KR102048776B1 - Diagnostic system for vulnerabilities of information security based on port logistics information system - Google Patents

Abstract

The present invention relates to an information security vulnerability diagnosis system of a port logistics information system for processing, sharing, aggregating and analyzing information related to sea transportation.
The present invention is individually installed in a plurality of port logistics information systems and equipment operating in a closed network, periodically checking security vulnerability diagnosis items according to the operating system and characteristics to be diagnosed, and storing and transmitting the check result as a log file An internal diagnostic server that identifies an agent module, a plurality of installed agent modules, and collects log files checked by each agent module, is connected to an external network through the internal diagnostic server and a communication module, and through the internal diagnostic server. External analysis server that derives risk analysis and improvement of security vulnerability by receiving the collected data, and the vulnerability diagnosis item checked by the agent module includes at least account management and patch management diagnosis items of the corresponding port logistics information system. Included. According to the present invention, agents corresponding to each operating system of various information systems are installed, and the information on the port logistics information system as the security vulnerability diagnosis is continuously performed through the internal diagnosis server connected to each installed agent and the closed network. Security The safety level is not limited to some devices and can be improved overall.

Description

Diagnostic system for vulnerabilities of information security based on port logistics information system}

The present invention relates to an information security vulnerability diagnosis system of a port logistics information system for processing, sharing, aggregating and analyzing information related to sea transportation.

The port logistics information system is configured to promptly collect all the data or information associated with the movement of cargo entering and leaving the port, to efficiently store or process it, and to provide users with relevant information in a timely manner.

FIG. 1 is a diagram for schematically explaining a structure of a general port container terminal, and FIG. 2 is a diagram for explaining an operation process of some systems among various port logistics information systems.

Referring to these drawings, the port container terminal for logistics transport includes a berth for anchoring vessels, a yard for loading container cargo, and a gate for managing access to the yard for container cargo. And equipment for transporting container cargo (such as quay cranes, trailers, yard cranes, reach stackers, top handlers, forklifts, etc.).

In the port container terminal configured as described above, various port logistics information systems are operated for efficient management and operation of port management.

For example, Port-MIS (Port Management Information System) operated at the Port Container Terminal promotes efficient port management operations and supports policy decisions for scientific management of ports.

The Port-MIS is a comprehensive information system installed and operated by port authorities to provide convenience to port users.It is used in 28 trade ports nationwide and comprehensively collects information on vessels' entry / exit, cargo, and port facilities. Manage.

In addition, the port logistics information system operated at the port container terminal includes the import and export logistics information service system (Single Window system), container terminal operation information system (ATOMS), global container tracking information system (GCTS), and terminal operation system (Terminal Operation System). ), And the like.

The import and export logistics information service system is a government-wide system that enables various logistics entities to handle import and export logistics-related tasks through a single window. Port logistics entities (shippers, terminals, carriers, inspectors, etc.) In collaboration with transit and transshipment, information sharing and port logistics lead time can be shortened.

The container terminal operation information system (ATOMS) is for planning, allocating, scheduling, controlling, and monitoring all production activities of the container terminal, maximizing the productivity and efficiency of the container terminal.

The Global Container Tracking System (GCTS) establishes an RFID-based logistics information network and automatically collects and extracts the logistics bases of vehicles and containers and the results of device and unloading operations in real time. Inquires the location tracking of containers and cargoes and provides information.

The terminal operation system (terminal operation system) is to perform the information exchange between the port operating system and the administrator using a wireless network installed inside the yard and a terminal equipped with a terminal operating system (TOS).

In other words, when the overall schedule of work at the berths, yards, and gates is established, the port operations system manager dispatches and directs the operators who will drive the quay cranes, trailers, reach stackers and tower handlers, and forks. Done.

In addition, the port operation system manager transmits container import / export information and external vehicle (truck or trailer) information to the gate manager using the terminal operating system (TOS).

In addition, as shown in Figure 2, the vehicle transport system in the port container terminal is carried out in a variety of processes, such as the process (a), the operation process (b), port container automation terminal operating process (c), etc. Information systems are linked to process information for port logistics management.

On the other hand, the information protection that is handled for port logistics management needs to be performed in the entire system area, such as operating system (OS), N / W (network), database management system (DBMS), applications from the perspective of information systems.

