KR20240177405A - Process logic-based detection system and method for detecting cyber attacks in reactor protection systems - Google Patents

Abstract

The present invention relates to a process logic-based detection system and method for detecting cyber attacks on a nuclear reactor protection system.
In particular, the present invention provides a technology capable of detecting the occurrence of a cyber attack on a nuclear protection system by monitoring input/output control signal information for each channel and controller in real time through an immutable unique rule (detection logic rule) configured based on the process logic that performs a reactor safety shutdown (trip) function for each channel and controller that constitutes a nuclear protection system.

Description

Process logic-based detection system and method for detecting cyber attacks in reactor protection systems

The present invention relates to a process logic-based detection system and method for detecting cyber-attacks on a nuclear reactor protection system, and more specifically, to a process logic-based detection system and method for detecting cyber-attacks on a nuclear reactor protection system, which analyzes all control logic related to a reactor stop operation for a safe reactor stop for each channel and each controller constituting a nuclear reactor protection system, derives an immutable unique rule, and detects an abnormal state of the nuclear reactor protection system based on the rule.

The Reactor Protection System (RPS) is a core instrumentation and control system (MMIS, Man-Machine Interface System) of a nuclear power plant that ensures the safe operation of the reactor.

These reactor protection systems are essential for protecting reactors from accidents or damage, and further protecting public safety and the environment.

The reactor protection system is composed of several detailed components consisting of multiple channels and modules to ensure core safety functions, and processes measurement information acquired from sensors through a safety-grade programmable logic controller (PLC) to determine the shutdown of the reactor through preset protection logic to maintain it in a safe state within the safety limit conditions (LCO, Limiting Condition for Operation) of the nuclear power plant.

To this end, the control devices of the reactor protection system are programmed with an algorithm that includes a series of control rules to safely stop the reactor when a situation occurs that exceeds the stable operating range. For example, if the temperature or pressure of the reactor rises rapidly and exceeds the set reactor shutdown setpoint, the reactor protection system generates a trip signal to stop the reactor and generates an engineering safety facility operation signal for follow-up measures.

Recently, as the plant industry environment has become digitalized and automated, industrial control systems (ICS) used in key national infrastructure such as nuclear power plants are playing an important role in key facilities that ensure the safety of the nation and its people, such as large-scale power plants and water treatment facilities.

As the use of programmable logic controllers and devices that incorporate them expand in these industrial control systems, concerns are being raised about the possibility of cyberattacks on key national facilities.

Malicious attacks on programmable logic controllers, which are commonly used in the ecosystem of industrial control systems, can lead to quite dangerous consequences.

First of all, one of the main reasons why programmable logic controllers have become vulnerable to cyberattacks is that as target environments such as digital factories have become digitized in recent years, many parts of them have become networked and can even be connected to security networks, making it easy for actors who can damage the system and control it for malicious purposes through various technologies such as malware.

Once access to the programmable logic controller is granted, an attacker (e.g. malicious actor) can use it to manipulate the target control system itself, potentially causing service interruption or physical damage to the system.

For example, an attacker can change the control parameters and logic of a programmable logic controller to cause the relevant process to change to an abnormal state. If we consider the relevant process as a nuclear power plant, this can result in significant economic loss and even loss of life.

However, to date, there is no technology that has been developed primarily for the purpose of detecting cyber attacks specific to specific control systems, such as the reactor protection system of a nuclear power plant.

Domestic patent registration No. 10-1977731 (registration date 2019.05.07.) discloses a technology for detecting abnormal signs by checking the hardware resource status of the system and the size of files processed by each device, targeting a general control system.

However, due to the nature of nuclear power plants, it is difficult to apply them because it is not realistically suitable to build hardware resource information and file information of the reactor protection system, which is responsible for core safety functions, within the system for the purpose of detecting abnormal signs, as it requires numerous system impact assessments and verification tasks, such as reliability of the system's unique functions and hardware/software.

In addition, domestically registered patent No. 10-0788826 (registration date 2007.12.18.) discloses a technology for testing and diagnosing the soundness of a nuclear reactor protection system.

However, this is not targeted at the original purpose of detecting cyber attacks, and although it is possible to detect abnormal hardware operation status of the controller by channel/module, there is a problem in that it is difficult to detect cases where the process logic itself is changed at the system level.

That is, there is a problem that it is difficult to detect in real time which channel, which module, and which logic caused the problem.

In addition, during the operation of a nuclear power plant, there are clear limitations in verifying/detecting whether the logic algorithms embedded in the control system themselves maintain their integrity unless the operator has specialized design knowledge of a specific system, such as the reactor protection system.

