KR20250063100A - Power grid access security system and method for intermittent communication ports - Google Patents

Abstract

The power grid access security system of an intermittent communication port according to the present invention comprises a connection management unit for managing and monitoring the connection of the communication port, a power supply unit for supplying power required for the functional operation of the communication port, and a composite interface unit for integrating and providing an interface for network connection and security services, wherein the connection management unit confirms whether a network connection is established for an external device based on connection setting information, and if the conditions for the network connection are not satisfied based on the connection setting information, data received from the external device is discarded.

Description

{POWER GRID ACCESS SECURITY SYSTEM AND METHOD FOR INTERMITTENT COMMUNICATION PORTS}

The present invention relates to a power grid access security system and method for an intermittent communication port.

Figure 1 is a diagram for explaining a conventional industrial network (open network, 100: 110, 120) where IT and OT are mixed.

In an open network (100), security reinforcement for the open part of the network is required, and for this purpose, a firewall device has been introduced at the connection between the Internet and the private network. This firewall is designed to effectively counter negative external access and malicious code attacks based on known methods from the outside through various security policies. Maintenance of the firewall device is required to maintain these security measures.

Figure 2 is a drawing to explain an example of a cyber threat to a power field network (200).

An industrial network (200) with a closed network configuration such as that of Fig. 2 has a closed characteristic with limited connection to the outside. However, even in such a closed network, connection of an engineering PC or connection of a storage device may be required for industrial equipment management such as maintenance and upgrade of devices.

Such physical access can lead to cyber threats, especially malware and viruses that can be infected through access to engineering PCs or storage devices.

Figure 3 is a drawing for explaining the connection structure of a conventional network relay device (310).

Figure 3 shows a typical chip unit structure of a conventional network relay device (310). This configuration enables physical connection if the MDI (Medial Dependent Interface) standard is the same for connected IT and OT devices (320), and in the case of a network protocol allowed by the network relay device (310), network connection of connected IT and OT devices (320) is enabled.

However, in this case, there is a risk of exposure to cyber threats such as malicious communication failure or malware distribution through third-party network access through vulnerabilities in accessible network protocols.

Patent Registration No. 10-1662118 (October 5, 2016)

The problem to be solved by the present invention is to provide a power grid access security system and method for an intermittent communication port capable of responding to physical and logical threats that may occur in a situation where OT (Operation Technology) and IT (Information Technology) protocols are simultaneously managed in a public network or an open network as the introduction of IoT (Internet of Things) devices in various industrial fields increases.

However, the problems to be solved by the present invention are not limited to the problems described above, and other problems may exist.

According to the first aspect of the present invention for solving the above-described problem, a power grid access security system of an intermittent communication port includes a connection management unit for managing and monitoring the connection of the communication port, a power supply unit for supplying power required for the functional operation of the communication port, and a composite interface unit for integrating and providing an interface for network connection and security services. At this time, the connection management unit checks whether or not a network is connected to an external device based on connection setting information, and if the conditions for the network connection are not satisfied based on the connection setting information, data received from the external device is discarded.

In some embodiments of the present invention, the composite interface unit obtains information of the external device including at least one of identification information, access permission time, connection method, use of encryption, and encryption key for the external device, and the connection management unit can change the connection setting information based on the information of the external device.

In some embodiments of the present invention, the connection management unit may allow the network connection of the external device if the connection setting information is satisfied, and may report the event to the management device if an event including at least one of a detection event of an unauthorized communication protocol for the network-connected external device, a connection release event, and a connection timeout event is detected.

Some embodiments of the present invention may further include an encryption unit that performs predetermined packet encryption and decryption on data transmitted and received with the network-connected external device.

In some embodiments of the present invention, the power grid access security system may be implemented in the form of a module inserted into a communication port of a network relay device.

In some embodiments of the present invention, the power grid access security system may be implemented as a PCB unit of a network relay equipment, or may be implemented to be embedded in a network relay chipset in the form of an SoC or SoP.