In particular, in the case of the port logistics system in which various information systems and equipment are operated, security vulnerabilities may occur for each OS and equipment.In the case of information security problems in the port container terminal, domestic export and import business Because of the risk of paralysis, the development of diagnostic techniques for security vulnerabilities is required.

KR 10-1548644 B1 KR 10-1105382 B1

An object of the present invention is to provide a port logistics system for diagnosing weaknesses in the port logistics information associated with various port logistics information systems used in the port container terminal and various equipment (yard tractor (YT), quay-crane, equipment crane, automation equipment, etc.). It is to provide information security vulnerability diagnosis system of information system.

The present invention is individually installed in a plurality of port logistics information systems and equipment operating in a closed network, periodically checking security vulnerability diagnosis items according to the operating system and characteristics to be diagnosed, and storing and transmitting the check result as a log file An internal diagnostic server that identifies an agent module, a plurality of installed agent modules, and collects log files checked by each agent module, is connected to an external network through the internal diagnostic server and a communication module, and through the internal diagnostic server. External analysis server that derives risk analysis and improvement of security vulnerability by receiving the collected data, and the vulnerability diagnosis item checked by the agent module includes at least account management and patch management diagnosis items of the corresponding port logistics information system. Characterized in that it is included.

The vulnerability diagnosis item checked by the agent module may further include one or more of file and directory management, service management, log management, security management, DB management, access management, option management, and function management according to a diagnosis target operating system. It is done.

The plurality of port logistics information systems and equipment further include a physical environment sensor for detecting a physical environment change, and the internal diagnosis server receives physical environment change information from the physical environment sensor to perform physical security diagnosis. And a software security diagnostic module for collecting data according to a diagnostic item from the agent module, receiving change information on system operation, and performing a software security diagnosis.

The internal diagnosis server is connected to any one of a plurality of port logistics information system that operates in a closed network is characterized in that it is operable.

According to the present invention, an agent corresponding to each operating system of various information systems is installed, and the information security safety level of the port logistics information system as the security vulnerability diagnosis is continuously performed through the internal diagnosis server connected to each installed agent and the closed network. This is not limited to some devices and can be improved overall.

In particular, since the monitoring of vulnerabilities that must inevitably take risks due to the characteristics of the application or the aging system is possible, there is an advantage that can effectively reduce the system failure due to the operator's mistake or unavoidable intention.

In addition, the internal diagnosis server is built inside the closed network of the port logistics information system, thereby improving safety from external attacks, and logically networked in case of emergency by connecting to the analysis server provided in the external network through an encrypted communication module. The separation has the advantage of preserving the diagnosis results.

In addition, in the present invention, the internal diagnostic server includes a physical security module and a software security module.

Accordingly, in the present invention, a physical security diagnosis is performed by receiving a detection signal from a physical environment sensor provided in each information system and device through the physical security module, and receiving a log file from an agent installed in each information system and device. As the software security diagnosis is performed by the software security module, more effective security vulnerability diagnosis can be performed.

1 is a view for schematically explaining the structure of a typical port container terminal.
2 is a view for explaining the operating process of some of the various port logistics information system.
3 is a view showing an embodiment of the information security vulnerability diagnosis system of the port logistics information system according to the present invention.
4 is a view showing another embodiment of the information security vulnerability diagnosis system of the port logistics information system according to the present invention.
5 is a view for explaining the diagnostic data collection structure of the information security vulnerability diagnosis system of the port logistics information system according to the present invention.
Figure 6 is a view for explaining the information security vulnerability diagnosis process of the port logistics information system according to the present invention.
7 to 14 are diagrams showing diagnostic items for each vulnerability diagnosis target.
15 is a view showing an embodiment of an information security vulnerability diagnosis result report according to the present invention.

Hereinafter, specific embodiments of the present invention will be described with reference to the drawings. However, the spirit of the present invention is not limited to the embodiments presented, and those skilled in the art who understand the spirit of the present invention can easily suggest other embodiments within the scope of the same idea.

Figure 3 is a view showing an embodiment of the information security vulnerability diagnosis system of the port logistics information system according to the present invention, Figure 4 is a view for explaining the diagnostic data collection structure of the vulnerability diagnosis system according to the present invention Is shown.

