4. Critical Issues
• Privacy (individual power consumption, smart home communication)
• Security (connection via Internet, different data and stakeholders)
4
5. Considerations by the EU
• EU Directive 2009/72/EC:
• 80% of households should be equipped with smart meters by 2020
• EU Task Force on Smart Grids, Expert Group 2 (February 2011):
• “Smart Grid products and solutions should be designed from the start
with appropriate levels of data privacy and security at their core”
• EU Commission’s recommendation (March 2012):
• Use “‘best available techniques’ to safeguard personal data and
guarantee data security when data are processed in smart metering
systems and smart grids”
(cf. Tijmen Wisman: “The Transformation of the Home through the Internet of Things: the impact on the private sphere” at APC 2012)
5
6. This Talk
Security requirements for smart meter gateways
The TURAYATM High-Assurance Security Kernel
Framework
Applying the security kernel framework
to smart meter gateways
6
8. Smart Meter Gateway
External Parties:
- Utility provider (billing)
- Gateway Admin
Home Area Network: Local Metrological Network:
- Controllable Local Systems (CLS) - Smart Meters (power, water, heat, etc.)
- User Displays for consumers
8
9. Main Functions of the Smart Meter Gateway
Meter Data Administration
Management
Receiving control
Capturing, commands and
processing, configuration data
and billing
CLS Proxy User Display
Providing an Providing an
interface for interface for
controllable local display units in
systems (CLS) to the HAN
the WAN
9
10. Protection Profile for Smart Meter Gateways
• Developed by German federal agency for information security (BSI)
• All gateway vendors must have their products certified according the PP
• PP comes along with Technical Specification regulating interoperability
• Overall security objectives:
• Protection of person-related data of consumers
• Securing a reliable billing process
• Protection of the smart meter systems
and smart grid infrastructure
10
11. Required Security Functions
• Providing secure communications channels between networks
• Privacy protection:
• Pseudonymization of consumer data
• Gateway administrators should not be able to see consumer data
• Confidentiality and integrity protection of content data
• On the device
• When transferred to external parties
• User authentication for consumers
• Secure execution environments for processing on the device
• Secure remote update (firmware, policies)
• Logging
• Self Tests
11
12. Information Flow Control
• WAN connection establishment
only allowed by Gateway (!)
• Exception: Wake-Up Call
• CLS and Meters can call Gateway
• CLS can communicate to
authorized parties in WAN
• Gateway acts as proxy
• No communication between HAN
and LMN allowed
• External parties must use Gateway
Admin to issue Wake-Up call
• Gateway then calls pre-defined
service in WAN
12
13. Problems
• Smart meter and smart meter gateway vendors are no IT security experts
• Unfamiliar with Common Criteria evaluation process
• Need to develop new or adapt existing system software to comply
• Need to demonstrate that their product protects data according PP
• Simply using Embedded Linux OS + firewall functionality not enough
• Protecting data on the device
• Controlling information flow
• Remote administrators should not be able to access consumer data
13
15. TURAYATM High-Assurance Security Kernel Framework
• Security architecture based on functional requirements from Common Criteria
• Platform independent:
server systems (virtualization, cloud) end-user / embedded devices
App App App
15
16. Experiences
• Research & Development projects:
• EMSCB: individual PCs, laptops
• OpenTC: trusted infrastructures (PCs, servers, virtual data center)
• TClouds: trusted cloud infrastructures
• Emergent: information flow control in digital enterprises
• RUBTrust/MediTrust: evaluation of certain application domains
• TrustedMobile/BizzTrust: smartphones
16
17. Development Approach
• HASK-PP: Common Criteria protection profile for the security kernel (EAL 5)
• Main concept: isolated domains for data/execution, trusted computing
• Approach: simplicity
(only few main security requirements, implementation-independent)
17
18. Framework Approach: Reduced Complexity
• Goal: Reduce size of trusted computing base
• Easier to maintain and evaluate (e.g., Common Criteria)
• Reduced attack surface
• Approaches: microkernel, virtualization, code optimization (e.g., remove
unneeded libraries)
App App App
Complex application logic
(could also include device drivers)
Basic security services
Basic resource management
Hardware security module
(e.g., TPM)
18
19. Framework Approach: Modularity
• Goal: Make security kernel applicable to several usage scenarios
• Components could be added or removed (depending on need)
• Components could be replaced by alternative implementations
(depending on hardware capabilities or required security guarantees)
• Examples:
• Resource Management: L4 microkernel, Xen hypervisor, SELinux, etc.
• Hardware Security Module: HSM, TPM, smartcard, etc.
19
26. Conclusion
• Smart grid needs to address security & privacy requirements
• Smart Meter Gateway is one important component
• In Germany: regulatory requirement of Common Criteria evaluation
• TURAYATM Security Kernel framework:
• Modular security architecture
• Common Criteria oriented development
• Smart Meter Gateway realizable on top of the security kernel framework:
• Gateway functions as isolated compartments
• Information flow control by design
26