In addition, domestically registered patent No. 10-1957744 (registration date 2019.03.07.) discloses a technology for collecting status information (log information) of a digital measurement control system, receiving it in chronological order, and comparing the received log information with reference information to determine whether a cyber attack has occurred.

However, since detecting an attack basically involves comparing log information from different systems, it is difficult to determine which function of which control device caused the attack, and there is a high possibility of false detection if the existing information itself is inaccurate.

Domestic registration patent No. 10-1977731 (registration date 2019.05.07.) Domestic registration patent No. 10-0788826 (registration date 2007.12.18.) Domestic registration patent No. 10-1957744 (registration date 2019.03.07.)

Accordingly, the present invention has been made to solve the problems of the prior art as described above, and an object of the present invention is to provide a process logic-based detection system and method for detecting cyber attacks on a reactor protection system by monitoring input/output control signal information for each channel and controller in real time through an immutable unique rule (detection logic rule) configured based on a process logic that performs a reactor safety shutdown (trip) function for each channel and controller constituting a reactor protection system.

In order to achieve the above-described purpose, the process logic-based detection system for detecting cyber-attacks on a nuclear reactor protection system of the present invention comprises: a first detection unit that collects input/output information of at least one controller, a second detection unit that collects operation status information of the controller, and an attack detection unit that detects whether a cyber-attack has occurred based on information received from the first detection unit and the second detection unit, wherein the attack detection unit compares the input/output information with pre-stored operation logic information for each controller to determine whether the controller is operating normally, and preferably detects whether a cyber-attack has occurred based on the operation status information and the determined normal operation status.

Furthermore, a process logic-based detection system for detecting cyber attacks on a reactor protection system, wherein the pre-stored operation logic information includes operation logic information for generating a reactor trip signal for each controller.

In addition, it is preferable that the attack detection unit detects that a cyber attack has occurred when, as a result of comparing the input/output information with the stored operation logic information, abnormal operation of the controller is calculated and the operation status information is a normal operation status.

Alternatively, the attack detection unit may determine that a failure has occurred rather than a cyber attack has occurred if, as a result of comparing the input/output information with the stored operation logic information, abnormal operation of the controller is calculated and the operation status information is an abnormal operation status.

At this time, it is preferable that the attack detection unit, when applying the input information included in the input/output information and the stored operation logic information to the stored operation logic information, calculates that the controller is operating abnormally if the predicted output information is different from the output information included in the input/output information.

Furthermore, it is preferable that the first detection unit collects input/output signal information by a comparison logic processor (BP, Bistable Processor) and a coincidence logic processor (CP, Coincidence Processor) included in a controller configured for each channel of the reactor protection system, and the second detection unit collects operation status information by an interface and test processor (ITP, Interface and Test Processor) and a maintenance test processor (MTP, Maintenance Test Processor) included in a controller configured for each channel of the reactor protection system.

At this time, it is desirable for the first detection unit and the second detection unit to collect information for each channel of the reactor protection system by applying a one-way communication method.

In order to achieve the above-mentioned object, the process logic-based detection method for detecting a cyber-attack on a nuclear protection system of the present invention is a method using a process logic-based detection system for detecting a cyber-attack on a nuclear protection system composed of multiple channels, the method including: a first detection step of collecting input/output information of at least one controller for each channel in a first detection unit; a second detection step of collecting operation status information of the controller in a second detection unit; and an attack detection step of comparing the input/output information by the first detection step with pre-stored operation logic information for each channel and each controller in an attack detection unit to determine whether the controller is operating normally, and detecting whether a cyber-attack has occurred based on the operation status information by the second detection step and the determined normal operation status, wherein the operation logic information preferably includes operation logic information for generating a nuclear reactor trip signal for each controller.

At this time, it is preferable that the attack detection step detects that a cyber attack has occurred when, as a result of comparing the input/output information with the stored operation logic information, abnormal operation of the controller is calculated and the operation status information is a normal operation status.

Alternatively, the attack detection step preferably determines that a failure has occurred rather than a cyber attack has occurred if abnormal operation of the controller is calculated as a result of comparing the input/output information with the stored operation logic information and the operation status information is an abnormal operation status.

In addition, when the attack detection step is applied to the stored operation logic information based on the input information including the input/output information by using the input/output information and the pre-stored operation logic information, if the predicted output information is different from the output information included in the input/output information, it is preferable to calculate it as an abnormal operation of the controller.