In addition, a power grid access security method of an intermittent communication port according to a second aspect of the present invention includes a step of maintaining a network connection blocking state when power is supplied; a step of operating in an interface standby state when configuration of connection setting information for the network connection is completed; a step of determining whether to allow a network connection based on the connection setting information when detecting a network connection attempt to an external device; and a step of destroying data received from the external device if the connection setting information is not satisfied.

In some embodiments of the present invention, the step of operating in an interface standby state upon completion of configuring connection setup information for the network connection may include the step of acquiring information of the external device including at least one of identification information of the external device, an access permission time, a connection method, whether to use encryption, and an encryption key; and the step of changing the connection setup information based on the information of the external device.

Some embodiments of the present invention may further include a step of allowing a network connection of the external device if the connection setting information is satisfied; and a step of reporting an event including at least one of a detection event of an unauthorized communication protocol for the network-connected external device, a connection release event, and a connection timeout event to a management device.

Some embodiments of the present invention may further include a step of performing predetermined packet encryption and decryption on data transmitted and received with the network-connected external device.

According to another aspect of the present invention for solving the above-described problem, a computer program is coupled with a computer as hardware to execute a method for securing power grid access of an intermittent communication port, and is stored in a computer-readable recording medium.

Other specific details of the present invention are included in the detailed description and drawings.

One embodiment of the present invention can provide improved safety and security in response to various cybersecurity issues that may occur in conventional industrial networks. Industrial networks commonly use well-known network protocols, which allows malicious third parties to attempt unauthorized network connections in various ways. This can cause malfunctions and communication errors in OT devices and terminals, and is recognized internationally as a cybersecurity issue.

One embodiment of the present invention can effectively address these problems by limiting network connections and enhancing security. First, network connections can be effectively limited by controlling the identification of the connected device, the time of the communication port, the communication speed, etc., thereby preventing unauthorized network connections in advance and enhancing the security of the system.

In addition, one embodiment of the present invention can provide a function for physically disconnecting a connected communication port. This can improve the level of security by blocking malicious access by a third party in a physical dimension. In addition, by preventing unauthorized physical network access, the integrity of the system can be protected and an environment can be maintained that is safe from potential threats.

In addition, one embodiment of the present invention can restrict connection time and protocols for devices or terminals that are allowed to connect, depending on the reason for network access. This can secure security and safety by preventing unnecessary connections while granting appropriate authority to authorized users.

The effects of the present invention are not limited to the effects mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art from the description below.

Figure 1 is a diagram explaining an industrial network (open network) where conventional IT and OT are mixed.
Figure 2 is a diagram illustrating an example of a cyber threat to a power sector network.
Figure 3 is a drawing for explaining the connection structure of a conventional network relay equipment.
FIG. 4 is a block diagram of a power grid access security system according to one embodiment of the present invention.
FIG. 5a and FIG. 5b are drawings for explaining an implementation example of a power grid access security system according to one embodiment of the present invention.
Figure 6 is a drawing for explaining an embodiment implemented with a modular structure of communication port units.
Figure 7 is a drawing for explaining an embodiment in which encryption modules are used simultaneously.
Figure 8 is a flowchart of a power grid access security method according to one embodiment of the present invention.

The advantages and features of the present invention, and the methods for achieving them, will become clear with reference to the embodiments described in detail below together with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but may be implemented in various different forms, and the present embodiments are provided only to make the disclosure of the present invention complete and to fully inform a person skilled in the art of the scope of the present invention, and the present invention is defined only by the scope of the claims.

The terminology used herein is for the purpose of describing embodiments only and is not intended to limit the present invention. In this specification, the singular also includes the plural unless specifically stated otherwise in the phrase. The terms "comprises" and/or "comprising" as used in the specification do not exclude the presence or addition of one or more other components in addition to the mentioned components. Like reference numerals refer to like components throughout the specification, and "and/or" includes each and every combination of one or more of the mentioned components. Although "first", "second", etc. are used to describe various components, it is to be understood that these components are not limited by these terms. These terms are merely used to distinguish one component from another. Therefore, it should be understood that a first component mentioned below may also be a second component within the technical spirit of the present invention.

