Undergraduate programme in Computer sciences Security Engineering MSc in Computer Science EIT Master on Security and Privacy Lecture 02 – A Smart Metering Infrastructure Federica Paci

Paci-Labunets-Security Engineering Lecture Outline General Introduction Motivation What is Smart Grid ? Description of the Scenario Environment Scenario Overview Security and Privacy Issues in Smart Grid Possible worst case scenarios Threat and Attack Analysis 12/11/2018 Paci-Labunets-Security Engineering

Undergraduate programme in Computer sciences Motivation 70% of urban population will live in cities by 2050 Current energy supply affected by: Blackouts Power overloads High costs Upcoming challenges: Distributed power supply Regenerative sources in many places Scarcity of resources Intermittent power supply 12/11/2018 Paci-Labunets-Security Engineering

Paci-Labunets-Security Engineering What is Smart Grid ? A smart grid is a modernized electrical grid that uses information and communications technology to gather and act on information, such as information about the behaviors of suppliers and consumers, in an automated fashion to improve the efficiency, reliability, economics, and sustainability of the production and distribution of electricity. ENERGY ICT SMART GRID 12/11/2018 Paci-Labunets-Security Engineering

Properties of the Smart Grid Self-monitoring Auto-balancing Self-Regulating Efficient Cost reducing Those properties are necessary to cope with the requirements of future power supply Energy is flowing in both directions Amount of energy must be carefully controlled Incentives must be provided to consume / store energy only when production is high in real-time 12/11/2018 Paci-Labunets-Security Engineering

Paci-Labunets-Security Engineering What is Smart Grid? 12/11/2018 Paci-Labunets-Security Engineering

Where is AMI in the Smart Grid? 12/11/2018 Paci-Labunets-Security Engineering

The scenario : private household ABD SM DCN HAN TV HG TN NG BD Raw BD REMS ESS S&C BDF Solar 3P EMS PDD 12/11/2018 Paci-Labunets-Security Engineering

Paci-Labunets-Security Engineering Entities (Roles) Energy Generators Prosumer & Home Domain Smart Appliances Smart Meter (Wireless) Home Area Network Home Gateway Home Energy Management System Energy Suppliers Data Communication Network Network Gateway Energy Supply Server Meter Point Operator 12/11/2018 Paci-Labunets-Security Engineering

Undergraduate programme in Computer sciences Home Domain Smar Meter (SM) Records date related to energy consumption and production Transmits this data to the Energy Supplier Energy Management System (EMS) Web server Allows users to check energy consumption and production Allow users to set up policies to buy, sell or consume energy 12/11/2018 Paci-Labunets-Security Engineering

Paci-Labunets-Security Engineering Home Domain Smart Appliances (SA) Devices that can be remotely controlled and monitored Home Gateway (HG) Device that connects to the Internet and SAs and SM Home Area Network (HAN) Wireless Network Connect SAs to EMS and EMS to HG 12/11/2018 Paci-Labunets-Security Engineering

Energy Supplier Domain Data Communication Network (DCN) IP Network Two-way communication between NG and SM Network Gateway (NG) Connect HG with other Smart Grid components Energy Supply Server (ESS) Collects aggregated billing data 12/11/2018 Paci-Labunets-Security Engineering

Paci-Labunets-Security Engineering Other domain Remote Device for Home Energy Management (REMS) Allow to remote access EMS Energy Generators (EG) Operate conventional or generative power plants Receive aggregated data from different households 12/11/2018 Paci-Labunets-Security Engineering

Data Flow Energy Generation („SA“) Data REMS: Remote device for Control & Usage Display Energy ESS: Energy Supplier Server S&C 20°C SA: Thermostat SA: Smart Appliances S&C EMS: Control & Usage Display BDF SA: TV S&C Vehicle Charging („SA“) ABD Internet HG: Home Gateway SA Third Parties: Energy Generator etc PDD DCN BD HAN: Home Area Network NG: NW Gateway Solar ABD 12/11/2018 Paci-Labunets-Security Engineering Raw BD SM: Smart Meter TN: Transmission Node

Paci-Labunets-Security Engineering Data Flow Raw BD (Raw Billing Data) All data related to energy consumption, storage and production Gathered by the SM BD (Billing Data) Processed and stored by the SM and the (local) EMS. ABD (Aggregated Billing Data) Sent to the NG over the public Data Communication Network and forwarded to the Energy Supplier DCN HAN TV HG TN NG ABD BD Raw BD REMS ESS S&C BDF Solar 3P EMS PDD SM PDD (data for power generation and distribution purposes) Aggregated by ES from ABD of several households Purpose: usage forecasts for certain sectors 12/11/2018 Paci-Labunets-Security Engineering

Paci-Labunets-Security Engineering Data Flow BDF (Billing Data Feedback Information) Every ± 5 minutes Users are informed Energy usage, generation volume, costs, revenues, and current rates S&C (Status and Control) Local logon to the EMS View the smart appliances’ status Control of the smart appliances or modification of the energy management policies DCN HAN TV HG TN NG ABD BD Raw BD REMS ESS RS&C BDF Solar S&C 3P EMS PDD SM RS&C (Remote S&C) Remotely logon to the EMS Using e.g., a cellular phone or a remote PC From external hot spots (e.g., internet café) 12/11/2018 Paci-Labunets-Security Engineering

