Quantum security communication device integrated process control system and method

Abstract

The present invention relates to a process control system integrated with a quantum security communication device, comprising: (1) a process control module that generates process control data; (2) a Device Identity Module (DIM) that is implemented as a separate independent chipset and can perform quantum security key injection according to a manager's settings and includes a quantum security device identification key; (3) a security module that generates quantum security process control data by performing quantum security operations on the process control data using the quantum security device identification key and the quantum security key through the DIM; and (4) a process control unit comprising a communication interface unit that transmits the quantum security process control data to a given communication environment; and a central control processing unit that receives the quantum security process control data, extracts the device identification key, determines the quantum security key based on the device identification key to detect the process control data, and processes the quantum security key injection by performing quantum key distribution in advance on the DIM.

Description

Technology Field

[0001] The present invention relates to a process control technology integrated with a quantum security communication device, and more specifically, to a process control system and method integrated with a quantum security communication device that supports mutual device identification and enables the transmission and reception of secure process control data through quantum security communication between each communication entity of a process control system. Background Technology

[0003] There are various types of industries, but process control is widely used in the field known as the equipment industry.

[0004] In the process industry, while various controls can be applied to each individual device, most devices are often interconnected—for example, material generated in Device A moves directly through a pipe to Device B, and its outlet is connected to Device C—therefore, control for operating the entire process is required alongside the control of individual devices.

[0005] Such device-level control and overall control are, of course, not possible by human hands but are carried out automatically. This is process automation, and the control technology that governs it is process control technology.

[0006] The process control system controls quantities such as temperature, pressure, flow rate, liquid level, and pH from various devices installed at industrial sites, processes and analyzes the data through a central processing unit and internal / external programs to control connected devices and controllers, and operates and manages the entire system through a central system.

[0007] Control facilities, such as process control systems, control control information such as temperature, pressure, flow rate, liquid level, and pH; these control systems support the transmission of process control data based on communication to perform control and management.

[0008] A process control communication system related to a process control system required a security system applicable between constituent entities to enable the transmission of reliable process control data through secure bidirectional communication between control facilities, upper systems, and central systems. Prior art literature

[0010] Korean Registered Patent No. 10-1575042 (December 1, 2015) The problem to be solved

[0011] One embodiment of the present invention aims to provide a quantum security communication device integrated process control system and method capable of supporting mutual device identification and transmitting and receiving secure process control data through quantum security communication between each communication entity of a process control system.

[0012] One embodiment of the present invention aims to provide a quantum security communication device integrated process control system and method that enhances security by encrypting and decrypting process control data with a quantum security module so that information is not exposed in the event of system hacking.

[0013] One embodiment of the present invention aims to provide a quantum security communication device integrated process control system and method that supports both fixed and mobile types of process controllers and supports mutual identification functions between the processor-controlled device and the controller, thereby enabling secure quantum security communication with a higher-level system utilizing a virtualized cloud environment, not just with a fixed controller. means of solving the problem

[0015] Among the embodiments, the quantum security communication device integrated process control system comprises: (1) a process control module that generates process control data; (2) a Device Identity Module (DIM) that is implemented as a separate independent chipset and can perform quantum security key injection according to the administrator's settings and includes a quantum security device identification key; (3) a security module that generates quantum security process control data by performing quantum security operations on the process control data using the quantum security device identification key and the quantum security key through the DIM; and (4) a process control unit including a communication interface unit that transmits the quantum security process control data to a given communication environment; and a central control processing unit that receives the quantum security process control data, extracts the device identification key, determines the quantum security key based on the device identification key to detect the process control data, and processes the quantum security key injection by performing quantum key distribution in advance on the DIM.

[0016] The above DIM may include a reset interface that receives a reset signal, and quantum security firmware that receives the quantum security key from the central control processing unit based on the reset signal and performs a quantum security operation on the device unique number using the quantum security key to generate the quantum security device identification key.

[0017] The above DIM may further include a UART interface that is connected to the process control module, provides the process control data to the quantum security firmware, and provides the quantum security process control data generated from the quantum security firmware to the communication interface unit.

[0018] The above quantum security firmware can receive the process control data and perform a quantum security operation based on the quantum security key to generate intermediate quantum security process control data.