In particular, the first detection step collects input/output signal information by a comparison logic processor (BP, Bistable Processor) and a coincidence logic processor (CP, Coincidence Processor) included in a controller configured for each channel of the reactor protection system, and the second detection step collects operation status information by an interface and test processor (ITP, Interface and Test Processor) and a maintenance test processor (MTP, Maintenance Test Processor) included in a controller configured for each channel of the reactor protection system. However, it is preferable that the first detection step and the second detection step apply a one-way communication method to collect information for each channel of the reactor protection system.

According to the present invention, a process logic-based detection system and method for detecting cyber attacks on a nuclear reactor protection system can provide a cyber attack detection technology specialized for a nuclear reactor protection system, thereby having the advantage of further improving the security of the nuclear reactor protection system.

In other words, it has the advantage of being able to detect in real time malicious cyber attacks, such as unauthorized control logic modification that damages the function of the reactor protection system, which can be said to be a key device for ensuring the safety of nuclear power plants.

In addition, there is an advantage in that by acquiring information on controllers for each channel of the reactor protection system consisting of multiple channels in real time and analyzing the information, power plant operators or managers can quickly detect suspicious or malicious actions on the target system and provide responses thereto.

In particular, given the characteristics of the nuclear reactor protection system, which requires highly specialized knowledge, there is a very high possibility of false detection if a general detection system is simply adopted without considering this.

In the event of a false detection, it may cause unnecessary power plant shutdowns and response measures, such as wasting the resources and operability of a nuclear power plant that aims for stable power generation as a base load. Therefore, the present invention has the advantage of generating a detection rule based on expert knowledge of the relevant system and detecting the occurrence of a cyber attack through this.

In addition, in order not to affect the structure and function of the MMIS system, which has been thoroughly analyzed and verified by nuclear regulatory requirements such as the multiplicity/diversity of systems responsible for the safety functions of existing nuclear power plants, it has the advantage of being able to efficiently detect the occurrence of cyber attacks without affecting the reactor protection system by configuring it as a separate system.

FIG. 1 is a configuration example diagram showing a process logic-based detection system for detecting cyber attacks on a nuclear reactor protection system according to one embodiment of the present invention.
FIG. 2 is a detailed configuration example diagram showing a process logic-based detection system for detecting cyber attacks on a nuclear reactor protection system according to one embodiment of the present invention.
FIG. 3 is a flowchart illustrating a process logic-based detection method for detecting cyber attacks on a nuclear reactor protection system according to one embodiment of the present invention.
FIG. 4 is a detailed flowchart illustrating an attack detection step of a process logic-based detection method for detecting cyber attacks on a nuclear reactor protection system according to one embodiment of the present invention.

The purpose, features and advantages of the present invention described above will become more apparent through the following examples with reference to the accompanying drawings. The specific structural and functional descriptions below are merely exemplified for the purpose of explaining embodiments according to the concept of the present invention, and the embodiments according to the concept of the present invention may be implemented in various forms and should not be construed as being limited to the embodiments described in this specification or application. Since the embodiments according to the concept of the present invention may have various changes and may have various forms, specific embodiments will be illustrated in the drawings and described in detail in this specification or application. However, this is not intended to limit the embodiments according to the concept of the present invention to specific disclosed forms, but should be understood to include all modifications, equivalents or substitutes included in the spirit and technical scope of the present invention. The terms first and/or second, etc. may be used to describe various components, but the components are not limited to the terms. The above terms are only for the purpose of distinguishing one component from other components, for example, without departing from the scope of rights according to the concept of the present invention, the first component may be called the second component, and similarly, the second component may also be called the first component. When a component is said to be connected or connected to another component, it should be understood that it may be directly connected or connected to the other component, but there may be other components in between. On the other hand, when a component is said to be directly connected or directly connected to another component, it should be understood that there are no other components in between. Other expressions used to describe the relationship between components, such as 'between' and 'directly between' or 'adjacent to' and 'directly adjacent to', should also be interpreted in the same way. The terminology used herein is only used to describe specific embodiments and is not intended to limit the present invention. The singular expression includes the plural expression unless the context clearly indicates otherwise. In this specification, the terms “include” or “have”, etc. are intended to indicate the presence of a described feature, number, step, operation, component, part, or combination thereof, but should be understood as not excluding in advance the possibility of the presence or addition of one or more other features, numbers, steps, operations, components, parts, or combinations thereof. Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by a person of ordinary skill in the art to which this invention belongs. Terms defined in commonly used dictionaries should be interpreted as having a meaning consistent with the meaning they have in the context of the relevant art, and shall not be interpreted in an ideal or overly formal sense unless explicitly defined herein. Hereinafter, the present invention will be described in detail by describing a preferred embodiment of the present invention with reference to the accompanying drawings. The same reference numerals presented in each drawing represent the same members.

