Apparatus and Method for inspecting the security requirements of smart ship

Abstract

The present invention relates to a smart ship security requirements inspection / analysis device and method, and a computer program stored on a computer-readable recording medium to perform the same. More specifically, it calls and executes a script based on security requirements obtained based on at least one of IEC 62443, IACS UR E26 and E27, provides an inspection report when the verification of the security requirements inspection result is successful, and provides the reason for the failure of the security requirements inspection when the verification of the security requirements inspection result is failed. Research Management Agency: Busan Information Industry Promotion Agency Research Project Name: 2024 Information Security Service Development and Commercialization Support Project Research Project Title: Development of Smart Ship Infrastructure Vulnerability Analysis, Verification Tools, and Security Technologies Contribution rate: 1 / 1 Organizer: Core Security Co., Ltd. Research Period: July 1, 2024 – November 30, 2024

Description

Technology Field

[0001] The present invention relates to a smart ship security requirements inspection device and method, and more specifically, to a smart ship security requirements inspection / analysis device and method that calls and executes a script based on security requirements obtained based on at least one of IEC 62443, IACS UR E26 and E27, provides an inspection report when the verification of the security requirements inspection result is successful, and provides the reason for the failure of the security requirements inspection when the verification of the security requirements inspection result is failed, and a computer program stored on a computer-readable recording medium to perform the same. Background Technology

[0003] As digital transformation accelerates, smart ships and the service infrastructure supporting them are becoming increasingly advanced and complex. Consequently, ship operating systems and networks are becoming primary targets of cyber threats, and these threats are having a serious impact not only on ship safety but also on maritime logistics and international trade.

[0004] In particular, cyber security incidents related to smart ships have been surging since the 2020s, and there have been increasing instances of hacking attempts on essential equipment such as GPS and AIS (Automatic Identification System). Major classification societies are presenting new cyber security guidelines and technical standards to prevent this.

[0005] Internationally, standards such as the U.S. NIST Cybersecurity Framework (CSF) and IEC 62443 are required, and the International Association of Classification Societies (IACS) clarifies cybersecurity requirements for smart ships through the UR E26 and E27 regulations. These regulations require ship operators and managers to establish a system capable of continuously monitoring security status and preventing vulnerabilities in advance.

[0006] In other words, ships are composed of complex systems equipped with multiple CBSs. As the proportion of ICT-based ship equipment installed increases, the risk of hacking and malware attacks is rising; however, unlike land-based systems, it is difficult to apply measures to block cyber risks against factors that impede safe ship operation.

[0007] In light of this trend, it is essential to develop tools that can automatically check and systematically manage security requirements within smart ships, thereby enhancing the efficiency of vulnerability checks and establishing a foundation to more safely protect ship systems from cyber threats. Prior art literature

[0009] Republic of Korea Registered Patent No. 10-2729649 The problem to be solved

[0010] The present invention aims to solve the above-mentioned problems by providing a smart ship security requirements inspection / analysis device and method that calls and executes a script based on security requirements obtained from at least one of IEC 62443, IACS UR E26 and E27, provides an inspection report when the verification of the security requirements inspection results is successful, and provides the reason for the failure of the security requirements inspection when the verification of the security requirements inspection results is failed, and a computer program stored on a computer-readable recording medium to perform the same.

[0011] Another purpose is to generate an inspection report showing the results of the security vulnerability check on the ship system (host) by performing a first detection using CVE data and a second detection using CPE data.

[0012] In addition, there is another purpose to perform verification of the matching results using CPE URI separators for the first and second detections, provide an inspection report showing the results of the security vulnerability check when the verification of the matching results using CPE URI separators is successful, and provide the reason for the failure of the security vulnerability check when the verification of the matching results using CPE URI separators fails. means of solving the problem

[0014] A smart ship security requirements inspection device according to the present invention for achieving the above-mentioned purpose comprises: a server that searches for a ship system connected to a network to obtain ship system information, groups the ship system to display hosts by IP address, inspects security requirements for at least one selected host or all hosts among the hosts, and generates a first inspection report indicating the results of the security requirements inspection for the hosts; and a database that stores the ship system (host) information and the first inspection report; wherein the server calls and executes a script according to security requirements classified according to a Windows-based host or a Linux-based host, and the security requirements are obtained based on at least one of IEC 62443, IACS UR E26, and E27, and if the verification of the results of the security requirements inspection is successful, a first inspection report is provided, and if the verification of the results of the security requirements inspection fails, a reason for the failure of the security requirements inspection may be provided.

