KR101871406B1 - Method for securiting control system using whitelist and system for the same - Google Patents

Abstract

A security management method of a control system using a white list and a system therefor are disclosed. The security control method according to the present invention is characterized in that the first security information collection device collects security information based on at least one security device included in the first control system; The first security information collecting device transmitting the security information to a first unit security control device corresponding to the first control system; The first unit security control apparatus analyzing the security information to perform a security control of the first control system; And the division security control device obtains the security information from the second unit security control device corresponding to the second control system and the first unit security control device respectively and transmits the security information to the first control system and the second control system based on the security information, 2 < / RTI > control system.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a security management method for a control system using a white list,

The present invention relates to a security control technology for a control system, and more particularly, to a security control system for a control system using a white list capable of cyber security for external contacts that transmit data to the internal network and external while maintaining a closed- And a system therefor.

The control system is used to control and monitor the industrial facilities, to monitor and control plant conditions, to produce and distribute electric power, to control traffic infrastructure such as trains and airplanes, to monitor and control dams, oil and gas facilities, Based equipment.

In such a control system, past data such as past information history management, report function, and past real-time measurement tendency are stored. Therefore, if cyber infringement occurs, operational information and status information of the corresponding control system are leaked and become a serious threat to the control system .

Most of the control systems have been recognized as being safe because the intrusion from the outside is fundamentally blocked by constituting the network with the closed network. However, starting with Stuxnet, a kind of computer virus designed to destroy infrastructure facilities such as power plants, airports and railways in 2010, the attack methods for control systems are gradually evolving, New malicious codes such as Duke, Flame, Gauss, Mahdi, Shaman and Skywiper have been found. In addition, it is dominant that control systems are no longer safe due to APT (Advanced Persistent Threat) attacks and disclosure of control system vulnerabilities. According to the ICS-CERT in the United States, 253 infringements of the control system in 2013 have increased by 25% over the previous year, and the number is expected to increase.

To solve this problem, control system operators are protecting the inside of the control system by applying network separation technology. In addition, much research is being done to apply IT security technology and control technology as control system. However, there are some problems to apply IT security technology and control technology to the control system.

First, IT security control technology implements security controls on incoming traffic from external networks (the Internet). However, since the control system network is operated as a closed network, the application of the external network security control technology is not suitable. Second, IDS (Intrusion Detection System), IPS (Intrusion Prevention System), and anti-virus programs used for IT security control update new attack detection patterns based on the Internet. However, the control system is difficult to apply security updates and patches because of the availability of the operating system. Third, because the control system has the highest purpose of availability, it is reluctant to introduce a system that affects network device performance such as traffic sensors.

Therefore, there is an urgent need for a new control system security control technology capable of protecting cybersecurity while maintaining the availability and closed-network principles of the control system.

Korean Registered Patent No. 10-1455167, registered on October 21, 2014 (name: white list-based network switch)

An object of the present invention is to perform security control of the control system without affecting the availability of the control system by separating the control traffic of the control system from the security control traffic.

In addition, the object of the present invention is to enable illegal USB usage, control network attack by attack, and response to accidents in consideration of control within the control system as well as the linking period.

It is another object of the present invention to provide a white list-based monitoring of a situation inside a control network by reflecting a characteristic of a control system, thereby enabling an abnormal symptom of the control system and cyber attack detection.

It is also an object of the present invention to enable mutual verification of log, event correlation, mutual correspondence analysis, communication history between control networks and security information among internal network security systems through correlation analysis of security information.

It is also an object of the present invention to enable information exchange for security control while maintaining the closed network policy of the control system.

It is another object of the present invention to provide a physical unidirectional data delivery system for blocking intrusion of an attacker into a control network of a control system.

It is also an object of the present invention to propagate cyber accident and system abnormality information to an upper authority through a predetermined system to minimize the damage of other control systems.

It is also an object of the present invention to facilitate information transfer of a higher management agency.

According to another aspect of the present invention, there is provided a security management method for a control system, comprising: collecting security information based on at least one security device included in a first control system; The first security information collecting device transmitting the security information to a first unit security control device corresponding to the first control system; The first unit security control apparatus analyzing the security information to perform a security control of the first control system; And the division security control device obtains the security information from the second unit security control device corresponding to the second control system and the first unit security control device respectively and transmits the security information to the first control system and the second control system based on the security information, 2 < / RTI > control system.

At this time, the collecting step may collect the security information from the at least one security device through the sheriff's network separated from the control network of the first control system.

At this time, the transmitting step may be performed by the first security information collecting device located inside the first control system, to the first unit security controlling device located outside the first control system based on the physical unidirectional transmission And may transmit the security information.

At this time, performing the security control of the first control system may include generating a first white list corresponding to the first control system based on the security information; Monitoring the first control system based on the first whitelist; And performing, when the first control unit has generated unauthorized information in violation of the first whitelist, processing by the first unit security control device in response to the unauthorized information.

At this time, the step of generating the first white list may analyze the operation pattern of the first control system based on the security information, and may generate the first white list according to the operation pattern.

Wherein the security information corresponds to a log of the at least one security device and includes at least one of a network traffic log, a firewall log, an embedded control device traffic log, a NAC (Network Access Control) log, a USB access log, A system log, a network system log, and a physical protection system log.