Referring to these drawings, the information security vulnerability diagnosis system of the port logistics information system according to the present invention (hereinafter referred to as a 'vulnerability diagnosis system') is a plurality of information systems 100 and a plurality of equipment operated by a closed network 300 Analyzing the data collected from the internal diagnostic server 600 and the internal diagnostic server 600 to collect and analyze the data transmitted from the agent module (410 to 460) and the agent module (410 to 460) that is installed separately in the It is configured to include an external analysis server 800.

The agent modules 410 to 460 may be installed in a plurality of information systems 100 connected to the internal diagnosis server 600, and developed for each version according to the operating system and characteristics of each information system 100. And driven.

The agent modules 410 to 460 installed and driven as described above perform periodic checks on security vulnerability diagnosis items according to the corresponding operating system, and store the check result in a log file to transmit to the internal diagnosis server 600. do.

That is, the agent modules 410 to 460 record the contents corresponding to the diagnostic items to be described below among all the usage history of the installed information system 100 in a log file and transmit them to the internal diagnosis server 600. The log file may be stored in a storage space of the installed information system 100.

Meanwhile, the internal diagnosis server 600 identifies each agent module 410 to 460, collects and stores log files checked by each agent module 410 to 460.

In addition, the internal diagnosis server 600 allows each agent module 410 to 460 installed periodically through diagnostic scheduling to perform vulnerability diagnosis, and provides a function of reporting the execution history periodically or aperiodically. .

In addition, the internal diagnosis server 600 may divide each information system 100 into fields (servers, network DBMSs, etc.) to provide a safety index for each field as well as a safety index for each information system 100. It can record the removal history of the vulnerability and support the management of the acceptance items.

In addition, the internal analysis server 600 may perform a logical network separation function to preserve diagnostic evidence.

The internal diagnosis server 600 providing the above function transmits the data collected by the agent modules 410 to 460 to the external analysis server 800 connected to the external network 500 through the communication module 680. Collect and deliver.

The external analysis server 800 receives data collected from the internal diagnosis server 600 to derive risk analysis and improvement for security vulnerabilities.

That is, the external analysis server 800 is connected to the external network 500 through the communication module 680 separately from the internal diagnosis server 600 to perform the analysis work outside the closed network 300, the internal Data transmitted from the diagnostic server 600 is encrypted and transmitted by the communication module 680.

On the other hand, each of the information system 100 may be further provided with a physical environmental sensor (210 to 260).

The physical environment sensors 210 to 260 are configured to check physical environment changes such as temperature, humidity, impact amount, etc. of each information system 100. Each information system 100 includes at least one physical environment of at least temperature or humidity. Sensors can be installed.

In addition, the internal diagnosis server 600 receives the environmental change information through the physical environment sensors 210 to 260 installed as described above, stores it, and analyzes it.

Analysis of the physical environment change can be made by comparing the measured values of the physical environment sensor (210 to 260) with a set range, the setting range is divided into a plurality of steps to distinguish the security level.

On the other hand, the internal diagnostic server 600 is a physical security diagnostic module 620 is connected to each physical environment sensor (210 to 260) and the software security diagnostic module is connected to each of the agents (410 to 460) 640, and includes a data manager 660, a main controller 610, and the aforementioned communication module 680 for managing received data.

In the present embodiment, the physical security diagnosis module 620 may be configured of Arduino, and is connected to a plurality of devices for operating a port logistics system together with the physical environment sensors 210 to 260.

In addition, in the present embodiment, the software security diagnostic module 640 is configured as a Raspberry Pi to remove unnecessary resources generated by using a commercial operating system or a device, thereby securing the closure to enhance security aspects. have.

On the other hand, the internal analysis server 600 of the above function is formed in a separate configuration that is directly connected to the closed network 300 as shown in FIG. 3 or connected to any one of the plurality of information systems 100 as shown in FIG. It may be configured in a portable form.

5 is a view showing another embodiment of a weak diagnosis system according to the present invention.

Referring to the drawings, the portable diagnostic apparatus 700 according to another embodiment of the present invention is described above together with the information system 100 directly connected to any one of the plurality of information systems 100 connected by the closed network 300. Perform the function of the internal diagnostic server 600.