[0015] The above server can acquire ship system information by performing at least one or all of the following: UPnP (Universal Plug and Play)-SSDP (Simple Service Discovery Protocol), HTTP (HyperText Transfer Protocol), MDNS (Multicast DNS) protocol, SNMP (Simple Network Management Protocol), and WS (Web Service)-Discovery.

[0016] The server extracts a matching keyword from the information of the host, searches for the matching keyword in Common Vulnerabilities and Exposures (CVE) data to perform a first detection of security vulnerabilities related to the host, searches for the matching keyword in Common Platform Enumeration (CPE) data to perform a second detection of security vulnerabilities related to the host, and generates a second inspection report indicating the results of the security vulnerability inspection for the host, and the database stores the matching keyword, CVE data, CPE data, and the second inspection report, and for the first detection and second detection, verification of the matching results is performed using a CPE URI separator, and if the verification of the matching results using the CPE URI separator is successful, a second inspection report indicating the results of the security vulnerability inspection is provided, and if the verification of the matching results using the CPE URI separator fails, the reason for the failure of the security vulnerability inspection may be provided.

[0017] When performing the first detection, the server can perform a search in the CVE data using the manufacturer, model, firmware, and protocol of the host, and when performing the second detection, it can perform a search in the CVE data by sequentially executing at least two protocols among UPnP (Universal Plug and Play)-SSDP (Simple Service Discovery Protocol), HTTP (HyperText Transfer Protocol), MDNS (Multicast DNS) protocol, SNMP (Simple Network Management Protocol), and WS (Web Service)-Discovery.

[0018] The above server can verify the physical signal strength using signal strength in the case of a Wi-Fi wireless network, verify the existence of a fake AP (Access Point) by detecting the existence of the same SSID (Subsystem Identification), verify the duplication of MAC (Media Access Control) addresses in the case of a Wi-Fi wireless network, and if the same MAC address is found, verify the presence of spoofing by checking for a collision of IP (Internet Protocol) addresses.

[0019] The above server can determine whether a security vulnerability exists by checking whether a password for user authentication is set in the case of a Wi-Fi wireless network.

[0020] A smart ship security requirements inspection method according to the present invention comprises: a host scan step of recognizing a ship system connected to a network and acquiring information about the ship system; a step of grouping the ship systems recognized in the host scan step and displaying the hosts by IP address; a first inspection step of inspecting security requirements for at least one host or all hosts selected among the hosts; and a first generation step of generating a first inspection report indicating the results of the security requirements inspection for the hosts identified in the first inspection step; wherein the first inspection step calls and executes a script according to security requirements classified according to a Windows-based host or a Linux-based host, and the security requirements are acquired based on at least one of IEC 62443, IACS UR E26, and E27, and if the verification of the results of the security requirements inspection in the first inspection step is successful, a first inspection report is provided, and if the verification of the results of the security requirements inspection in the first inspection step fails, a reason for the failure of the security requirements inspection may be provided.

[0021] In the above host scanning step, hosts can be scanned by performing at least one or all of the following: UPnP (Universal Plug and Play)-SSDP (Simple Service Discovery Protocol), HTTP (HyperText Transfer Protocol), MDNS (Multicast DNS) protocol, SNMP (Simple Network Management Protocol), and WS (Web Service)-Discovery.

[0022] The method comprises: a second inspection step for inspecting Common Vulnerabilities and Exposures (CVE) vulnerabilities for at least one host selected among the hosts or all of the hosts after the step of displaying the hosts or the first generation step; and a second generation step for generating a second inspection report by analyzing the matching results confirmed in the second inspection step; wherein the second inspection step and the second generation step include: a step of extracting matching keywords from host information collected in the host scanning step; a step of performing a first detection of security vulnerabilities related to the host by searching the matching keywords in CVE data; and a step of performing a second detection of security vulnerabilities related to the host by searching the matching keywords in CPE data. The method includes the step of generating a second inspection report indicating the results of a security vulnerability check for the host; wherein verification of the matching results is performed using a CPE URI separator for the first detection and the second detection, and if the verification of the matching results using the CPE URI separator is successful, a second inspection report indicating the results of the security vulnerability check is provided, and if the verification of the matching results using the CPE URI separator fails, the reason for the failure of the security vulnerability check may be provided.

[0023] A computer program according to the present invention is a computer program for checking smart ship security requirements recorded on a non-transitory computer-readable medium comprising computer program instructions executable by a processor, wherein when the computer program instructions are executed by a processor of a computing device, the computer program program includes: a host scan step for recognizing a ship system connected to a network; a step of grouping the ship systems recognized in the host scan step and representing the hosts by IP addresses; and a first check step for checking security requirements for at least one host or all hosts selected among the hosts. The operation includes a first generation step of generating a first inspection report that indicates the results of the security requirements inspection for the host identified in the first inspection step; wherein the first inspection step calls and executes a script according to security requirements classified according to a Windows-based host or a Linux-based host, and the security requirements are obtained based on at least one of IEC 62443, IACS UR E26 and E27, and if the verification of the results of the security requirements inspection in the first inspection step is successful, a first inspection report is provided, and if the verification of the results of the security requirements inspection in the first inspection step fails, a reason for the failure of the security requirements inspection may be provided.