In addition, a system refers to a set of components including devices, mechanisms, and means that are organized and interact regularly to perform necessary functions.

In order to secure the reliability of the system function, the reactor protection system of a nuclear power plant is usually multiplexed into four channels and each channel is configured with its own computational module, which is also multiplexed.

Additionally, the integrity of the unique functions of the instrumentation and control system is verified by periodically checking the system functions through test and diagnostic functions for each channel and each controller.

However, as mentioned above, cyber threats targeting major infrastructure facilities, including domestic and international nuclear power plants, have been increasing in recent years, and cyber threats targeting these industrial control systems are developing in a very sophisticated and intelligent manner, with long-term, meticulous preparations and continuous attempts at attacks.

For example, this is done in an intelligent and complex manner, such as manipulating sensor signals/control logic targeting core control systems or tampering with information provided to operators.

Since it is realistically difficult to detect cyber attacks/threats specific to nuclear power plants using conventional self-testing and diagnostic functions or detection technologies used in general information technology environments, there is a need for cyber attack detection technologies to be specialized for nuclear power plants as well.

In other words, given the nature of nuclear power plants, if automatic protection functions that ensure the stability of nuclear power plants, such as the reactor protection system, fail to operate properly due to cyberattacks/cyber threats, or if the operator's situational awareness is distorted and incorrect manual actions occur, significant economic losses and casualties are bound to occur.

In order to solve these problems, a process logic-based detection system and method for detecting cyber attacks on a nuclear reactor protection system according to one embodiment of the present invention are intended to provide a technology capable of detecting in real time whether a cyber attack has occurred and the channel, module, and control logic thereof where the attack occurred.

FIG. 1 is a configuration example diagram showing a process logic-based detection system for detecting cyber attacks on a nuclear reactor protection system according to one embodiment of the present invention.

A process logic-based detection system for detecting cyber attacks on a nuclear reactor protection system according to one embodiment of the present invention preferably includes a first detection unit (100), a second detection unit (200), and an attack detection unit (300), as illustrated in FIG. 1.

It is most preferable that each channel of the nuclear protection system composed of multiple channels includes the configurations of the first detection unit (100) and the second detection unit (200), and that the attack detection unit (300) is configured by integrating the entire channel. However, this is only one embodiment of the present invention, and the first detection unit (100), the second detection unit (200), and the attack detection unit (300) may be configured for each channel, and the first detection unit (100), the second detection unit (200), and the attack detection unit (300) that integrate the entire channel may be configured. At this time, it is preferable that each configuration is individually or integrally configured in an operation processing means including a CPU to perform operations.

Let's take a closer look at each component:

It is preferable that the above first detection unit (100) collects input/output information (input/output signal information) by each controller configured for each channel of the reactor protection system.

An example of the above controller includes at least one comparison logic processor (BP, Bistable Processor) and at least one coincidence logic processor (CP, Coincidence Processor).

It is preferable that the second detection unit (200) collects operating status information of the controller.

To this end, the second detection unit (200) collects operation status information (normal operation status or abnormal operation status) of each controller by the Maintenance Test Processor (MTP) and Interface and Test Processor (ITP) configured for each channel of the reactor protection system.

At this time, it is desirable for the first detection unit (100) and the second detection unit (200) to collect information by applying a one-way communication method.

Specifically, the present invention will be described based on the configuration of a typical nuclear power plant's reactor protection system, as shown in FIG. 2, based on the configuration of a single channel's reactor protection system, the configurations of the present invention can be corresponded to a dedicated detection device for a Safety Data Link (SDL), a dedicated detection device for a Safety Data Network (SDN), a dedicated network for a detection server, and a detection server for the reactor protection system.

The above SDL-only detection device is the first detection unit (100), and collects in real time control signal information about an output module of a control device (controller) transmitted from a comparison logic processor to a simultaneous logic processor and an output module transmitted from a simultaneous logic processor to another linked control system. For collection, it is preferable that the first detection unit (100) include a tapping or mirroring device.

In order not to affect the reactor protection system, it is preferable that the above first detection unit (100) obtain input/output signal information only in a broadcasting manner using an optical unidirectional data transmission device.

In addition, the SDN-only detection device, as the second detection unit (200), collects information on the maintenance test processor, linkage, and input/output modules of the test processor in real time. It is preferable that the second detection unit (200) also includes a tapping or mirroring device, like the first detection unit (100).

In addition, in order not to affect the reactor protection system, it is desirable to acquire operating status information only through broadcasting using an optical one-way data transmission device.

