KR20160038935A - Secure communication apparatus and method of distribute network protocol message - Google Patents

Abstract

The present invention relates to a secure communication device for distributed network protocol (DNP) messages. The secure communication device includes: a serial interface transmitting and receiving the DNP messages; a block analysis unit which separates the DNP messages transmitted and received through the serial interface into first blocks, intermediate blocks, and last blocks and manages and analyzes each of the blocks; and a security module unit which provides an encryption library to encrypt the DNP blocks generated by the block analysis unit and manages security keys and policies; and a security processing unit which uses the encryption library delivered from the security module unit to encrypt the DNP blocks and execute the authentication process.

Description

Technical Field [0001] The present invention relates to a secure communication apparatus and method for a DNP message,

The present invention relates to a security communication apparatus and method for a DNP message, and more particularly, to a security communication apparatus and method for a DNP message by dividing a DNP (Distribute Network Protocol) message transmitted / received with a master or an outstation into a plurality of data blocks To a secure communication device and method of a DNP message.

The DNP (Distribute Network Protocol), which is a control system communication protocol developed under the assumption that the control system is a security closed system, is vulnerable to security, and a security protocol and a security communication device for protecting control commands are being actively developed. Control System IEEE 1815, an international standard communication protocol, added a Secure Authentication mechanism to protect the DNP-based control command by changing only the existing DNP application layer, but it applies to the control system that operates the above standard There are difficulties in doing so. In particular, in order to add security functions to existing control systems, it is necessary to replace the entire existing system with a new system equipped with security functions. Therefore, a lot of construction costs are required for security, and difficulties such as interruption of power service supply due to system replacement .

A general control system is a system for centrally monitoring and controlling remote devices. It is an out-station (remote sub-device) responsible for monitoring and operating facilities located at remote sites, and collects remote device status information using analog or digital signals. A master (control server) for remotely monitoring and controlling the remote slaughter device, and a serial data output unit (SIO) for receiving the DNP message from the master and transmitting the DNP message to each out-station, and a serial modem .

The control system to which the security function is applied performs the encryption / decryption operation on the DNP message transmitted through the master, the outstation which is the lower node of the master, and the control communication network which connects the master and the out station, A Secure Serial Input Output Module (SSIO), a Bump In The Wire (BITW), and the like for providing security functions such as DNP message authentication, integrity check, confidentiality retention, And may include a serial modem.

Although the IEEE 1815 Secure Authentication standard provides the message integrity function and the systematic key structure by changing only the application layer, in case of implementing as a separate security communication device, since the subject of DNP message generation and the subject of security function are different, And the division process is additionally generated, thereby increasing the transmission time.

In the conventional control system, only the connection section between the control server and the serial data collection device, the connection section between the serial data collection device and the remote remote device corresponds to the low-speed communication section, but in the control system using the separate security communication device, Since the connection section between the security communication devices, the control communication network connecting the master security communication device and the slave security communication device, and the connection section between the slave security communication device and the remote remote device become low speed communication sections, Increases the waiting time for receiving DNP messages at each connection point.

Therefore, in a control system that implements a security function in a separate security communication device, the transmission time is longer than the message transmission time of the existing control system due to the security function execution time and the message reception waiting time. As a result, Conditions can not be met and can affect the availability of control services.

The background art of the present invention is disclosed in Korean Patent Laid-Open Publication No. 10-2013-0034770 (Apr.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-mentioned problems, and it is an object of the present invention to provide a method and system for securing data integrity and confidentiality in the secure and stable operation of DNP (IEEE 1815) And to provide a secure communication apparatus and method of a DNP message that minimizes an increase in the number of DNP messages.

Another object of the present invention is to provide a secure communication apparatus and method of a DNP message for minimizing a message processing time by transmitting control data in real time according to a security mode applied for data protection and preventing communication resource consumption and hardware resource consumption .

It is another object of the present invention to provide a method and system for verifying a DNP message, which can greatly improve the transmission performance of a DNP security message by verifying a message to process data that has not been verified for data integrity, Apparatus and method.

It is a further object of the present invention to provide a method and system for real-time processing according to the characteristics of a security message, rather than being operated separately from existing security protocols, And to provide a secure communication apparatus and method of a DNP message that minimizes an increase in time.

A secure communication device of a DNP message according to an aspect of the present invention includes: a serial interface for transmitting and receiving a DNP (Distribute Network Protocol) message; A block analyzer for analyzing and managing the DNP message transmitted / received through the serial interface by a block, an intermediate block, and a last block; A security module for providing an encryption library for encrypting the DNP block blocked by the block analyzer and managing a security key and a security policy; And a security processing unit for encrypting and authenticating the DNP block using the encryption library transmitted from the security processing unit.

In the present invention, the block analyzer may include a block identification module managing a location of the DNP block and a secure operation mode; A secure header processing module for adding and verifying a secure header of the DMP message according to a security operation mode of the block identification module; A block storage module for storing the DNP block; And an authentication data storage module for storing authentication target data for generating a message authentication code of the DNP block.

In the present invention, the block identification module analyzes the DNP block and manages the position and processing state of the DNP block in the DNP frame as a type.

In the present invention, the type is classified into Type 1, Type 2, Type 3, and Type 4, and Type 1 represents a first block including a data link header as an initial value, and Type 2 includes application layer data In the case where the data size is equal to or greater than the Secure header, the password padding, and the hash data size added by the DNP secure communication mode and the encryption algorithm, the type 3 is used only when receiving the DNP message. The type setting value is changed to 4, and the type 4 indicates that the DNP message has been received.