[0024] After the step of displaying the host or the first generation step, a second inspection step of inspecting Common Vulnerabilities and Exposures (CVE) vulnerabilities for at least one host selected among the hosts or all of the hosts; and a second generation step of generating a second inspection report by analyzing the matching results confirmed in the second inspection step; wherein the second inspection step and the second generation step include: a step of extracting a matching keyword from the host information collected in the host scan step; a step of performing a first detection of security vulnerabilities related to the host by searching the matching keyword in Common Vulnerabilities and Exposures (CVE) data; and a step of performing a second detection of security vulnerabilities related to the host by searching the matching keyword in Common Platform Enumeration (CPE) data. The operation includes the step of generating a second inspection report indicating the results of a security vulnerability check for the host; wherein verification of the matching results is performed using a CPE URI separator for the first detection and the second detection, and if the verification of the matching results using the CPE URI separator is successful, a second inspection report indicating the results of the security vulnerability check is provided, and if the verification of the matching results using the CPE URI separator fails, the reason for the failure of the security vulnerability check may be provided. Effects of the invention

[0026] The present invention has the effect of automatically checking and systematically managing smart ship security requirements by calling and executing a script based on security requirements obtained from at least one of IEC 62443, IACS UR E26 and E27.

[0027] The present invention can provide an inspection report when the verification of the security requirements inspection results is successful, and has the effect of reducing the false positive rate by scanning the ship system using various protocols.

[0028] In addition, the present invention has the effect of quickly providing an inspection report showing the results of a security vulnerability inspection of a ship system by performing a first detection using CVE data and a second detection using CPE data. Brief explanation of the drawing

[0030] FIG. 1 is an exemplary diagram of a smart ship security requirements inspection device of the present invention. FIG. 2 is a screen of a computer program displaying the host of the present invention. FIGS. 3 and FIGS. 4 are drawings illustrating security requirements obtained according to a Windows-based host of the present invention. FIGS. 5 and 6 are drawings illustrating security requirements obtained according to a Linux-based host of the present invention. FIG. 7 is a screen of a computer program when the execution of a script according to the security requirements of a Windows-based host of the present invention is completed. FIG. 8 is a screen of a computer program showing the results of a security requirement check for a Windows-based host of the present invention. FIG. 9 is a part of a first inspection report showing the results of a security requirements inspection for a Windows-based host of the present invention. FIG. 10 is a screen of a computer program displaying the host of the present invention. FIG. 11 is a screen of a computer program when a script according to the security requirements of a Linux-based host of the present invention is completed. FIG. 12 is a screen of a computer program showing the results of a security requirement check for a Linux-based host of the present invention. FIG. 13 is a part of the first inspection report showing the results of the security requirements inspection for the Linux-based host of the present invention. FIG. 14 is a screen of a computer program displaying the host of the present invention. FIG. 15 is a screen of a computer program when the security vulnerability check result of the present invention is completed. FIG. 16 is a screen of a computer program showing the results of a security vulnerability check of the present invention. FIG. 17 is a part of the second inspection report showing the results of the security vulnerability inspection of the present invention. FIG. 18 is an example diagram of the smart ship security requirements inspection process of the present invention. FIG. 19 is an example diagram of the smart ship security vulnerability inspection process of the present invention. Specific details for implementing the invention

[0031] In describing preferred embodiments of the present invention in detail, specific descriptions of related known configurations or functions are omitted if it is determined that such descriptions could obscure the essence of the invention.

[0032] The embodiments can be implemented in various forms of products, such as personal computers, laptop computers, tablet computers, smartphones, ship systems, ship equipment, CBS, and smart terminals.

[0033] FIG. 1 is an exemplary diagram showing the configuration of a smart ship (vessel) security requirements inspection device (system) according to an embodiment of the present invention.

[0034] As illustrated in FIG. 1, the smart ship security requirements inspection device (100) may include a plurality of ship systems (110-1, ..., 110-n), a server (120), and a database (130). According to one embodiment, the database (130) is illustrated as being configured separately from the server (120), but is not limited thereto, and the database (130) may be provided within the server (120). For example, the server (120) may include a plurality of artificial intelligence models for performing machine learning algorithms. According to one embodiment, the ship systems (110-1, ..., 110-n), the server (120), and the database (130) may be connected to communicate with each other through a network (N).