[0019] The above quantum security firmware can provide the quantum security process control data in the form of a transmittable data structure including the intermediate quantum security process control data and the quantum security device identification key to the communication interface unit by generating the DUSS (Different Unit Same Security) protocol specification, which is independent of the given communication environment.

[0020] delete

[0021] If the DIM does not operate normally, the security module can receive a public key from the central control processing unit and perform a security operation on the process control data using the public key to replace the quantum security process control data with public key security process control data.

[0022] The central control processing unit can detect whether the DIM is operating normally to the process control unit, and if so, perform the quantum security key injection.

[0023] The central control processing unit above may provide an RSA or ECC-based public key to the security module if the DIM does not operate normally.

[0024] Among the embodiments, the quantum security communication device integrated process control method comprises: a step of generating process control data; a step of generating quantum security process control data by performing quantum security operations on the process control data using the quantum security device identification key and the quantum security key through a Device Identity Module (DIM) which is implemented as a separate independent chipset and can perform quantum security key injection according to the administrator's settings and includes a quantum security device identification key; a step of transmitting the quantum security process control data to a given communication environment; and a step of receiving the quantum security process control data, extracting the device identification key, determining the quantum security key based on the device identification key to detect the process control data, and processing the quantum security key injection by performing quantum key distribution in advance on the DIM. Effects of the invention

[0026] The disclosed technology may have the following effects. However, this does not mean that a specific embodiment must include all of the following effects or only the following effects; therefore, the scope of the rights of the disclosed technology should not be understood as being limited by this.

[0027] A quantum security communication device integrated process control system and method according to one embodiment of the present invention can support mutual device identification and transmit and receive secure process control data through quantum security communication between each communication entity of the process control system.

[0028] A quantum security communication device integrated process control system and method according to one embodiment of the present invention can improve security by encrypting and decrypting process control data with a quantum security module so that information is not exposed in the event of system hacking.

[0029] A quantum security communication device integrated process control system and method according to one embodiment of the present invention supports both fixed and mobile types of process controllers and supports mutual identification functions between the processor-controlled target device and the controller, thereby enabling secure quantum security communication with a higher-level system applying a virtualized cloud environment, not just with a fixed controller. Brief explanation of the drawing

[0031] FIG. 1 is a diagram showing a quantum security communication device integrated process control system according to one embodiment of the present invention. Figure 2 is a block diagram showing the Device Identity Module (DIM) of the process control unit in Figure 1. Figure 3 is a block diagram showing the functional configuration of quantum security firmware in the Device Identity Module (DIM) in Figure 2. FIG. 4 is a flowchart showing the quantum security communication process of a quantum security communication device integrated process control system according to one embodiment. Specific details for implementing the invention

[0032] The description of the present invention is merely an example for structural or functional explanation, and therefore the scope of the present invention should not be interpreted as being limited by the examples described in the text. That is, since the examples are subject to various modifications and may take various forms, the scope of the present invention should be understood to include equivalents capable of realizing the technical concept. Furthermore, the objectives or effects presented in the present invention do not imply that a specific example must include all of them or only such effects; therefore, the scope of the present invention should not be understood as being limited by them.

[0033] Meanwhile, the meaning of the terms described in this application should be understood as follows.

[0034] Terms such as "first," "second," etc., are intended to distinguish one component from another, and the scope of rights shall not be limited by these terms. For example, the first component may be named the second component, and similarly, the second component may be named the first component.

[0035] When it is stated that one component is "connected" to another component, it should be understood that it may be directly connected to that other component, or that there may be other components in between. Conversely, when it is stated that one component is "directly connected" to another component, it should be understood that there are no other components in between. Meanwhile, other expressions describing the relationships between components, such as "between" and "exactly between," or "adjacent to" and "directly adjacent to," should be interpreted in the same way.

[0036] A singular expression should be understood to include a plural expression unless the context clearly indicates otherwise, and terms such as "include" or "have" are intended to specify the existence of the implemented features, numbers, steps, actions, components, parts, or combinations thereof, and should be understood not to preclude the existence or addition of one or more other features, numbers, steps, actions, components, parts, or combinations thereof.

