KR20200141774A - Integrated security network system having reinforced cyber security in smartship - Google Patents

Abstract

Disclosed is an integrated onboard security network system of a smart ship with reinforced cyber security which comprises: a first network switch wirelessly connected to an external network; a plurality of second network switches routed by the first network switch; and corresponding onboard network groups (120, 130, 140) configured to group onboard equipment and systems by each second network switch. In the event of a connection network failure of one of the onboard network groups (120, 130), backup is manually performed through an AP (143) of the other one of the onboard network group (140) to build a network topology in consideration of the cyber security so as to reinforce the onboard cyber security, thereby preventing expansion of accidents in the event of a cyber accident.

Description

Integrated onboard security network system of smart ship with enhanced cyber security {INTEGRATED SECURITY NETWORK SYSTEM HAVING REINFORCED CYBER SECURITY IN SMARTSHIP}

The present invention relates to an integrated in-ship security network system of a smart ship with enhanced cyber security, and more particularly, when a network error occurs in which the operation essential system, the integrated control system and the automation system are connected, the connection is bypassed through the AP of the crew network group. Thus, it relates to an integrated in-ship security network system of a smart ship with enhanced cyber security that can network backup data related to ship operation.

Usually, the main equipment of the ship is not connected to the ship's network system, and when connection with the satellite equipment is needed, the main equipment and the satellite equipment are directly connected.

Recently, as smart ships or digital ships are applied, when an integrated system is established and connected to satellite equipment, all equipment of the ship is connected to one network.

In addition, for big data collection and transmission, or for remote maintenance, integrated and automated ship equipment is connected to the ship network, and the connected equipment is accessible from outside and control of some systems is becoming possible.

For example, as shown in FIG. 1, a conventional ship communication network is connected to a satellite 10 through a VSAT 20, and router/firewall devices 30 and 40 and a ship management system (SMS) 60 ), through the main network 50 connected to the ship's main system, the EEMS (Energy Efficiency Management System), the navigation system, IP CCTV, special container monitoring, SPMS (Ship Power Management System), and the crew PC and AP. .

Accordingly, all major ship systems are connected to one main network 50, so that the vulnerabilities of internal and external cyber attacks of the ship's equipment are intactly exposed, thus managing the risk of cyber attacks by hacking and rapid increase in traffic. Is a situation that is desperately required.

Korean Patent Application Publication No. 2008-0075801 (Security Unit, 2008.08.19) Korean Patent Application Publication No. 2014-0144518 (Ship's network integration system and its control method, 2014.12.19)

The technical problem to be achieved by the idea of the present invention is that in the event of a network error in which the operation essential system, the integrated control system and the automation system are connected, the connection is bypassed through the AP of the crew network group, so that the ship operation related data can be backed up the network. It is to provide an integrated onboard security network system of smart ships with enhanced cyber security.

In order to achieve the above object, the present invention provides a first network switch wirelessly connected to an external network; A plurality of second network switches routed by the first network switch; And a corresponding onboard network group configured by grouping onboard equipment by each of the second network switches; including, when a connection network of one onboard network group fails, backing up through the AP of the other onboard network group, cyber Provides an integrated onboard security network system of smart ships with enhanced security.

Here, the first network switch is configured to divide a network group by constructing a virtual LAN with an L3 switch connected to a router and a firewall device, and the second network switch is connected to a micro satellite transmission/reception station for satellite communication through a satellite antenna. And the second network switch is composed of an L2 switch, an IT network group connected to each of the L2 switches, an OT network group bridged through the L2 switch and grouped with an inboard monitoring/control system, and the It is bridged through the L2 switch to form an onboard network group of a crew network group in which crew PCs are grouped, and the onboard network group including the L2 switch can be routed through the L3 switch and traffic can be monitored.

In addition, the crew network group includes an AP, and when a network error occurs in the IT network group or the OT network group, the crew network group may be connected manually by bypassing the L3 switch through the AP of the crew network group.

Further, the IT network group or the OT network group may be connected to the L3 switch through an AP of the crew network group to back up data.