[0035] The server (120) is a plurality of ship systems (CBS, ship equipment, ballast water treatment system, SCR NO) on the network. XShip system information can be obtained by searching for reduction devices, ship energy efficiency management systems, etc. According to one embodiment, the server (120) can obtain ship system information by searching for a plurality of ship systems (110-1, ..., 110-n) on a network (N). For example, the ship system information may include the manufacturer, model, firmware, protocol, signal strength, SSID (Subsystem Identification), MAC (Media Access Control) address, etc. of the plurality of ship systems (110-1, ..., 110-n). According to one embodiment, the server (120) can obtain ship system information using at least one protocol. For example, at least one protocol may include UPnP (Universal Plug and Play)-SSDP (Simple Service Discovery Protocol), HTTP (HyperText Transfer Protocol), MDNS (Multicast DNS) protocol, SNMP (Simple Network Management Protocol), and WS (Web Service)-Discovery.

[0036] Multiple information related to the ship system can be obtained using UPnP-SSDP, HTTP, MDNS, SNMP, and WS-Discovery.

[0037] FIG. 2 is a screen of a computer program in which hosts are displayed through a host scan according to an embodiment of the present invention. As shown in FIG. 2, the server (120) can search for 207 ship systems through a host scan and group the searched ship systems to display the hosts in the form of IP addresses.

[0038] The server (120) can check for security requirements for at least one host or all hosts selected from the displayed hosts. In this case, the security requirements may be obtained based on at least one of IEC 62443, IACS UR E26 and E27. In this case, the security requirements may be distinguished according to the Windows-based ship system (host) or the Linux-based ship system (host).

[0039] FIGS. 3 and 4 are drawings showing security requirements obtained according to a Windows-based host according to an embodiment of the present invention, and FIGS. 5 and 6 are drawings showing security requirements obtained according to a Linux-based host according to an embodiment of the present invention.

[0040] The server (120) can classify security requirements into account management, service management, patch management, log management, and security management on a Windows-based host, and into account management, file / directory management, service management, patch management, and log management on a Linux-based host.

[0041] The server (120) can call and execute a script according to security requirements classified according to a Windows-based host or a Linux-based host, and can automatically check / analyze security requirements obtained based on at least one of IEC 62443, IACS UR E26 and E27, and can generate a first inspection report showing the results of the security requirements check for the host.

[0042] FIG. 7 is a screen of a computer program when a script according to the security requirements of a Windows-based host according to an embodiment of the present invention is completed, FIG. 8 is a screen of a computer program showing the results of a security requirements check for a Windows-based host according to an embodiment of the present invention, and FIG. 9 is a part of a first inspection report showing the results of a security requirements check for a Windows-based host according to an embodiment of the present invention. At this time, although the first inspection report was generated in Excel, it can be generated in various formats, and the ship system (host) information and the first inspection report can be stored in a database.

[0043] FIG. 10 is a screen of a computer program showing a host through a host scan according to an embodiment of the present invention, FIG. 11 is a screen of a computer program when a script according to the security requirements of a Linux-based host according to an embodiment of the present invention is completed, FIG. 12 is a screen of a computer program showing the results of a security requirements check for a Linux-based host according to an embodiment of the present invention, and FIG. 13 is a part of a first inspection report showing the results of a security requirements check for a Linux-based host according to an embodiment of the present invention.

[0044] If the server (120) succeeds in verifying the results of the security requirements check (the server calls and executes a script according to the host's security requirements normally), a first inspection report may be provided, and if the server fails to verify the results of the security requirements check (the server fails to call and execute a script according to the host's security requirements normally), a reason for the failure of the security requirements check (the reason for failing to call and execute the script normally) may be provided.

[0045] The server (120) can extract matching keywords from information of the ship system (host) and can perform a primary detection of security vulnerabilities related to the host by searching for matching keywords in CVE (Common Vulnerabilities and Exposures) data. At this time, the server (120) can perform a search in the CVE data using the manufacturers, models, firmware, and protocols of multiple hosts (110-1,…, 110-n).

[0046] The server (120) can perform secondary detection of security vulnerabilities related to a host by searching for matching keywords in Common Platform Enumeration (CPE) data. At this time, the server (120) can perform a search in the CPE data by sequentially executing at least two protocols, and the server (120) can repeat primary detection and secondary detection for multiple hosts (110-1,…, 110-n).

[0047] The server (120) can generate a second inspection report indicating the results of a security vulnerability check on the host. At this time, the database (130) can store matching keywords, CVE data, CPE data, and the second inspection report.