In this case, performing the security control of the first control system and the second control system may include analyzing a communication pattern correlation between the first control system and the second control system based on the security information, Generating a control-system whitelist corresponding to the correlation; Monitoring the first control system and the second control system based on the inter-control white list; And when unauthorized communication information that violates the inter-control whitelist during communication between the first control system and the second control system occurs, the departmental security control device transmits, to the first unit security control device, And controlling the control device to perform processing corresponding to the unlicensed communication information.

In this case, the step of generating a white list between control systems may include extracting at least one log of a firewall log, an L3 device log, an IDS log, and an IPS log based on the security information, Pattern correlation can be analyzed.

At this time, the security control method includes: the integrated security control device sharing the security control information with the sector security control device; And the department security control device sharing the security control information with the first unit security control device and the second unit security control device.

At this time, the security management information may correspond to at least one of security threat information, cyber accident processing information, detection rules, event information, and document information.

At this time, the step of performing the security control of the first control system and the second control system may include the step of performing the security control of the first control system and the second control system by using the first communication information from the first control system to the second control system, Obtaining second communication information to the second communication information; Analyzing the consistency of the first communication information and the second communication information; And when the inconsistency between the first communication information and the second communication information is lacking, the departmental security control device controls the first unit security control device and the second unit security control device, And blocking communication between the first and second control systems.

According to another aspect of the present invention, there is provided a security control system including: a security information collection device installed in a control system and collecting security information based on at least one security device included in the control system; A unit security control unit for analyzing the security information and performing a security control of the control system; And a divisional security control device for obtaining the security information from the control system and another control system, respectively, and for performing security control of the control system and the other control system based on security information.

At this time, the security information collection device may collect the security information from the at least one security device through a sheriff's network separated from the control network of the control system.

At this time, the security information collecting apparatus can transmit the security information to the unit security control apparatus located outside the control system based on the physical one-way transmission.

At this time, the unit security control apparatus monitors the control system based on the whitelist corresponding to the control system based on the security information, and when the unauthorized information violating the whitelist is generated in the control system It is possible to perform processing corresponding to the unauthorized information.

At this time, the unit security control apparatus analyzes the operation pattern of the control system based on the security information, and generates the white list according to the operation pattern.

Wherein the security information corresponds to a log of the at least one security device and includes at least one of a network traffic log, a firewall log, an embedded control device traffic log, a NAC (Network Access Control) log, a USB access log, A system log, a network system log, and a physical protection system log.

At this time, the security control system may further include an integrated security control device that shares security control information with the sector security control device.

At this time, the division security control device may share the security control information with the unit security control device.

At this time, the security management information may correspond to at least one of security threat information, cyber accident processing information, detection rules, event information, and document information.

According to the present invention, the security control of the control system can be performed without affecting the availability of the control system by separating the control traffic of the control system and the security control traffic.

In addition, the present invention may be able to respond to control network attacks and accidents caused by illegal USB use, maintenance, and the like in consideration of control within the control system as well as the connection interval.

In addition, the present invention can detect abnormalities of the control system and cyber attack by monitoring the inside of the control network based on the white list based on the characteristics of the control system.

Also, the present invention can enable mutual verification of log, event correlation, mutual correspondence analysis, communication history between control networks, and security information among internal network security systems through correlation analysis of security information.

Further, the present invention can enable information exchange for security control while maintaining the closed network policy of the control system.

In addition, the present invention can prevent an attacker from intruding into a control network of a control system by using a physical unidirectional data delivery system when performing a security control.

In addition, the present invention can propagate the cyber accident and system abnormality information to an upper authority through a predetermined system, thereby minimizing the damage to other control systems.

Further, the present invention can facilitate information transfer by a higher management agency.

1 is a block diagram illustrating a security management system of a control system using a white list according to an embodiment of the present invention.
FIG. 2 is a diagram illustrating an example of a control system to which the security control system according to the present invention is applied.
3 is a diagram illustrating an example of a method for transmitting security information in a control system according to the present invention.
4 is a flowchart illustrating a security management method for a control system using a white list according to an embodiment of the present invention.
5 is a diagram illustrating a process of detecting an unauthorized service connection to a security control system according to an exemplary embodiment of the present invention.
6 is a diagram illustrating a process of detecting connection of an unauthorized device to a security control system according to an embodiment of the present invention.
7 is a flowchart illustrating a process of detecting a failure of an internal control system using a security control system according to an embodiment of the present invention.
8 to 9 illustrate a process of applying a routing policy of a control system in a security control system according to an embodiment of the present invention.
10 to 11 are views illustrating a process of applying a firewall policy of a control system in a security control system according to an embodiment of the present invention.
12 is a diagram illustrating a process of sharing collected information and security threat information in a security control system according to an embodiment of the present invention.
13 is a diagram illustrating a process of detecting an abnormal symptom between internal networks of a control system using a security control system according to an embodiment of the present invention.
14 is a diagram illustrating a process of applying a firewall policy of a control system based on an authorization service in a security control system according to an embodiment of the present invention.

The present invention will now be described in detail with reference to the accompanying drawings. Hereinafter, a repeated description, a known function that may obscure the gist of the present invention, and a detailed description of the configuration will be omitted. Embodiments of the present invention are provided to more fully describe the present invention to those skilled in the art. Accordingly, the shapes and sizes of the elements in the drawings and the like can be exaggerated for clarity.

The embodiments according to the concept of the present invention can make various changes and can take various forms, so that the embodiments are illustrated in the drawings and described in detail herein. It should be understood, however, that it is not intended to limit the embodiments according to the concepts of the present invention to the particular forms disclosed, but includes all modifications, equivalents, or alternatives falling within the spirit and scope of the invention.

