KIPS Transactions on Computer and Communication Systems (정보처리학회논문지:컴퓨터 및 통신 시스템)

Korea Information Processing Society (한국정보처리학회)
권호 표지
DOI QR코드

DOI QR Code

A Study on Application Methodology of SPDL Based on IEC 62443 Applicable to SME Environment

중소기업환경에서 적용 가능한 IEC 62443 기반의 개발 보안 생애주기 프로세스 적용 방안 연구

  • Jin, Jung Ha ;
  • Park, SangSeon ;
  • Kim, Jun Tae ;
  • Han, Keunhee
  • 진정하 (고려대학교 정보보호연구원) ;
  • 박상선 (고려대학교 정보보호연구원) ;
  • 김준태 (고려대학교 정보보호연구원) ;
  • 한근희 (고려대학교 정보보호연구원)
  • Received : 2021.12.31
  • Accepted : 2022.02.19
  • Published : 2022.06.30
Download PDF
⟨ Previous Next ⟩

Abstract

In a smart factory environment in a small and medium-sized enterprise (SME) environment, sensors and actuators operating on actual manufacturing lines, programmable logic controllers (PLCs) to manage them, human-machine interface (HMI) to control and manage such PLCs, and consists of operational technology server to manage PLCs and HMI again. PLC and HMI, which are in charge of control automation, perform direct connection with OT servers, application systems for factory operation, robots for on-site automation, and production facilities, so the development of security technology in a smart factory environment is demanded. However, smart factories in the SME environment are often composed of systems that used to operate in closed environments in the past, so there exist a vulnerable part to security in the current environment where they operate in conjunction with the outside through the Internet. In order to achieve the internalization of smart factory security in this SME environment, it is necessary to establish a process according to the IEC 62443-4-1 Secure Product Development Life cycle at the stage of smart factory SW and HW development. In addition, it is necessary to introduce a suitable development methodology that considers IEC 62443-4-2 Component security requirements and IEC 62443-3 System security requirements. Therefore, this paper proposes an application plan for the IEC 62443 based development security process to provide security internalization to smart factories in an SME environment.

SME(small and medium-sized enterprise) 환경의 스마트제조 환경에서는 실제 제조라인에서 동작하는 센서(Sensor) 및 액추에이터(Actuator)와 이를 관리하는 PLC(Programmable Logic Controller), 더불어 그러한 PLC를 제어 및 관리하는 HMI(Human-Machine Interface), 그리고 다시 PLC와 HMI를 관리하는 OT(Operational Technology)서버로 구성되어 있으며, 제어자동화를 담당하는 PLC 및 HMI는 공장운영을 위한 응용시스템인 OT서버 및 현장 자동화를 위한 로봇, 생산설비와의 직접적인 연결을 수행하고 있어서 스마트제조 환경에서 보안 기술의 개발이 중점적으로 필요한 영역이다. 하지만, SME 환경의 스마트제조에서는 과거의 폐쇄 환경에서 동작하던 시스템으로 구성되어 있는 경우가 상당하여 인터넷을 통해 외부와 연동되어 동작하게 되는 현재의 환경에서는 보안에 취약한 부분이 존재한다. 이러한 SME 환경의 스마트제조 보안 내재화를 이루기 위해서는, 스마트제조 SW 및 HW 개발 단계에서 IEC 62443-4-1 Secure Product Development Lifecycle에 따른 프로세스 정립 및 IEC 62443-4-2 Component 보안 요구사항과 IEC 62443-3-3 System 보안 요구사항에 적합한 개발 방법론의 도입이 필요하다. 따라서, 본 논문에서는 SME 환경에서의 스마트제조에 보안 내재화를 제공하기 위한 IEC 62443 기반의 개발 보안 생애주기 프로세스에 대한 적용 방안을 제안한다.

Keywords

Acknowledgement

이 논문은 2022년도 과학기술정보통신부의 재원으로 IITP의 지원을 받아 수행된 연구임 (No.2021-0-01774, IEC 62443 기반의 스마트공장 보안 내재화 및 임베디드 기기 보안 기술 개발).