In the present invention, the block identification module checks whether the DNP block includes the DNP identification code if the type is set to the type 1, calculates the total length of the DNP frame, Is changed from the type 1 to the type 2 when a predetermined size or more is reached.

In the present invention, when the DNP message is transmitted, if the type is set to the type 2, the block identification module refers to the DNP length information calculated in the first block, and if the data size of the block storage module is greater than the DNP length The type 2 to the type 4 is changed.

In the present invention, when receiving the DNP message, if the type is set to the type 2, the block identification module refers to the DNP length information calculated in the first block, and if the data size of the block storage module is greater than the DNP length The type 2 is changed to the type 3.

In the present invention, when the type is the type 3, the block identification module changes the type 3 to type 4 upon completion of receiving the additional data for DNP message verification.

In the present invention, when the type is the type 4, the block identification module initializes the type 4 to the type 1 after processing the DNP block.

In the present invention, the secure header processing module determines a security mode by referring to the security policy of the security module, and generates a secure header field according to the determined security mode.

In the present invention, the security processing unit may include a cryptographic module that provides a data encryption function for the DNP block using an encryption algorithm and a security key provided by the security module unit; And an authentication module that provides a data authentication function.

In the present invention, the security processing unit may transmit the first block and the intermediate block to the master or the out-station in an authentication mode for providing an authentication function, and transmit a message authentication code for the entire DNP frame stored in the block- The message authentication code is added to the last block and is transmitted to the master or the out-station.

In the present invention, the security processing unit may copy the first block and the intermediate block to the block analyzing unit, encrypt the first block and the intermediate block in a password authentication mode that provides a message encryption and an authentication function, And transmits the message to the station, encrypts the last block, generates a message authentication code for the authentication area data stored in the block analyzing unit, and transmits the message authentication code to the master or the out station after attaching the message authentication code to the last encrypted block. .

A secure communication method of a DNP message according to an aspect of the present invention includes a first step of receiving a DNP block in a password authentication mode for providing a message encryption and an authentication function; A second step of identifying the received DNP block as one of a first block, an intermediate block, and a last block; And encrypting the first block and the intermediate block according to the identification result, encrypting the first block and the intermediate block, encrypting the last block, generating a message authentication code, attaching the message authentication code to the last encrypted block, The method comprising the steps of:

In the present invention, if the DNP block is the first block, the third step determines the security mode by referring to the security policy, generates a secure header field according to the determined security mode, adds the secure header field to the data link header CRC, ; When the received data size is larger than the input / output size of the encryption algorithm, the data encryption library and the security key are used to encrypt the first block, And transmitting the header of the DNP data link to the master or the out station together with the header of the DNP data link.

If the additional data size after the encrypted data in the first block process is larger than the input / output size of the encryption algorithm, the third step is to select the DNP block as the input / output size of the encryption algorithm, And encrypts the data using the encryption library and the security key.

In the present invention, if the DNP block is the last block, if the last block is smaller than the input / output size of the encryption algorithm, padding data is added to the additional received data to encrypt the additional received data, And encrypts the padding data without adding the padding data, generates a message authentication code for the last block, adds the generated message authentication code to the last encrypted block, and transmits the encrypted message authentication code. do.

A secure communication method of a DNP message according to another aspect of the present invention includes a first step of receiving a DNP block in an authentication mode providing an authentication function; A second step of identifying the received DNP block as one of a first block, an intermediate block, and a last block; And generating a message authentication code for the entire DNP frame stored in the block analyzing module according to the identification result, transmitting the first block and the intermediate block to a master or an out station, And a third step of performing an integrity verification process using the code and transmitting the integrity verification process to the master or the out-station.

According to another aspect of the present invention, there is provided a secure communication method of a DNP message, comprising: identifying the DNP block as one of a first block, an intermediate block, and a last block; Transmitting the first block and the intermediate block to the master or out station in real time; And transmitting the final block to the master or out station after processing the final block according to the message integrity verification result.

In the present invention, the step of processing the last block according to the message integrity verification result and transmitting the message to the master or the out-station may include transmitting the valid message as a result of the integrity verification, And the out-station changes the last block to arbitrary data so as to drop the message in which the integrity verification has failed.

According to another aspect of the present invention, there is provided a secure communication method of a DNP message, the method comprising: a first step of receiving a DNP block in a password authentication mode for providing a message encryption and authentication function; A second step of identifying the received DNP block as one of a first block, an intermediate block, and a last block; And performing decoding on the first block or the intermediate block according to the identification result, transmitting the first block or the intermediate block to a master or an out station, performing decryption and integrity verification on the last block, And a third step of transmitting the validation result to the master or the out-station according to the integrity verification result, wherein the third step is a step of, according to the integrity verification result of the first block or the last block, And transmits the message in which the integrity verification has failed, after changing the last block into arbitrary data so that the master or the out-station may drop the message that failed the integrity verification.

The present invention minimizes the transmission time increase due to the security function while ensuring the integrity and confidentiality of the data in the safe and stable operation of the DNP (IEEE 1815) based power automation service.

The present invention minimizes message processing time by transmitting control data in real time according to a security mode applied for data protection, and prevents communication resource consumption and hardware resource consumption.

The present invention greatly improves the transmission performance of the DNP security message by verifying the message and processing the corrupted control data so that the data whose data integrity verification has not been completed can be processed in real time.

The present invention is not operated separately from the existing security protocol, but can increase the data transmission time due to the addition of the secure communication device without changing the existing security protocol or changing the system configuration through the real- Minimize it.