In detail, the portable diagnostic apparatus 700 includes a physical module 720 connected to the physical environment sensors 210 to 260 or a plurality of devices to collect data, and a plurality of agent modules connected to the closed network 300. 410 to 450 are configured to include a software module 740 for collecting data.

And, the communication function for the connection with the external network 500 utilizes the communication means of the connected information system 100, the data storage function is the information system if the storage space of the connected information system 100 is secured enough You can take advantage of the storage space, you can secure the storage space in a separate memory.

Hereinafter will be described the operation of the vulnerability diagnosis system to the present invention with a focus on the internal diagnostic server 600 fixedly installed.

6 is a view for explaining the information security vulnerability diagnosis process of the port logistics information system according to the present invention, Figures 7 to 14 are diagrams showing the diagnostic items for each vulnerability diagnosis target.

Referring to these drawings, first, in the vulnerability diagnosis system according to the present invention, a step S100 of connecting to a plurality of information systems 100 and a plurality of devices through a closed network 300 and installing an agent is performed.

In the step (S100) check whether the agent corresponding to the operating system is installed according to the operating system of the connected information system 100 and the device, the agent of the operating system is installed on the information system 100 and the device is not installed agent do.

After the agent corresponding to the operating system of each information system 100 and the device is installed as described above, collecting data according to the diagnostic item from the installed agent (S200) is performed.

In the step (S200), the diagnostic items for data collection include account management, patch management diagnostic items, and file and directory management, service management, log management, security management, DB management, access management, At least one of option management and function management is further included.

In detail, when the Unix-based operating system is applied, diagnostic items for account management, file and directory management, service management, patch management, and log management are included as shown in FIGS. 7 and 8.

In the case of a system to which a Windows-based operating system is applied, diagnostic items for account management, service management, patch management, log management, and security management DB management are included as shown in FIGS. 9 and 10.

In the case of the DBMS, diagnostic items for account management, access management, option management, patch management, and log management are included, and detailed diagnosis is as shown in FIG.

Diagnostic items for diagnosing vulnerabilities of the network include items such as account management, access management, option management, patch management, and log management, as shown in FIG. 12. Items for diagnosing vulnerabilities of security equipment are shown in FIG. As mentioned, it includes account management, access management, patch management, log management, and function management.

In addition, in the case of a PC connected to the closed network 300 according to the present invention, as shown in FIG. 14, the log data of the corresponding item is installed by an agent including the account management, service management, patch management, and security management items. Collected and saved to file.

In addition, in the present invention, the step (S300) of collecting environmental change data from the physical environment sensors 410 to 460 installed in each information system 100 and a plurality of devices is performed separately from the step (S200).

In the step (S300) to collect the physical environment changes, such as temperature, humidity, impact amount, the data collected separately from the step (S200) is stored as a log file.

That is, the step (S200) and step (S300) are each performed through the software security diagnosis module 640 consisting of Raspberry Pi and the physical security diagnosis module 620 consisting of Arduino, respectively, collected as described above Each piece of information is saved as a log file.

Meanwhile, the log files collected and stored through the steps S200 and S300 are transmitted to the internal diagnosis server 600 from the information system 100 and the device and stored therein (S400).

In step S400, the internal diagnosis server 600 identifies a plurality of installed agents and equipment, collects and analyzes log files checked by each agent, and stores analysis results.

15 is a view showing an embodiment of an information security vulnerability diagnosis result report according to the present invention.

As shown, the internal diagnosis server 600 identifies and shows the system status of the information system using the Windows operating system, and statistically analyzes the diagnosis result for each area of the information system.

To this end, the internal diagnosis server 600 assigns the importance of the vulnerability diagnosis item and gives a score as shown in the following table.

The criteria for evaluation are as follows: Good (the state of the information system setting applied to the check item), weakness (the state of the information system setting not applied to the check item), N / A (the information system) For operational environments, these requirements are not included).

Diagnostic result Importance of Vulnerability Diagnostics H ( High ) M ( Medium ) L ( Low ) Vulnerability found 10 points 8 points 6 points Vulnerability Removal 0 points 0 points 0 points N / A (not applicable) Exclude from Vulnerability Safety Index Calculation

In addition, the safety index is derived based on the scores added as described above, and the information protection level as shown in the following table is defined according to the derivation result.