The terms first, second, etc. may be used to describe various elements, but the elements should not be limited by the terms. The terms may be named for the purpose of distinguishing one element from another, for example, without departing from the scope of the right according to the concept of the present invention, the first element may be referred to as a second element, The component may also be referred to as a first component.

Hereinafter, preferred embodiments according to the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram illustrating a security management system of a control system using a white list according to an embodiment of the present invention.

1, the security control system of the control system using the white list according to the embodiment of the present invention includes control systems 110-1 to 110-N, security information collection devices 111-1 to 111-N, The unit security control units 120-1 to 120-N, the divisional security control units 130-1 to 130-M, and the integrated security control unit 140. [

The control systems 110-1 through 110-N may correspond to systems for controlling and managing the operation of power generation and distribution, dam operation, gas production and distribution, water resources, and the like.

Since most of the control systems constitute the network with the closed network, it is recognized that the intrusion from outside is fundamentally blocked and safe. However, it is widely believed that the control system is no longer safe due to the appearance of Stuxnet, control system malware, APT (Advanced Persistent Threat) attacks and disclosure of control system vulnerabilities.

In order to solve this problem, much research has been conducted on the cyber security control on the control system. However, despite the difference in structure and service between IT system and control system, most control system cyber security control adopts IT security technology.

Table 1 compares general IT system and control system.

Item IT system Control system Real-time cast Real-time requirement depending on some services real time responsibility Require reliable response based on some services Service response critical QoS Allow delay or jitter Unacceptable Service Continuity Non-continuous service Continuous service Failure and failure Fault and fault tolerance Operation not allowed service Applicable after beta testing Requires thorough testing before applying importance Data Integrity Critical Human stability important Loss Loss of data or loss of work Loss of environment, person, equipment, product Policy Confidentiality> Integrity> Availability Availability> Integrity> Confidentiality hardware Computer and network equipment Computer, network, PLC, IED, RTU, etc. network Connect with the Internet Closed network operation operation Relatively short term Long-term operation application Various applications Dedicated applications protocol Open protocol Private private protocol patch Patch easy Patch difficulty Maintenance Remote maintenance and on-site maintenance Site visit maintenance Cyber accident effect Data takeover, destruction Destruction and deodorization of data and systems, loss of life, destruction of physical devices restore ease difficulty Recovery time Short-term It takes a long time

At this time, referring to [Table 1], the control system requires high real-time performance, reliable response and safety. And while IT systems are important to the confidentiality of data, control systems place greater emphasis on system availability.

In addition to the server and network equipment, the IT system also manages security for external contacts. However, in addition to servers and network equipment, PLCs (Programmable Logic Controllers), Intelligent Electronic Devices (IEDs), Remote Terminal Units (RTUs) ), And Distributed Control System (DCS). In addition, the control system uses a proprietary control protocol for applications and communication protocols, and requires high reliability of communication.

In this case, [Table 2] compares IT security control with control system security control.

compare IT Security control Control system Security control section Internet and institution network connection section Control network and business network connection section
Inside the control network object IT equipment Control devices and field devices Main information collection sensor Linked traffic statistics information
Security log (firewall log, IDS log)
USB connection event IT security control
USB connection event
Control network traffic statistics information
Control network security log (IDS log, whitelist log)
Physical Protection System Log protocol Open protocol Use a private, proprietary protocol Vaccine program Operable Can not install on embedded devices Update server available Operating the update server on some control systems
- Control devices (RTOS products) not available

Also, referring to [Table 2], the IT security control system implements security control for the system connected to the Internet. Therefore, IT security control technology is the key to the sharer of the data coming from the outside. At this time, blacklist-based security control is being implemented to protect unspecified and unspecified traffic that is accessed via the Internet. However, since the control system operates as a closed network and emphasizes availability, it can only accept data necessary for system operation. For this reason, only the data necessary for operating the system is used for the traffic from the outside, and the traffic inside the control system is used only for the data for the system operation.

In addition, the control system operates as a closed network, and security patch upgrades (IDS signature, IPS signature, firewall rule update, system security patch, vaccine update, etc.) can not be applied in real time like IT security control system. Therefore, the security control of the control system should be based on the allowed pattern-based, whitelist.

In addition, to maintain the closed network policy, the attack should be blocked as a network separation system capable of transmitting data in one direction or one direction.

Accordingly, in order to solve these problems, the present invention proposes a security control system capable of providing cyber security for the control system while ensuring security and availability within the control system.

At this time, the portion of the security control system that is responsible for the actual security control is the unit security control units 120-1 to 120-N, the divisional security control units 130-1 to 130-M, And may correspond to the control device 140.

At this time, the unit security control units 120-1 to 120-N, the divisional security control units 130-1 to 130-M, and the integrated security control unit 140 can be classified according to their sizes and operating methods. For example, the unit security control can be performed in accordance with the control target system or the control system, the sector security control can be performed in accordance with the head office of the target organization, and the integrated security control can be performed by the Ministry of Industry, Such as government agencies.

At this time, it is possible to operate the security control system only with the unit security control devices 120-1 to 120-N and the sector security control devices 130-1 to 130-M depending on the situation. Or may be operated as the unit security control devices 120-1 to 120-N and the integrated security control device 140 according to the situation of the site.