1 is a conceptual diagram illustrating an operation of a DNP message security communication apparatus according to an exemplary embodiment of the present invention.
2 is a block diagram of a DNP message security communication apparatus according to an exemplary embodiment of the present invention.
3 is a flowchart illustrating a DNP message transmission processing method in an encryption / authentication mode according to an embodiment of the present invention.
4 is a flowchart illustrating a DNP message transmission processing method in an authentication mode according to an embodiment of the present invention.
5 is a flowchart illustrating a DNP message reception processing method according to an embodiment of the present invention.

Hereinafter, a DNP message security communication apparatus and method according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings. In this process, the thicknesses of the lines and the sizes of the components shown in the drawings may be exaggerated for clarity and convenience of explanation. Further, the terms described below are defined in consideration of the functions of the present invention, which may vary depending on the user, the intention or custom of the operator. Therefore, definitions of these terms should be made based on the contents throughout this specification.

1 is a conceptual diagram illustrating an operation of a DNP message security communication apparatus according to an exemplary embodiment of the present invention.

Generally, since the increase of control message transmission time is determined by the waiting time of DNP message reception, the performance of the secure communication device depends on how much the waiting time is reduced. Since the DNP frame is transmitted by being divided into arbitrary lengths, it is necessary to perform the security function at the same time as receiving the arbitrary divided data, so that the waiting time for receiving a message can be minimized. In this embodiment, the DNP frame is divided into smaller data units (blocks) and processed.

The DNP message security communication apparatus according to an exemplary embodiment of the present invention receives a DNP block equal to or larger than an input data size of a cryptographic algorithm used in a cipher in a cipher mode and performs security function and transmits the DNP block. It is processed in real time according to the message block size received from Master or Outstation to minimize the waiting time. In addition, according to the secure communication mode, since the security communication device generates the DNP message and the function to be performed when verifying the DNP message is different and the data processing method is different according to the location of the data in the DNP frame, A real-time security processing method for message transmission (DNP message generation) and DNP message reception (DNP message verification) should be separately designed to optimize transmission performance for each security mode.

In this embodiment, a method of dividing a DNP frame into a first block, an intermediate block, and a last block according to a security function performed by the secure communication device for each security mode and data location in the DNP frame is proposed.

Referring to FIG. 1, in the DNP message security communication apparatus 40 according to the embodiment of the present invention, the master 10 (or slave) secure communication apparatus receives the DNP frame transmitted from the master (or out station) When receiving DNP data (block) of a certain length or longer without waiting until it is received, it analyzes the location of the received data in the secure mode and the DNP frame, and performs security functions such as adding and encrypting the secure header to the received data. Then, the security function block data is immediately transmitted to the slave (or master) security communication device and the security function for the next data block is performed. When the slave (or master) secure communication device receives the DNP block data transmitted from the master (or slave) secure communication device, it performs the secure header removal and message decryption function according to the security mode, or the master 10). At this time, the data for verifying the message integrity is accumulated and stored until the reception of the DNP frame is completed, and the DNP message integrity verification function is performed after receiving the last block. If the message integrity check result is normal, the last block is restored to the original control message and transferred to the outstation (or master). If the integrity check fails, the last block is changed to arbitrary data and the outstation (Or the master) fails to analyze the DNP frame and causes the corresponding DNP message to be dropped.

Hereinafter, a DNP message security communication apparatus 40 according to an embodiment of the present invention will be described in detail with reference to FIG.

2 is a block diagram of a DNP message security communication apparatus according to an exemplary embodiment of the present invention.

2, the DNP message security communication apparatus 40 includes a serial interface 41 for transmitting and receiving a DNP control message transmitted from the master 10 or the out station 20, a DNP message A security analysis module 43 for managing the security key and the security policy, a security module module 43 for encrypting the DNP message on a block-by-block basis, A security processing unit 44 for performing authentication processing, and an Ethernet interface 45 for communicating with the security server (KMS) 30.

The block analyzing unit 42 includes a block identification module 424 for managing the location of the DNP block received via the serial interface 41 and the secure operation mode, and a secure header generation unit 424 for generating and verifying the secure header of the DNP message according to the secure operation mode A secure header processing module 423 in charge, and an authentication data storage module 421 for storing authentication target data for generating a message authentication code for a DNP message.

The block identification module 424 analyzes the DNP block received through the serial interface 41 and manages the position and the processing state of the received DNP block in the DNP frame as a type.

Type 1 represents the first block including the data link header as an initial value, and Type 2 represents an intermediate block including application layer data. Type 3 is a type used only for receiving DNP messages. When the received data size exceeds the Secure header, password padding, or hash data size added by the DNP secure communication mode and encryption algorithm, the type setting value is changed to 4. Type 4 indicates that the reception of the DNP frame is completed.

If the type setting value is set to 1, the block identification module 424 checks whether the received block includes the DNP identification code, calculates the total length of the DNP frame, If the data size is larger than the specified size (eg, data link header length), change the type setting value to 2.

When the secure communication device 40 transmits the DNP message and the type setting value is set to 2, the block identification module 424 refers to the DNP length information calculated in the first block and determines that the data size of the block storage module 422 is If the DNP length is exceeded, change the type setting value to 4.

When the secure communication device 40 receives the DNP message and the type setting value is set to 2, the block identification module 424 refers to the DNP length information calculated in the first block and determines that the data size of the block storage module 422 is If the DNP length is exceeded, change the type setting value to 3. When the type setting value is 3, it means that additional data such as the secure header and authentication data are needed for DNP message verification, so change the type setting value to 4 after completion of receiving additional data.

