Patent Publication Number: US-2023164134-A1

Title: Method and apparatus for access control on ship network

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
     This application claims priority to Korean Patent Application No. 10-2021-0162302 filed on Nov. 23, 2021, with the Korean Intellectual Property Office (KIPO), the entire contents of which are hereby incorporated by reference. 
     BACKGROUND 
     1. Technical Field 
     Exemplary embodiments of the present disclosure relate to a method for controlling access to ship networks, and more particularly, to a method and an apparatus for controlling access to the ship networks to cope with a cyber-attack due to the development of in-ship communication technologies, which enhance security functions through network splitting between in-ship networks and access controls thereon. 
     2. Related Art 
     Recently, the development of smart ships such as autonomous ships to which information technology (IT) and operational technology (OT) are applied is accelerating. Accordingly, the application of communication technologies to the inside and outside of the ship is proceeding very actively, and the need for cyber security is also greatly increasing. For example, security is required to prevent considerable damages to human life or property due to abnormal operations of the ship from occurring. 
     Accordingly, the international maritime organization (IMO), which is an international organization established to deal with international issues related to shipping and shipbuilding, is implementing cybersecurity risk management regulations. 
     However, in the shipbuilding and marine industry, there is still a problem that ship-related systems need to secure technologies or systems to prepare for cyber-attacks such as malicious codes. In particular, as the attacks on ship systems have increased hundreds of times in the past three years, research and development on cybersecurity technologies for ships are being conducted accordingly, but the supply of appropriate security measures is still insignificant. As described above, there is a significant need for an appropriate solution for the cybersecurity of ships. 
     SUMMARY 
     Accordingly, exemplary embodiments of the present disclosure are provided to substantially obviate one or more problems due to limitations and disadvantages of the related art. 
     Exemplary embodiments of the present disclosure provide a method and an apparatus for controlling access to ship networks to cope with a cyber-attack due to the development of in-ship communication technologies, which enhance security functions through network splitting between in-ship networks and access controls thereon. 
     According to a first exemplary embodiment of the present disclosure, a ship network access control method, performed by an access control apparatus connected to a ship network, may comprise: receiving, from an agent installed in a specific sub-network among sub-networks of the ship network, a registration request message requesting registration based on an agent certificate, and verifying the agent certificate; in response to determining that the agent certificate is valid, transmitting, to the agent, agent registration information for the agent; receiving, from the agent, a connection request message generated based on the agent registration information, and verifying the agent registration information; in response to determining that the agent registration information is successfully verified, performing a mutual authentication protocol with the agent; and determining whether to allow a connection between the first terminal and a second terminal located in another sub-network of the ship network or an external network according to an authority of the agent. 
     The agent registration information may include a public key of the first terminal, a unique identification value capable of identifying the first terminal, and an access token. 
     The access token may include a value for verifying whether the first terminal is authorized to access resources within the ship network. 
     The determining of whether to allow the connection may comprise: receiving, from the agent, a connection request message for the second terminal or another agent related to the second terminal; identifying the authority of the agent in response to the connection request message; in response to identifying the authority of the agent, transmitting, to the agent, registration confirmation information for the second terminal or the another agent; and transmitting the registration confirmation information to the second terminal or the another agent. 
     The ship network access control method may further comprise, before transmitting the registration confirmation information to the second terminal or the another agent, receiving, from the second terminal or the another agent, a message requesting the registration confirmation information. 
     In the performing of the mutual authentication protocol, information on a service provided by the first agent may be received, and the information on the service may include an Internet protocol (IP) address, a port, and an identifier of the service. 
     The sub-networks may be connected to an authentication-based network access control channel of the ship network access control apparatus through gateways respectively installed in the sub-networks. 
     The agent may include a first agent of a host agent type that is installed in a specific terminal within the ship network or a second agent of a gateway type that is coupled with a switch of a sub-network to which another specific terminal in which the first agent is not installed belongs. 
     The ship network access control method may further comprise controlling access of the second terminal so that data traffic of the second terminal from the another sub-network or the external network is denied, wherein the data traffic is data traffic that is not permitted to connect to the specific sub-network. 