FIG. 2 is a diagram illustrating an example of a control system to which the security control system according to the present invention is applied.

Referring to FIG. 2, the control system 210 to which the security control system according to the present invention is applied may include at least one security device for generating security information. That is, the security information collecting device 211 may collect a log of the security devices recorded in accordance with the operation of the control system 210 and transmit the collected information to the unit security control device or the unit security control system 230.

At this time, in order to guarantee the availability of the internal control network of the control system 210, the log may be transmitted to the security information collection apparatus 211 through the sheriff's network.

The security information collection device 211 located inside the control system 210 may transmit the security information to the unit security control system 230 using the one-way transmission device 212. At this time, there is an effect that the possibility of accessing from the outside to the control system can be fundamentally blocked by transmitting security information through the one-way transmission device 212.

3 is a diagram illustrating an example of a method for transmitting security information in a control system according to the present invention.

3, a method for transmitting security information of a control system according to the present invention is a method for transmitting security information of a control system 300 in which a security information collection device 330 located inside a control system 300 is separated from a control network 310 of a control system 300 The security information collection unit 330 collects security information using the sheriff's request 320 and transmits the collected security information to the unit security control unit 340 through one-way or unidirectional data transfer.

At this time, the security information may correspond to a log of at least one security device provided in the control system 300. For example, as shown in FIG. 3, the USB monitoring system log, the patch management system log, the NMS log, the control device traffic information, and the NAC log may correspond to the security information.

At this time, at least one security device may have a separate LAN card for using the sheriff's network.

Also, although not shown in FIG. 3, a control network and a sheriff's network may be separated using a network device such as a switch or a router.

4 is a flowchart illustrating a security management method for a control system using a white list according to an embodiment of the present invention.

Referring to FIG. 4, a method for security management of a control system using a white list according to an embodiment of the present invention is characterized in that the first security information collecting apparatus includes security information (S410)

At this time, the first control system may include at least one security device for generating security information. For example, USB surveillance system, patch management system, Network Management System (NMS), Network Access Control (NAC), Intrusion Detection System (IDS), Intrusion Prevention System (IPS) It may correspond to a security device.

At this time, the security information may correspond to a log of at least one security device. That is, a log of at least one security device recorded according to the operation of the first control system may be collected by the first security information collection device.

At this time, the first security information collecting device receives the white list-based monitoring log, the network traffic log, the firewall log, the embedded control device traffic log, the NAC (Network Access Control) log, the USB connection log, , System logs, network system logs, and physical protection system logs.

At this time, the whitelist based surveillance log and the network traffic log may be collected to detect anomalous indications occurring in the first control system based on the whitelist.

In addition, the firewall log can be collected to analyze the abnormality of communication between the control systems.

The embedded control device traffic log may also be collected to detect anomalous behavior of embedded control devices included in the first control system.

In addition, the NAC log may be collected to detect whether unauthorized illegal equipment is being used in connection with the network, or to perform asset management corresponding to the first control system.

The USB connection log may also be collected to detect whether illegal USB is being used.

In addition, the vaccine detection log can be collected to detect host-based malware.

In addition, the system log can be collected to check whether the system of the computer system, the control device, and the field device corresponding to the first control system is abnormal.

In addition, the network system log can be collected to check whether there is an abnormality through the system and the QoS value of the network equipment.

In addition, the physical protection system log can be collected to check whether there is any abnormality in the physical protection system such as door lock management system, fingerprint recognition system and CCTV.

At this time, the first security information collection device may collect security information from at least one security device through the sheriff's network separated from the control network of the first control system.

At this time, the main object of the cyber security control for the control system according to the embodiment of the present invention may be to detect and prevent a cyber attack on the control system while maintaining the availability of the control system. That is, the security control traffic that may occur as a result of performing the cyber security control on the control system is such that the control system does not affect the control traffic.

Therefore, in order to prevent a problem in the operation of the control system, it is possible to collect security information for performing a security control using a separate shrine shunt separate from the control network of the control system.

At this time, at least one security device may further include a separate LAN card to use the sheriff's network.

Also, in the security management method using the white list according to an embodiment of the present invention, the first security information collection device transmits the security information to the first unit security control device corresponding to the first control system (S420 ).

At this time, the first unit security control apparatus may correspond to a unit of the first control system actually operated. For example, it may correspond to the area where the security control is applied to the control system of the scale corresponding to the power supply branch of the power company from the scale corresponding to the first reactor in the nuclear power plant, or a unit smaller than that.

Accordingly, the unit security control device may be determined to correspond to the number of control systems, and one control system and one unit security control device may exist corresponding to the one-to-one correspondence.

In this case, the first unit security control apparatus includes a first security information collection apparatus installed in the first control system, a unit security management information analysis unit for performing a security control of the first control system in the first unit security management apparatus, Device.

In this case, although the term 'unit security control device' is used in the present invention, it can also be expressed as a unit sheriff's department, a unit security control system, or the like. In addition, the security information collection device and the unit security control information analysis device included in the control system may correspond to the components of the unit security control unit or the unit security control system.

At this time, the first security information collecting apparatus located in the first control system can transmit the security information to the first unit security controlling apparatus located outside the first control system on the basis of the physical unidirectional transmission.

In this case, unidirectional data transmission or unidirectional data transmission is one of the manganese data transmission techniques, which can correspond to a system that physically removes the RX communication and thereby originally blocks the penetration path from the outside. Therefore, by transmitting the security information through the physical uni-directional transmission, it is possible to intrude the penetration of the control system from the outside into the control network. It may also maintain the closed-network principle of the control system.