Unless otherwise defined, all terms (including technical and scientific terms) used in this specification may be used with the meaning commonly understood by those skilled in the art to which the present invention belongs. In addition, terms defined in commonly used dictionaries shall not be ideally or excessively interpreted unless explicitly specifically defined.

The present invention relates to a power grid access security system and method for an intermittent communication port.

One embodiment of the present invention is to enhance access security and management functions for communication ports (terminals) in an open network environment utilized in the industrial field, and in particular, to enhance network security by granting strict connection restrictions and effective management functions to network communication ports used intermittently for maintenance of each device.

That is, one embodiment of the present invention strictly restricts access to a communication port that is used intermittently. This means preventing unauthorized access from the outside, minimizing potential security threats through the communication port, and strengthening security procedures for access for maintenance work on each connected device.

In addition, one embodiment of the present invention provides detailed control and monitoring of intermittently used communication ports. This enables the transparency and stability of the network to be maintained by thoroughly managing the identification information, access rights, connection method, encryption settings, etc. of the devices connected through the communication ports.

In this way, one embodiment of the present invention enhances the security of communication ports that are intermittently used in an open network environment and provides effective access and management functions for safely performing maintenance work, thereby improving network security in the industrial field.

Hereinafter, a power grid access security system (hereinafter referred to as the power grid access security system) of an intermittent communication port according to one embodiment of the present invention will be described with reference to FIGS. 4 to 7.

FIG. 4 is a block diagram of a power grid access security system (400) according to one embodiment of the present invention.

A power grid access security system (400) according to one embodiment of the present invention includes a connection management unit (410), a power supply unit (420), a composite interface unit (430), and an encryption unit (440).

The Link Manager (410) manages and monitors the connection of the communication port. That is, it can be responsible for establishing, maintaining, and releasing a connection to the communication port.

The power supply unit (PWR, 420) provides power and supplies the power required for the functional operation of the communication port.

The Multi Interface (MI; 430) provides an integrated interface for network connection and security services.

In one embodiment, the composite interface unit (430) can obtain information of an external device including at least one of identification information for the external device, access permission time, connection method, whether encryption is used, and an encryption key.

Accordingly, the connection management unit (410) can change the connection setting information based on information of an external device allowed to be connected from a security service management server or an edge computing device.

In addition, the connection management unit (410) checks whether there is a network connection to an external device based on the connection setting information. And, if the conditions for network connection are not satisfied based on the connection setting information, all data, packets, etc. received from the external device are discarded.

In contrast, the connection management unit (410) may allow the network connection of the external device if the connection setting information is satisfied. Then, the connection management unit (410) may report an event to the management device (security service management server or edge device) when detecting an event including at least one of an unauthorized communication protocol detection event, a connection release event, and a connection timeout event for the external device connected to the network. In addition, when detecting an access or connection event of an external device that does not satisfy the connection setting information, the corresponding event may be reported to the management device.

In one embodiment, the encryption unit (440) may perform predetermined packet encryption and decryption on data transmitted and received with a network-connected external device. That is, the encryption unit (440) performs packet encryption and decryption determined by the security service in order to limit arbitrary connections by a third party. The encryption unit (440) may be applied by implementing a public encryption algorithm based on a block cipher or a specially designed encryption algorithm.

FIG. 5a and FIG. 5b are drawings for explaining an implementation example of a power grid access security system (510, 520) according to one embodiment of the present invention.

In one embodiment, the power grid access security system (510) according to the present invention can be implemented in the form of a module inserted into a communication port of a network relay equipment as shown in FIG. 5a. That is, since it is implemented in the form of a module inserted into a communication port of a conventional network relay equipment as shown in FIG. 5a, it has the advantage of providing modularization and expanded flexibility of the communication equipment. This has the advantage of being particularly easy to integrate and connect to conventional equipment, making it easy to upgrade or improve existing network infrastructure. In addition, when power is supplied to a specific communication port, it can be replaced with a function block that can utilize the power, thereby increasing efficiency in terms of power management.

