Vulnerability Analysis on a VPN for a Remote Monitoring System

다국어 초록 (Multilingual Abstract)

14 Pressurized Water Reactors (PWR) in Korea use a remote monitoring system (RMS), which have been used in Korea since 1998. A Memorandum of Understanding on Remote Monitoring, based on Enhanced Cooperation on PWRs, was signed at the 10th Safeguards Review Meeting in October 2001 between the International Atomic Energy Agency (IAEA) and Ministry Of Science and Technology (MOST). Thereafter, all PWR power plants applied for remote monitoring systems. However, the existing method is high cost (involving expensive telephone costs). So, it was eventually applied to an Internet system for Remote Monitoring. According to the Internet-based Virtual Private Network (VPN) applied to Remote Monitoring, the Korea Atomic Energy Research Institute (KAERI) came to an agreement with the IAEA, using a Member State Support Program (MSSP). Phase I is a Lab test. Phase II is to apply it to a target power plant. Phase III is to apply it to all the power plants. This paper reports on the penetration testing of Phase I. Phase I involved both domestic testing and international testing. The target of the testing consisted of a Surveillance Digital Integrated System (SDIS) Server, IAEA Server and TCNC (Technology Center for Nuclear Control) Server. In each system, Virtual Private Network (VPN) system hardware was installed. The penetration of the three systems and the three VPNs was tested. The domestic test involved two hacking scenarios: hacking from the outside and hacking from the inside. The international test involved one scenario from the outside. The results of tests demonstrated that the VPN hardware provided a good defense against hacking. We verified that there was no invasion of the system (SDIS Server and VPN; TCNC Server and VPN; and IAEA Server and VPN) via penetration testing.