[0037] In each step, identifiers (e.g., a, b, c, etc.) are used for convenience of explanation and do not describe the order of the steps; the steps may occur differently from the specified order unless a specific order is clearly indicated in the context. That is, the steps may occur in the same order as specified, may be performed substantially simultaneously, or may be performed in the reverse order.

[0038] The present invention may be implemented as computer-readable code on a computer-readable recording medium, and the computer-readable recording medium includes all types of recording devices in which data that can be read by a computer system is stored. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage device, etc. Additionally, the computer-readable recording medium may be distributed across networked computer systems, so that computer-readable code can be stored and executed in a distributed manner.

[0039] Unless otherwise defined, all terms used herein have the same meaning as generally understood by those skilled in the art to which this invention pertains. Terms defined in commonly used dictionaries should be interpreted as having meanings consistent with the context of the relevant technology and should not be interpreted as having an ideal or overly formal meaning unless explicitly defined in this application.

[0041] FIG. 1 is a diagram showing a quantum security communication device integrated process control system according to one embodiment of the present invention.

[0042] Referring to FIG. 1, the quantum security communication device integrated process control system (10) may include a process control unit (100) and a central control processing unit (200). Here, the process control unit (100) and the central control processing unit (200) may be connected via wired communication such as Ethernet and serial communication.

[0043] The process control unit (100) may correspond to a process control panel in which each control facility is installed, and may include a process control module (110), a DIM (Device Identity Module) (130), a security module (150), and a communication interface unit (170).

[0044] Control equipment is a device to be controlled installed at an industrial site.

[0045] The process control module (110) can generate process control data. Here, the process control data may include data representing a control quantity that is the subject of control, such as temperature, pressure, flow rate, liquid level, pH, etc.

[0046] The DIM (Device Identity Module) (130) is implemented as a separate, independent chipset and can perform the injection of a quantum security key according to the administrator's settings and can include a quantum security device identification key. The DIM (130) can receive a quantum security key from a central control processing unit (200) and can generate a quantum security device identification key by performing quantum security on a device unique number using the quantum security key.

[0047] Quantum-Safe Security refers to security technology that cannot be breached even by the computational power of quantum computers utilizing the principles of quantum mechanics. Currently, quantum security is divided into hardware-based Quantum Key Distribution (QKD) and software-based Post-Quantum Cryptography (PQC). QKD refers to a technology that enables two users to secretly share a key (a type of random password) necessary for encrypted communication by utilizing the no-cloning theorem and the collapse of the wave function phenomena in quantum mechanics. PQC can provide not only key distribution but also all the functions necessary for secure encrypted communication. In other words, it can provide encrypted communication involving the steps of generating a password key randomly through a Pseudo Random Number Generator (PRNG) or a Quantum Random Number Generator (QRNG), user authentication, key distribution (or sharing), and encryption using the shared key through a secret key (symmetric key) encryption algorithm such as AES or SEED; in the case of public key cryptography (PQC), encrypted communication is possible without using a secret key (symmetric key) encryption algorithm.

[0048] Here, DIM (130) performs quantum security by generating random numbers through quantum random numbers.

[0049] The security module (150) can generate quantum security process control data by performing quantum security operations on process control data using a quantum security device identification key and a quantum security key through the DIM (130). If the DIM (130) does not operate normally, the security module (150) can receive a public key from the central control processing unit (200) and perform security operations on process control data using the public key to replace the quantum security process control data with public key security process control data. The security module (150) can perform encryption and decryption of the process control data, and a key such as a quantum security key or a public key may be used in this process.

[0050] Public-key cryptography is an asymmetric key method in which different keys are used for encryption and decryption. It involves generating a key pair consisting of a public key and a private key using a specific algorithm, then encrypting with the public key and decrypting with the private key.

[0051] The communication interface unit (170) can transmit quantum security process control data for a given communication environment. Here, the communication environment refers to a communication method that can be integrated and interconnected with satellite communication, wireless communication such as 4G, 5G, 6G, WiFi, TVWS, LoRa, and wired communication methods such as Ethernet, Serial 232, 485, so there is no need to rely on the security of individual communications.

