안전한 SCADA 통신을 위한 트리 기반의 효율적인 키 관리 구조
Advanced Key Management Architecture Based on Tree Structure for Secure SCADA Communications
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
SCADA(Supervisory Control and Data Acquisition) 시스템은 국가 기반시설에서 주로 사용되는 제어 시스템이다. 과거 SCADA 시스템은 폐쇄 망에서 운영되어진다는 이유로 보안에 대한 고려 없이 설계되었다. 하지만 기술의 발달로 SCADA 시스템과 공용망과의 연계가 추진되면서 보안에 대한 문제점이 대두 되고 있다. 본 논문에서는 SCADA 시스템의 제약사항과 보안요구사항을 살펴보고, 안전한 SCADA 시스템을 위한 키 관리 구조를 제안한다. 기존에 제안되어있는 SCADA 시스템을 위한 키 관리 방식이 메시지 브로드캐스팅을 지원하지 못하는 반면, 제안하는 방식은 메시지 브로드캐스팅을 지원한다. 또한 제안하는 방식은 성능상의 제약을 가지고 있는 RTU의 계산량을 최소화하기 위해, 상위 노드(SUB-MTU 또는 MTU)에 계산량을 분배하여 RTU의 잠재적인 성능 병목을 해결하였다.
Abstract
The SCADA(Supervisory Control And Data Acquisition) system is a control system for infrastructure of nation. In the past, the SCADA system was designed without security function because of its closed operating environment. However, the security of the SCADA system has become an issue with connection to the open network caused by improved technology. In this paper we review the constraints and security requirements for SCADA system and propose advanced key management architecture for secure SCADA communications. The contributions of the present work are that our scheme support both message broadcasting and secure communications, while the existing key management schemes for SCADA system don't support message broadcasting. Moreover, by evenly spreading much of the total amount of computation across high power nodes (MTU or SUB-MTU), our protocol avoids any potential performance bottleneck of the system while keeping the burden on low power (RTU) nodes at minimal.
참고문헌 (21)
- 김인중, "중요핵심기반시설(SCADA)에 대한 보안 관리 연구", 한국통신학회논문지C, 30(8), pp.838~848 (2005), 한국통신학회
- A DNP3 protocol primer, Technical report, "Curts, K", DNP User Group, ~ (2005)
- "Critical Infrastructure Protection : Challenge and Efforts to Secure Control Systems"[URL]
- S. Mittra, "Iolus: A Framework for Scalable Secure Multicasting", Proc. ACM SIGCOMM'97, pp.277~288 (1997)
- "Key Management for SCADA"[URL]
- Robert Dawson, "SKMA - A Key Management Architecture for SCADA Systems", Proc. Fourth Australasian Information Security Workshop, 통권 : 54, pp.138~192 (2006)
- Marcel Waldvogel, "The VersaKey Framework: Versatile Group Key Management", IEEE JSAC, 17(9) (1999)
- "IEEE standard definition, specification, and analysis of systems used for supervisory control, data acquisition, and automatic control"[URL]
- "Cryptographic protection of SCADA communications Part 1: Background, Policies and Test Plan, Technical Report 12-1 Draft 5 revision 3, American Gas Assocation"[URL]
- "Information Technology - Security Techniques - Key Management - Part 2: Mechani는 Using Symmetric Techniques ISO", IEC 11770-2 International Standard, 1996, 규격
- Vinay M. Igure, "Security issues in SCADA networks", Computers & Security, 25, pp.498~506 (2006)
- Roberto Di Pietro, "Efficient and Secure Keys Management for Wireless Mobile Communications", Proceedings of the second ACM international workshop on Principles of mobile computing, pp.66~73 (2002)
- Instrumentation systems and Automation Society, "Security Technologies for Industrial Automation and Control Systems, ANSI", ISA-TR99.00.01-2007, 2007, 규격
- Instrumentation systems and Automation Society, "Integrating Electronic Security into the manufacturing and Control Systems Environment, ANSI", ISA-TR99.00.02-2004, 2004
- National Institute of Standards and Technology, "System Protection Profile - Industrial Control Systems v1.0" (2004)
- American Petroleum Institute, "API 1164: Pipeline SCADA Security", ~ (2004)
- Cryptographic Protection of SCADA Communications; Part2: Retrofit Link Encryption for Asynchronous Serial Communications, "American Gas Association", ~, pp.AGA Report No. 12 (Part 2) (2005)
- Information Technology Laboratory, National Institute of Standards and Technology, "Security Requirements for Cryptographic Modules", pp.140~141 (1994), FIPS PUB
- K. Stouffer, "Supervisory Control and Initial Public Draft, National Institute of Standards and Technology", ~, pp.규격
- Chung Kei Wong, "Secure Group Communications Using Key Graphs", Proceedings of the ACM SIGCOMM '98 Conference on Applications, Technologies, Architectures, and Protocols for Computer Communication, pp.68~79 (1998)