In case of Type 4, it indicates that the DNP frame has been received. Therefore, after the corresponding DNP block is processed to process the next DNP frame, the type setting value is initialized to 1.

The block analysis unit 42 stores the DNP block received via the serial interface in the block storage module 422, and obtains the secure header information, the DNP block after the Secure header, and the authentication processing, which are data necessary for authentication data generation and verification And stores the padding data in the authentication data storage module 421.

The block storage module 422 and the authentication data storage module 421 initialize the stored data when the type setting value is changed from 4 to 1 after the generation and transmission of the DNP message is completed.

Secure header processing module 423 determines a security mode to be performed by the secure communication device 40 by referring to the security policy managed by the security policy management module of the security module 43, .

The security module unit 43 communicates with the security server 30 and provides a security policy such as a security key length, a key renewal cycle, a cryptographic algorithm, etc., by communicating with a cryptographic library that provides a cryptographic function such as a symmetric key encryption algorithm, And a security policy management module 432 for managing security keys such as key generation, distribution, and renewal.

The security processing unit 44 includes a cryptographic module 441 that provides a data encryption function for a DNP block using an encryption algorithm and a security key provided by the security module, and an authentication module 442 that provides a data authentication function .

When the secure communication apparatus 40 is operating in the authentication mode, the security processing unit 44 transmits all the DNP blocks except the last block to the master 10 or the out-station 20 at the same time as receiving the data, Generates a message authentication code for the entire DNP frame stored in the data storage module 421, and transmits the message authentication code at the end of the last block. In the case of the password authentication mode for simultaneously providing the message encryption and the authentication function, the security processing unit 44 receives the DNP message block and simultaneously copies the DNP message block to the authentication data storage module 421, encrypts the received DNP block, Out station 20, encrypts the last block, generates a message authentication code for the authentication area data stored in the authentication data storage module 421, and transmits the message authentication code at the end of the last encrypted block.

Hereinafter, a secure communication method of a DNP message according to an embodiment of the present invention will be described in detail with reference to FIG. 3 to FIG.

For reference, in the present embodiment, the secure communication method of each DNP message is classified according to the secure communication mode and is described separately.

3 is a flowchart illustrating a DNP message transmission processing method in an encryption / authentication mode according to an embodiment of the present invention.

Referring to FIG. 3, the secure communication apparatus 40 according to an exemplary embodiment of the present invention divides a DNP frame into a first block, an intermediate block, and a last block.

First, the first block processing of the DNP message is as follows.

The block analyzer 42 receives the DNP block transmitted from the master 10 or the out station 20 through the serial interface 41 (S102).

The block analysis unit 42 stores the received DNP block in the block storage module 422 and determines whether the data received through the block identification module 424 is the first data block of the DNP frame including the identification code of the DNP data (S104).

In this case, in the case of the first data block including the identification code, the block identification module 424 analyzes the header information of the DNP data link to calculate the total length of the frame (S106), and calculates the total length of the frame excluding the CRC (Cyclic Redundancy Check) And copies the header information of the DNP data link to the authentication data storage module 421 (S108).

When the block identification is completed as described above, the secure header processing module 423 refers to the security policy managed by the security policy management module of the security module unit 43 to determine the security communication mode to be performed by the secure communication device 40 (S110).

Then, the Secure header processing module 423 generates a Secure header field according to the determined security mode, adds the Secure header field before the data link header CRC (S112), and adds the changed data to the authentication data storage module 421 (S114).

The encryption field is from the Secure header to the end of the DNP frame, and data for the cryptographic processing is required as much as the input / output size of the encryption algorithm (hereinafter referred to as 'block size').

The block analyzer 42 compares the data size after the Secure header and the block size among the data accumulated in the authentication data storage module 421 (S116). If the received data size is smaller than the block size as a result of the comparison, the process returns to step S102 to further receive data from the serial interface 41. [

On the other hand, if the data after the Secure header is larger than the block size, the block analyzing unit 42 transfers the data of the block size and the header of the DNP data link to the security processing unit 44 and is transmitted to the security processing unit 44 And records the remaining data in the authentication data storage module 421 to manage security processing together with reception of the next data block.

The cryptographic module 441 of the security processing unit 44 encrypts the data of the block size received through the block analyzing unit 42 by using the cryptographic library managed by the security module unit 43 and the security key, And transmits the data through the serial interface.

Next, the intermediate block processing process of the DNP message is as follows.

The block identification module 424 classifies the intermediate block into data that does not include the identification code and skips the process of calculating the frame length and adding the secure header data. The block identification module 424 stores the previous data block in the block storage module 422 and the authentication data storage module 421). The block identification module 424 receives the serial data again when the additional received data size of the authentication data storage module 421 (the size after the encrypted data in the first block process) is smaller than the block size, 421).

If the received data size of the authentication data storage module 421 becomes larger than the block size, the data corresponding to the block size is cut out (S118), and the data is transmitted to the security processing unit 44, 421) and manages them to be processed together when the next data block is received.

The cryptographic module 441 of the security processing unit 44 encrypts the received data using the cryptographic library managed by the security module unit 43 and the security key and transmits the received data to the counterpart secure communication apparatus 40 (S130) . The received data is then repeated until the last block of the DNP frame.

Finally, the last block processing of the DNP message is as follows. The block analyzer 42 compares the data size of the block storage module 422 with the DNP message size calculated at the first block processing to determine whether the data received through the serial interface 41 is the last block, And initializes data of the post-processing block storage module 422 and the authentication data storage module 421.

