KR101288233B1 - Access control apparatus and access controlling method in scada system - Google Patents

Abstract

Disclosed are an access control apparatus and an access control method in a SCADA system. An access control apparatus according to the present invention includes a database engine unit for receiving a device control message from a user, an access control interworking unit for converting a device control message received from the database engine unit into a standardized format, and the access control interworking unit converted from the access control interworking unit. It includes an access control unit for determining the access authority for a message having a formal format. This prevents illegal access to resources and prevents malfunction due to immaturity of the operator.

Description

ACCESS CONTROL APPARATUS AND ACCESS CONTROLLING METHOD IN SCADA SYSTEM}

The present invention relates to an access control apparatus and an access control method, and more particularly, to an access control apparatus and an access control method capable of preventing illegal access to a SCADA network.

Conventional Supervisory Control and Data Acquisition (SCADA) systems allow authorized users to control or monitor the system. However, unlike the conventional SCADA system which was operated in such a closed manner, in the SCADA network which is gradually opened, there is a fear that the illegal access is made and the terrorism and hacking of the main facilities occur.

Skada system is generally referred to as centralized remote monitoring and control system, and RTU (Remote Terminal Unit) equipment is installed at each site to measure and control the equipment situation in order to economically and efficiently operate the increasingly advanced industrial facilities. It is an integrated measurement and monitoring control system that installs computers and software in the central control room and connects and operates the data between the central control room and the RTU.

Referring to FIG. 1, the conventional SCADA system is a MTU (Master Terminal Unit, 10), which is a central control center as shown in FIG. 1, and a remote terminal unit (RTU) for measuring and controlling the situation of each field facility. , 20), and FEP (Front End Processor, 30) connecting the two.

The control command is transmitted to the FEP 30 through a communication interface, which is one component of the MTU 10, which is in turn transmitted to the RTU 20 to finally perform control.

The surveillance data is acquired by the FEP 30 from the RTU 20 and transmitted to the MTU 10 through the communication interface of the MTU 10.

The FEP 30 and the RTU 20 transmit and receive data using serial communication.

Such a conventional Skada system has the following problems.

First, authorized operators will be able to control or monitor the entire SCADA network. Operators with ID or password-based authentication provided by the SCADA system will be able to control or monitor the SCADA network. This has the problem that if only authentication is obtained, the SCADA network resources can be used with the right, and thus no protection of the network can be achieved. In addition, the security level for surveillance data is not distinguished at all, allowing all users to monitor the entire data.

Second, there is a fear that a false order may be transmitted due to the inexperienced operation of the operator. Control commands transmitted by the SCADA operator are transmitted to the RTU 20 through the FEP 30 to control equipment. In this case, unintended control may be made due to a user's mistake or immaturity. Such a misplacement can pose a major threat to the installation.

Third, since the network between the FEP 30 and the RTU 20 uses serial communication, it is impossible to install a firewall to solve the problem.

Therefore, there is a need for a SCADA system that can solve such problems.

The present invention has been made in view of the above-described problems, and an object of the present invention is to provide an access control apparatus and an access control method capable of preventing resource access to an illegal user and preventing malfunction due to an immaturity of an operator. Is in.

An access control apparatus according to an embodiment of the present invention for achieving the above object, the database engine unit for receiving a device control message from the user; An access control interworking unit converting the device control message received from the database engine unit into a standardized format; And an access control unit for determining an access right to a message having a standardized format converted by the access control interworking unit.

When the access right is granted by the access control unit, the database engine unit may transmit the device control message to a front end processor (FEP).

In addition, the access control unit, Policy Administration Point (PAP) for policy setting and management; Policy Decision Point (PDP) for authorization determination; A context handler for converting eXtensible Access Control Language (XACML) context; A PIP for storing attribute information; And a PEP for acting as a transmission / reception agent of an access request and a response.

And a PIP storing attribute information for access control, wherein the attribute information may be information about an access subject, an access target, and an access environment.

In addition, the access control unit performs an authority verification for the access request through the PDP, and includes the result in the XACML access response message to perform a message conversion operation in the context handler, and then determine whether the determined final access authority is the PEP. Through the database engine unit; can be delivered to.

The access control unit may transmit an access permission message to the database engine unit when the access authority of the message is granted.

On the other hand, an access control method according to an embodiment of the present invention for achieving the above object comprises the steps of receiving a device control message from the user; Converting the input device control message into a standardized format; Determining access rights to the message having the converted formatted format; And if the access right to the message is granted, forwarding the message to a front end processor (FEP).

The determining of the access authority may include: performing authority verification on an access request; Performing a message conversion operation by including the verification result in an XACML access response message; And determining whether or not final access authority.

