KR20210111081A - System and method for cyber security analysis in nuclear facilities - Google Patents

Abstract

The present invention relates to a system and method for a cyber security analysis in nuclear facilities. The system includes: a physical device which is actually simulated based on a special system of a nuclear power plant; a simulator which generates a simulation of an entire operation of a nuclear power plant including a special system and synchronizes control signals applied to the special system in real time with a physical device; and a cyber security analysis device which executes a cyber attack on a control module (PLC) or local user interface (Local HMI) of the physical device through a network of the physical device and a simulator, and collects data transmitted by accessing the network. Therefore, it is possible to track the influence of other systems related to multiple systems due to a cyber attack in the cyber security of a nuclear power plant.

Description

SYSTEM AND METHOD FOR CYBER SECURITY ANALYSIS IN NUCLEAR FACILITIES

A cybersecurity analysis system and method for a nuclear facility are provided.

As cybersecurity incidents increase or decrease in industrial control systems, technical security measures and cybersecurity education and training are underway.

In particular, in the field of major energy infrastructure such as nuclear power plants, the size of the damage caused by cyber attacks is large and it is likely that the damage to human life is high.

Because it is difficult to utilize the actual operating system for cyber training, in general, training for cyber attacks is performed through equipment composed of IT-based systems, or cyber training is performed by simulating the target system as an actual physical device.

However, when cyber security training is performed through an IT-based system, it is convenient to configure the environment because it is implemented virtual, but it takes a lot of time and money to accurately express the characteristics of the target system. Cybersecurity training is conducted in an existing IT-based environment instead of this.

In addition, when a simulation device is provided, cyber security training can be performed based on the characteristics of the simulated target line, but it is difficult to systematically perform cyber security training with training limited to each target line.

Therefore, in order to efficiently perform cyber security training in the nuclear field, a technology capable of performing various analyzes by linking simulation and physical devices is required.

As a related prior document, Korean Patent Application Laid-Open No. 10-2018-0030443 discloses "a water supply system simulating device and a water supply system simulating system".

Korean Patent Laid-Open Patent No. 10-2018-0030443

One embodiment of the present invention is to provide a system and method for testing cybersecurity of a nuclear facility and analyzing the results by linking a nuclear power plant operation simulation with a physical device.

In addition to the above problems, the embodiment according to the present invention may be used to achieve other problems not specifically mentioned.

A cyber security analysis system according to an embodiment of the present invention generates an overall operation simulation of a nuclear power plant including an actual simulated physical device and a special system based on a special system of the nuclear power plant, and controls applied to the special system in real time A simulator that synchronizes signals with a physical device, executes a cyber attack on the control module (PLC) of the physical device or a local user interface (Local HMI) through the network of the physical device and the simulator, and collects the transmitted data by accessing the network and a cybersecurity analysis device.

A cyber security analysis method according to an embodiment of the present invention includes performing an overall operation simulation of a nuclear power plant by synchronizing an actual simulated physical device based on a special system of the nuclear power plant and a control signal applied to the special system; and modulating a control signal of a control module of a physical device or a user interface of a physical device through a connection network between the physical device and the entire operating simulation, collecting a transmission signal between the physical device and the overall operating simulation in response to the modulated control signal, and and confirming the changed state information in the physical device and the overall operation simulation through the transmission signal.

According to an embodiment of the present invention, it is possible to collect and analyze data from the sensor level of multiple systems due to a cyber attack to the overall operation state of the nuclear power plant by linking the nuclear power plant operation simulation and the physical device.

According to an embodiment of the present invention, it is possible to track the influence of other systems associated with multiple systems due to a cyber attack in cyber security of a nuclear power plant.

According to an embodiment of the present invention, by analyzing data collected through a cyber attack and its simulation, it can be used for cyber security testing and training such as intrusion analysis, emergency event management and response, digital forensics, and cyber attack training. .

1 is an exemplary diagram illustrating a network of a cyber security analysis system according to an embodiment of the present invention.
2 is an exemplary diagram illustrating a physical device according to an embodiment of the present invention.
3 is an exemplary diagram illustrating a process of providing a cyber attack according to an embodiment of the present invention.
4 is an exemplary diagram for explaining a route for attacking a local interface according to an embodiment of the present invention.
5 is an exemplary diagram for explaining a process of collecting and analyzing data for a cyber attack according to an embodiment of the present invention.
6 shows an interface screen showing monitoring results for a plurality of systems in a user interface according to an embodiment of the present invention;
7 shows an interface screen showing a monitoring result through the entire simulation of a nuclear power plant in a user interface according to an embodiment of the present invention.