[0048] In the case of a Wi-Fi wireless network, the server (120) can check the physical signal strength using signal strength and detect whether there is a fake AP (Access Point) by detecting whether there is a duplicate MAC (Media Access Control) address in the case of a Wi-Fi wireless network, and if the same MAC address is found, check whether there is a conflict of IP (Internet Protocol) addresses to check for spoofing.

[0049] The server (120) can determine whether a security vulnerability exists by checking whether a password for user authentication is set in the case of a Wi-Fi wireless network. At this time, if a password is not set, it is determined that a security vulnerability exists, and if a password is set, it is determined that no security vulnerability exists.

[0050] FIG. 14 is a screen of a computer program showing a host through a host scan according to an embodiment of the present invention, FIG. 15 is a screen of a computer program when the results of a security vulnerability (CVE vulnerability) check according to an embodiment of the present invention are completed, FIG. 16 is a screen of a computer program showing the results of a security vulnerability (CVE vulnerability) check according to an embodiment of the present invention, and FIG. 17 is a part of a second check report showing the results of a security vulnerability (CVE vulnerability) check according to an embodiment of the present invention.

[0051] The server (120) performs verification of the matching results using a CPE URI separator for the first detection and the second detection, and if the verification of the matching results using the CPE URI separator is successful, a second inspection report showing the results of the security vulnerability check may be provided, and if the verification of the matching results using the CPE URI separator fails, the reason for the failure of the security vulnerability check may be provided.

[0052] The server (120) can output different screens depending on the event that occurs. The server (120) can execute a function of a different plug-in module by calling it depending on the event that occurs.

[0053] The plugin module consists of functions that perform key functions such as scanning and vulnerability matching of the ship system, and each module is developed in C++ and can be stored in the form of a DLL. Data corresponding to all function operations is generated in the corresponding plugin, and result data for scanning and vulnerability matching can be stored in the database (130).

[0054] The database (130) uses SQLite, which is an RDBMS (Relational Database Management System), rather than a separate server, and may be composed of a unique vulnerability information table (CVE, CWE, OUI) that is not changed or modified due to functional operation and a result information table that stores generated data (scanning and vulnerability matching results).

[0055] The server (120) can configure network interfaces such as a network interface card and whether it is wired or wireless. Additionally, the server (120) can specify a scan range such as a LAN (local area network) network range and a scan IP address range. Furthermore, the server (120) can scan multiple ship systems (110-1, ..., 110-n) to obtain ship system information such as manufacturer, equipment model, operating system information, and network information.

[0056] FIG. 18 is an example diagram of a smart ship security requirements inspection process according to an embodiment of the present invention.

[0057] When a user clicks "Host Scan" in FIG. 2, FIG. 10, FIG. 14, etc., a computing device, which may include a server and / or a database, can recognize a ship system (host) connected to a network and obtain information about the ship system (host), and can group the ship systems and display the hosts by IP address. At this time, whether the computing device and the ship system are remotely connected and / or whether IP information is verified may be taken into consideration.

[0058] The first inspection step involves inspecting security requirements for at least one selected host or all hosts among the hosts. The security requirements can be obtained based on at least one of IEC 62443, IACS UR E26, and E27, and a script corresponding to the security requirements classified according to Windows-based hosts or Linux-based hosts can be called and executed. At this time, if a script corresponding to the security requirements exists, the command of the script is executed by the user clicking "Security Requirements" in FIG. 2, FIG. 10, FIG. 14, etc., and a first inspection report showing the results of the security requirement inspection can be automatically generated (first generation step). If the script does not exist, the user can upload and execute the script.

[0059] If the verification of the results of the security requirements inspection is successful in the first inspection stage, a first inspection report may be provided, and if the verification of the results of the security requirements inspection fails in the first inspection stage, the reason for the failure of the security requirements inspection may be provided.

[0060] FIG. 19 is an example diagram of a smart ship security vulnerability (CVE vulnerability) check process according to an embodiment of the present invention.

[0061] When a user clicks on "CVE vulnerability" in FIG. 2, FIG. 10, FIG. 14, etc., in the second inspection step, after the host scan step, the host display step, or the first generation step, a CVE (Common Vulnerabilities and Exposures) vulnerability can be checked (inspected) for at least one selected host or all of the hosts. At this time, the second inspection step and the second generation step include: a step of extracting a matching keyword from the host information collected in the host scan step; a step of performing a first detection of security vulnerabilities related to the host by searching the matching keyword in CVE (Common Vulnerabilities and Exposures) data; a step of performing a second detection of security vulnerabilities related to the host by searching the matching keyword in CPE (Common Platform Enumeration) data; and a step of generating a second inspection report indicating the results of the security vulnerability inspection for the host.