[0052] The central control processing unit (200) receives quantum security process control data, extracts a device identification key, determines a quantum security key based on the device identification key to detect the process control data, and can process quantum security key injection by performing quantum key distribution to the DIM (130) in advance. In one embodiment, the central control processing unit (200) is a higher-level system of the process control unit (100) and may correspond to a controller that controls control facilities. In this case, the central control processing unit (200) may correspond to a higher-level system that applies a virtualized cloud environment, rather than just a fixed controller.

[0053] The central control processing unit (200) detects whether the DIM (130) is operating normally, and if the DIM (130) is operating normally, it can perform quantum security key injection, and if the DIM (130) is not operating normally, it can provide an RSA or ECC-based public key to the security module (150).

[0054] RSA (Rivest, Shamir, Adleman) is a public-key cryptographic algorithm consisting of a public key and a private key; the public key is used to encrypt a message, and the private key is used to decrypt the encrypted message. ECC (Elliptic Curve Cryptosystem) is a public-key cryptographic algorithm that utilizes the mathematical properties of elliptic curves and provides stronger security compared to RSA for the same key length.

[0056] Figure 2 is a block diagram showing the Device Identity Module (DIM) of the process control unit in Figure 1.

[0057] Referring to FIG. 2, the DIM (130) of the process control unit (100) is implemented as a single chipset including a power interface (210), a reset interface (220), an SWD interface (230), a UART interface (240), quantum security firmware (250), and a quantum entropy chip (QEC) (260), and can perform the injection of a quantum security key according to the administrator's settings and can include a quantum security device identification key.

[0058] The power interface (210) can provide external input power as the power required for the operation of the DIM (130). In one embodiment, the power interface (210) can receive approximately 3.3V as power input.

[0059] The reset interface (220) can receive a reset signal to reset the quantum security firmware (250). Here, the reset signal may be provided to the reset interface (220) according to the administrator's settings. In one embodiment, the reset signal may be configured to be provided to the reset interface (220) whenever process control data is generated in the process control module (110) and provided to the DIM (130).

[0060] The SWD (Serial Wire Debug) interface (230) can provide programming and debugging to the MCU to which the quantum security firmware (250) is downloaded.

[0061] The UART interface (240) is connected to the process control module (110) and provides process control data to the quantum security firmware (250), and can provide quantum security process control data generated from the quantum security firmware (250) to the communication interface unit (170).

[0062] Quantum security firmware (250) can receive a quantum security key from a central control processing unit (200) based on a reset signal and generate a quantum security device identification key by performing quantum security on a device unique number using the quantum security key. Quantum security firmware (250) can receive process control data and generate intermediate quantum security process control data based on the quantum security key. Quantum security firmware (250) can receive process control data in a UART (Universal Asynchronous Receiver / Transmitter) communication environment. Quantum security firmware (250) can generate quantum security process data by merging the quantum security device identification key with the intermediate quantum security process control data. Quantum security firmware (250) can provide quantum security process data to a communication interface unit (170) through a DUSS (Different Unit Same Security) protocol independent of a given communication environment.

[0063] A quantum entropy chip (hereinafter referred to as QEC) (260) can generate a quantum random number entropy source (noise source) to provide analog noise to the quantum security firmware (250). At this time, the analog noise can be generated to have sufficient entropy to generate an unpredictable encryption seed. In one embodiment, the QEC (260) may correspond to a noise source operating system implemented in software such as Android, Linux, or Windows. In one embodiment, the QEC (260) may be implemented in hardware by utilizing non-deterministic phenomena in electronic circuits, such as shot noise of a Zener diode or inherent thermal noise of a semiconductor circuit, or by utilizing physical phenomena such as radiation decay. In one embodiment, the QEC (260) may be implemented by combining software and hardware.

[0065] Figure 3 is a block diagram showing the functional configuration of quantum security firmware in the Device Identity Module (DIM) in Figure 2.

[0066] Referring to FIG. 3, the quantum security firmware (250) of the DIM (130) includes a security function processing unit (310), a cryptographic algorithm processing unit (320), an important security parameter processing unit (330), a finite state processing unit (340), an instruction set-based security agent protocol processing unit (350), and an input / output data processing unit (360) to perform quantum security and generate a quantum security device identification key and quantum security process data.