     According to a second exemplary embodiment of the present disclosure, a ship network access control apparatus for a ship network may comprise: a transceiver connected to the ship network; a memory storing at least one command; and at least one processor connected with the transceiver and the memory, wherein the at least one command causes the at least one processor to: receive, from an agent installed in a specific sub-network among sub-networks of the ship network, a registration request message requesting registration based on an agent certificate, and verify the agent certificate; in response to determining that the agent certificate is valid, transmit, to the agent, agent registration information for the agent; receive, from the agent, a connection request message generated based on the agent registration information, and verify the agent registration information; in response to determining that the agent registration information is successfully verified, perform a mutual authentication protocol with the agent; and determine whether to allow a connection between the first terminal and a second terminal located in another sub-network of the ship network or an external network according to an authority of the agent. 
     The agent registration information may include a public key of the first terminal, a unique identification value capable of identifying the first terminal, and an access token. 
     The access token may include a value for verifying whether the first terminal is authorized to access resources within the ship network. 
     In the determining of whether to allow the connection, the at least one command may further cause the at least one processor to: receive, from the agent, a connection request message for the second terminal or another agent related to the second terminal; identify the authority of the agent in response to the connection request message; in response to identifying the authority of the agent, transmit, to the agent, registration confirmation information for the second terminal or the another agent; and transmit the registration confirmation information to the second terminal or the another agent. 
     The at least one command may further cause the at least one processor to: before transmitting the registration confirmation information to the second terminal or the another agent, receive, from the second terminal or the another agent, a message requesting the registration confirmation information. 
     In the performing of the mutual authentication protocol, information on a service provided by the first agent may be received, and the information on the service may include an Internet protocol (IP) address, a port, and an identifier of the service. 
     The sub-networks may be connected to an authentication-based network access control channel of the ship network access control apparatus through gateways respectively installed in the sub-networks. 
     The agent may include a first agent of a host agent type that is installed in a specific terminal within the ship network or a second agent of a gateway type that is coupled with a switch of a sub-network to which another specific terminal in which the first agent is not installed belongs. 
     The at least one command may further cause the at least one processor to control access of the second terminal so that data traffic of the second terminal from the another sub-network or the external network is denied, wherein the data traffic is data traffic that is not permitted to connect to the specific sub-network. 
     According to the present disclosure, to cope with a cyber-attack caused by the development of in-ship communication technologies, the security functions of the ship network can be enhanced through network splitting and access control between in-ship networks and access control between the inside and outside of the ship. In addition, according to the present disclosure, network splitting can be effectively performed for a plurality of sub-networks within a ship by using a plurality of types of authentication controller agents, thereby improving the efficiency and reliability of network access control in the ship. In addition, according to the present disclosure, it is made possible to effectively allow or block data traffic between sub-networks or access between the sub-networks and an external network based on authentication through the access control apparatus installed at an upper end of the sub-networks within the ship, so that the security of the ship network can be effectively improved. 
    
    
     
       BRIEF DESCRIPTION OF DRAWINGS 
         FIG.  1    is a block diagram for describing a method for controlling access to a ship network according to an exemplary embodiment of the present disclosure. 
         FIG.  2    is a conceptual diagram for describing a network splitting structure using a ship network access control apparatus according to an exemplary embodiment of the present disclosure. 
         FIG.  3    is a conceptual diagram for describing an operation principle of the ship network access control apparatus of  FIG.  2   . 
         FIG.  4    is a sequence chart for describing a registration procedure between an agent and a controller of the ship network access control apparatus of  FIG.  2   . 
         FIG.  5    is a sequence chart illustrating a connection procedure between an agent and a controller of the ship network access control apparatus of  FIG.  2   . 
         FIG.  6    is a block diagram illustrating a configuration of the ship network access control apparatus of  FIG.  2   . 
     
    
    
     DETAILED DESCRIPTION OF THE EMBODIMENTS 
     Exemplary embodiments of the present disclosure are disclosed herein. However, specific structural and functional details disclosed herein are merely representative for purposes of describing exemplary embodiments of the present disclosure. Thus, exemplary embodiments of the present disclosure may be embodied in many alternate forms and should not be construed as limited to exemplary embodiments of the present disclosure set forth herein. 