[0062] Verification of the matching results using CPE URI separators can be performed for the first detection and second detection, and if the verification of the matching results using CPE URI separators is successful, a second inspection report showing the results of the security vulnerability inspection can be provided, and if the verification of the matching results using CPE URI separators fails, the reason for the failure of the security vulnerability inspection can be provided.

[0063] The server (120) can output vulnerability results such as IP address information of the ship system, manufacturer and model information, vulnerability information (CVE, CWE), and execution time.

[0064] The server (120) can extract basic information (manufacturer, model name, firmware, etc.) of the identified ship system for mapping with the vulnerability DB, and add protocol versions and firmware versions for step-by-step, detailed vulnerability checks to the matching items. Additionally, the server (120) can perform matching with PK values, CWE, and CVE within the defined vulnerability DB using the scanning and check results.

[0065] When matching fails, the server (120) attempts to update the existing vulnerability DB and perform detailed matching by increasing the depth (level) of information provided to the integrated DB, and can derive general CVE and CWE items through additional matching of protocol version and firmware version. If the matching of the CVE Description or CWE number is successful, the server (120) proceeds with a verification step, and when matching is complete, verifies the matched result using a CPE URI identifier to improve the identification rate.

[0066] If matching is performed using only information such as manufacturer, model, firmware, and protocol from the content of the CVE description, the false positive rate may be high, so the server (120) can perform a first matching using the CVE description and a second matching through comparison of CPE identifiers. In addition, if scanning is performed by separating by protocol, the collected information is minimized and inaccurate data may be collected, so instead of separating scanning by protocol, scanning of all protocols sequentially or randomly can be performed to maximize the efficiency of the collected information.

[0067] The server (120) utilizes the active scan method among the active / passive scans of Wi-Fi, and in the case of Wi-Fi, vulnerabilities such as CVEs are hardware (interface) content. In the case of advanced Wi-Fi vulnerabilities, most are password or hardware-related vulnerabilities, and to check for vulnerabilities, an actual attack may be performed to affect equipment connected to the AP. Therefore, the server (120) can check for vulnerabilities to general security threats of Wi-Fi.

[0068] CPE is a command system designed to identify vulnerabilities in operating systems and software. Its syntax is based on URIs, and since it was developed to address the difficulty of identifying vulnerabilities solely through CVEs, every CVE includes CPE content, allowing for the detection of specific matching CVE identification numbers through this information.

[0069] The network (N) consists of a number of IoT devices (110-1, , 110-n), a server (120),

[0070] Wireless or wired communication between databases (130), etc. may be performed. For example, the network (N) may perform wireless communication according to methods such as LTE (long-term evolution), LTE-A (LTE Advanced), CDMA (code division multiple access), WCDMA (wideband CDMA), WiBro (Wireless BroadBand), WiFi (wireless fidelity), Bluetooth, NFC (near field communication), GPS (Global Positioning System), or GNSS (global navigation satellite system). For example, the network (N) may perform wired communication according to methods such as USB (universal serial bus), HDMI (high definition multimedia interface), RS-232 (recommended standard 232), or POTS (plain old telephone service).

[0071] The database (130) can store various data. Data stored in the database (130) may include software (e.g., programs) as data acquired, processed, or used by a plurality of ship systems (110-1, ..., 110-n), a server (120), and at least one component of the database (130). The database (130) may include volatile and / or non-volatile memory. In one embodiment, the database (130) may store ship system (host) information, matching keywords, CVE data, CPE data, inspection reports, etc.

[0073] The foregoing description is merely an illustrative explanation of the technical concept of the present invention, and those skilled in the art to which the present invention pertains will be able to make various modifications and variations within the scope of the essential characteristics of the present invention. Accordingly, the embodiments disclosed in the present invention are intended to explain, not limit, the technical concept of the present invention, and the scope of the technical concept of the present invention is not limited by such embodiments. The scope of protection of the present invention shall be interpreted by the claims below, and all technical concepts within an equivalent scope shall be interpreted as being included within the scope of rights of the present invention. Explanation of the symbols

[0075] 100: Smart Ship Security Requirements Inspection Device (System) 110-1,… ,100-n: Ship System (Host) 120: Server 130: Database