It is preferable that the above attack detection unit (300) detects whether a cyber attack has occurred based on information received from the first detection unit (100) and the second detection unit (200).

It is preferable that the above attack detection unit (300) compares the input/output information and the pre-stored operation logic information for each controller to determine whether the controller (corresponding controller) is operating normally, and detects whether a cyber attack has occurred based on the operation status information and the determined normal operation status.

The operation of the above attack detection unit (300) will be described in detail later.

It is preferable that the process logic-based detection system for detecting cyber attacks on a nuclear protection system according to one embodiment of the present invention classifies and groups the information collected by the first detection unit (100) and the second detection unit (200) by each channel, each controller, and each function of the nuclear protection system.

Through this, the attack detection unit (300) detects whether a cyber attack has occurred using the grouped information.

The above first detection unit (100) and second detection unit (200) collect information on each controller configured in each channel of the reactor protection system, and the collected information is raw data in the form of binary data packets. In order to apply this data to the detection logic rules, a function must be performed to classify and group the data by each channel, controller, and function of the reactor protection system, and to convert it into a form suitable for input of the detection logic.

Here, the function of the reactor protection system means the reactor safety shutdown function. Examples of such reactor safety shutdown functions include variable overpower reactor shutdown function, high logarithmic power level reactor shutdown function, high local power density reactor shutdown function, low denuclearization rate reactor shutdown function, pressurizer high pressure reactor shutdown function, pressurizer low pressure reactor shutdown function, steam generator low level reactor shutdown function, steam generator high level reactor shutdown function, steam generator low pressure reactor shutdown function, containment high pressure reactor shutdown function, reactor coolant low flow reactor shutdown function, and manual reactor shutdown function.

To briefly explain the representative functions, the pressurizer high pressure reactor trip function is a logic function that generates a reactor trip signal when the measured pressurizer pressure (PZR_pressure) signal is higher than the high pressure setpoint (trip setpoint). In addition, the steam generator low pressure reactor trip function is a logic function that generates a reactor trip signal when the measured steam generator secondary pressure (SG# pressure_measured) signal falls below the low pressure setpoint (trip setpoint).

In addition, it is preferable that the process logic-based detection system for detecting cyber attacks on a nuclear reactor protection system according to one embodiment of the present invention further includes a separate database unit (400) for storing operation logic information for each controller, as illustrated in FIG. 1.

Through the above database section (400), it is desirable to store and manage, in advance, the operation logic information for the generation of the reactor trip signal loaded in all controllers for each channel of the reactor protection system. That is, based on professional analysis, the operation logic information for the generation logic of the reactor trip signal loaded in each channel and each controller is stored.

At this time, the saved operation logic information corresponds to an immutable unique rule derived by analyzing the reactor safety shutdown logic, which is the core unique function of the system, based on expert design knowledge of the reactor protection system.

Through this, the attack detection unit (300) compares the input/output information for one controller collected by the first detection unit (100) with the operation logic information of the corresponding controller among the operation logic information stored in advance through the database unit (400), and calculates whether the corresponding controller is operating normally.

That is, when the predicted output information is applied to the operation logic information based on the input information included in the input/output information collected in real time, the actual output information collected is compared, and if there is a difference, the corresponding controller is output as an abnormal operation.

Of course, when applying the operation logic information based on the input information included in the input/output information collected in real time, the predicted output information is compared with the collected actual output information, and if they match, the corresponding controller is output as normal operation.

To give a simple example, if the currently collected input information is applied to the operation logic information, a trip signal should be generated, but if the actual output information does not include a trip signal, the corresponding controller is judged to be in an abnormal operation state.

Thereafter, the attack detection unit (300) compares the input/output information for one controller collected by the first detection unit (100) with the operation logic information of the corresponding controller among the operation logic information stored in advance through the database unit (400), and if abnormal operation of the corresponding controller is detected, in other words, if the expected output information is different from the collected output information, the attack detection unit (300) detects whether a cyber attack has occurred on the corresponding controller by using the operation status information of the corresponding controller collected by the second detection unit (200).

Specifically, if the operation status information of the corresponding controller collected by the second detection unit (200) is in a normal operation state, it is detected that a cyber attack has occurred on the corresponding controller, and if the operation status information of the corresponding controller collected by the second detection unit (200) is in an abnormal operation state, it is preferable to determine that a failure has occurred on the corresponding controller, not that a cyber attack has occurred on the corresponding controller.