     Accordingly, while the present disclosure is capable of various modifications and alternative forms, specific exemplary embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It should be understood, however, that there is no intent to limit the present disclosure to the particular forms disclosed, but on the contrary, the present disclosure is to cover all modifications, equivalents, and alternatives falling within the spirit and scope of the present disclosure. Like numbers refer to like elements throughout the description of the figures. 
     It will be understood that, although the terms first, second, etc. may be used herein to describe various elements, these elements should not be limited by these terms. These terms are only used to distinguish one element from another. For example, a first element could be termed a second element, and, similarly, a second element could be termed a first element, without departing from the scope of the present disclosure. As used herein, the term “and/or” includes any and all combinations of one or more of the associated listed items. 
     In exemplary embodiments of the present disclosure, “at least one of A and B” may refer to “at least one of A or B” or “at least one of combinations of one or more of A and B”. In addition, “one or more of A and B” may refer to “one or more of A or B” or “one or more of combinations of one or more of A and B”. 
     It will be understood that when an element is referred to as being “connected” or “coupled” to another element, it can be directly connected or coupled to the other element or intervening elements may be present. In contrast, when an element is referred to as being “directly connected” or “directly coupled” to another element, there are no intervening elements present. Other words used to describe the relationship between elements should be interpreted in a like fashion (i.e., “between” versus “directly between,” “adjacent” versus “directly adjacent,” etc.). 
     The terminology used herein is for the purpose of describing particular exemplary embodiments only and is not intended to be limiting of the present disclosure. As used herein, the singular forms “a,” “an” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms “comprises,” “comprising,” “includes” and/or “including,” when used herein, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof. 
     Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this present disclosure belongs. It will be further understood that terms, such as those defined in commonly used dictionaries, should be interpreted as having a meaning that is consistent with their meaning in the context of the relevant art and will not be interpreted in an idealized or overly formal sense unless expressly so defined herein. 
     Hereinafter, exemplary embodiments of the present disclosure will be described in greater detail with reference to the accompanying drawings. In order to facilitate general understanding in describing the present disclosure, the same components in the drawings are denoted with the same reference signs, and repeated description thereof will be omitted. 
       FIG.  1    is a block diagram for describing a method for controlling access to a ship network according to an exemplary embodiment of the present disclosure. 
     Referring to  FIG.  1   , a method for controlling access to a ship network may be implemented by an apparatus (i.e., ship network access control apparatus)  100  for controlling access between sub-networks within a ship. The sub-networks may include an operational technology (OT) network  10 , an information technology (IT) network  20 , a crew network  30 , and the like. 
     The OT network  10 , IT network  20 , and crew network  30  may be connected to the ship network access control apparatus  100  or an authentication-based network access control channel controlled by the ship network access control apparatus  100  through the respective gateways (G/W)  11 ,  21 , and  31 . 
     The OT network  10  may include a first gateway (G/W),  11 , a plurality of user devices  14 , a sensor  12  connected to a specific user device, an actuator  13  connected to a specific user device, and the like. The IT network  20  may include a second gateway (G/W)  21 , a plurality of user devices  24 , and the like. The crew network  30  may include a third gateway (G/W)  31 , a plurality of user devices  34 , and the like. 
     The ship network access control method may be implemented by an authentication-based network control apparatus to control data traffic between sub-networks existing within the ship and may be applied to the upper end of the sub-networks. Specifically, a computing device implementing the ship network access control method or the ship network access control apparatus  100  may control access through mutual authentication when data is exchanged between the OT network, IT network, and crew network. 
     In addition, the ship network access control apparatus  100  may control access of an external network  200  based on authentication when a sub-network is accessed by the external network  200 . In addition, the ship network access control apparatus  100  may deny access of data traffic for which connection is not permitted based on authentication. 