Claims

Claim 1 A server that searches for ship systems connected to a network to obtain ship system information, groups the ship systems to display hosts by IP address, checks security requirements for at least one selected host or all hosts among the hosts, and generates a first inspection report indicating the results of the security requirement check for the hosts; and a database storing the above-mentioned ship system information and a first inspection report; wherein the server calls and executes a script according to security requirements classified according to a Windows-based host or a Linux-based host, and the security requirements are obtained based on at least one of IEC 62443, IACS UR E26, and E27, and if the verification of the security requirements inspection result is successful, a first inspection report is provided, and if the verification of the security requirements inspection result fails, a reason for the failure of the security requirements inspection is provided, and the server extracts a matching keyword from the information of the host, searches the matching keyword in CVE (Common Vulnerabilities and Exposures) data to perform a first detection of security vulnerabilities related to the host, searches the matching keyword in CPE (Common Platform Enumeration) data to perform a second detection of security vulnerabilities related to the host, and generates a second inspection report indicating the results of the security vulnerability inspection for the host, and the database stores the matching keyword, CVE data, CPE data, and the second inspection report, and regarding the first detection and the second detection Regarding this, verification of the matching result is performed using the CPE URI separator, and if the verification of the matching result using the CPE URI separator is successful, a second inspection report showing the security vulnerability check result is provided, and if the verification of the matching result using the CPE URI separator fails, the reason for the failure of the security vulnerability check is provided.The server performs a search on the CPE data by sequentially executing at least two protocols among UPnP (Universal Plug and Play)-SSDP (Simple Service Discovery Protocol), HTTP (HyperText Transfer Protocol), MDNS (Multicast DNS) protocol, SNMP (Simple Network Management Protocol), and WS (Web Service)-Discovery when performing the secondary detection; the server classifies security requirements into account management, service management, patch management, log management, and security management on a Windows-based host, and into account management, file and directory management, service management, patch management, and log management on a Linux-based host; and in the case of a Wi-Fi wireless network, the server verifies the physical signal strength using signal strength, detects the existence of the same SSID (Subsystem Identification) to verify the existence of a fake AP (Access Point), checks for duplicate MAC (Media Access Control) addresses on a Wi-Fi wireless network, and if the same MAC address is found, verifies the presence of spoofing by checking for IP (Internet Protocol) address conflicts. Easy security requirements inspection device. Claim 2 A smart ship security requirements inspection device according to claim 1, characterized in that the server acquires ship system information by performing at least one or all of UPnP (Universal Plug and Play)-SSDP (Simple Service Discovery Protocol), HTTP (HyperText Transfer Protocol), MDNS (Multicast DNS) protocol, SNMP (Simple Network Management Protocol), and WS (Web Service)-Discovery. Claim 3 A smart ship security requirements inspection device according to claim 1 or 2, characterized in that, when performing the first detection, the server performs a search in the CVE data using the manufacturer, model, firmware, and protocol of the host. Claim 4 A method for checking smart ship security requirements by a computing device comprises: a host scan step of recognizing a ship system connected to a network and acquiring information about the ship system; a step of grouping the ship systems recognized in the host scan step and displaying the hosts by IP address; and a first inspection step of checking security requirements for at least one host or all hosts selected among the hosts. and a first generation step for generating a first inspection report indicating the results of a security requirement inspection for the host identified in the first inspection step; wherein the first inspection step calls and executes a script according to security requirements classified according to a Windows-based host or a Linux-based host, and the security requirements are obtained based on at least one of IEC 62443, IACS UR E26, and E27, and if the verification of the results of the security requirement inspection in the first inspection step is successful, a first inspection report is provided, and if the verification of the results of the security requirement inspection in the first inspection step is unsuccessful, a reason for the failure of the security requirement inspection is provided; a second inspection step for inspecting for CVE (Common Vulnerabilities and Exposures) vulnerabilities for at least one host selected among the hosts or all of the hosts after the step of displaying the host or the first generation step; and a second generation step for generating a second inspection report analyzing the matching results identified in the second inspection step; wherein the second inspection step and the second generation step include a step of extracting matching keywords from the host information collected in the host scan step; A step of performing a primary detection of security vulnerabilities related to the host by searching for the above-mentioned matching keywords in CVE (Common Vulnerabilities and Exposures) data;A step of performing secondary detection of security vulnerabilities related to a host by searching for the above-mentioned matching keywords in CPE (Common Platform Enumeration) data; and a step of generating a second inspection report indicating the results of the security vulnerability inspection for the host;It includes, wherein verification of the matching result is performed using a CPE URI separator for the above first detection and second detection, and if the verification of the matching result using the CPE URI separator is successful, a second inspection report indicating the security vulnerability check result is provided, and if the verification of the matching result using the CPE URI separator fails, the reason