In addition, the IT network group includes a platform server, an administrator server, and an owner server for collecting ship operation data, and the OT network group includes a navigation recorder, electronic chart information system, IP telephone, IP CCTV, smart navigator, It includes a periodic engine, a generator or a monitoring system and a control system of an intelligent recognition system, and is divided into at least one subgroup including each L2 switch, and the crew network group may include equipment for crew welfare.

In addition, a cut-off switch is connected between the L3 switch and the OT network group and the corresponding L2 switch of the crew network group, and the cut-off switch is connected to the network control computer of the IT network group through the L2 switch. Alternatively, upon detecting an increase in traffic, the network control computer may control the cut-off switch to bypass and communicate with the main ship system of the OT network group.

In addition, when a cyber attack or traffic increase is detected by the network control computer, the network control computer may detect and control the cut-off switch by a specific program logic or an operator.

In addition, a first blocking switch is connected between the L3 switch and a first network server communicating with an external network, and a second blocking switch is between the first blocking switch and the corresponding L2 switch of the OT network group and the crew network group. Is connected, and when the traffic detection module of the IT network group monitors the traffic volume of the first network server and detects a cyber attack or a sudden increase in traffic volume, the external network is physically controlled by controlling the first and second blocking switches. It is possible to block the system and operate the operation essential system and the autopilot system of the OT network group through the second network server.

In addition, the traffic detection module may identify a malicious packet for hacking among packets received by the first network server, and remove the malicious packet for hacking by bypassing the dummy server.

According to the present invention, in the event of a network error in which the operation essential system, the integrated control system and the automation system are connected, it is bypassed through the AP of the crew network group and is manually connected, so that it is used for emergency until the network is restored. Data can be backed up by network, and in the event of a cyber accident caused by hacking or a rapid increase in traffic, the expansion of infection can be prevented, thereby preventing the expansion of the accident.

1 illustrates an onboard network system according to the prior art.
2 and 3 are schematic configuration diagrams of an integrated onboard security network system of a smart ship with enhanced cyber security according to an embodiment of the present invention.
4 and 5 illustrate a modified example of the integrated in-ship security network system of the smart ship with enhanced cyber security of FIG. 2.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those of ordinary skill in the art may easily implement the present invention. The present invention may be implemented in various different forms, and is not limited to the embodiments described herein.

2 and 3 are schematic configuration diagrams of an integrated in-board security network system of a smart ship with enhanced cyber security according to an embodiment of the present invention.

2 and 3, the integrated in-ship security network system of a smart ship with enhanced cyber security according to an embodiment of the present invention, as a whole, includes a first network switch wirelessly connected to an external network, and a first network switch. Connection network failure of any one of the ship's network groups (120, 130), including a plurality of second network switches routed by the ship and the corresponding on board network groups (120, 130, 140) configured by grouping and grouping onboard equipment and systems by each second network switch In case of a cyber accident, the main point is to reinforce the onboard cybersecurity by manually backing up through the AP 143 of the other onboard network group 140 to establish a network topology in consideration of cybersecurity and to prevent the expansion of accidents in the event of a cyber accident. do.

First, the first network switch is a micro-satellite transceiver station that establishes a virtual LAN (VLAN) with the L3 switch 110 connected to the router 30 and the firewall device 40, and communicates with the satellite 10 through a satellite antenna. It is connected to (VSAT; Very Small Aperture Terminal) (20) and routes the second network switch to physically/logically separate the network group.

Next, a second network switch 2 is constituted by an L2 switch (121 131 141) on the ^nd layer, the bridge through, IT network group 120 and, the L2 switch 131 is connected to each L2 switch (121 131 141) on board the monitoring / The OT network group 130 in which the control system is grouped and the onboard network group of the crew network group 140 in which the crew PC is grouped by being bridged through the L2 switch 141 are divided and configured, through the L3 switch 110. It is possible to route the onboard network groups 120, 130, and 140 including the corresponding L2 switches 121, 131, and 141 and monitor traffic.

Here, the IT network group 120 is an IT (Information Technology) and an administrator network group, and an IT network system 122 including a platform server, an administrator server, and an owner server for collecting ship operation data. It is composed of, and performs system management and authorization of the OT network group 130 and the crew network group 140.