     In  FIG.  1   , a data flow by a controller of the ship network access control apparatus  100  is represented by a solid line, a flow for which connection is allowed by the controller is represented by a dashed-dotted line, and a flow for which connection is not allowed by the controller is represented by a dotted line. 
       FIG.  2    is a conceptual diagram for describing a network splitting structure using a ship network access control apparatus according to an exemplary embodiment of the present disclosure. 
     Referring to  FIG.  2   , the ship network access control apparatus  100  may split the ship network into the sub-networks  10 ,  20 , and  30  through authentication controller agents. The authentication controller agents may include a first agent  50   a  of a host agent type and a second agent  50   b  of a gateway type. The sub-networks may be connected to each other through first switches  11   a,    21   a,  and  31   a  installed in the respective sub-networks. 
     The first agent  50   a  may be referred to as a ‘server agent’ when installed on a server device  14   a,    24   a,  or  34   a,  and may be referred to as a ‘user agent’ when installed on a user device  14   b  or  34   b.  For the security of service devices  14   b  or  34   c  or user devices in which the first agent  50   a  is not installed, the second agent  50   b  may be installed at each rear end of second switches  11   b,    21   b,  and  31   b  of the sub-networks  10 ,  20 , and  30 . 
     As described above, the network access control apparatus  100  of the present exemplary embodiment may separate the sub-networks  10 ,  20 , and  30  through the authentication controller agents, and effectively perform access control between them and between them and an external network. 
       FIG.  3    is a conceptual diagram for describing an operation principle of the ship network access control apparatus of  FIG.  2   . 
     Referring to  FIG.  3   , the network access control apparatus  100  may control an access Al between an authentication device (or, device to be authenticated or authentication target device)  34   d  and the gateway  31  through an authentication verification server  36 . The authentication device  34   d  may be a server device, a user device, or the like, and a first agent may be installed in the authentication device  34   d.    
     In this case, the network access control apparatus  100  may authenticate the authentication device  34   d  by using a public key certificate  37   b  of the authentication device  34   d  registered with a certification authority  37 , and may allow the authentication device  34   d  to access the gateway  31  through a wireless local area network (LAN) or an internal network. The wireless LAN may be formed by a wireless communication device  35 . 
     In addition, the network access control apparatus  100  may support external communication A 2  based on a certificate such as the public key certificate  37   b  so that the authentication device  34   d  can access a VAST system  38  such as an external network, database management system, storage server, web server, or the like through the gateway  31  and the switch  31   c.    
     On the other hand, when an unauthenticated device  34   c  within a sub-network such as the crew network attempts an access A 3  to an external network through the gateway  31  and the switch  31   c,  the network access control apparatus  100  may perform control thereon so that external communication of the unauthenticated device  34   c  is blocked and its access to the external is restricted. The unauthenticated device  34   c  may be a user device or a server device in which the first agent is installed, a user device or a server device in which the first agent is not installed, or an arbitrary terminal that is not identified in the ship. 
     According to the present exemplary embodiment, it is possible to efficiently control access for internal communication within the same network or external communication. 
       FIG.  4    is a sequence chart for describing a registration procedure between an agent and a controller of the ship network access control apparatus of  FIG.  2   . 
     Referring to  FIG.  4   , a server agent  150  connected to a controller  100   a  of the ship network access control apparatus through a wired and/or wireless network may transmit a registration request message requesting registration of the server agent  150  based on a first certificate  37   c  to the controller  100   a  of the ship network access control apparatus. 
     Then, the controller  100   a  may verify the validity of the certificate  37   c  received through the registration request message (S 43 ), and transmit registration information to the server agent  150  for confirmation of the server agent  150  (S 44 ). Here, the registration information may include a public key (KEYS A) of the server agent  150 , a unique identification value or unique identifier capable of identifying the server agent  150 , and an access token. The access token may refer to a value for verifying whether permission to access resources within the ship network is granted. 
     Then, the server agent  150  may transmit a connection request message to the controller  100   a  based on the registration information received from the controller  100   a  (S 45 ). 
     Then, the controller  100   a  may verify the registration information according to the reception of the connection request message (S 46 ), and may provide, to the server agent  150 , information on a service that can be provided by the server agent  150  to perform a mutual authentication protocol with the server agent  150  (S 47 ). 