Evaluation standard Safety Index Justice Great 90% <Result (D) ≤ 100% Almost all security settings are complete Good 80% <Result (D) ≤ 90% Most security settings are complete usually 70% <Result (D) ≤ 80% Presence of short-term action due to risk Inadequate 60% <Result (D) ≤ 70% Short-term action priority level required due to external invasion weak 0% <Result (D) ≤ 60% High level of external intrusion risk required emergency security setting

On the other hand, the internal analysis server 600 transmits the stored data to the external analysis server 800 while performing the analysis as described above (S500).

In step S500, the collected data is encrypted using the communication module 680 and then transmitted through the external network 500.

In addition, the external analysis server 800 that receives the encrypted data through the step S500 performs a step of generating a security vulnerability analysis and an analysis result report after decrypting the received data (S600).

In the step (S600), the diagnostic results are counted by type of information system, and the results are displayed in a table and a chart, and are stored separately from the internal diagnosis server 600.

In addition, the result analyzed in step S600 is further transmitted to the internal diagnosis server 600, and the step S700 of confirming and storing through the internal diagnosis server 600 is further performed.

That is, in the present invention, the results of vulnerability analysis and log data for the vulnerability analysis may be stored in the internal analysis server 600 and the external analysis server 800, respectively. The internal analysis server 600 and the communication module 680 may be used. The external analysis server 800 repeatedly performs a logical connection, and can block unauthorized access attempts so that the external analysis server 800 can be connected to a commercial network if necessary while maintaining the characteristics of the closed network 300.

100 ........ Information System 210 ~ 260 ... Physical Environment Sensor
300 ........ Closed network 410 ~ 460 .... Agent
500 ........ External network 600 ........ Internal diagnostic server
800 ........ External Analysis Server

Claims (5)

An agent module that is individually installed in a plurality of information systems and equipment operating in a closed network, periodically checks a security vulnerability diagnosis item according to an operating system and characteristics to be diagnosed, and stores and transmits the check result as a log file;
An internal diagnostic server for identifying a plurality of installed agent modules and equipment, and collecting and analyzing log files checked by each agent module; And
And an external analysis server connected to the internal diagnosis server and an external network through a communication module, and receiving data collected through the internal diagnosis server to derive risk analysis and improvement on security vulnerabilities.
In the vulnerability diagnosis item checked by the agent module,
At least account management, patch management diagnostic items of the corresponding port logistics information system,
The plurality of information systems and equipment information security vulnerability diagnosis system of the port logistics information system, characterized in that further comprising a physical environment sensor for detecting a change in the physical environment.
The method of claim 1,
In the vulnerability diagnosis item checked by the agent module,
Diagnosis of information security vulnerabilities of port logistics information system further comprising one or more of file and directory management, service management, log management, security management, DB management, access management, option management, and function management depending on the operating system to be diagnosed system.
An agent module that is individually installed in a plurality of information systems and equipment operating in a closed network, periodically checks a security vulnerability diagnosis item according to an operating system and characteristics to be diagnosed, and stores and transmits the check result as a log file;
An internal diagnostic server for identifying a plurality of installed agent modules and equipment, and collecting and analyzing log files checked by each agent module; And
And an external analysis server connected to the internal diagnosis server and an external network through a communication module, and receiving data collected through the internal diagnosis server to derive risk analysis and improvement on security vulnerabilities.
In the vulnerability diagnosis item checked by the agent module,
At least account management, patch management diagnostic items of the corresponding port logistics information system,
The plurality of information systems and equipment is further provided with a physical environmental sensor for detecting a change in the physical environment,
The internal diagnostic server
A physical security diagnosis module connected to a plurality of devices and configured to receive physical environment change information from the physical environment sensor and perform physical security diagnosis;
And a software security diagnostic module for collecting data according to the diagnostic items from the agent module and receiving change information on system operation to perform a software security diagnosis.
The method of claim 3, wherein
The software security diagnostic module is composed of a Raspberry Pi, the physical security diagnostic module information security vulnerability diagnosis system of the port logistics information system, characterized in that composed of Arduino.
The method of claim 1, wherein the internal diagnostic server,
Information security weakness diagnosis system of the port logistics information system, characterized in that the operation is connected to any one of a plurality of port logistics information system operating in a closed network.

Images