When the last block is smaller than the block size (S122), the cryptographic module 441 of the security processing unit 44 encrypts the additional received data by adding padding data (S124, S126). In this case, when the additional received data is the same as the block size, encryption is performed without adding padding data.

The authentication module 442 of the security processing unit 44 generates a message authentication code for the data of the authentication data storage module 421 and adds the generated message authentication code to the encrypted data at step S128, (Step S130).

4 is a flowchart illustrating a DNP message transmission processing method in an authentication mode according to an embodiment of the present invention.

In one embodiment of the present invention, the process of real-time DNP message transmission (DNP message real-time generation) processing of the secure communication device 40 operating in the authentication mode is as shown in FIG.

Referring to FIG. 4, the DNP message transmission processing method in the authentication mode is the same as the password authentication mode except for the process of analyzing the received data size for encryption and the encryption process, and all the blocks except the last block are stored Module 422, stores the authentication area data in the authentication data storage module 421, and transmits the authentication area data to the master 10 or the out-station 20.

First, the block analyzer 42 receives the DNP block transmitted from the master 10 or the out station 20 through the serial interface 41 (S202).

The block analysis unit 42 stores the received DNP block in the block storage module 422 and determines whether the data received through the block identification module 424 is the first data block of the DNP frame including the identification code of the DNP data (S204).

In this case, in the case of the first data block including the identification code, the block identification module 424 analyzes the header information of the DNP data link to calculate the total length of the frame (S206), and calculates the total length of the frame excluding the CRC (Cyclic Redundancy Check) And copies the header information of the DNP data link to the authentication data storage module 421 (S208).

When the block identification is completed as described above, the secure header processing module 423 refers to the security policy managed by the security policy management module of the security module 43 to determine a security mode to be performed by the secure communication device 40 (S210).

Then, the Secure header processing module 423 generates a secure header field according to the determined security mode, adds the header to the data link header CRC (S212), and adds the changed data to the authentication data storage module 421 (S214).

Then, the block analyzing unit 42 compares the data size of the block storage module 422 with the DNP message size calculated in the first block process (S216), and checks whether the data received through the serial interface 41 is the last block If the received data is not the last block, it is transmitted to the relative security communication device 40. In the case of the last block, the message authentication code is generated, and the generated message authentication code is attached to the last block, The data of the block storage module 422 and the authentication data storage module 421 are initialized.

The cryptographic module 441 of the security processing unit 44 generates a message authentication code for the data of the authentication data storage module 421 when the received data is the last block and adds the generated message authentication code to the encrypted data (S218) and transmits it to the counterpart secure communication device 40 (S220).

Meanwhile, the DNP message real-time processing process of the secure communication device 40 operating in the non-secured mode according to an embodiment of the present invention is as follows.

The block analysis module refers to the security policy of the security module unit 43 and transmits the received data to the master 10 or the outstation 20 when the secure communication device 40 operates in the non- Lt; / RTI >

When the secure communication device 40 receives the DNP message differently from the DNP message transmission, it is necessary to analyze exactly which security mode the received DNP message operates to perform the DNP message verification process according to each security mode There is a need for a method for efficiently deleting a forgery DNP message so that a sophisticated DNP message security mode analysis method is required and a forged DNP message is not delivered to the master 10 or the outgoing station 20. [

The security mode classification method of the block analysis unit 42 and the forgery message removal method of the security processing unit 44 are as follows.

The block analyzer 42 verifies the validity (CRC) of the received DNP header, analyzes the secure header information, determines the communication mode of the data, and transmits the data to the security processor 44 according to the secure communication mode.

In the security mode, since the secure header is inserted in front of the CRC of the DNP data link header to change the position of the CRC field, it is possible to distinguish the security mode from the non-security mode through CRC verification.

Since data of 10 bytes or more is required for CRC verification, when the length of the received data is 10 bytes or less, the data is additionally received from the serial interface 41.

If the received data size is 10 bytes or more, change the type setting value to 2 and calculate the total length of the DNP frame. Then, it is discriminated whether the received DNP block is a security mode or an unsecured mode through CRC verification. At this time, the message that has succeeded in CRC verification is determined to be in non-security mode, and the failed message is determined to be in security mode.

Here, the security mode is subdivided into an authentication mode providing only a message authentication function and a password authentication mode providing a message encryption and a message authentication function at the same time. In order to perform appropriate security functions according to the security mode of the received message, it is necessary to perform an authentication mode and a password / authentication mode classification process using Secure header analysis.

In the case of cipher mode, Secure header analysis fails because the Secure header field is encrypted.

The block analyzing unit 42 determines that the block failed in the CRC verification and succeeded in the secure header analysis in the authentication mode, and determines in the password authentication mode in the block in which both the CRC verification and the secure header analysis fail.

Upon receipt of the DNP message, the security processing unit 44 performs message decryption and message integrity verification according to security functions to be performed on a block-by-block basis, and efficiently removes the forgery message.

The existing secure communication device 40 stores the received DNP message without transmitting the DNP message until the integrity verification is completed for the purpose of removing the forgery-fugged message, so that the transmission time of 0.245 sec at the maximum increases per frame . If the DNP message verification function is implemented to send messages in real time in order to shorten the waiting time for message reception, the DNP message modulated by the external attacker can be transmitted without completing message integrity verification, There is a risk that the station 20 may malfunction.

Therefore, in order to secure both the security and the transmission performance, a method of transmitting a message in real time and preventing a forgery message from being processed by the master 10 or the out-station 20 is needed.