In summary, based on the operation logic information (operation logic information for generating a reactor trip signal) for each controller, the real-time input/output information collected from the corresponding controller is compared and analyzed. If it is determined that an operation that deviates from the normal operation logic is being performed, it is determined whether the problem is due to an abnormality (failure) in the controller itself or a malicious cause (cyber attack).

As described above, the above attack detection unit (300) preferably performs operations for each controller, thereby specifying a controller in which a cyber attack is determined to have occurred, generating final detection result information, and outputting the generated final detection result information to the outside.

Due to the nature of nuclear power plants, even if a cyber attack is detected, immediate response such as forcibly shutting down the nuclear power plant is impossible. However, it is desirable to generate the final detection result information that the function has generated an output signal that violates the operation process logic. For example, it is desirable to generate an alarm signal, save the corresponding log history, generate an alarm log, and output it on the information display screen at the same time, so as to convey information about the detection result (corresponding channel, controller, function, etc.) to the operator so that follow-up response can be made.

FIG. 3 is a flowchart illustrating a process logic-based detection method for detecting cyber attacks on a nuclear reactor protection system according to one embodiment of the present invention.

As illustrated in FIG. 3, a process logic-based detection method for detecting cyber attacks on a nuclear reactor protection system according to one embodiment of the present invention includes a first detection step (S100), a second detection step (S200), and an attack detection step (S300).

Each step is operated by a process logic-based detection system for detecting cyber attacks on the reactor protection system, which consists of multiple channels.

Let's take a closer look at each step:

The above first detection step (S100) collects input/output information (input/output signal information) by each controller configured for each channel of the reactor protection system in the first detection unit (100). At this time, an example of a controller that generates the input/output information includes at least one comparison logic processor (BP, Bistable Processor) and at least one simultaneous logic processor (CP, Coincidence Processor).

The second detection step (S200) collects the operation status information of the controller whose input/output information was collected by the first detection unit (100) in the second detection unit (200).

To this end, the second detection step (S200) collects operation status information (normal operation status or abnormal operation status) of each controller by the Maintenance Test Processor (MTP) and Interface and Test Processor (ITP) configured for each channel of the reactor protection system.

The above first detection step (S100) and second detection step (S200) collect information by applying a one-way communication method.

To this end, the first detection step (S100) and the second detection step (S200) acquire operating status information only in a broadcasting manner using an optical unidirectional data transmission device so as not to affect the reactor protection system.

The above attack detection step (S300) compares the input/output information by the first detection step (S100) with the pre-stored operation logic information for each channel and each controller in the attack detection unit (300) to determine whether the corresponding controller is operating normally. Thereafter, based on the operation status information by the second detection step (S200) for the corresponding controller and the determined normal operation status, the occurrence of a cyber attack on the corresponding controller is detected.

To this end, in the process logic-based detection method for detecting cyber attacks on a nuclear protection system according to one embodiment of the present invention, the information collected by the first detection step (S100) and the second detection step (S200) is classified and grouped by each channel, each controller, and each function of the nuclear protection system. Through this, the attack detection step (S300) detects whether a cyber attack has occurred using the grouped information, thereby easily generating detection result information by specifying a controller.

The information collected by the above first detection step (S100) and the above second detection step (S200) collects information on each controller configured in each channel of the reactor protection system, and the collected information is raw data in the form of binary data packets. In order to apply this data to the detection logic rule, a function must be performed to classify and group the data by each channel, controller, and function of the reactor protection system, and to convert it into a form suitable for input of the detection logic.

Here, the function of the reactor protection system means the reactor safety shutdown function. Examples of such reactor safety shutdown functions include variable overpower reactor shutdown function, high logarithmic power level reactor shutdown function, high local power density reactor shutdown function, low denuclearization rate reactor shutdown function, pressurizer high pressure reactor shutdown function, pressurizer low pressure reactor shutdown function, steam generator low level reactor shutdown function, steam generator high level reactor shutdown function, steam generator low pressure reactor shutdown function, containment high pressure reactor shutdown function, reactor coolant low flow reactor shutdown function, and manual reactor shutdown function.

To briefly explain the representative functions, the pressurizer high pressure reactor trip function is a logic function that generates a reactor trip signal when the measured pressurizer pressure (PZR_pressure) signal is higher than the high pressure setpoint (trip setpoint). In addition, the steam generator low pressure reactor trip function is a logic function that generates a reactor trip signal when the measured steam generator secondary pressure (SG# pressure_measured) signal falls below the low pressure setpoint (trip setpoint).

In addition, a process logic-based detection method for detecting cyber attacks on a nuclear protection system according to one embodiment of the present invention further includes a DB processing step (S10) for storing operation logic information for each controller in a database unit (400), as illustrated in FIG. 3, in order to utilize operation logic information stored in advance in the attack detection step (S300).