According to the access control device and the access control method according to the above configuration, it has a technical effect to prevent resource access to illegal users and to prevent malfunction due to immaturity of the operator.

1 is a view showing the configuration of a conventional skada system,
2 is a view for explaining a data flow between XACML components for access control;
3 is a view showing the overall structure of a system including an access control device according to an embodiment of the present invention;
4 is a view showing a configuration of an access control unit which is one configuration of an access control apparatus according to an embodiment of the present invention;
5 is a view for explaining the operation of the access control device according to an embodiment of the present invention, and
6 is a flowchart illustrating an access control method according to an embodiment of the present invention.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It is to be understood, however, that the invention is not to be limited to the specific embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail.

Prior to the detailed description of the present invention will be described for eXtensible Access Control Language (XACML) that is a premise of the present invention. EXtensible Access Control Language (XACML) is an XML-based language that can control fine-grained access to resources using access control policies. Resources in this policy can be any object represented using XML, and XACML can be used in conjunction with various protocols such as XPath or LDAP. XACML consists of three main components: subject, resource, and action. A subject represents an access subject and may be an ID or a group of a user. A resource refers to data that a subject will access, and an action consists of an action that can be performed on the resource.

2 shows a data flow between XACML components for access control. First, a Proven Access Request message is sent to a Policy Enforcement Point (PEP). Thereafter, a decision request message is generated by referring to the attribute information of a specific domain-based access request message, and then an authorization decision is requested from a policy decision point (PDP). PDP transfers permissions based on the policy control's access control policy. As a result, the access request acts as a grant or deny access to the resource. The present invention performs access control using XACML.

3 shows the overall structure of a system including an access control device according to an embodiment of the present invention. The access control system includes an access control device 100, a communication module 200, and an FEP 210 as shown in FIG. 3.

The access control apparatus 100 includes a database engine unit 110, an access control interworking unit 120, and an access control unit 130. The database engine 110 performs data communication using the FEP 210 and the communication module 200, and the system operates.

The access control interworking unit 120 analyzes the user authority attribute from the received control message and communicates with the PEP (not shown) of the access control unit 130 and processes the access request / response message.

The access control interworking unit 120 is for the purpose of interworking between the Skada system and the access control unit 130, for this purpose may have a functional structure suitable for the operation method of the existing Skada. The access control interworking unit 120 converts the unique access control request of the SCADA into a standardized form and performs a function of delivering the XACML service. Therefore, it defines the integrated request form for the access control request and performs the process of converting various types of requests into one integrated form. For this purpose, the access control interworking unit 120 has an access request information analysis function and an access request and response message conversion function.

The access control unit 130 checks whether or not the user's authority through the access control policy described in FIG. 2 before returning the control message to the communication module 200 and returns the result.

The access control unit 130 has a function of verifying an access right for the user before the control command is transmitted to the RTU (not shown) through the FEP 210. The access control unit 130 performs the role of verifying the authority based on the access control policy, and provides a service interface for applying to various applications or environments, so that access control management suitable for the SCADA network environment can be performed. The configuration of the access control unit 130 is shown in more detail in FIG.

As illustrated in FIG. 4, the access control unit 130 may be configured as a context handler for converting a PAP (Policy Administration Point) 139, a PDP (Policy Decision Point, 135), and an XACML (eXtensible Access Control Language) context. It includes a PIP (137) for managing attribute information and a PEP (131) for the role of the transmission and reception agent of the access request and response.

The PAP 139 has a policy setting and management function, the PDP 137 has a permission decision function, and the context handler 133 has a XACML context conversion function. In addition, the PIP 137 manages the attribute information, and the PEP 131 serves as a transmission / reception agent for access requests and responses.

5 is a view for explaining the operation of the access control apparatus according to an embodiment of the present invention.

The main components for access control include the database engine unit 110 for transmitting control messages generated by the HMI, the access control interlocking unit 120 for integrated interworking with the access control unit 130, and determining access authority. It consists of an access control unit 130, an attribute information storage unit 140 for storing the attribute information for access control, and finally the FEP 210, which is the object to be accessed.

In FIG. 5, an operation thereof will be described through a flow of messages between components. The device control message transmitted by the user is transmitted to the database engine unit 110, which is in turn transferred to the access control interworking unit 120 and converted into a standardized format for communication with the access control unit 130.

Thereafter, the access request message having a formalized form is transferred to the PEP 131, which plays an agent role of the access control unit 130, and the access control unit 130 generates an XACML access request document based on the contents of the access request message. In order to obtain the attribute information from the attribute information storage unit 140. Here, the attribute information includes the access subject, the access target FEP, and access environment information for access control.