[0067] The security function processing unit (310) is divided into an important security parameter management function, a cryptographic algorithm setting function, and a cryptographic algorithm execution (data input) function to provide cryptographic algorithm services to the administrator. The list of security parameters and supported cryptographic algorithms can be exemplified as shown in Tables 1 and 2 below.

[0068] [Table 1]

[0069]

[0070] [Table 2]

[0071]

[0072] The cryptographic algorithm processing unit (320) supports block ciphers such as ARIS, SEED, LEA, and HIGHT, as well as AES cryptographic algorithms and block cipher operating modes for confidentiality and authentication services such as GMAC, CMAC, CCM, and GCM. The cryptographic algorithm processing unit (320) supports the ECDSA algorithm for digital signatures and the ECDH algorithm for key setting, so that it can be applied to wireless communication such as 4G LTE, 5G, 6G, satellite, and TVWS, and IoST environments such as WiFi, LTE Cat.m1, NB-IoT, and LoRa for IoT security of drones, autonomous vehicles, robots, analog and digital traffic signal controllers.

[0073] The important security parameter processing unit (330) is a layer that processes core security parameters and public security parameters, and is responsible for the creation, setting, injection, output, storage, and zeroing of security parameters.

[0074] The finite state processing unit (340) is responsible for processing to map the state and input to the output for a finite set of input events, a finite set of output events, and a finite set of states.

[0075] The command set-based security agent protocol processing unit (350) processes CMDSAP.

[0076] The input / output data processing unit (360) provides a password algorithm service to the administrator through a password function and provides other services through a version display function, status display function, initialization function, termination function, information management function, authentication function, test function, security parameter management function, and password algorithm function.

[0078] FIG. 4 is a flowchart showing the quantum security communication process of a quantum security communication device integrated process control system according to one embodiment.

[0079] In FIG. 4, the quantum security communication device integrated process control system (10) can generate process control data through the process control unit (100) (step S410). In one embodiment, the process control unit (100) can generate process control data through the process control module (110).

[0080] The quantum security communication device integrated process control system (10) can generate quantum security process control data by performing quantum security operations on process control data through the process control unit (100) (step S420). In one embodiment, the process control unit (100) can perform quantum security operations on process control data using a quantum security device identification key and a quantum security key through a Device Identity Module (DIM) (130). Here, the DIM (130) is implemented as a separate independent chipset and can perform the injection of a quantum security key according to the administrator's settings and may include a quantum security device identification key.

[0081] The quantum security communication device integrated process control system (10) can transmit quantum security process control data to a given communication environment through a process control unit (100) (step S430). In one embodiment, the process control unit (100) can transmit quantum security process control data to a communication interface unit (170) by providing the quantum security process control data to the communication interface unit (170) through a DUSS (Different Unit Same Security) protocol independent of the given communication environment.

[0082] The quantum security communication device integrated process control system (10) can receive quantum security process control data through the central control processing unit (200), extract a device identification key, and determine a quantum security key based on the device identification key to detect the process control data (step S440). In one embodiment, the central control processing unit (200) can perform quantum key distribution in advance on the DIM (130) of the process control unit (100) to process quantum security key injection. Here, if the DIM (130) does not operate normally, the central control processing unit (200) can provide an RSA or ECC-based public key to the security module (150) of the process control unit (100) to perform security operations on the process control data using the public key. In conclusion, the quantum security communication device integrated process control system can provide an integrated security system in various communication environments.

[0084] Although the present invention has been described above with reference to preferred embodiments, those skilled in the art will understand that various modifications and changes can be made to the invention without departing from the spirit and scope of the invention as described in the following claims. Explanation of the symbols

[0086] 10: Quantum security communication device integrated process control system 100: Process Control Unit 110: Process Control Module 130: DIM (Device Identity Module) 150: Security Module 170: Communication Interface Unit 200: Central Control Processing Unit 210: Power Interface 220: Reset Interface 230: SWD interface 240: UART interface 250: Quantum Security Firmware 260: Quantum Entropy Chip (QEC) 310: Security function processing unit 320: Cryptographic algorithm processing unit 330: Important security parameter processing unit 340: Finite state processing unit 350: Command Set-Based Security Agent Protocol Processor 360: Input / Output Data Processing Unit