With reference to the accompanying drawings, the embodiments of the present invention will be described in detail so that those of ordinary skill in the art to which the present invention pertains can easily implement them. The present invention may be embodied in many different forms and is not limited to the embodiments described herein. In order to clearly explain the present invention in the drawings, parts irrelevant to the description are omitted, and the same reference numerals are used for the same or similar components throughout the specification. In addition, in the case of a well-known known technology, a detailed description thereof will be omitted.

Throughout the specification, when a part "includes" a certain element, it means that other elements may be further included, rather than excluding other elements, unless otherwise stated.

In the specification, the condensate system condenses the steam discharged from the turbine / generator in the nuclear power plant in the condenser, and the condensed condensate is collected in the hot water tank of the condenser, and then heated in the condensate system and transferred to the water supply system. It means a set of devices.

In the specification, a process of performing a cyber security test and analysis process based on a plurality of systems will be described, but the present invention is not limited thereto.

In the specification, a cyber attack has the same concept as a cyber security test and cyber security training, and performing a cyber attack has the same meaning as performing a cyber security test or training.

Hereinafter, a cyber security analysis system including a cyber security test device and a cyber security analysis device will be described in detail with reference to FIGS. 1 and 2 .

1 is an exemplary diagram illustrating a network of a cyber security analysis system according to an embodiment of the present invention, and FIG. 2 is an exemplary diagram illustrating a physical device according to an embodiment of the present invention.

The cyber security analysis system 1000 performs a cyber security test or training in a nuclear facility through the cyber security testing device 100 and the cyber security analysis device 200 , and analyzes result data according to the performed test or training.

Specifically, the cyber security test device 100 is a simulator 120 that simulates a nuclear power plant system in a virtual environment, a physical device 130 that simulates the water supply system of a nuclear power plant, and the simulator 120 and the physical device 130. and a user interface 100 for performing control settings and monitoring for the .

The user interface 100 (Human Machine Interface, HMI) is a user interface implemented in a virtual environment, and is connected to the simulator 120 and the physical device 130 in real time to collect and monitor status information.

The user interface 100 may be interlocked with one or more displays, one or more touchpads, input devices, and the like to receive a setting value for the simulator 120 or the physical device 130 from the user.

Then, the user interface 100 may transmit the corresponding setting value to the corresponding simulator 120 or the physical device 130 , and collect and provide changed state information by applying the corresponding setting value.

Next, the simulator 120 represents a module for simulating the operating state of nuclear power plant facilities in a virtual environment, and transmits and receives control signals to and from the power plant protection system, control system, turbine, and multiple systems of the nuclear power plant, run the simulation.

The simulator 120 may set conditions of a virtual environment, set values of nuclear power plant facilities, connection relationships between facilities, characteristics of facilities, conditions for determining abnormal symptoms, and the like, in order to perform the overall simulation of the nuclear power plant.

The simulator 120 may acquire network data information between nuclear power plant facilities in operation and implement a network in a virtual environment through the acquired network data information. Similarly, the simulator may provide a simulation applied by collecting set values of nuclear power plant facilities in actual operation.

In addition, the simulator 120 may generate a simulation implemented centered on a specific system module in order to precisely apply the operating situation for a related system for system-level training while performing the entire operation simulation of the nuclear power plant.

For example, the plurality of systems is characterized in that it is not dependent on the type of reactor of the nuclear power plant and can be configured in most similar forms. The simulator 120 may generate a simulation related to the overall operation of the nuclear power plant based on a plurality of independent systems in consideration of these characteristics.

Therefore, the simulator 120 may generate a simulation code by reflecting the basic concept of the physical device 130 in the design, and input/output values centered on the pressure, flow rate, etc. directly related to water level information in order to link with the physical device 130 . You can create simulation code to control

In this case, the simulator 120 may be set to be synchronized with each other between a simulation implemented around a specific system module and an actual simulation device implementing the specific system module.

In other words, the control signal of the nuclear power plant simulation implemented by the simulator 120 and the control signal of the physical device 130 in which the specific system module is simulated are synchronized with each other.

For example, the simulator 120 collects data from a plurality of system-related turbine output values, a turbine stop signal, a pump, a cooling water pump, an air pump, a condenser pump, and the like and shares the calculated water level information with the physical device 130 . can do.

Therefore, when a change in the nuclear power plant simulation occurs, the generated change is applied to the physical device 130 , and when the water tank state of the physical device 130 changes, the changed water tank state is reflected in the simulation state information.