The master 10 or the out-station 20 performs CRC verification to detect a transmission error, and if the CRC verification fails, the corresponding message is not processed and dropped.

In this embodiment, the error detection function of the master 10 or the out station 20 is used to transmit the DNP message in real time, but the master 10 or the out station 20 does not malfunction due to a forgery message.

In detail, the first block and the intermediate block of the DNP message are transmitted in real time to shorten the waiting time for receiving a message, and the last block of the DNP message including the last CRC of the application data is transmitted to the message integrity verification result It is possible to remove the forgery-and-fake message by processing after being processed.

If the received message is a password authentication mode that simultaneously provides a password and an authentication function, the DNP message block excluding the last block is decrypted at the same time as it is received and transmitted to the master 10 or the outstation 20 in real time, Do not transmit until integrity verification is completed. The final decoded block is transmitted by only valid messages after completion of the integrity verification process, and the message whose integrity verification has failed is changed to the arbitrary data by the last block and transmitted by the error detection function of the master 10 or the out- And induce the corresponding message to be dropped.

As described above, according to the present embodiment, by using the error detection function of the existing control system, it is possible to effectively remove the control message in which the transmission error occurred or the control message falsified by the external attack without changing the existing control system, .

If the received message is an authentication mode that only provides the authentication function, the decryption process is omitted and the same operation is performed as in the password authentication mode.

If the received message is in the non-secure mode, the message is delivered to the master 10 or the out-station 20 at the same time as the reception without performing the decryption and integrity verification process.

5 is a flowchart illustrating a DNP message reception processing method according to an embodiment of the present invention.

5, the first block process of the DNP message is firstly performed by the block analyzer 42 through the serial interface 41, which receives the DNP block transmitted from the master 10 or the out station 20 (S302) .

The block identification module 424 determines whether the received data is the first data block of the DNP frame including the identification code of the DNP data (S304). If the received data is the first data block of the DNP frame including the identification code of the DNP data, the block identification module 424 adds the corresponding data to the block storage module 422 (S306).

If it is determined in step S304 that the received data is not the first data block of the DNP frame including the identification code of the DNP data, the previously received data exists in the block storage module 422 (S308). If there is no previously received data, it is determined that the received data is error data and the received data is dropped. If there is previous data, it is determined that the received data is an intermediate block. (S310). This will be explained in the intermediate block process.

If it is the first data block including the DNP identification code, it is determined whether the received data is received in the predetermined length (S312). If the received data is received in the predetermined length, the block identification module 424 transmits the DNP data link The entire length of the frame is calculated (S316), the data after the secure header is stored in the authentication data storage module 421, and the operation mode is determined (S318). Here, if the received data is received for a predetermined length or longer, the type setting value is changed to 2 (S314).

At this time, the block identification module 424 determines whether the length of the received data stored in the block storage module 422 is a predetermined length, for example, 15 bytes or more (S320). If the length of the received data is smaller than the set length, And further receives data from the interface 41 (S302).

On the other hand, if the received data is received in the set length in step S312, step S318 is performed.

The secure header processing module 423 analyzes the secure communication mode of the received data through the CRC verification and the secure header analysis to check what the operation mode is (S322).

When the security communication mode analysis is completed, the security processing unit 44 analyzes the size of the received data block for decoding. In order to decode the first block, data corresponding to the block size is required.

Accordingly, the block analyzer 42 compares the data size after the Secure header with the block size among the data accumulated in the block storage module 422 and determines whether the data size after the Secure header is greater than or equal to the block size (S324).

If the received data size is smaller than the block size, the data is further received from the serial interface 41 (S302). If the data after the secure header is larger than the block size, the received data is cut off (S326) And transfers the remaining data to the security processing unit 44 and writes the remaining data in the block storage module 422 to manage security processing together with the next data block.

The cryptographic module 441 of the security processing unit 44 decrypts the data of the block size received via the block analyzing unit 42 using the cryptographic library managed by the security module unit 43 and the secret key (S328) And copies the decrypted data to the authentication data storage module 421 (S330).

The block analyzer 42 then determines whether the data size of the block storage module 422 is equal to the calculated DNP message length (S332). As a result of the determination, if the data size of the block storage module 422 is equal to the calculated DNP message length, the received data block is the first block and the last block of the DNP frame. Therefore, the security processing unit 44 stores the hash data of the authentication data (S334), and determines whether the received hash data is the same as the calculated hash data (S336), and performs a message integrity verification function. That is, if the received value is the same as the calculated hash value, it is a normal message. Therefore, the corresponding message is stored in the transmission data storage unit (S338), and decoded data excluding the data link header and the secure header are transmitted to the master or out station (S344) And initializes the block storage module 422, the authentication data storage module 421, and other setting values. As a result of the determination in step S336, if the received value is different from the calculated hash value, the message is changed due to a transmission error or is falsified in response to an external attack, so that the last block is changed to arbitrary data and transmitted (S340, S344) Master or Oustation causes the corresponding DNP frame to be dropped, and initializes the block storage module 422, the authentication data storage module 421, and other setting values.

If the size of the received data storage unit is different from the calculated DNP message length in step S332, the security processing unit 44 stores the decrypted data in the transfer data storage unit (S342) and transmits it to the master 10 or the out-station 20 via the serial interface 41 together with the data link header (S344).

In the intermediate block processing and the last block processing of the DNP message, the same parts as those of the first data block processing will be described in detail.