Smart Grid Security Issues Data confidentiality How to make energy consumption information confidential? How to make forecast information of energy consumption confidential? Tamper resistance and non repudiation How to make sure that billing data and consumption data are not tampered and not repudiable? How to make sure that stored billing data and consumption data are not tampered and not repudiable? 12/11/2018 Paci-Labunets-Security Engineering

Smart Grid Security Issues Availability How to ensure the availabilty of all Smart Grid components? What about if the Energy Supplier Server is target of DoS? What about if the Energy Management System is target of DoS? What about if the Smart Meter is target of DoS? 12/11/2018 Paci-Labunets-Security Engineering

Smart Grid Security Threat: An example Energy theft Based on tampering energy consumption data Different ways to conduct this attack When the data are collected from the smart meter When they are stored in the smart meter When they are transmitted to the energy supplier server Possible attackers: Prosumer Organized Crime Insiders 12/11/2018 Paci-Labunets-Security Engineering

Smart Grid Privacy Issues Privacy of prosumers How to ensure privacy of end users without relying on a trusted aggregator? How to ensure that consumption data are processed according to user consent? 12/11/2018 Paci-Labunets-Security Engineering

Smart Grid Privacy Threats: An Example What fine-grained consumption data can reveal? Question Pattern Granularity Where you home during your sick leave? Yes: Power activities during the day No: Low power usage during the day Hour/Minute Did you leave your child home alone? Yes: Single Person Activity Pattern No: Simultaneous power events in distinct are of the hours Minute/Second Do you eat hot or cold breakfast? Hot: burst of power events in the mornings Cold: No power event matching hot breakfast appliances Second 12/11/2018 Paci-Labunets-Security Engineering

Paci-Labunets-Security Engineering Assignments Identify threats External attackers Insiders which are either malicious or careless Employees, family members, neighbours, installers, manufacturers Identify security controls to provide First line of defence Defence in depth or redundancies Focus on network and application layers CORAS and SecRAM will “guide” you in the identification of threats and controls 12/11/2018 Paci-Labunets-Security Engineering

Paci-Labunets-Security Engineering 1: Family with children Which information could the attacker obtain? What can he deduce? How many persons live? Possible tracing? Combination of information useful for burglary or … ? Possible weak point Attacker: insider / outsider 12/11/2018 Paci-Labunets-Security Engineering

Paci-Labunets-Security Engineering 2: Smart Appliances Which appliances are “smart”? What kind of information (R/S&C) do they process? What are the appliances’ functionalities? Can a successful attack to an appliance lead to a compromise of the AMI? Attacker: insider / outsider 12/11/2018 Paci-Labunets-Security Engineering

Paci-Labunets-Security Engineering 3: Privacy Initial assumption: all communication is encrypted Possible to read / disclose / etc. information regardless of encryption? Time / Communication Parties / Message length etc., help disclose the payload data? Possible to misuse insider status (Prosumer / Energy Supplier)? Attacker: insider / outsider 12/11/2018 Paci-Labunets-Security Engineering

Possible impersonation How to impersonate another customer for accounting fraud? Possible to impersonate a server? With which results? X Possible impersonation or interference Attacker: insider / outsider 12/11/2018 Paci-Labunets-Security Engineering

Paci-Labunets-Security Engineering 5: Encryption & Key mgmt Assumption: Communication is encrypted Possible to bypass the communication encryption? Possible to extract keys or to intercept key exchanges or key updates? Possible to exploit implementation weaknesses at the network / transport / application layer? Possible weak point Attacker: insider / outsider 12/11/2018 Paci-Labunets-Security Engineering

Undergraduate programme in Computer sciences 6: Electric Mobility Assumption: Electric vehicles share an unique vehicle ID Possible impersonation? Possible fraud? Possible tracing? Possible theft? … uvID uvID 12/11/2018 Paci-Labunets-Security Engineering

Material on the Scenario Slides from this lecture You can download it from esse3 Under the Slides folder A description of the scenario Under the Smart Grid folder Send to you via email 12/11/2018 Paci-Labunets-Security Engineering

Paci-Labunets-Security Engineering Suggested Readings NIST Smart Grid Conceptual Model http://smartgrid.ieee.org/ieee-smart-grid/smart-grid-conceptual-model NIST, Smart grid: A beginner's guide. http://www.nist.gov/smartgrid/ beginnersguide.cfm. The Perils of Smart Metering http://www.lightbluetouchpaper.org/2012/09/17/the-perils-of-smart-metering/ Smart Metering – Ed Milliband’s Poisoned Chalice http://www.cl.cam.ac.uk/~rja14/Papers/SmartMetering-Feb82012.pdf On the security economics of electricity metering http://www.cl.cam.ac.uk/~rja14/Papers/meters-weis.pdf Who controls the off switch? http://www.lightbluetouchpaper.org/2010/07/26/who-controls-the-off- The Foundation for Information Policy Research http://www.fipr.org/100110smartmeters.pdf 12/11/2018 Paci-Labunets-Security Engineering

Paci-Labunets-Security Engineering Suggested Readings G. Wood and M. Newborough, Dynamic energy-consumption indicators for domestic appliances: environment, behaviour and design, 2003. E. Quinn, Privacy and the new energy infrastructure,2009. A. Molina-Markham, P. Shenoy, K. Fu, E. Cecchet, and D. Irwin, Private memoirs of a smart meter, 2010. P. McDaniel and S. McLaughlin, Security and privacy challenges in the smart grid, 2009. 12/11/2018 Paci-Labunets-Security Engineering