For reference, the IT network system is a non-real-time system related to IT network, e-mail, ship management and ship preventive maintenance, and the integrity and confidentiality of data are important.

In addition, the OT (Operation Technology) network group 130, a Voyage Data Recorder (VDR), an Electronic Chart Display and Information System (ECDIS), IP phone, IP CCTV, smart navigation, energy The main engine (ME) of the management system (EMS; Energy Management System), the generator (GE (GEnerator)), or the intelligent recognition system (IAS; Intelligent Awareness System) that provides integrated information on the weather and route Including the onboard OT network system 132 of the monitoring system and control system.

Here, the OT network group 130 may be divided into at least one or more subgroups including each L2 switch 131, a navigation recording device, an electronic chart information system, an IP telephone, an IP CCTV, and the first of the smart navigator. It may be divided into a sub-group and a second sub-group of an intelligent recognition system that provides integrated information of a main engine, a generator, or a weather and a route of an operation sea area of the energy management system.

For reference, the OT network system 132 is a real-time system related to PLCs, on-board measurement and control, ECDIS (Electronic Chart Display and Information System), GPS, and data logger, and availability and integrity of data are important.

In addition, the crew network group 140 includes a crew PC or equipment and an AP 143 for seafarer welfare.

Accordingly, as shown in FIG. 3, when a network failure occurs in the IT network group 120 or the OT network group 130, the AP 143 constituting the wireless network of the crew network group 140 By bypassing the L3 switch 110 and being manually connected by an operator or operator terminal, it is used for emergency purposes until the network is restored, so that the IT network group 120 or the OT network group 130 is a crew network group 140 ) Is connected to the L3 switch 110 through the AP 143 of the network to back up the data, and prevents the expansion of the infection by preventing the expansion of the infection in the event of a cyber accident caused by hacking or a rapid increase in traffic.

On the other hand, by an additional configuration as shown in Fig. 4, when a cyber attack or traffic increases, the network is physically separated to smoothly maintain the function of the ship's main system of the OT network group 130 or the crew network group 140 You can do it.

For example, a cut-off switch 151 is connected between the L3 switch 110 and the corresponding L2 switches 131 and 141 of the OT network group 130 and the crew network group 140, and the cut-off switch 151 is the L2 switch 131, 141. ) Is connected to the network control computer 152 of the IT network group 120.

Accordingly, when the network control computer 152 detects a cyber attack or an increase in traffic, the network control computer 152 controls the cut-off switch 151 to physically separate the network, and thus, the ship's main system of the OT network group 130 By bypassing communication with the in-OT network system 132 and the crew network system 142 of the crew network group 140, it is possible to secure the safety of ships and cargo.

Here, when a cyber attack or traffic increase is detected by the network control computer 152, the network control computer 152 detects and controls the cutoff switch 151 by a specific program logic or an operator.

On the other hand, by an additional configuration as shown in Fig. 5, when a cyber attack or traffic increases, the function of the ship's main system of the OT network group 130 or the crew network group 140 by blocking access to the ship's internal network Can be maintained smoothly.

For example, the first blocking switch 162 is connected between the L3 switch 110 and the first network server 161 communicating with the external network, and the first blocking switch 162 and the OT network group 130 and the crew network The second blocking switch 163 is connected between the corresponding L2 switches 131 and 141 of the group 140, and the traffic detection module 164 of the IT network group 120 monitors the traffic volume of the first network server 161 do.

Accordingly, when the traffic detection module 164 detects a cyber attack or a sudden increase in traffic volume, it controls the first and second blocking switches 162 and 163 to physically block the external network, and through the second network server 165 By operating the operation essential system of the OT network group 130 and the OT network system 132, which is an autopilot system, the ship's internal network can be protected and safe operation can be continued through the second network server 165.

Here, the traffic detection module 164 may identify a malicious packet for hacking among packets received by the first network server 161, and distribute the excessive load by bypassing and removing the malicious packet for hacking to the dummy server 166. have.