Claims

Claim 1 (1) a process control module that generates process control data; (2) a Device Identity Module (DIM) that is implemented as a separate independent chipset and can perform the injection of a quantum security key according to the administrator's settings and includes a quantum security device identification key; (3) a security module that generates quantum security process control data by performing a quantum security operation on the process control data such that the quantum security device identification key is included in the process control data using the quantum security device identification key and the quantum security key as inputs through the DIM; and (4) a process control unit including a communication interface unit that transmits the quantum security process control data to a given communication environment; and a central control processing unit that receives the quantum security process control data, extracts the device identification key included in the quantum security process control data, determines the quantum security key based on the extracted device identification key to detect the process control data, and processes the quantum security key injection by performing quantum key distribution in advance on the DIM, wherein the DIM includes a reset interface that receives a reset signal whenever process control data is generated and provided from the process control module according to the administrator's settings;A quantum security communication device integrated process control system comprising: receiving the quantum security key from the central control processing unit based on the reset signal and generating the quantum security device identification key by performing a quantum security operation on the device unique number using the quantum security key; receiving the process control data and generating intermediate quantum security process control data by performing a quantum security operation based on the quantum security key; and generating the quantum security process control data of a transmittable data structure including the intermediate quantum security process control data and the quantum security device identification key according to the DUSS (Different Unit Same Security) protocol standard independent of the given communication environment and providing it to the communication interface unit; wherein the quantum security firmware comprises a cryptographic algorithm processing unit that supports a block cipher operating mode as a cryptographic algorithm used for the quantum security operation, supports the ECDSA algorithm for digital signatures and the ECDH algorithm for key setting, and enables application to satellite communication, wireless communication, and wired communication environments. Claim 2 delete Claim 3 A quantum security communication device integrated process control system according to claim 1, wherein the DIM further includes a UART interface connected to the process control module, providing the process control data to the quantum security firmware, and providing the quantum security process control data generated from the quantum security firmware to the communication interface unit. Claim 4 delete Claim 5 delete Claim 6 delete Claim 7 A quantum security communication device integrated process control system according to claim 1, characterized in that, when the DIM does not operate normally, the security module receives a public key from the central control processing unit and performs a security operation on the process control data using the public key to replace the quantum security process control data with public key security process control data. Claim 8 A quantum security communication device integrated process control system according to claim 1, wherein the central control processing unit detects whether the DIM is operating normally to the process control unit, and if the DIM is operating normally, performs the quantum security key injection. Claim 9 A quantum security communication device integrated process control system according to claim 8, characterized in that the central control processing unit provides an RSA or ECC-based public key to the security module when the DIM does not operate normally. Claim 10 A step of generating process control data in a process control module of a process control unit; a step of generating quantum security process control data by performing quantum security operations on the process control data with the quantum security device identification key and the quantum security key in a security module of the process control unit through a DIM (Device Identity Module) which is implemented as a separate independent chipset, can perform the injection of a quantum security key according to the administrator's settings, and includes a quantum security device identification key; and a step of transmitting the quantum security process control data to a given communication environment in a communication interface unit of the process control unit. The method includes the step of receiving the quantum security process control data from the central control processing unit, extracting the device identification key, determining the quantum security key based on the device identification key, detecting the process control data, and performing quantum key distribution in advance on the DIM to process the quantum security key injection, wherein the process control data generation step includes: receiving a reset signal whenever process control data is generated and provided from the process control module according to the administrator's settings; receiving the quantum security key from the central control processing unit based on the reset signal and performing a quantum security operation on the device unique number using the quantum security key to generate the quantum security device identification key; and receiving the process control data and performing a quantum security operation based on the quantum security key to generate intermediate quantum security process control data.A quantum security communication device integrated process control method comprising the step of generating the quantum security process control data in the form of a transmittable data structure including the intermediate quantum security process control data and the quantum security device identification key according to the DUSS (Different Unit Same Security) protocol specification independent of the given communication environment and providing it to the communication interface unit, and characterized by using a block cipher algorithm including at least one of ARIS, SEED, LEA, HIGHT, and AES in the quantum security operation.

Images