     The mutual authentication protocol may use a transport layer security (TLS) or any other mutual authentication-based network encryption protocol corresponding thereto, and the information on the service may include an Internet protocol (IP) address, port, service ID, etc. 
     The above-described steps S 41  to S 47  may be a registration procedure performed between the controller  100   a  and the server agent  150  and may be referred to as a first process (i.e., A process) or a server agent registration process. 
     On the other hand, a user agent  50  connected to the controller  100   a  of the ship network access control apparatus through a wired and/or wireless network may transmit a registration request message for requesting registration of a user device based on a second certificate  37   d  to the controller  100   a  of the ship network access control apparatus (S 51 , S 52 ). 
     Then, the controller  100   a  may verify the validity of the second certificate  37   d  received through the registration request message (S 53 ), and transmit registration information for confirmation of the user agent  50  to the user agent  50  (S 54 ). Here, the registration information may include a key, a unique identification value or unique identifier capable of identifying the user agent  50 , an access token, and the like. 
     Then, the user agent  50  may transmit a connection request message to the controller  100   a  based on the registration information received from the controller  100   a  (S 55 ). 
     Then, the controller  100   a  may verify the registration information according to the reception of the connection request message (S 56 ), and transmit, to the user agent  50 , information on a service that can be provided by the user agent  50  to perform a mutual authentication protocol with the user agent  50  (S 47 ). The mutual authentication may use a TLS or any other mutual authentication-based network encryption protocol corresponding thereto. The information on the service may include an IP address, port, service ID, and the like of the service. 
     The above-described steps S 51  to S 57  are a registration procedure performed between the controller  100   a  and the user agent  50  and may be referred to as a second process (B process) or a user device agent registration process. 
     According to the present exemplary embodiment, in the registration procedure between the controller and the agent, the information of each agent is registered in the controller to allow access of the agents separated from each other, so that access control to the network can be performed effectively with high security. In particular, when the registration process is successfully completed, a connection process for subsequent network access can be performed, so that access control on the ship network can be effectively performed. 
       FIG.  5    is a sequence chart illustrating a connection procedure between an agent and a controller of the ship network access control apparatus of  FIG.  2   . 
     Referring to  FIG.  5   , the user agent  50  that has completed the registration procedure may receive information on the server agent  150  to be connected through the network through the controller  100   a.  That is, through the above-described registration procedure, the controller  100   a  may retain information on the server agent  150  to which the user agent  50  wants to access. 
     Then, the user agent  50  may perform mutual authentication with the server agent  150  through the connection procedure and establish a connection through the network. Specifically, the user agent  50  may request information on the server agent  150  to be connected through the network from the controller  100   a  (S 51 ). 
     Then, the controller  100   a  may first identify the authority of the user agent  50  in response to the connection request message of the user agent  50  (S 52 ). Here, the controller  100   a  may apply network-splitting according to a position or a network position of the server agent  150  to which the user agent  50  intends to access. 
     Then, the controller  100   a  may transmit, to the user agent  50 , information on server agents to which the user agent  50  can access or a list of the server agents through a connection response message corresponding to the connection request message (S 53 ). In this case, the controller  100   a  may not transmit registration confirmation information used in the registration procedure of the user agent  50  to the user agent  50  by including it in the connection response message, but may transmit new registration confirmation information to be used in the connection procedure to the user agent  50  by including it in the connection response message. 
     Here, the controller  100   a  may transmit the new registration confirmation information to the server agent  150  to which the user agent  50  intends to access while transmitting the connection response message to the user agent  50  (S 54 ). The new registration confirmation information may refer to new authentication information of the existing registration confirmation information. 
     Then, the user agent  50  may transmit a connection request message to the server agent  150  based on the information on the server agents or the list of the server agents received from the controller  100   a  (S 61 ). The connection request message may include the new registration confirmation information. 