In the intermediate block process of the DNP message, the block identification module 424 first adds the received data to the block storage module 422 after performing the block position check process in the same manner as the first block process (S302, S304, S306 ). If the block is not the first data block, the block storage module 422 determines whether previously received data exists (S308). If there is no previously received data, the received data is determined to be error data, If there is previous data, it is determined as an intermediate block and added to the block storage module 422 (S310).

For the sake of brevity, the detailed description of the same parts of the intermediate block processing as those of the first block processing will be omitted.

If the size of the data accumulated in the block storage module 422 is smaller than the DNP frame length calculated in the first block process, the type of the received data is set to 2 by the first block process, The security processing unit 44 decrypts the intermediate block according to the security mode determined in the process (S328).

In this case, the block identification module 424 changes the type setting value to 3 (S314) after confirming whether or not the length of the DNP frame has been received (S312).

The block analyzer 42 compares the block size with an additional received data size of the block storage module 422 (received data size after the data transmitted to the master or out station). If the additional received data is smaller than the block size, the serial data is received again and added to the block storage module 422. If the additional received data size of the block storage module 422 is larger than the block size, the data corresponding to a multiple of the block size of the additional received data is transmitted to the security processing unit 44. The security processing unit 44 decrypts the data using the encryption algorithm managed by the security module unit 43 and the security key (S28), and stores the data in the authentication data storage module 421 (S330).

The block analyzer 42 compares the data size of the block storage module 422 with the size of the calculated DNP security frame (S332). When the data size of the block storage module 422 is smaller than the calculated DNP security frame size, the decrypted data is transmitted to the master 10 or the outstation 20 (S344). The received data is then repeated until the last block of the DNP frame.

Next, the last block process of the DNP message is performed by the block identification module 424, and the received data is added to the block storage module 422 after the block location process is performed in the same manner as described above (S302, S304, S306 ). At this time, the type setting value of the received data is set to 3 by the intermediate block processing, and the data size of the block storage module 422 is compared with the size of the calculated DNP security frame (S320) To 4.

The security processing unit 44 decrypts the last block using the cryptographic module 441 (S328) and stores the decrypted data in the authentication data storage module 421 (S330).

After completion of the decryption process, the security processing unit 44 performs an integrity verification process using the cryptographic module 441 to forward only valid messages to the master 10 or the out-station 20 (S344). If the integrity verification fails, (S340), and then the message is transmitted (S344), thereby causing the master 10 or the out-station 20 to drop the corresponding message using the transmission error detection function.

Here, the message integrity verification is performed through a process of calculating the hash value of the data of the authentication data storage module 421 and comparing the hash value with the authentication data of the block storage module 422 (S336). If the received value and the calculated hash value are the same, it is a normal message. Therefore, decoded data excluding the data link header and the secure header are transmitted to the master 10 or the out station 20 (S344), and the block storage module 422, And initializes the storage module 421 and other setting values. If the received value is different from the calculated hash value, the message is changed due to transmission error or falsified for external attack. Therefore, the last block is changed to arbitrary data and transmitted (S340, S344) To drop the corresponding DNP frame, and initializes the block storage module 422, the authentication data storage module 421, and other set values.

In the present embodiment, the process of real-time DNP message reception (DNP message real-time verification) processing of the secure communication device 40 operating in the password authentication mode is the same as the password authentication mode except for the process of analyzing the received data size for encryption and the encryption process Do.

Also, in this embodiment, in the real-time reception process of the DNP message of the secure communication device 40 operating in the unsecured mode, the security processing unit 44 transmits the data received at the same time as the reception to the master 10 To the out-station (20).

Meanwhile, the above-described invention can be implemented in various embodiments. For example, the method of analyzing the position of the received data block in the DNP frame, the classification of the secure communication mode of the received data mode, and the data modification for ensuring the message integrity in the data real- It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. Also, although the present embodiment is described only in the frame real-time transmission method and the security functional implementation method in the data link layer of the power control system, it can be applied to a protocol that can shorten the data transmission time through a simple analysis process and data real- Do.

This embodiment can minimize the increase of transmission time due to the security function while ensuring the integrity and confidentiality of data in the safe and stable operation of DNP (IEEE 1815) based power automation service.

In this embodiment, the control data is transmitted in real time according to the security mode applied for data protection, thereby minimizing message processing time, and preventing communication resource consumption and hardware resource consumption.

The present embodiment can significantly enhance the transmission performance of the DNP security message by verifying the message and processing the corrupted control data so that the data whose data integrity verification has not been completed can be processed in real time.

The present embodiment can minimize an increase in data transmission time through a method of real-time processing according to the characteristics of security messages, rather than operating separately from existing security protocols.

10: Master
20: Out station
30: Security server
40: Secure communication device
41: Serial interface
42: block analysis unit
421: Authentication data storage module
422: Block storage module
423: Secure header processing module
424: Block identification module
43: Security module section
431: Password Library
432: Security Policy Management Module
44:
441: Cryptographic module
442: Authentication module
45: Ethernet interface

Claims (21)