The physical device 130 is a device that simulates multiple systems of an actual nuclear power plant, and is formed as a separate, independent device.

As shown in FIG. 2 , the physical device 130 includes a condenser tank (131, Condenser), a control module (132, Programmable Logic Controller, PLC), a condenser storage tank (133, Condenser Storage Tank), a pump (134, Pumps), an emergency button (135, Emergency circuit Breaker), a local user interface (136, HMI), a power supply (137, Power supply), valves (138, Valves) and the like.

The physical device 130 performs a driving simulation of a plurality of systems by controlling a sensor (not shown) or a power supply 137 mounted on a main physical device part in order to maintain the water level of the plurality of systems.

In addition, the physical device 130 automatically operates the pump 134 or the valve 138 according to the change in the water level of the condenser tank 131 , and records the manipulated data and results in real-time values of the multiple systems of the simulator 120 . Share information to reflect

In the physical device 130, a plurality of systems controlled according to the control module 132 and the local user interface 136 physically implement the process of physically operating multiple inflow and outflow as an actual device, so each process is intuitively identified. possible.

The user interface 100 , the simulator 120 , and the physical device 130 are closely connected to each other through a network, and transmit and receive data to and from each other. The communication network 20 may include any type of communication network that transmits data, such as a wired communication network, a short-distance or long-distance wireless communication network, and a mixed network thereof.

In addition, the cyber security analysis device 200 performs a cyber attack scenario by accessing the network between the user interface 100, the simulation 120, and the physical device 130, or in an attack scenario situation in which the user interface 100, the simulator ( 120) and all information transmitted between the physical devices 130 may be collected.

In detail, the cyber security analysis device 200 collects/analyses a module that performs a cyber attack to generate a cyber attack on the control module (PLC) and the user interface (HMI) through the network and acquires and analyzes network information. It contains a module that performs the analysis.

Here, the cyber attack is described as a scenario of attacking the control module 132 and the local user interface 134 of the physical device 130, but is not necessarily limited thereto.

For example, in addition to the physical device 130 , the cyber attack may be performed in a configuration control configuration of the user interface 110 or some configuration in a nuclear power plant operation simulation of the simulator 120 .

Meanwhile, for the sake of explanation, the user interface 100 , the simulator 120 , and the cyber security analysis device 200 are named and called, but they may be implemented as a computing device operated by at least one processor. In other words, the user interface 100 , the simulator 120 , and the cyber security analysis device 200 may be implemented as one computing device or distributed in separate computing devices. When distributed in separate computing devices, the user interface 100 , the simulator 120 , and the cyber security analysis device 200 may communicate with each other through a communication interface. The computing device may be any device capable of executing a software program written to carry out the present invention, and may be, for example, a server, a laptop computer, or the like.

3 is an exemplary diagram illustrating a process of providing a cyber attack according to an embodiment of the present invention, and FIG. 4 is an exemplary diagram illustrating a route for attacking a local interface according to an embodiment of the present invention.

As shown in FIG. 3 , the cyber security analysis apparatus 200 may perform a cyber attack targeting the control module PLC and the local user interface (HMI) by using the cyber attack module 210 .

For example, the cyber attack may include a packet replay attack and a man-in-the-middle attack as an attack using a protocol (1) targeting the control module 132, and a remote execution attack (2) targeting the local user interface (HMI) may include.

Here, the packet replay attack means modulating a control signal by repeating it periodically for a relatively short time without blocking or changing a connected communication line. On the other hand, the man-in-the-middle attack means to continuously provide a modulated control signal by blocking the connected communication line.

When the cyber attack module 210 performs a cyber attack, the physical device 130 detects an abnormal state according to the modulated signal.

For example, as shown in FIG. 4 , the cyber attack may modulate the control signal of the local interface 136 of the physical device 130 in three ways.

For example, a pump that modulates the water level information of the condenser as shown in A, controls the on/off of the condenser cooling pump as shown in B, and lowers the water level of the condenser as shown in C. It is possible to insert a modulated signal that controls the on/off of

The local interface 136 transmits the modulated control signal to the control module PLC, thereby driving the physical device 130 according to the modulated signal due to a cyber attack.

As such, when a cyber attack is performed on the physical device 130, the result (recognizing that the water level of the condenser is out of the reference range, increasing the temperature of the condenser, or gradually decreasing the water level of the condenser) is simulated in response to the control signal. 120) and

Then, the physical device 130 additionally operates to automatically compensate for the state changed by the cyber attack, and at the same time, a change is also generated in the simulation of the operating state of the entire nuclear research institute.