     Here, the server agent  150  may identify the new registration confirmation information received from the user agent  50  based on the new registration confirmation information previously received from the controller  100   a,  but exemplary embodiments of the present disclosure are not limited thereto. That is, the server agent  150  may request the new registration confirmation information from the controller  100   a  in response to the connection request message of the user agent  50  (S 62 ), receive the new registration confirmation information from the controller  100   a  through a response message (S 63 ), and then may confirm the new registration confirmation information received from the user agent  50  based on the new registration confirmation information received from the controller  100   a.  As described above, when the server agent  150  confirms the authentication information of the user agent  50 , one of the above two schemes may be selected to perform the verification. 
     Then, the server agent  150  may verify information required for connection with the user agent  50  based on the new registration confirmation information (S 64 ), and perform a mutual authentication protocol procedure with the user agent  50  (S 65 ). 
     When the mutual authentication protocol procedure is completed, the user agent  50  may be connected to the server agent  150  through user authentication for the server device and may transmit and receive signals and data with the server agent  150 . 
       FIG.  6    is a block diagram illustrating a configuration of the ship network access control apparatus of  FIG.  2   . 
     Referring to  FIG.  6   , the ship network access control apparatus  100  may include at least one processor  110 , a memory  120 , and a transceiver  130  connected to a network to perform communications. The ship network access control apparatus  100  may be configured to include a controller and the transceiver  130 . In this case, the controller may include the processor  110  and the memory  120 . The transceiver  130  may include a communication subsystem supporting a wired network or a wireless communication module (WCM)  150  supporting a wireless network. 
     In addition, the ship network access control apparatus  100  may include a user agent or server agent having the same or similar configuration. The user agent or server agent may be configured to include a processor, a memory, and a transceiver as components thereof. 
     In addition, the ship network access control apparatus  100  may further include an input interface device, an output interface device, a storage device, and the like. The respective components included in the ship network access control apparatus  100  may be connected by a bus to communicate with each other. 
     However, each of the components included in the ship network access control apparatus  100  may be connected through an individual interface or an individual bus centering on the processor  110  instead of the common bus. For example, the processor  110  may be connected to at least one of the memory  120 , the transceiver  130 , the input interface device, the output interface device, and the storage device through a dedicated interface. 
     The processor  110  may execute program commands stored in at least one of the memory  120  and the storage device. The processor  110  may refer to a central processing unit (CPU), a graphics processing unit (GPU), or a dedicated processor on which the method according to the exemplary embodiment of the present disclosure is performed. Each of the memory  120  and the storage device may be configured as at least one of a volatile storage medium and a non-volatile storage medium. For example, the memory  120  may be configured as at least one of a read only memory (ROM) and a random access memory (RAM). 
     The above-described program commands may include: commands for receiving a registration request message for registration based on a certificate from a first agent connected to the ship network; commands for validating the certificate; commands for transmitting registration information for the first agent to the first agent when the certificate is validated; commands for receiving a connection request message generated based on the registration information from the first agent; commands for verifying the registration information upon receipt of the connection request message; commands for performing a mutual authentication protocol procedure with the first agent or a first terminal in which the first agent is installed when verification of the registration information is normally completed; and commands for determining whether to allow a connection between the first terminal and a second terminal based on registration information or a certificate of each of the first terminal and the second terminal to which the first terminal intends to connect. 
     The exemplary embodiments of the present disclosure may be implemented as program instructions executable by a variety of computers and recorded on a computer-readable medium. The computer-readable medium may include a program instruction, a data file, a data structure, or a combination thereof. The program instructions recorded on the computer-readable medium may be designed and configured specifically for the present disclosure or can be publicly known and available to those who are skilled in the field of computer software. 
     Examples of the computer-readable medium may include a hardware device such as ROM, RAM, and flash memory, which are specifically configured to store and execute the program instructions. Examples of the program instructions include machine codes made by, for example, a compiler, as well as high-level language codes executable by a computer, using an interpreter. The above exemplary hardware device can be configured to operate as at least one software module in order to perform the embodiments of the present disclosure, and vice versa. 
     While the exemplary embodiments of the present disclosure and their advantages have been described in detail, it should be understood that various changes, substitutions, and alterations may be made herein without departing from the scope of the present disclosure.