A serial interface for transmitting and receiving a DNP (Distribute Network Protocol) message;
A block analyzer for analyzing and managing the DNP message transmitted / received through the serial interface by a block, an intermediate block, and a last block;
A security module for providing an encryption library for encrypting the DNP block blocked by the block analyzer and managing a security key and a security policy; And
And a security processing unit for encrypting and authenticating the DNP block using the encryption library transmitted from the security processing unit. The apparatus of claim 1, wherein the block analyzer
A block identification module for managing the location of the DNP block and the secure operating mode;
A secure header processing module for adding and verifying a secure header of the DMP message according to a security operation mode of the block identification module;
A block storage module for storing the DNP block; And
And an authentication data storage module for storing authentication target data for generating a message authentication code of the DNP block. 3. The apparatus of claim 2, wherein the block identification module
And analyzes the DNP block to manage the position and processing state of the DNP block in the DNP frame as a type. 4. The method of claim 3, wherein the type is classified into Type 1, Type 2, Type 3, and Type 4, the Type 1 indicates a first block including a data link header as an initial value, Type 3 is a type used only when receiving the DNP message, and the data size is greater than or equal to a Secure header, a password padding, and a hash data size added by the DNP secure communication mode and the encryption algorithm. The type setting value is changed to 4, and the type 4 indicates that the DNP message has been received. The method of claim 4, wherein the block identification module checks whether the DNP block includes a DNP identification code if the type is set to the type 1, calculates a total DNP frame length, And changing from the type 1 to the type 2 when the data size is greater than a predetermined size. The method of claim 4, wherein when the type is set to the type 2, the block identification module refers to the DNP length information calculated in the first block, and if the data size of the block storage module is DNP And changing the type from the type 2 to the type 4 if the length exceeds the predetermined length. 5. The method of claim 4, wherein upon receiving the DNP message, if the type is set to the type 2, the block identification module refers to the DNP length information calculated in the first block, And changing the type 2 to the type 3 if the length of the type 2 is greater than the length of the DNP message. 5. The method according to claim 4, wherein, when the type is the type 3, the block identification module changes the type 3 to type 4 when the receiving of the additional data for verifying the DNP message is completed. Device. 5. The apparatus of claim 4, wherein the block identification module processes the DNP block and initializes the type 4 to the type 1 when the type is the type 4. 3. The apparatus of claim 2, wherein the secure header processing module determines a security mode by referring to the security policy of the security module, and generates a secure header field according to the determined security mode. The apparatus of claim 1, wherein the security processing unit
A cryptographic module for providing a data encryption function for the DNP block using an encryption algorithm and a security key provided by the security module; And
And an authentication module for providing a data authentication function. 2. The method according to claim 1, wherein the security processing unit transmits the first block and the intermediate block to a master or an out station in an authentication mode for providing an authentication function, And the message authentication code is added to the last block and transmitted to the master or the out-station. The method according to claim 1, wherein the security processing unit copies the first block and the intermediate block to the block analysis unit in a password authentication mode in which the message encryption and authentication functions are provided, and then encrypts the first block and the intermediate block, To the out-station, encrypts the last block, generates a message authentication code for the authentication area data stored in the block analyzer, and transmits the message authentication code to the master or the out-station by attaching the message to the master Wherein the DNP message is a secure communication device. A first step of receiving a DNP block in a password authentication mode that provides a message password and an authentication function;
A second step of identifying the received DNP block as one of a first block, an intermediate block, and a last block; And
Encrypting and transmitting the first block and the intermediate block according to the identification result, encrypting the last block, generating a message authentication code, attaching the message authentication code to the last encrypted block, and transmitting the message A method for secure communication of a DNP message comprising: 15. The method of claim 14, wherein the third step comprises: if the DNP block is the first block,
Determining a security mode by referring to the security policy, generating a Secure header field according to the determined security mode, adding the Secure header field before the data link header CRC, and storing the changed data;
When the received data size is larger than the input / output size of the encryption algorithm, the data encryption library and the security key are used to encrypt the first block, And transmitting the DNP message to the master or the out-station together with the header of the DNP data link. 16. The method of claim 15, wherein if the DNP block is the intermediate block,
And encrypting data corresponding to an input / output size of the encryption algorithm using an encryption library and a secret key if the additional data size after the encrypted data in the first block process is larger than the input / output size of the encryption algorithm. . 17. The method as claimed in claim 16, wherein the third step comprises: if the DNP block is the last block,
If the last block is smaller than the input / output size of the encryption algorithm, adding the padding data to the additional reception data and encrypting the additional reception data, and if the additional reception data is equal to the input / output size of the encryption algorithm, Generating a message authentication code for data stored in the authentication data storage module, and adding the generated message authentication code to the last block and transmitting the message. A first step of receiving a DNP block in an authentication mode providing an authentication function;
A second step of identifying the received DNP block as one of a first block, an intermediate block, and a last block; And
The first block and the intermediate block are transmitted to the master or out station according to the identification result, a message authentication code for the entire DNP frame stored in the block analysis module is generated, And a third step of transmitting the DNP message to the master or the out-station. Identifying the DNP block as either a first block, an intermediate block, or a last block;
Transmitting the first block and the intermediate block to the master or out station in real time; And
Processing the last block according to the message integrity verification result, and transmitting the final block to the master or out station. 20. The method of claim 19, wherein processing the last block according to a message integrity verification result and transmitting the final block to the master or out station comprises:
The validation message is transmitted as a result of the integrity verification, and the message in which the integrity verification has failed is changed to the arbitrary data so that the master or the out-station may drop the message that failed the integrity verification And transmitting the DNP message to the base station. A first step of receiving a DNP block in a password authentication mode that provides a message password and an authentication function;
A second step of identifying the received DNP block as one of a first block, an intermediate block, and a last block; And
Performing decoding on the first block or the intermediate block according to the identification result, transmitting the first block or the intermediate block to a master or an out station, performing decoding and integrity verification on the last block, To the master or the out-station according to a result of integrity verification,
The third step is to pass a valid message to the master or the out-station according to the integrity verification result of the first block or the last block, and the message in which the integrity verification has failed may be performed by the master or the out- And changing the last block to arbitrary data so as to drop the failed message.

Images