It is preferable that the above DB processing step (S10) store and manage, in advance, the operation logic information for the generation of the reactor trip signal loaded in all controllers for each channel of the reactor protection system. That is, based on expert analysis, the operation logic information for the generation logic of the reactor trip signal loaded in each channel and all controllers is stored.

At this time, the saved operation logic information corresponds to an immutable unique rule derived by analyzing the reactor safety shutdown logic, which is the core unique function of the system, based on expert design knowledge of the reactor protection system.

Through this, the attack detection step (S300) compares the input/output information for one controller collected by the first detection step (S100) with the operation logic information of the corresponding controller among the operation logic information stored in advance by the DB processing step (S10), thereby determining whether the corresponding controller is operating normally.

That is, when the predicted output information is applied to the operation logic information based on the input information included in the input/output information collected in real time, the actual output information collected is compared, and if there is a difference, the corresponding controller is output as an abnormal operation.

Of course, when applying the operation logic information based on the input information included in the input/output information collected in real time, the predicted output information is compared with the collected actual output information, and if they match, the corresponding controller is output as normal operation.

To give a simple example, as shown in Fig. 4, when the currently collected input information is applied to the operation logic information, a trip signal should be generated, but if the actual output information does not include a trip signal, the corresponding controller is determined to be in an abnormal operation state.

Next, the attack detection step (S300) compares the input/output information for one controller collected by the first detection step (S100) with the operation logic information of the corresponding controller among the operation logic information pre-stored by the DB processing step (S10), and if abnormal operation of the corresponding controller is detected, in other words, if the expected output information is different from the collected output information, the operation status information of the corresponding controller collected by the second detection step (S200) is used to detect whether a cyber attack has occurred on the corresponding controller.

In detail, if the operation status information of the corresponding controller collected by the second detection step (S200) is in a normal operation state, it is detected that a cyber attack has occurred on the corresponding controller, and if the operation status information of the corresponding controller collected by the second detection step (S200) is in an abnormal operation state, it is determined that a failure has occurred on the corresponding controller, not that a cyber attack has occurred on the corresponding controller.

Through this, the attack detection step (S300) compares and analyzes real-time input/output information collected from the corresponding controller based on the operation logic information (operation logic information for generating a reactor trip signal) for each controller, and if it is determined that an operation that deviates from the normal operation logic is being performed, it determines whether the problem is due to an abnormality (failure) of the controller itself or a malicious cause (cyber attack).

Based on these detection results, a process logic-based detection method for detecting cyber attacks on a nuclear reactor protection system according to one embodiment of the present invention further includes a response step (S400) after performing the attack detection step (S300), as illustrated in FIG. 3.

The above response step (S400) identifies the controller where a cyber attack is determined to have occurred, generates final detection result information, and outputs the generated final detection result information to the outside.

Due to the nature of nuclear power plants, even if a cyber attack is detected, immediate response such as forcibly shutting down the nuclear power plant is impossible. However, it is desirable to generate the final detection result information that the function has generated an output signal that violates the process logic, generate an alarm signal for this, save the log history, and transmit it to the operator so that a response can be made.

Meanwhile, in one embodiment of the present invention, a process logic-based detection method for detecting cyber attacks on a nuclear reactor protection system may be implemented in the form of program commands that can be executed through various electronic information processing means and recorded in a storage medium. The storage medium may include program commands, data files, data structures, etc., singly or in combination.

The program commands recorded on the storage medium may be those specially designed and configured for the present invention, or may be those known and available to those skilled in the software field. Examples of the storage medium include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs and DVDs, magneto-optical media such as floptical disks, and hardware devices specially configured to store and execute program commands such as ROMs, RAMs, and flash memories. Examples of the program commands include not only machine language codes generated by a compiler, but also high-level language codes that can be executed by a device that electronically processes information using an interpreter, for example, a computer.

Although the preferred embodiments of the present invention have been described above, the embodiments disclosed in the present invention are not intended to limit the technical idea of the present invention but are merely intended to explain it. Therefore, the technical idea of the present invention includes not only each disclosed embodiment but also a combination of the disclosed embodiments, and further, the scope of the technical idea of the present invention is not limited by these embodiments. In addition, those skilled in the art to which the present invention pertains can make numerous changes and modifications to the present invention without departing from the spirit and scope of the appended claims, and all such appropriate changes and modifications should be considered as equivalents and falling within the scope of the present invention.