In another embodiment, the power grid access security system (520) according to the present invention may be implemented as a PCB unit of a network relay device as shown in FIG. 5b, or may be implemented to be embedded in a network relay chipset in the form of a SoC (System on a Chip) or SoP (System on a Package). Through this structure, one embodiment of the present invention can maximize performance and efficiency by increasing the degree of integration.

Figure 6 is a drawing for explaining an embodiment implemented with a modular structure (600) of communication port units.

As shown in Fig. 6, a security module type (600) that implements one embodiment of the present invention in a modular structure (600) of communication ports can provide stronger security. This module can enhance security by applying a structure that is firmly fixed to the communication port, that is, a Safety Lock Object.

The Safety Lock Object safely fixes the module (600) to the communication port, so that if there is an attempt to forcibly remove the security module (600), any device or terminal connected to the communication port of the network relay equipment (610) will damage it. Accordingly, if there is an attempt to forcibly remove the security module (600), unauthorized third-party network connections can be blocked, and the integrity of the system can be protected.

Figure 7 is a drawing for explaining an embodiment in which encryption modules (720) are used simultaneously.

As shown in Fig. 7, if a security module (710) and an encryption module (720) are used simultaneously, constant encryption operation can be applied to the communication port of the network relay device (710). This can enable stricter connection management by making network connection and access through a conventional communication connection device impossible. This encryption module (720) protects sensitive information by safely encrypting and decrypting data, and further enhances the integrity and security of the network.

Figure 8 is a flowchart of a power grid access security method according to one embodiment of the present invention.

First, when power is applied (S101), the network connection is maintained in a disconnected state (S102).

Next, as the configuration of connection setup information for network connection is completed (S103), the interface is operated in a standby state (S104). At this time, one embodiment of the present invention obtains information of the external device including at least one of identification information for the external device, access permission time, connection method, use of encryption, and encryption key, and can change the connection setup information based on the information of the external device.

Next, when a network connection attempt to an external device is detected (S105), a communication connection standby state is maintained (S106), and whether to allow the network connection is determined based on the connection setting information (S107).

If the judgment result does not satisfy the connection setup information, the data received from the external device can be discarded and the event can be reported to the management device (S108).

In contrast, if the judgment result satisfies the connection setup information, the network connection of the external device is permitted (S109).

Next, when an event including at least one of a detection event of an unauthorized communication protocol for a network-connected external device (S110), a disconnection event (S111), and a connection timeout event (S112) is detected, the event is reported to the management device (S108).

Meanwhile, in the above description, steps S101 to S112 may be further divided into additional steps or combined into fewer steps, depending on the implementation of the present invention. In addition, some steps may be omitted as needed, and the order between the steps may be changed. In addition, the contents of FIGS. 4 to 7 and the contents of FIG. 8 may be mutually applied.

The above-described embodiment of the present invention can be implemented as a program (or application) to be executed in combination with a computer, which is hardware, and stored in a medium.

The above-described program may include codes coded in a computer language, such as C, C++, JAVA, Ruby, or machine language, that can be read by the processor (CPU) of the computer through the device interface of the computer, so that the computer reads the program and executes the methods implemented as a program. Such codes may include functional codes related to functions that define functions necessary for executing the methods, and may include control codes related to execution procedures necessary for the processor of the computer to execute the functions according to a predetermined procedure. In addition, such codes may further include memory reference-related codes regarding which location (address address) of the internal or external memory of the computer should be referenced for additional information or media necessary for the processor of the computer to execute the functions. In addition, if the processor of the computer needs to communicate with another computer or server located remotely in order to execute the functions, the code may further include communication-related code regarding how to communicate with another computer or server located remotely using the communication module of the computer, what information or media to send and receive during communication, etc.