References

  1. M. K. Gil, "In 2021, the first year of OT security... Cooperation between ICS operators, manufacturers, and security vendors is essential" [Internet], https://www.dailysecu.com/news/articleView.html?idxno=110872.
  2. Hugh Taylor, "News Insights: Gangnam Industrial Style: Apt Campaign Targets Korean Industrial Companies - Cyberx" [Internet], https://journalofcyberpolicy.com/2019/12/17/news-insights-gangnam-industrial-style-apt-campaign-targets-korean-industrial-companies-cyberx/.
  3. The White House, "FACT SHEET: President Signs Executive Order Charting New Course to Improve the Nation's Cybersecurity and Protect Federal Government Networks" [Internet], https://www.whitehouse.gov/briefing-room/statements-releases/2021/05/12/fact-sheet-president-signs-executive-order-charting-new-course-to-improve-the-nations-cybersecurity-and-protect-federal-government-networks/.
  4. IEC 62443-4-1:2018, "Security for industrial automation and control systems - Part 4-1: Secure product development lifecycle requirements," Jan. 15, 2018.
  5. IEC Editorial Team, "Understanding IEC 62443" International Electrotechnical Commission News & blogs, Feb. 26, 2021, [Internet], https://www.iec.ch/blog/understandingiec-62443.
  6. IEC TS 62443-1-1:2009, Industrial communication networks - Network and system security - Part 1-1: Terminology, concepts and models, Jul. 30, 2009.
  7. IEC 62443-2-1:2010, Industrial communication networks - Network and system security - Part 2-1: Establishing an industrial automation and control system security program, Nov. 10, 2010.
  8. IEC TR 62443-2-3:2015, Security for industrial automation and control systems - Part 2-3: Patch management in the IACS environment, Jun. 30, 2015.
  9. IEC TR 62443-3-1:2009, Industrial communication networks - Network and system security - Part 3-1: Security technologies for industrial automation and control systems, Jul. 30, 2009.
  10. IEC TR 62443-2-3:2015, Security for industrial automation and control systems - Part 2-3: Patch management in the IACS environment, Jun. 30, 2015.
  11. IEC 62443-3-3:2013, Industrial communication networks - Network and system security - Part 3-3: System security requirements and security levels, Aug. 7, 2013.
  12. IEC 62443-4-2:2019, Security for industrial automation and control systems - Part 4-2: Technical security requirements for IACS components, Feb. 27, 2019.
  13. ISO/IEC/IEEE 24748-1:2018, Systems and software engineering - Life cycle management - Part 1: Guidelines for life cycle management, Nov. 2018.
  14. ISO/IEC/IEEE 15288:2015, Systems and software engineering - System life cycle processes, May 2015.
  15. ISO/IEC/IEEE 12207:2017, Systems and software engineering - Software life cycle processes, Nov. 2017.
  16. Kilian Marty, "How to implement Cyber Security acc. to IEC 62443," CertX, Nov. 12, 2020, https://certx.com/cybersecurity/how-to-implement-cyber-security-acc-to-iec-62443-ep-4-penetrations-tests.
  17. J. J. Ha, J. T. Kim, S. S. Park, and K.h. Han, "A study on threat analysis and risk assessment in a smart manufacturing environment based on IEC 62443," KICS Fall Conference 2021, Nov. 18, 2021.
  18. ISO/SAE 21434:2021, Road vehicles - Cybersecurity engineering, August, 2021
  19. The MITRE Corporation, CVE Program [Internet], https://www.cve.org/.
  20. A. Shostack, "Experiences threat modeling at microsoft," MODSEC@ MoDELS 2008, 35, 2008.
  21. ISO/IEC 29192-2:2019, Information security - Lightweight cryptography - Part 2: Block ciphers, Nov. 2019.
  22. KS X 3246:2016, 128-bit block cipher LEA, Oct. 20. 2016.