250 connected to each RTU, receives the intrusion detection from each intrusion prevention device 250 to monitor the network security status, and generates an operation control command accordingly The intrusion prevention apparatus 250 is issued. The security state determination module 220 analyzes the intrusion detection status data received from each intrusion prevention device 250 and analyzes the intrusion detection and the data accuracy to determine the security state.

For example, in more detail, if the value of the power state data is read as correct, but an attempt to invade some RTU side networks is detected, it may be determined that the network side has a temporary failure or malfunction due to a virus. .

In addition, if the power state data value is read as an error but the intrusion attempt is not detected by the entire intrusion prevention device, it may be determined that there is a physical (hardware) intrusion or damage to the corresponding RTU or system. When an intrusion attempt is detected from some or all intrusion prevention devices as well as an error in the power state data value, it may be determined that there is a risk of hacking or that it has already been hacked.

The security control module 210 generates and issues an instruction for increasing the security strength or blocking the connection and subsequently restoring or repairing the security state of the network according to the determination in the security state determination module 220. .

That is, when it is determined that a temporary failure occurs in the network or a malfunction due to a virus in the security state determination module 220, the security control module 210 drives the antivirus program to delete the virus or after a predetermined time passes. You can check the status again and issue a recovery command to ensure normal operation.

If it is determined that there is a physical intrusion or damage, the security control module 210 blocks the network connection to the node or a node adjacent to the node and notifies the administrator or maintenance personnel to perform a direct repair or repair. Can be.

And, if it is determined that the hack already, the security control module 210 may give a corresponding command by blocking the network connection to the remaining nodes that are not detected intrusion attempt, if it is determined that there is a risk of hacking Again, each intrusion prevention device or RTU can be notified by issuing a command to replace a cryptographic key that temporarily blocks network connections, encrypts incoming or outgoing data, or by replacing cryptographic keys.

Operations of the security state determination module or the security control module as described above are merely examples, and the specific operations of these modules may be easily changed by those skilled in the art.

3 is a diagram illustrating a network intrusion determination principle in an embodiment of the present invention.

In an embodiment of the present invention, the security server and intrusion prevention device may be based on IPS.

Intrusion Prevention System (IPS) is a preventive approach to network security technology that recognizes and responds to potential threats, and monitors network traffic just like intrusion detection systems (IDS).

Once an attacker has gained access to the network, malicious use of the system can proceed very quickly, so it is desirable that IPS also take immediate action based on a set of rules set by the network administrator.

To this end, the IPS can inspect a packet and block all traffic from the IP address or port if it is determined to be an invalid packet, and forward the legitimate traffic to the receiver without any interruption or service delay.

To be an effective intrusion prevention system, more complex monitoring and analysis such as monitoring and responding to traffic patterns as shown in FIG. 3 as well as individual packets can be performed. Detection methods include address matching, HTTP string and substring matching. Intrusion detection can be detected through general pattern matching, TCP connection analysis, anomalous packet detection, abnormal traffic detection, and TCP / UDP port matching, and specific detection techniques can be easily modified by those skilled in the art.

Figure 4 is a flow chart illustrating the operation of the security management method of the SCADA system according to an embodiment of the present invention.

First, power state data is received from each RTU, and it is determined whether or not there is a measurement error in the received power state data value (S10, S30).

In addition, it receives status data on whether network intrusion is detected from an intrusion prevention device connected to each RTU.

If it is determined that there is an error as a result of the determination of the accuracy of the power state data (S40), it is checked whether there is a network intrusion attempt for the node where the corresponding power state data has been received or the entire network node (S50).

If it is determined that there is no network intrusion attempt, it is determined that there is a physical intrusion or damage to the equipment at the point where the power status data is received, and the relevant person or manager is notified to promptly repair / repair. (S70)

If it is determined that there is a network intrusion attempt, it is determined that there is a risk of hacking or is hacked to block the network connection to the corresponding or adjacent point and prevent the hack from expanding. In this case, if it is determined that there is a risk of hacking, the security strength may be strengthened by replacing the data encryption key.

Even if it is determined that there is no error as a result of determining the accuracy of the power state data, it is checked whether there is an intrusion attempt for all network nodes.

As a result of the check, if it is determined that there is an intrusion attempt, it may be determined that there is a temporary failure or a virus in the corresponding branch network, and accordingly, an antivirus program may be executed or the security state may be determined again after a certain time.

In the above, the process of judging the accuracy of the power state data is performed prior to the network intrusion attempt process, but the order of each process may be changed and it is desirable to simultaneously perform the security security detection.

As described above, the SCADA system and its security management method according to the present invention have been described with reference to the illustrated drawings, but are not limited to the embodiments and drawings disclosed herein, and verify the accuracy of data received from the power system. At the same time, the technical concept of the present invention, which detects network intrusion and improves network security of a remote control system built in a system, and can respond quickly to a problem, can be easily modified by those skilled in the art within a protected range. It can be obvious.

100: management server 200: security server
210: security control module 220: security status determination module
250: intrusion prevention device 230, 350: data condition estimation module
300: energy management system

Claims (9)

In the SCADA (Supervisory Control and Data Acquisition) system composed of each RTU provided in the power system and a management server for central control of the RTU,
And a security server connected to the RTU and a management server to determine the accuracy of power state data received from the remote terminal unit (RTU) and to monitor the security state of the network. The method of claim 1,
SCADA system connected to each of the RTU, including an intrusion prevention device for monitoring the intrusion through the network and transmits the status information to the security server. The method of claim 2,
The security server is connected to an energy management server that monitors network intrusion into the management server and determines whether or not there is an error in power state data values received from each of the RTUs.
And a security state determination module for determining a network security state by checking whether an intrusion detection is received from each of the intrusion prevention apparatuses when receiving an error message for the power state data from the energy management server. The method of claim 1,
The security server may include: a data state estimation module for determining accuracy of a measurement error in power state data values received from each of the RTUs; And
Security status determination module for detecting the network intrusion into the management server, and if there is a measurement error to determine whether the network intrusion
SCADA system comprising a. The method of claim 4, wherein
The data state estimation module determines the error from the data redundancy (redundancy) received from the RTU. The method according to claim 3 or 4,
The security state determination module is a SCADA system for determining the hacking, temporary network failure or physical damage, according to whether each of the power state data value error and network intrusion. The method according to claim 6,
If it is determined that there is a risk of hacking in the security state determination module, the security control module is a SCADA system for issuing a command to replace the encryption key used when encrypting data. A first step of determining whether there is a measurement error of the power state data received from the RTU and monitoring the intrusion into the SCADA network from the outside;
A second step of determining a network state by any one of hacking, network failure, and physical damage according to the determination and monitoring result; And
And a third step of issuing a repair or repair command and notifying an administrator according to the determination result. The method of claim 8,
In the second step, if a measurement error occurs in the power state data but no intrusion into the SCADA network is detected, the SCADA system determines that there is a physical damage on the RTU side that transmitted the power state data in which the measurement error occurred. Security management method.

Images