For example, when the water level information of the condenser is modulated to be higher than a reference range, a pump or a valve may be controlled to lower the water level of the condenser.

Accordingly, in reality, as the water level of the condenser is lowered below the reference range, a pump and a valve for supplying water to the condenser are driven to lower the water level in the storage tank of the condenser and increase the temperature of the condenser. According to the change of the multiple systems, it may be applied to the operation simulation of the entire nuclear research institute, and changes may occur in other systems linked to the multiple systems.

As described above, the information collection/analysis module 220 of the cyber security analysis device 200 collects changes detected in the entire simulation of the nuclear power plant as well as changes in the physical device 130 in response to a cyber attack in real time.

5 is an exemplary diagram for explaining a process of collecting and analyzing data for a cyber attack according to an embodiment of the present invention.

As shown in FIG. 5 , the information collection/analysis module 220 of the cyber security analysis apparatus 200 includes an information collection unit 221 , a file conversion unit 222 , a file analysis unit 223 , and a transmission unit ( 224).

The information collection unit 221 collects all information transmitted between the control module 132 and the cyber security testing device 100 through a network device connected to the control module 132 . The communication protocol used at this time is dependent on the control module 132, for example, follows the s7commplus protocol according to the Siemens s7-1500 model.

In this case, the information collection unit 221 may use a mirroring port that mirrors traffic using span port switch credentials in order to collect network information. Through this, the information collection unit 221 may collect information from a switch (not shown) of the physical device 130 through a separate device (NUC PC hardware).

In addition, the file conversion unit 222 stores network information and continuously changes and stores it in a specific file type that can be analyzed (eg, json format, etc.).

The file analysis unit 223 analyzes data of a specific file type using an analysis algorithm and derives an analysis result. In this case, the file analysis unit 223 may decrypt and analyze the encrypted protocol in addition to the simple data.

In detail, the file analysis unit 223 analyzes the control network communication used in the nuclear power plant operation simulation or the physical device 130 , and controls the control module 132 through the analysis of the control process procedure of the physical device 130 . As a standard, data transmission/reception status and control signal processing status can be analyzed.

In addition, the file analysis unit 223 checks the state change of a special system according to control information at the level of one unit system, such as the physical device 130, and determines the influence between different unit systems based on the processing information of the special system. It can be analyzed through the state change according to the entire process for the entire operation simulation of the nuclear power plant.

The transmission unit 224 transmits it to the user dashboard that is linked based on the derived analysis result. Alternatively, the transmitter 224 may transmit the analysis result to a set user terminal (not shown).

Hereinafter, a configuration in which a monitoring result provided by the user interface 110 according to an embodiment of the present invention is displayed as a trend change will be described in detail.

6 shows an interface screen showing monitoring results for a plurality of systems in a user interface according to an embodiment of the present invention, and FIG. 8 is a monitoring result through simulation of the entire nuclear power plant in the user interface according to an embodiment of the present invention Shows the displayed interface screen.

As shown in FIG. 6 , the user interface 110 allows monitoring information on the interlocking simulator 120 or the physical device 130 of multiple systems to understand the flow at regular time intervals instead of the current state at the time. It can be provided in a trend format.

Figure 6 (a) is an output change trend collected from the entire simulation of the nuclear power plant, (b) and (c) are multiple systems water level information (Condenser Level) collected from the entire simulation of the nuclear power plant or the physical device 130 of multiple systems ) trend and multiple system pressure information (condenser pressure) trends are shown.

Meanwhile, since the entire simulation of the nuclear power plant and the physical device 130 share control signals with each other, data collected by the simulator 120 or the physical device 130 have the same trend.

On the other hand, (d) of FIG. 6 is a trend showing a change in the water level of a plurality of systems in which a replay attack has occurred.

Referring to FIG. 6( d ), the graph temporarily lowers through a short attack in the multiple system water level information of 100 with a reference value and then recovers to 100, and the graph temporarily lowers and then recovers again through a short attack. It can be seen that repeating When a change in numerical values for a certain time is displayed as a trend graph, the repeated attack can be intuitively identified.

In the past, monitoring information was provided as a numerical value at the present time, or in divided stages such as normal, dangerous, and warning based on the provided numerical value.

In such a case, if a repeated attack is received, a notification signal may not be generated in a timely manner or an abnormal state may not be detected because abnormality and normality are repeated in real time.