At this time, the first control system may include a separate unidirectional transmission device in order to perform physical unidirectional transmission.

In addition, in the security management method of the control system using the whitelist according to an embodiment of the present invention, the first unit security control device performs security control of the first control system by analyzing the security information (S430).

At this time, the first unit security control apparatus can generate the first white list corresponding to the first control system based on the security information.

At this time, the operation pattern of the first control system may be analyzed based on the security information, and the first white list may be generated according to the operation pattern. At this time, the operation pattern can be analyzed in the security information by using the characteristic that the control system generally operates in a predetermined pattern.

Therefore, it is possible to determine that the operation pattern extracted through the security information is the normal operation pattern of the first control system, and generate the first white list so as to correspond to the operation pattern.

For example, the first whitelist may include a switch interface number, a MAC address, and an IP address of a permitted device that is allowed to access the first control system.

In another example, the first whitelist includes a source MAC address, a source IP address, a source port number, a protocol type, a destination MAC address, a destination IP address, and a destination port for a permitted communication interval in which communication with the first control system is permitted Number, and so on.

As another example, the traffic log of the first control system may be analyzed to detect frequently occurring patterns of traffic, and the communication permission period corresponding to the detected traffic may be included in the first white list.

At this time, the first control system can be monitored based on the first white list.

At this time, when unauthorized information that violates the first white list is generated in the first control system, the first unit security control apparatus can perform processing corresponding to the unauthorized information.

For example, if the first whitelist or the traffic that violates a separate security policy occurs by monitoring the network traffic generated in the first control system, the traffic of the corresponding traffic is generated so that the manager of the first control system can process the traffic To the manager of the first control system. Alternatively, the first unit security control apparatus may directly transmit a control command to the first control system to block access of the corresponding traffic.

Another example is to monitor network data and control signals coming and going to and from an embedded control device included in the first control system and notify an administrator of the first control system as an alarm when an abnormal behavior occurs.

For example, the NAC log in the normal state or the system log (Management Information Base, MIB information) in the normal state may be generated as a first whitelist, and when an abnormal log that violates the first whitelist is generated, The system administrator can be notified by an alarm.

As another example, an administrator of the first control system can be notified of an illegal USB, that is, when the use of USB not registered in the first whitelist is detected.

As another example, when an abnormal behavior occurs in a door lock management system included in the first control system, a fingerprint recognition system, and a physical protection system such as a CCTV, the manager of the first control system can be informed by an alarm.

In addition, the security management method for a control system using a whitelist according to an embodiment of the present invention is a security management method of a control system using a white list, And performs security control of the first control system and the second control system based on the security information (S440).

At this time, the first control system and the second control system may be simply named to distinguish the control systems, regardless of the particular order. Therefore, the first unit security control device and the second unit security control device are also for distinguishing the unit security control device corresponding to the first control system and the unit security control device corresponding to the second control system, There is no difference between the two.

At this time, the divisional security control device may correspond to a device capable of controlling several unit security control devices. Accordingly, the sector security control device can acquire security information of various control systems from various unit security control devices, and can analyze the correlation between the various control systems by integrating the obtained security information.

At this time, the division security control unit may include a divisional security control information analysis unit that performs security control similar to the unit security control unit. In addition, a departmental security control device may include an information sharing section capable of providing information necessary for security control to various control systems and various unit security control devices.

In this case, the present invention uses the expression "department security control device", but it can also be expressed as a department sheriff's department, a divisional security control system, or the like.

Also, depending on the environment of the security control system, the unit security control unit may be replaced with the unit security control unit.

At this time, the communication pattern correlation between the first control system and the second control system can be analyzed based on the security information, and the inter-control white list corresponding to the communication pattern correlation can be generated.

At this time, at least one log of the firewall log, the L3 device log, the IDS log, and the IPS log may be extracted based on the security information, and the communication pattern correlation may be analyzed based on at least one log.

At this time, the first control system and the second control system can be monitored based on the inter-control white list.

At this time, when unauthorized communication information that violates the whitelist among control systems occurs during communication between the first control system and the second control system, the division security control device controls the first unit security control device and the second unit security control device Thereby performing processing corresponding to unauthorized communication information.

For example, a firewall log of a device communicating with the outside is detected in each control system based on security information, and is generated as a whitelist between control systems. When a device violating the firewall log is detected, an alarm is notified to the manager of the control system . In this case, the communication pattern log between the control systems can be expressed as: communication interval = {source MAC address, source IP address, source port number, protocol type, destination MAC address, destination IP address, destination port number}.

As another example, the fault management log, the configuration management log, the security management log, the performance management log, and the account management log can be generated as a white list between the control systems, and monitoring can be performed based on this. At this time, when a log that is in violation of the whitelist among the control systems occurs, it can be notified to the manager of the control system by an alarm.

In addition, the divisional security control device can identify anomalous signs among various unit security control devices, and can detect security threat information (domestic and foreign press releases, security vulnerability information, emergency security threat information, emergency security patch information, and the like) ) To each unit security control device. If there is an integrated security control device that controls the sector security control device, the security threat information can also be transmitted to the integrated security control device.

At this time, the first communication information from the first control system to the second control system and the second communication information from the second control system to the first control system can be obtained.