Therefore, by the configuration of the integrated in-ship security network system of the smart ship with enhanced cyber security as described above, in the event of a network error in which the operation essential system, the integrated control system and the automation system are connected, it is bypassed through the AP of the crew network group and It can be used for emergency purposes until the network is restored, so that it is possible to back up the ship operation-related data to the network, and to prevent the expansion of infection in the event of a cyber accident caused by hacking or a rapid increase in traffic. .

The embodiments described in the present specification and the configurations shown in the drawings are only the most preferred embodiments of the present invention, and do not represent all the technical spirit of the present invention, so various equivalents that can replace them at the time of the present application It should be understood that there may be water and variations.

10: satellite 20: VSAT
30: router 40: firewall device
110: L3 switch 120: IT network group
121,131,141: L2 switch 122: IT network system
130: OT network group 132: OT network system
140: crew network group 142: crew network system
143: AP 151: cut-off switch
152: network control computer 161: first network server
162: first cut-off switch 163: second cut-off switch
164: traffic detection module 165: second network server
166: dummy server

Claims (9)

A first network switch wirelessly connected to an external network;
A plurality of second network switches routed by the first network switch; And
Including; a corresponding in-board network group configured by grouping the in-board equipment by each of the second network switches,
Smartship's integrated in-board security network system with enhanced cyber security that backs up through the AP of the other in-board network group when the connection network of one onboard network group fails. The method of claim 1,
The first network switch is configured to divide a network group by constructing a virtual LAN as an L3 switch connected to a router and a firewall device, and is connected to a micro satellite transmission/reception station for satellite communication through a satellite antenna to route the second network switch. and,
The second network switch is composed of an L2 switch, an IT network group connected to each of the L2 switches, an OT network group bridged through the L2 switch to group the in-board monitoring/control system, and the L2 switch. Bridged to form an onboard network group of the crew network group where the crew PCs are grouped,
An integrated in-board security network system of a smart ship with enhanced cyber security, which routes and monitors traffic through the L3 switch. The method of claim 2,
The crew network group includes an AP, and when a network error occurs in the IT network group or the OT network group, the crew network group is bypassed to the L3 switch through the AP of the crew network group and is manually connected. Integrated onboard security network system of enhanced smart ship. The method of claim 3,
The IT network group or the OT network group is connected to the L3 switch through an AP of the crew network group to back up data. An integrated onboard security network system of a smart ship with enhanced cyber security. The method of claim 2,
The IT network group includes a platform server, an administrator server, and an owner server for collecting ship operation data,
The OT network group includes a navigation recording device, an electronic chart information system, an IP telephone, an IP CCTV, a smart navigator, a periodic engine, a generator or a monitoring system and a control system of an intelligent recognition system, and at least one including each L2 switch Separated into more than one subgroup,
The crew network group, characterized in that including equipment for seafarer welfare, the integrated in-board security network system of a smart ship with enhanced cyber security. The method of claim 2,
A cutoff switch is connected between the L3 switch and the corresponding L2 switch of the OT network group and the crew network group, and the cutoff switch is connected to the network control computer of the IT network group through the L2 switch,
When detecting a cyber attack or traffic increase, the network control computer controls the cut-off switch to bypass and communicate with the ship's main system of the OT network group.Integrated in-board security of a smart ship with enhanced cyber security Network system. The method of claim 6,
When a cyber attack or traffic increase is detected by the network control computer, the network control computer detects and controls the cut-off switch by a specific program logic or by an operator. Integrated onboard security network system. The method of claim 2,
A first blocking switch is connected between the L3 switch and a first network server communicating with an external network, and a second blocking switch is provided between the first blocking switch and the corresponding L2 switch of the OT network group and the crew network group. Connected,
When the traffic detection module of the IT network group monitors the traffic volume of the first network server and detects a cyber attack or a sudden increase in traffic volume, it controls the first and second blocking switches to physically block the external network, An integrated in-board security network system of a smart ship with enhanced cyber security, characterized in that operating the mandatory system and an autopilot system of the OT network group through the second network server. The method of claim 8,
The traffic detection module identifies malicious packets for hacking among packets received by the first network server, and bypasses and removes the malicious packets for hacking to a dummy server. Onboard security network system.

Images