The PDP 135 of the access control unit 130 performs authority verification for the access request, and the result thereof is included in the XACML access response message to perform domain-based message conversion of the context handler 133, and then PEP ( The transaction for the access control is terminated by transmitting the final access right result to the database engine unit 110 through 131.

If the access is allowed, the control message is transmitted to the corresponding FEP 210. If the access is not allowed, the transaction for the control message is terminated and the user cannot control the device.

Such a configuration has a technical effect to prevent resource access to illegal users who do not have access rights and to prevent malfunction due to immaturity of the operator.

Meanwhile, in the present invention, it is preferable that the SCADA network environment is designed based on an RBAC (Role Based Access Control) model.

Table 1 below shows the information included in the target of the policy.

Subject (role) Resource (resourece type) Action (service type) administrator any control manager any db change

Subject applies user's role and Resource applies FEP type. And Action applies the type of control service for FEP. If the condition of the policy target is satisfied, the rule target is checked.

Table 2 shows information included in the target of the rule.

Subject (id) Resource (name) Action (name) 212206 FEP1 FEP Reload 212207 FEP2 FEP Switch

Subject applies user's ID, Resource includes FEP name and Action includes control command name for FEP. Condition is executed when target condition of Rule is satisfied.

Condition provides a variety of operations for access control. In this paper, we set up to check the access time. Table 3 shows the settings for allowable time in Condition.

Apply Access time Until Time 12:00:00 After Time 18:00:00

The result of the access authority is determined by verifying the validity of the access request for the access control policy. XACML access request message expresses access request to user in XACML and follows format defined in XACML Context schema. The elements that compose XACML access request message are Subject, Resource, Action, Environment as shown in Table 4, and each element is used for authorization verification in Policy target and Rule target of XACML policy document.

Subject Resource Action Env. role (policy) type (policy) service type (policy) cur. time (condition) id (rule) name (rule) name (rule) x

subject contains the Role applied in the Policy and the name of the FEP applied in the Rule. And Action includes type of control service applied in policy and name of control command applied in rule.

The environment contains information about the current time to check whether the access time falls within the range of allowed access time.

6 is a flowchart illustrating step by step an access control method according to an embodiment of the present invention.

The device control message is input from the user (S300). Thereafter, the input device control message is converted into a standardized format (S310). In this regard, it is as described above.

Next, the access right to the device control message converted to the standardized format is determined (S320). The device control message determines whether there is an access right or not, and if the access right is recognized (S330-Yes), the message is transmitted to the FEP (S340). On the other hand, if the access permission is not recognized (S330-No), do not transmit the message to the FEP (S350). Detailed operations associated with each step are the same as described above, and thus redundant descriptions thereof will be omitted.

Such a configuration has a technical effect to prevent resource access to illegal users who do not have access rights and to prevent malfunction due to immaturity of the operator.

In the foregoing description, each component and / or function described in various embodiments may be implemented in combination with each other, and those skilled in the art may recognize the present invention described in the claims below. It will be understood that various modifications and variations can be made in the present invention without departing from the spirit and scope.

100 ...................................... Access Control Unit
110 ............. Database engine part
120 ............................ Access control linkage
130 ...................................... Access Control Unit
200 ....................... Communication module
210 ......................... FEP

Claims (8)

A database engine unit for receiving a device control message from a user;
An access control interworking unit converting the device control message received from the database engine unit into a standardized format; And
The access control interworking unit includes an access control unit for determining an access authority for a message having a standardized format converted by the access control interlocking unit, the access control interlocking unit, defines an integrated request form for the access control request, request of various types Convert into a single integrated form, the access control unit,
Policy Administration Point (PAP) for policy setting and management;
Policy Decision Point (PDP) for authorization determination;
A context handler for converting eXtensible Access Control Language (XACML) context;
A PIP for storing attribute information; And
Access control device including a PEP for acting as a transmission and reception agent of the access request and response. The method of claim 1,
The database engine unit,
And when the access right is granted by the access control unit, transmitting the device control message to a front end processor (FEP). delete The method of claim 1,
The attribute information is an access control device, characterized in that the information about the access subject, the access target and the access environment. The method of claim 1,
The access control unit,
The authority verification for the access request is performed through the PDP,
And including the result in the XACML access response message and performing a message conversion operation in the context handler, and then transmitting the determined final access authority to the database engine unit through the PEP. The method of claim 1,
The access control unit,
And when the access right of the message is granted, transmitting the access permission message to the database engine unit. delete delete

Images