In this case, the consistency of the first communication information and the second communication information is analyzed, and if the inconsistency is lacked, the division security control device controls the first unit security control device and the second unit security control device, Communication between the first and second control systems can be blocked.

In addition, although not shown in FIG. 4, in the security control method of the control system using the whitelist according to the embodiment of the present invention, the integrated security control device may share the security control information with the sector security control device.

At this time, the integrated security control device can control the sector security control device and carry out the role of transmitting information. That is, the integrated security control unit controls the sector security control unit, and the sector security control unit controls the unit security control unit. Accordingly, the integrated security control device can collect security control information of the sector security control device and use it for security control of the control systems.

 At this time, the integrated security control device may be replaced with the integrated security control device depending on the environment.

In this case, the integrated security control device may be composed of an integrated security control information analysis part for collecting security related data of the sector security control device and an information sharing part for sharing information to the organization responsible for each control system. Therefore, the integrated security control device can share the security control information based on the information sharing part.

Although not shown in FIG. 4, in the security management method of the control system using the whitelist according to an embodiment of the present invention, the divisional security control device may include a first unit security control device and a second unit security control device, Information can be shared.

At this time, the security management information may correspond to at least one of security threat information, cyber accident processing information, detection rules, event information, and document information.

For example, the security threat information may correspond to at least one of domestic and foreign press releases, security vulnerability information, emergency threat information, and emergency security patch information. In addition, the cyber incident processing information may correspond to at least one of control system incident detection information, accident detection information at the operating agency, accident related log information, and accident case information. In addition, the detection rule may correspond to a new malicious code detection rule. In addition, the event information may correspond to at least one of security related event information and security related education information. The document information may also correspond to at least one of a guideline, shared policy information, and a key security policy.

At this time, it is possible to ensure the availability of the control system through the connection of the unit security control unit, the sector security control unit, and the integrated security control unit, and to enable the maintenance of the closed network policy of the control system.

5 is a diagram illustrating a process of detecting an unauthorized service connection to a security control system according to an exemplary embodiment of the present invention.

Referring to FIG. 5, when the unauthorized service is accessed by the control system (S502), the security information collection device installed in the control system may collect the log and transmit the collected log to the unit security control device (S504).

Thereafter, the unit security control device can detect and analyze an event of the unauthorized service generated in the control system based on the received log (S506).

At this time, the divisional security control device also acquires the log, receives the event analysis result of the unit security control device, and analyzes the device corresponding to the unauthorized service (S508).

Thereafter, the unit security control device detects abnormal communication (S510) and transmits a blocking command for the unauthorized service to the control system (S512).

Thereafter, the control system blocks the unauthorized service according to the blocking command (S514), and the unit security control device receives the result of the blocking command to confirm that the unauthorized service is blocked (S516). In this case, the unit security control device also transmits the blocking result to the sector security control device, thereby confirming that the unauthorized service access is blocked in the sector security control device (S518).

6 is a diagram illustrating a process of detecting connection of an unauthorized device to a security control system according to an embodiment of the present invention.

Referring to FIG. 6, when an unauthorized device is connected to the control system (S602), steps S606 to S614 until the unauthorized device connected to the control system is blocked and the corresponding result is transmitted is the same as that of the unauthorized service Can be similar to the case.

However, unlike the case of unauthorized service connection, since the connection of the unauthorized apparatus is strictly prohibited during operation of the control system, the information can be regarded as an accident situation as in step S616 and the corresponding information can be propagated to the sector security control apparatus.

At this time, the department security control device receives the situation (S618), dispatches the investigation team to the field (S620), analyzes the corresponding device (S622), and propagates the accident case (S624).

7 is a flowchart illustrating a process of detecting a failure of an internal control system using a security control system according to an embodiment of the present invention.

Referring to FIG. 7, when failure occurs in the internal device in the control system (S702), the security information collection device may collect the log and transmit it to the unit security control device (S704).

Thereafter, the unit security control device detects that the internal device of the control system has failed (S708) based on the event detection and analysis (S706), and controls to recover the failed internal device (S710).

Thereafter, when the control system transmits the restoration result to the unit security control unit and the restoration is confirmed (S712), the unit security control unit transmits the restoration result to the unit security control unit, and the restoration result is also confirmed in the unit security control unit (S714).

At this time, as in the connection example of the unauthorized apparatus shown in Fig. 6, the failure of the control system internal apparatus is regarded as an accident situation, and the accident situation and information can be propagated to the sector security control apparatus as in step S716.

After receiving the situation (S718), the SFCU sends an inspection team to the site (S720), analyzes the influence and ripple effect of the other device due to the failure of the relevant device (S722) (S724).

8 to 9 illustrate a process of applying a routing policy of a control system in a security control system according to an embodiment of the present invention.

Most control systems can use static routing for operational reasons. Therefore, the control system can operate the defined routing policy and operate based on the determined routing path according to the routing policy.

In this case, since the routing policy also corresponds to a kind of security policy, the routing policy of the control system operator may be included in the security control.

Referring to FIGS. 8 to 9, the routing policy change scenario in the unit security control apparatus and the routing policy change scenario in the sector security control apparatus can be confirmed.

First, FIG. 8 may correspond to a process for changing a routing policy when a router or an L3 network device is installed in the unit security control apparatus.

Referring to FIG. 8, when the routing policy is changed in the router installed in the unit security control device (S802), the unit security control device can perform verification of the changed routing table (S804).

Thereafter, when the unit security control apparatus transfers the update information of the routing table to the control system (S806), the control system may update the routing table (S808).

