산업용 무선통신기기 사이버 보안위협 및 보안요구사항에 관한 연구
A Study on Cyber Security Threat and Security Requirements for Industrial Wireless Communication Devices
0
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
산업제어시스템(ICS)은 분산된 다양한 자산을 측정, 감시, 제어하는 시스템으로 에너지, 화학, 교통, 수처리, 제조 공장 등의 산업 시설 및 국가기반시설에서 사용된다. 산업제어시스템의 특성상 보안위협에 노출되면 오동작, 중단 등으로 인해 막대한 인명, 자산 피해 등이 발생할 수 있어 산업제어시스템의 보안위협을 예방하고 최소화하기 위한 연구가 필요하다. 기존의 산업제어시스템의 경우 보안위협을 고려하여 무선통신기기의 사용을 제한하였으나 최근에는 유지보수의 용이성 및 비용의 장점으로 인해 산업용 무선통신기기 도입이 점차 증가하고 있다. 이에 본 논문에서는 WirelessHART와 ISA100.11a를 지원하는 산업용 무선통신기기의 보안위협을 분석하고, 분석 결과를 기반으로 산업용 무선통신기기의 도입 및 운영에 필요한 보안요구사항을 제시하였다. 본 연구에서 제시한 보안요구사항을 활용하여 국가기반시설을 포함한 다양한 산업분야의 산업용 무선통신환경 구축 시 보안위협을 완화할 수 있을 것으로 기대한다. ABSTRACT
Abstract
Industrial Control System(ICS) is a system that measures, monitors, and controls various distributed assets, and is used inindustrial facilities such as energy, chemical, transportation, water treatment, and manufacturing plants or critial infrastructure. Because ICS system errors and interruptions can cause serious problem and asset damage, research on prevention andminimization of security threats in industrial control systems has been carried out. Previously wireless communication wasapplied in limited fields to minimize security risks, but the demand for industrial wireless communication devices isincreasing due to ease of maintenance and cost advantages. In this paper, we analyzed the security threats of industrialwireless communication devices supporting WirelessHART and ISA100.11a. Based on the analysis results, we proposed thesecurity requirements for adopting and operating industrial wireless communication devices. We expect that the proposedrequirements can mitigate security threats of industrial wireless devices in ICS.
참고문헌 (28)
- 박경미, "산업용 제어기기의 통신 견고성 시험 방안 연구", 정보보호학회논문지, 29(5), pp.1099~1116 (2019), 한국정보보호학회[DOI]
- "Industrial communication networks – Network and system security – Part 1-1: Terminology, concepts and models", IEC 62443-1-1:2009, ~ (2009)
- Sunghyuck Hong, "Research on Wireless Sensor Networks Security Attack and Countermeasures:Survey", Journal of Convergence for Information Technology, 4(4), pp.1~6 (2014)
- Industrial Wireless Sensor Network(IWSN) Market Analysis and Segment Forecasts To 2025, , Grand View Research, Inc, ~ (2017)
- Cristina Alcaraz, "A Security Analysis for Wireless Sensor Mesh Networks in Highly Critical Systems", IEEE Transactions on Systems, Man, and Cybernetics, Part C, 40, pp.419~428 (2010)
- A Security Framework for Routing over Low Power and Lossy Networks, "T. Tsao", Internet Engineering Task Force(IETF), ~ (2009)
- Erwin Paternotte, "It WISN’t me, attacking industrial wireless mesh networks", HITBSecConference (2018)
- Lyes Bayou, "Security Analysis of WirelessHART Communication Scheme", Conference of International Symposium on Foundations and Practice of Security (2017)
- Feng Xie, "Evaluating Industrial Control Devices Security:Standards, Technologies and Challenges", LNCS, 8838, pp.624~635 (2015)
- "TUV SUD"[URL]
- "exida for IEC 62443 Cyber Certification" (2019)[URL]
- "Certification CSPN"[URL]
- Security Requirements for Industrial Control System – Part 2: Field Device Layer, , Telecommunications Technology Association(TTA), ~ (2017)
- Security for industrial automation and control system –Part 4-2:Technical security requirements for IACS components, , Korean Standards and Certification, ~ (2019)
- Security Requirements for Industrial Control System – Part. 1: Concepts and Reference Model, , Telecommunications Technology Association(TTA), ~ (2017)
- Mark Nixon, "A Comparison of WirelessHART and ISA100.11a" (2012), Emerson
- Stig Petersen, "WirelessHART Versus ISA100.11a:The Format War Hits the Factory Floor", IEEE Industrial Electronics Magazine, 5, pp.23~34 (2011)
- Andrzej Bialas, "Vulnerability Assessment of Sensor Systems", Sensors, 19(11) (2019)
- Lyes Bayou, "Assessment and enforcement of wireless sensor network-based SCADA systems security", Hyper Articles on Line(HAL), ~ (2018)
- Intrinsically Secure WirelessHART Field Device Networks and the Industrial Internet of Things(IIoT), , Fieldcomm Group, ~ (2017)
- S3-17: SUTD Security Showdown Event Report, , iTrust: Centre for Research in Cyber Security, ~ (2017)
- "Wireless communication network and communication profiles –WirelessHART", IEC 62591 Edition 2.0, ~ (2016)
- NISTIR-7176, System Protection Profile-Industrial Control Systems Version 1.0, , National Institute of Standards and Technology(NIST), ~ (2004)
- Field Device Protection Profile for SCADA systems in Medium Robustness Environments Version 0.71, , National Institute of Standards and Technology(NIST), ~ (2006)
- Common Criteria for Information Technology Security Evaluation, Version 3.1 Revision 5, , The Common Criteria Recognition Agreement (CCRA), ~ (2017)
- "BBC News"[URL]
- 정다혜, "시큐어 코딩 중심으로 본 원자력 관련 소프트웨어", 정보보호학회논문지, 23(2), pp.243~250 (2013), 한국정보보호학회
- 김우년, "4차 산업혁명 시대의 산업 제어시스템 보안성 평가 방안 연구", 한국통신학회논문지, 44(5), pp.943~956 (2019), 한국통신학회[DOI]