원전 디지털 계측제어시스템 사이버보안 기술 체계 수립 방법 연구
A Study on Method to Establish Cyber Security Technical System in NPP Digital I&C
0
조회
0
다운로드
3
인용
0
참고문헌
키워드
초록
원자력 발전소(이하 원전)의 계측제어시스템은 원자력 발전소를 안전하게 운전하기 위한 설비로 아날로그 기술에서디지털기술로 변하고 있다. 그리고 2010년 이란의 부셰르 원자력 발전소의 원심분리기의 가동을 중단시킨 스턱스넷 공격으로 인해 원전의 사이버공격의 가능성이 많이 증가하고 있다. 하지만 국내외 원전 디지털 계측제어시스템의 사이버보안 강화를 위해 발간된 규제지침들은 보안요구사항들과 정책 및 절차 수립 방법들에 대하여 기술하고 있으며, 실제적용 가능한 사이버보안 기술을 개발하기 위한 지침으로는 사용하기에 적합하지 않다. 이러한 이유로 원전 디지털 계측제어시스템의 보안을 강화 할 수 있는 원전에 특화된 사이버보안 기술 개발이 필요하다. 이에 본 논문은 원전에 특화된사이버보안 기술 개발을 위한 기술 개발 체계를 제안하고, 이를 KINCS 사업에서 개발된 공학적안전설비-기기계통에 적용하였다.
Abstract
Nuclear Power Plant Instrumentation and Control System(NPP I&C) which is used to operate safely is changing from analogtechnology to digital technology. Ever since NPP Centrifuge of Iran Bushehr was shut down by Stuxnet attack in 2010, thepossibility of cyber attacks against the NPP has been increasing. However, the domestic and international regulatory guidelinesthat was published to strengthen the cyber security of the NPP I&C describes security requirements and method s to establishpolicies and procedures. These guidelines are not appropriate for the development of real applicable cyber security technology. Therefore, specialized cyber security technologies for the NPP I&C need to be developed to enhance the security of nuclearpower plants. This paper proposes a cyber security technology development system which is exclusively for the development ofnuclear technology. Furthermore, this method has been applied to the ESF-CCS developed by The KINCS R&D project.
참고문헌 (24)
- Cheol-kwon Lee, "Trend of technology of instrumentation and control system in nuclear power plants", Review of KIISC, 22(5), pp.28~34 (2012)
- 구인수, "원자력발전소의 디지털계측제어시스템의 사이버보안을 위한 디지털 자산분석 방법", 한국전자통신학회 논문지, 6(6), pp.839~847 (2011), 한국전자통신학회
- Nicolas Falliere, "W32.Stuxnet Dossier Version 1.4", Symantec Security Response, ~ (2011)
- Dong-Hoon Kim, "Concept of KNICS Development", The proceedings of KIEE, 52(9), pp.24~32 (2003)
- KINS, "instrumentation and control system", KINS, ~ (2011)
- US NRC, "Cyber Security Programs for Nuclear Power Facilities", NRC Regulatory Guide 5.71, ~ (2010)
- US NRC, "Criteria for Use of Computers in Safety Systems of Nuclear Power Plants", Regulatory Guide 1.152, Rev. 03, ~ (2010)
- Cyber Security Plan for Nuclear Power Reactors, "Nuclear Energy Institute", NEI, ~, pp.NEI 08-09 (2010)
- IAEA, "Computer Security at Nuclear Facilities", IAEA Nuclear Security Series, 17 (2010)
- Development of digital reactor safety systems: Development of network protocol for the integrated safety system, "KAERI", KAERI, ~ (2007)
- Development of digital reactor safety system - Production of the digital reactor safety systems, "KAERI", KAERI, ~ (2004)
- Development of digital reactor safety system, "Ministry of Trade, Industry and Energy", Ministry of Trade, Industry and Energy, ~ (2008)
- Development of digital reactor safety system - Design support for ESF-CCS, "KAERI", KAERI, ~ (2008)
- ENISA Threat Landscape 2013, "Louis Marinos", European Network and Information Security Agency, ~ (2013)
- "US.ICS-CERT"[URL]
- Gunhee Lee, "Smart Grid Security Threats and Security Requirements Analysis", Review of KIISC, 21(7), pp.7~17 (2011)
- Special Publication 800-53, "National Institute of Standards and Technology", National Institute of Standards and Technology, ~ (2009)
- Publication 800-82, "National Institute of Standards and Technology", National Institute of Standards and Technology, ~ (2011)
- International Organization for Standardization, "Information technology - Security techniques - Information security management systems —Requirements", ISO, 2013
- KISA, "G-ISMS specification of information protection measures", KISA, ~ (2013)
- KISA, "ISMS certification criteria of detailed inspection items", KISA, ~ (2013)
- Ministry of Security and public Administration, "Information and Communication Security business rules", Ministry of Security and public Administration, ~ (2009)
- Critical information and communication infrastructure vulnerability assessment, evaluation criteria, "Ministry of Security and public Administration", Ministry of Security and public Administration, ~, pp.Notice No. 2012-54 (2012)
- Information Security Management Guidelines, "Korea Communications Commission", Korea Communications Commission, ~, pp.Directive No.109 (2012)