Thereafter, when the update of the routing table is completed, the control system transmits the update result to the unit security control unit to inform the completion of the update (S810), and the unit security control unit can notify the unit security control unit of the update result to the unit security control unit (S812).

Further, FIG. 9 may correspond to a procedure for changing a routing policy when a router or an L3 network device is installed in the sector security control apparatus.

Referring to FIG. 9, if the routing policy is changed in the router installed in the segment security control device (S902), the segment security control device may perform the verification of the changed routing table (S904).

Thereafter, the unit security control device receives the routing table update information from the department security control device and transmits the routing table update information to the control system (S906), and may update the routing table in the control system (S908).

Thereafter, when the update of the routing table is completed, the control system transmits the update result to the unit security control unit to inform the completion of the update (S910), and the unit security control unit can notify the unit security control unit of the update result to the unit security control unit (S912).

10 to 11 are views illustrating a process of applying a firewall policy of a control system in a security control system according to an embodiment of the present invention.

10 to 11, when a control system operator requests a change of a firewall policy, a firewall policy change in the unit security control unit and a firewall policy change scenario in accordance with a firewall policy change in the division security control unit can be confirmed .

10 may correspond to a process of changing a firewall policy when a firewall policy is applied to the unit security control apparatus.

Referring to FIG. 10, when a change in the firewall policy applied to the unit security control apparatus is determined (S1002), the unit security control apparatus can verify the changed firewall policy (S1004).

Thereafter, when the verification of the firewall policy is completed, the unit security control apparatus transfers the firewall policy update information to the control system (S1006), and updates the firewall policy of the control system (S1008).

Thereafter, when the update of the firewall policy is completed, the control system transmits the update result to the unit security control unit to notify that the update is completed (S1010), and the unit security control unit can notify the unit security control unit of the update result to the unit security control unit (S1012).

In addition, FIG. 11 may correspond to a process of performing a firewall policy change when a firewall policy is applied to the department security control apparatus.

Referring to FIG. 11, when the change of the firewall policy applied to the sector security control apparatus is determined (S1102), the sector security control apparatus can verify the changed firewall policy (S1104).

Thereafter, the verification of the firewall policy is completed, and the unit security control device receives the firewall policy update information from the department security control device and transfers the updated information to the control system (S1106), and the control system can update the firewall policy S1108).

Thereafter, when the update of the firewall policy is completed, the control system transmits the update result to the unit security control unit to inform the completion of the update (S1110), and the unit security control unit can notify the unit security control unit of the update result to the unit security control unit (S1112).

12 is a diagram illustrating a process of sharing collected information and security threat information in a security control system according to an embodiment of the present invention.

Referring to FIG. 12, the integrated security control device included in the security control system according to an embodiment of the present invention can confirm that the integrated security control device propagates to share the security threat information with the unit security control device and the unit security control device.

In the process of propagating the security threat information, the integrated security control device may first share the security threat information with the sector security control device (S1202).

Thereafter, the division security control apparatus stores the shared security threat information in the information sharing unit (S1204), and may transmit the corresponding information to the unit security control apparatus (S1206).

At this time, the sector security control device can transmit the security threat information to the unit security control device while propagating the security threat information to the system corresponding to the sector security control device (S 1212).

Thereafter, the unit security control apparatus also stores the received security threat information in the information sharing unit (S1208), and can transmit the security threat information to the related system (S12010).

At this time, the integrated security control device may analyze the information collected from the divisional sheriff's department through the information sharing department and propagate it together with the security threat information.

Through such information sharing, each control device can quickly incorporate the collected information analysis result and security threat information into the control system control.

13 is a diagram illustrating a process of detecting an abnormal symptom between internal networks of a control system using a security control system according to an embodiment of the present invention.

Referring to FIG. 13, the security control system according to an embodiment of the present invention can control not only a single control system internal network but also security control situations that can occur among various control system internal networks.

For example, as shown in FIG. 13, it is possible to detect anomalies that are outside the rules that may occur between control system internal networks.

13 illustrates a series of processes for detecting and responding to anomalous indications between the A control system and the B control system internal network.

Referring to FIG. 13, the A control system and the B control system can perform communication with each other (S1302, S1306).

At this time, the communication information may be detected by each unit security control device and transmitted to the sector security control device (S1304, S1308).

At this time, the division security control apparatus collects the communication information of A and B (S1310), and can perform the consistency analysis (S1312).

Thereafter, the SFP can detect anomalies through the lack of consistency and can propagate this to each unit (S1314).

Thereafter, each unit security control device checks the site through analysis of the corresponding communication information (S1316, S1322), and may remove or block the device causing the abnormal symptom (S1318, 1324).

Thereafter, when the result of removing or blocking the device from each control system is transmitted to each unit security control device (S1320, S1326), each unit security control device can forward the result to the sector security control device (S1328).

14 is a diagram illustrating a process of applying a firewall policy of a control system based on an authorization service in a security control system according to an embodiment of the present invention.

Referring to FIG. 14, the security control system according to an embodiment of the present invention can detect the start or the end of an authorized service and apply the firewall policy to each control system.

FIG. 14 illustrates a process of applying the firewall policy of the A control system and the B control system according to the start or end of the S service in the internal network of the A control system.

Referring to FIG. 14, when the S service is started or terminated in the A control system (S1402), it can be detected in the A unit security control device (S1404) and the firewall policy change can be performed (S1406 to S1416).