for the failure of the security vulnerability check is provided, and when performing the above second detection, at least two protocols among UPnP (Universal Plug and Play)-SSDP (Simple Service Discovery Protocol), HTTP (HyperText Transfer Protocol), MDNS (Multicast DNS) protocol, SNMP (Simple Network Management Protocol), and WS (Web Service)-Discovery are executed sequentially to perform a search on the above CPE data, and on the above Windows-based host, security requirements are classified into account management, service management, patch management, log management, and security management, and on the above Linux-based host, they are classified into account management, file and directory management, service management, patch management, and log management, and in the case of a Wi-Fi wireless network, the server checks the physical signal strength using signal strength, and the same A smart ship security requirements inspection method characterized by detecting the existence of an SSID (Subsystem Identification) to verify the existence of a fake AP (Access Point), checking for duplicate MAC (Media Access Control) addresses in the case of a Wi-Fi wireless network, and, if the same MAC address is found, checking for an IP (Internet Protocol) address conflict to verify spoofing. Claim 5 A smart ship security requirements inspection method according to claim 4, characterized by scanning a host by performing at least one or all of UPnP (Universal Plug and Play)-SSDP (Simple Service Discovery Protocol), HTTP (HyperText Transfer Protocol), MDNS (Multicast DNS) protocol, SNMP (Simple Network Management Protocol), and WS (Web Service)-Discovery in the host scanning step. Claim 6 A smart ship security requirements check method characterized by performing a search in the CVE data using the manufacturer, model, firmware, and protocol of the host when performing the first detection in claim 4 or 5. Claim 7 A computer program for checking smart ship security requirements recorded on a non-transitory computer-readable medium containing computer program instructions executable by a processor, wherein when said computer program instructions are executed by a processor of a computing device, the program comprises: a host scan step for recognizing a ship system connected to a network; a step for grouping the ship systems recognized in said host scan step and representing the hosts by IP addresses; and a first check step for checking security requirements for at least one host or all hosts selected among said hosts. The operation includes: a first generation step for generating a first inspection report indicating the results of a security requirement inspection for the host identified in the first inspection step; wherein the first inspection step involves calling and executing a script according to security requirements classified according to a Windows-based host or a Linux-based host, and the security requirements are obtained based on at least one of IEC 62443, IACS UR E26, and E27; wherein if the verification of the results of the security requirement inspection in the first inspection step is successful, a first inspection report is provided, and if the verification of the results of the security requirement inspection in the first inspection step fails, a reason for the failure of the security requirement inspection is provided and the host is displayed; or, after the first generation step, a second inspection step for inspecting CVE (Common Vulnerabilities and Exposures) vulnerabilities for at least one host selected among the hosts or all of the hosts; and a second generation step for generating a second inspection report analyzing the matching results identified in the second inspection step; wherein the second inspection step and the second generation step include a step of extracting matching keywords from the host information collected in the host scan step;A step of performing a first detection of security vulnerabilities related to a host by searching for the matching keyword in CVE (Common Vulnerabilities and Exposures) data; a step of performing a second detection of security vulnerabilities related to a host by searching for the matching keyword in CPE (Common Platform Enumeration) data; and a step of generating a second inspection report indicating the results of the security vulnerability inspection for the host;It performs operations including, and for the first and second detections, verification of the matching results is performed using a CPE URI separator; if the verification of the matching results using the CPE URI separator is successful, a second inspection report indicating the security vulnerability check results is provided; if the verification of the matching results using the CPE URI separator fails, the reason for the failure of the security vulnerability check is provided; when performing the second detection, at least two protocols among UPnP (Universal Plug and Play)-SSDP (Simple Service Discovery Protocol), HTTP (HyperText Transfer Protocol), MDNS (Multicast DNS) protocol, SNMP (Simple Network Management Protocol), and WS (Web Service)-Discovery are executed sequentially to perform a search on the CPE data; on the Windows-based host, security requirements are classified into account management, service management, patch management, log management, and security management; on the Linux-based host, they are classified into account management, file and directory management, service management, patch management, and log management; and in the case of a Wi-Fi wireless network, the server checks the physical signal strength using signal strength, and the same A computer program characterized by detecting the existence of an SSID (Subsystem Identification) to verify the existence of a fake AP (Access Point), checking for duplicate MAC (Media Access Control) addresses in the case of a Wi-Fi wireless network, and, if the same MAC address is found, checking for a conflict in IP (Internet Protocol) addresses to verify spoofing. Claim 8 A computer program according to claim 7, characterized in that, in the host scanning step, it scans hosts by performing at least one or all of UPnP (Universal Plug and Play)-SSDP (Simple Service Discovery Protocol), HTTP (HyperText Transfer Protocol), MDNS (Multicast DNS) protocol, SNMP (Simple Network Management Protocol), and WS (Web Service)-Discovery. Claim 9 A computer program characterized by performing a search in the CVE data using the manufacturer, model, firmware, and protocol of the host when performing the first detection in claim 7 or 8. Claim 10 delete Claim 11 delete

Images