100: 1st Detection Unit
200: 2nd Detection Unit
300: Attack Detection Unit

Claims (12)

A first detection unit for collecting input/output information of at least one controller;
A second detection unit for collecting operation status information of the above controller; and
An attack detection unit that detects whether a cyber attack has occurred based on information received from the first detection unit and the second detection unit;
Including, but not limited to,
The above attack detection unit
A process logic-based detection system for detecting cyber attacks on a nuclear reactor protection system, which compares the input/output information with the stored operation logic information for each controller to determine whether the controller is operating normally, and detects whether a cyber attack has occurred based on the operation status information and the determined normal operation status.
In paragraph 1,
The above operation logic information
A process logic-based detection system for detecting cyber attacks on a nuclear reactor protection system, including operation logic information for generating a reactor trip signal for each controller.
In paragraph 1,
The above attack detection unit
A process logic-based detection system for detecting cyber attacks on a nuclear reactor protection system, which detects that a cyber attack has occurred when the abnormal operation of the controller is calculated as a result of comparing the above input/output information with the stored operation logic information and the operation status information is a normal operation status.
In paragraph 1,
The above attack detection unit
A process logic-based detection system for detecting cyber attacks on a nuclear reactor protection system, which determines that a failure has occurred rather than a cyber attack has occurred when the abnormal operation of the controller is calculated as a result of comparing the above input/output information with the stored operation logic information and the above operation status information is an abnormal operation status.
In paragraph 3 or paragraph 4,
The above attack detection unit
Using the above input/output information and the stored operation logic information,
A process logic-based detection system for detecting cyber attacks on a nuclear reactor protection system, which, when applied to stored operation logic information based on input information included in the above input/output information, calculates abnormal operation of the controller if the predicted output information is different from the output information included in the above input/output information.
In paragraph 1,
The above first detection unit
Collects input/output signal information by the comparison logic processor (BP, Bistable Processor) and the simultaneous logic processor (CP, Coincidence Processor) included in the controller configured for each channel of the reactor protection system.
The above second detection unit
A process logic-based detection system for detecting cyber attacks on a nuclear protection system, which collects operation status information from the Interface and Test Processor (ITP) and Maintenance Test Processor (MTP) included in the controller configured for each channel of the nuclear protection system.
In paragraph 1,
The above first detection unit and the second detection unit
A process logic-based detection system for detecting cyber attacks on a nuclear protection system, which collects information for each channel of the nuclear protection system by applying a one-way communication method.
A method using a process logic-based detection system for detecting cyber attacks on a nuclear reactor protection system consisting of multiple channels,
In the first detection unit, a first detection step for collecting input/output information of at least one controller for each channel;
In the second detection unit, a second detection step for collecting operation status information of the controller; and
An attack detection step for comparing the input/output information by the first detection step with the stored operation logic information for each channel and controller in the attack detection unit to determine whether the controller is operating normally, and detecting whether a cyber attack has occurred based on the operation status information by the second detection step and the determined normal operation status;
Including,
The above operation logic information
A process logic-based detection method for detecting cyber attacks on a nuclear reactor protection system, including operation logic information for generating a reactor trip signal for each controller.
In Article 8,
The above attack detection steps are
A process logic-based detection method for detecting cyber attacks on a nuclear reactor protection system, wherein a cyber attack is detected when abnormal operation of the controller is calculated as a result of comparing the above input/output information with the stored operation logic information and the operation status information is a normal operation status.
In Article 8,
The above attack detection steps are
A process logic-based detection method for detecting cyber attacks on a nuclear reactor protection system, wherein, when the abnormal operation of the controller is calculated as a result of comparing the above input/output information with the stored operation logic information and the operation status information is an abnormal operation status, it is determined that a failure has occurred rather than a cyber attack has occurred.
In Article 9 or Article 10,
The above attack detection steps are
Using the above input/output information and the stored operation logic information,
A process logic-based detection method for detecting cyber attacks on a nuclear reactor protection system, which, when applied to stored operation logic information based on input information including the above input/output information, calculates abnormal operation of the controller if the predicted output information is different from the output information included in the above input/output information.
In Article 8,
The above first detection step is
Collects input/output signal information by the comparison logic processor (BP, Bistable Processor) and the simultaneous logic processor (CP, Coincidence Processor) included in the controller configured for each channel of the reactor protection system.
The second detection step above
Collects operation status information by the Interface and Test Processor (ITP) and Maintenance Test Processor (MTP) included in the controller configured for each channel of the reactor protection system.
The above first detection step and the second detection step
A process logic-based detection method for detecting cyber attacks on a nuclear protection system, which collects information for each channel of the nuclear protection system by applying a one-way communication method.