At this time, the process corresponding to steps S1406 to S1416 is the same as the process of changing the firewall policy shown in Figs. 10 to 11, so that a description thereof will be omitted.

At this time, the departmental security control device can acquire the detected information from the A unit security control device and analyze the used device related to the S service (S1418).

Thereafter, the division security control device notifies the start / end information of the S service to the B unit security control device (S1420), detects the B unit security control device (S1422), and can perform the firewall policy change (S1424 ~ S1432).

As described above, the security management method and system for the control system using the white list according to the present invention are not limited to the configuration and method of the embodiments described above, All or some of the embodiments may be selectively combined.

110-1 to 110-N, 210, 220 and 300: a control system
111-1 to 111-N, 211, and 330: security information collecting device
120-1 to 120-N: Unit security control devices 130-1 to 130-M: Sector security control devices
140: Integrated security control device 212: One-way transmission device
230: unit security control system 310: control network
320: Sheriff's plea

Claims (20)

The first security information collection device collecting security information based on at least one security device included in the first control system;
The first security information collecting device transmitting the security information to a first unit security control device corresponding to the first control system;
The first unit security control apparatus analyzing the security information to perform a security control of the first control system; And
The divisional security control device acquires the security information from the second unit security control device corresponding to the second control system and the first unit security control device respectively and transmits the security information to the first control system and the second Performing security control of the control system
Lt; / RTI >
Wherein performing the security controls of the first control system and the second control system comprises:
Generating a white list between control systems by analyzing a communication pattern correlation between the first control system and the second control system based on the security information, Performing a security control between the second control systems; And
Analyzing the consistency of the first communication information from the first control system to the second control system and the second communication information from the second control system to the first control system, Blocking communication between the control system and the second control system,
The transmitting step
Wherein the first security information collection device is located in the first control system and the first unit security control device is located in the first control system, Is located outside of the control system. The method according to claim 1,
The collecting step
Wherein the first security information collecting device collects the security information from the at least one security device through a sheriff's network separate from the control network of the first control system. delete The method according to claim 1,
The step of performing the security control of the first control system
Generating a first whitelist corresponding to the first control system based on the security information;
Monitoring the first control system based on the first whitelist; And
And if the unauthorized information violating the first white list occurs in the first control system, performing the processing corresponding to the unauthorized information by the first unit security control device Control method. The method of claim 4,
The step of generating the first whitelist
Analyzing an operation pattern of the first control system based on the security information, and generating the first white list according to the operation pattern. The method according to claim 1,
The security information
Wherein the at least one security device is configured to monitor at least one of a network traffic log, a firewall log, an embedded control device traffic log, a NAC (Network Access Control) log, a USB access log, And a physical protection system log. ≪ RTI ID = 0.0 > 31. < / RTI > The method according to claim 1,
Wherein performing the security controls of the first control system and the second control system comprises:
Monitoring the first control system and the second control system based on the inter-control white list; And
Wherein, when unauthorized communication information that violates the control system whitelist during communication between the first control system and the second control system occurs, the sectoral security control device transmits, to the first unit security control device and the second unit security control device Further comprising the step of controlling the device to perform a process corresponding to the unlicensed communication information. The method of claim 7,
The step of generating the inter-control-system white list
Extracting at least one log of a firewall log, an L3 device log, an IDS log, and an IPS log based on the security information, and analyzing the communication pattern correlation based on the at least one log; Security control method. The method according to claim 1,
The security management method
The integrated security control device sharing security control information with the sector security control device; And
Further comprising the step of sharing the security management information with the first unit security control device and the second unit security control device. The method of claim 9,
The security management information
The security threat information, the cyber incident handling information, the detection rule, the event information, and the document information. delete A security information collection device installed inside the control system and collecting security information based on at least one security device included in the control system;
A unit security control unit for analyzing the security information and performing a security control of the control system; And
A security management system for managing security of the control system and the other control systems based on security information,
Lt; / RTI >
The departmental security control device
Generating a white list between control systems by analyzing a communication pattern correlation between the control system and the other control system on the basis of the security information, Analyzing the consistency of the first communication information from the control system to the other control system and the second communication information from the other control system to the control system, and when the inconsistency is absent, And the other control system,
The security information collection device
Wherein the security information collection device is located inside the control system and the unit security control device is located outside the control system in order to maintain the closed network policy. Security control system. The method of claim 12,
The security information collection device
And collects the security information from the at least one security device through a sheriff's network separate from the control network of the control system. delete The method of claim 12,
The unit security control device
Monitoring the control system based on the white list generated according to the control system based on the security information, and when the unauthorized information violating the white list occurs in the control system, processing corresponding to the unauthorized information is performed The security management system comprising: 16. The method of claim 15,
The unit security control device
Analyzes the operation pattern of the control system based on the security information, and generates the white list according to the operation pattern. The method of claim 12,
The security information
Wherein the at least one security device is configured to monitor at least one of a network traffic log, a firewall log, an embedded control device traffic log, a NAC (Network Access Control) log, a USB access log, And at least one of a physical protection system log and a physical protection system log. The method of claim 12,
The security control system
Further comprising an integrated security control device sharing security management information with the departmental security control device. 19. The method of claim 18,
The departmental security control device
And the security management information is shared with the unit security control device. 19. The method of claim 18,
The security management information
Security threat information, cyber incident handling information, detection rules, event information, and document information.

Images