산업용 무선통신기기 사이버 보안위협 및 보안요구사항에 관한 연구

국문 초록 (Abstract)

산업제어시스템(ICS)은 분산된 다양한 자산을 측정, 감시, 제어하는 시스템으로 에너지, 화학, 교통, 수처리, 제조 공장 등의 산업 시설 및 국가기반시설에서 사용된다. 산업제어시스템의 특성상 보안위협에 노출되면 오동작, 중단 등으로 인해 막대한 인명, 자산 피해 등이 발생할 수 있어 산업제어시스템의 보안위협을 예방하고 최소화하기 위한 연구가 필요하다. 기존의 산업제어시스템의 경우 보안위협을 고려하여 무선통신기기의 사용을 제한하였으나 최근에는 유지보수의 용이성 및 비용의 장점으로 인해 산업용 무선통신기기 도입이 점차 증가하고 있다. 이에 본 논문에서는 WirelessHART와 ISA100.11a를 지원하는 산업용 무선통신기기의 보안위협을 분석하고, 분석 결과를 기반으로 산업용 무선통신기기의 도입 및 운영에 필요한 보안요구사항을 제시하였다. 본 연구에서 제시한 보안요구사항을 활용하여 국가기반시설을 포함한 다양한 산업분야의 산업용 무선통신환경 구축 시 보안위협을 완화할 수 있을 것으로 기대한다.

다국어 초록 (Multilingual Abstract)

Industrial Control System(ICS) is a system that measures, monitors, and controls various distributed assets, and is used in industrial facilities such as energy, chemical, transportation, water treatment, and manufacturing plants or critial infrastructure. Because ICS system errors and interruptions can cause serious problem and asset damage, research on prevention and minimization of security threats in industrial control systems has been carried out. Previously wireless communication was applied in limited fields to minimize security risks, but the demand for industrial wireless communication devices is increasing due to ease of maintenance and cost advantages. In this paper, we analyzed the security threats of industrial wireless communication devices supporting WirelessHART and ISA100.11a. Based on the analysis results, we proposed the security requirements for adopting and operating industrial wireless communication devices. We expect that the proposed requirements can mitigate security threats of industrial wireless devices in ICS.

목차 (Table of Contents)

• 요약
• ABSTRACT
• I. 서론
• II. 관련 연구
• III. 산업제어시스템 무선 통신 운용환경
• IV. 산업용 무선통신 보안위협
• V. 산업용 무선통신기기 보안요구사항
• VI. 결론
• References

참고문헌 (Reference)

1 정다혜, "시큐어 코딩 중심으로 본 원자력 관련 소프트웨어" 한국정보보호학회 23 (23): 243-250, 2013

2 박경미, "산업용 제어기기의 통신 견고성 시험 방안 연구" 한국정보보호학회 29 (29): 1099-1116, 2019

3 "exida for IEC 62443 Cyber Certification"

4 Stig Petersen, "WirelessHART Versus ISA100.11a:The Format War Hits the Factory Floor" 5 : 23-34, 2011

5 "Wireless communication network and communication profiles –WirelessHART"

6 Andrzej Bialas, "Vulnerability Assessment of Sensor Systems" 19 (19): 2019

7 "TUV SUD"

8 "Security for industrial automation and control system –Part 4-2:Technical security requirements for IACS components" Korean Standards and Certification 2019

9 "Security Requirements for Industrial Control System – Part. 1: Concepts and Reference Model" Telecommunications Technology Association(TTA) 2017

10 "Security Requirements for Industrial Control System – Part 2: Field Device Layer" Telecommunications Technology Association(TTA) 2017

11 Lyes Bayou, "Security Analysis of WirelessHART Communication Scheme" 2017

12 "S3-17: SUTD Security Showdown Event Report" iTrust: Centre for Research in Cyber Security 2017

13 Sunghyuck Hong, "Research on Wireless Sensor Networks Security Attack and Countermeasures:Survey" 4 (4): 1-6, 2014

14 "NISTIR-7176, System Protection Profile-Industrial Control Systems Version 1.0" National Institute of Standards and Technology(NIST) 2004

15 Erwin Paternotte, "It WISN’t me, attacking industrial wireless mesh networks" 2018

16 "Intrinsically Secure WirelessHART Field Device Networks and the Industrial Internet of Things(IIoT)" Fieldcomm Group 2017

17 "Industrial communication networks – Network and system security – Part 1-1: Terminology, concepts and models"

18 "Industrial Wireless Sensor Network(IWSN) Market Analysis and Segment Forecasts To 2025" Grand View Research, Inc 2017

19 "Field Device Protection Profile for SCADA systems in Medium Robustness Environments Version 0.71" National Institute of Standards and Technology(NIST) 2006

20 Feng Xie, "Evaluating Industrial Control Devices Security:Standards, Technologies and Challenges" 8838 : 624-635, 2015

21 "Common Criteria for Information Technology Security Evaluation, Version 3.1 Revision 5" The Common Criteria Recognition Agreement (CCRA) 2017

22 ANSSI, "Certification CSPN"

23 "BBC News"

24 Lyes Bayou, "Assessment and enforcement of wireless sensor network-based SCADA systems security"

25 T. Tsao, "A Security Framework for Routing over Low Power and Lossy Networks" Internet Engineering Task Force(IETF) 2009

26 Cristina Alcaraz, "A Security Analysis for Wireless Sensor Mesh Networks in Highly Critical Systems" 40 : 419-428, 2010

27 Mark Nixon, "A Comparison of WirelessHART and ISA100.11a" Emerson 2012

28 김우년, "4차 산업혁명 시대의 산업 제어시스템 보안성 평가 방안 연구" 한국통신학회 44 (44): 943-956, 2019