The above storage medium means a medium that stores data semi-permanently and can be read by a device, rather than a medium that stores data for a short period of time, such as a register, cache, or memory. Specifically, examples of the storage medium include, but are not limited to, ROM, RAM, CD-ROM, magnetic tape, floppy disk, or optical data storage device. That is, the program can be stored in various storage media on various servers that the computer can access or in various storage media on the user's computer. In addition, the medium can be distributed to computer systems connected to a network, so that a computer-readable code can be stored in a distributed manner.

The above description of the present invention is for illustrative purposes, and those skilled in the art will understand that the present invention can be easily modified into other specific forms without changing the technical idea or essential characteristics of the present invention. Therefore, it should be understood that the embodiments described above are exemplary in all respects and not restrictive. For example, each component described as a single component may be implemented in a distributed manner, and likewise, components described as distributed may be implemented in a combined form.

The scope of the present invention is indicated by the claims described below rather than the detailed description above, and all changes or modifications derived from the meaning and scope of the claims and their equivalent concepts should be interpreted as being included in the scope of the present invention.

400: Power Grid Access Security System
410: Connection Management
420: Power supply
430: Composite interface section
440: Encryption Unit

Claims (10)

A connection management unit that manages and monitors the connection of communication ports,
A power supply unit that supplies the power required for the functional operation of the above communication port,
Including a composite interface section that provides an integrated interface for network connection and security services,
The above connection management unit determines whether a network connection is made to an external device based on the connection setting information, and if the conditions for the network connection are not satisfied based on the connection setting information, the data received from the external device is discarded.
Power grid access security system for intermittent communication ports.
In the first paragraph,
The above composite interface unit obtains information of the external device including at least one of identification information, access permission time, connection method, use of encryption, and encryption key for the external device,
The above connection management unit changes the connection setting information based on the information of the external device.
Power grid access security system for intermittent communication ports.
In the second paragraph,
The above connection management unit allows the network connection of the external device when the connection setting information is satisfied, and reports the event to the management device when detecting an event including at least one of a detection event of an unauthorized communication protocol for the network-connected external device, a connection release event, and a connection timeout event.
Power grid access security system for intermittent communication ports.
In the third paragraph,
Further comprising an encryption unit that performs packet encryption and decryption for data transmitted and received with the external device connected to the network.
Power grid access security system for intermittent communication ports.
In the first paragraph,
The above power grid access security system is implemented in the form of a module inserted into the communication port of a network relay equipment.
Power grid access security system for intermittent communication ports.
In the first paragraph,
The above power grid access security system is implemented as a PCB unit of a network relay equipment or is implemented to be embedded in the form of SoC or SoP within a network relay chipset.
Power grid access security system for intermittent communication ports.
In a method performed by a power grid access security system of an intermittent communication port,
Step of maintaining a network connection disconnected state when power is applied;
A step of operating in an interface standby state upon completion of configuration of connection setup information for the above network connection;
Upon detecting a network connection attempt to an external device, a step of determining whether to allow the network connection based on the connection setting information; and
Comprising a step of destroying data received from the external device if the above connection setting information is not satisfied.
A method for securing power grid access for intermittent communication ports.
In paragraph 5,
The step of operating in the interface standby state as the configuration of the connection setup information for the above network connection is completed is as follows:
A step of acquiring information of an external device including at least one of identification information, access permission time, connection method, use of encryption, and encryption key for the external device; and
Comprising a step of changing the connection setting information based on information of the external device,
A method for securing power grid access for intermittent communication ports.
In Article 6,
A step for allowing network connection of the external device if the above connection setting information is satisfied; and
Further comprising a step of reporting the event to a management device upon detection of an event including at least one of a detection event of an unauthorized communication protocol for the network-connected external device, a disconnection event, and a connection timeout event.
A method for securing power grid access for intermittent communication ports.
In Article 9,
Further comprising a step of performing a predetermined packet encryption and decryption on data transmitted and received with the external device connected to the network.
A method for securing power grid access for intermittent communication ports.

Images