7 shows possible results that can be confirmed in the entire system other than multiple systems due to repeated attacks.

Figure 7 (a) shows the numerical value of the multiple system (CD level) due to the repeated attack, (b) shows the numerical change of the feed water tank lever according to the numerical change of the multiple system.

In addition, (c) of FIG. 7 shows a change in pressure (CD pressure) of a plurality of systems, (d) is a pressure of a steam generator (SG pressure), and (e) is a change in total output (Reactor power) of a nuclear power plant.

As described above, the cyber security analysis system may collect and analyze data from the sensor level of multiple systems due to a cyber attack to the overall nuclear power plant operation state through the link between the nuclear power plant operation simulation and the physical device.

In addition, it is possible to track the influence of other systems associated with multiple systems due to cyber attacks in the cybersecurity of nuclear power plants.

A program for executing the cyber security analysis system may be recorded in a computer-readable recording medium.

The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The media may be specially designed and configured, or may be known and available to those skilled in the art of computer software. Examples of the computer-readable recording medium include hard disks, magnetic media such as floppy disks and magnetic tapes, optical recording media such as CD-ROMs and DVDs, magneto-optical media such as floppy disks, and ROMs, RAMs, flash memories, and the like. Hardware devices specially configured to store and execute the same program instructions are included. Here, the medium may be a transmission medium such as an optical or metal wire or a waveguide including a carrier wave for transmitting a signal designating a program command, a data structure, and the like. Examples of program instructions include not only machine language codes such as those generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like.

Although the preferred embodiment of the present invention has been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements by those skilled in the art using the basic concept of the present invention as defined in the following claims are also provided. is within the scope of the

Claims (10)

A physical device that is actually simulated based on a special system of a nuclear power plant,
A simulator for generating an overall operation simulation of a nuclear power plant including the special system, and synchronizing a control signal applied to the special system in real time with the physical device; and
A cyber attack that executes a cyber attack on a control module (PLC) of the physical device or a local user interface (Local HMI) of the physical device through the network of the physical device and the simulator, and collects data transmitted by accessing the network security analysis device
A cybersecurity analysis system comprising a.
In claim 1,
A user interface implemented in a virtual environment, the cyber security analysis system further comprising a user interface for collecting state information in real-time connection with the physical device and the simulator, and transmitting the input control signal to the physical device and the simulator.
In claim 2,
The user interface is
A cyber security analysis system that displays the status information collected in real time as a trend graph for a certain period of time.
In claim 1,
The physical device is
A cyber security analysis system that is simulated based on a plurality of systems of the nuclear power plant and independently driven based on a control module (PLC), and shares real-time operation data and state data according to the driving operation with the simulator.
In claim 2,
The cyber security analysis device,
When a vulnerability is identified from a digital asset connected to the switch of the physical device and a root shell is obtained, one or more cyber attacks are selected from among a packet replay attack using a network protocol, a man-in-the-middle attack, or a remote execution attack using the root shell. A cybersecurity analysis system that executes selected cyberattacks.
In claim 2,
The cyber security analysis device,
A cyber security analysis system for collecting state information changed in the physical device and the simulator based on the cyber attack to analyze a direct impact of the cyber attack and a ripple effect on the entire operation of the nuclear power plant.
Performing an overall operation simulation of the nuclear power plant by synchronizing the actual simulated physical device based on the special system of the nuclear power plant and the control signal and state information applied to the special system;
modulating a control signal of a control module of the physical device or a user interface of the physical device through a connection network between the physical device and the overall operation simulation;
collecting a transmission signal between the physical device and the overall operation simulation in response to the modulated control signal; and
Confirming changed state information in the physical device and the overall operation simulation through the transmission signal
A cybersecurity analysis method comprising a.
In claim 7,
The step of performing the entire operation simulation of the nuclear power plant comprises:
As a user interface implemented in a virtual environment, the state information obtained from the results of the simulation and the physical device collected in real time through a user interface interworking with the connection network between the physical device and the simulator is displayed as a trend graph for a certain period of time. A cybersecurity analysis method further comprising the step of:
In claim 8,
The step of modulating the control signal comprises:
A cybersecurity analysis method for modulating a control signal of a plurality of system configurations of a simulator or modulating a setting signal of the user interface through the connection network.
In claim 7,
The step of checking the status information,
A cyber security analysis method for analyzing an encrypted protocol from a transmitted signal collected based on the cyber attack, and checking status information based on a control module of the physical device based on the analyzed data.

Images