Low Cost and Secure Smart Meter Communications using the TV White Spaces Omid Fatemieh (UIUC) Ranveer Chandra (Microsoft Research) Carl A. Gunter (UIUC)

AMI: integral part of smart grid Reconfigurable nature and communication capabilities of advanced (smart) meters allow for deploying a rich set of applications – Automated meter reading – Outage management – Demand response – Electricity theft detection – Support for distributed power generation Advanced Meter Infrastructure (AMI) 2

ISM bands – Crowded in urban areas – Short distances not suitable for rural areas Cellular links – Expensive and low bandwidth – Crowded in urban areas and limited in rural areas Proprietary mesh network technology reduces inter-operability and impedes meter diversity Idea: Use white spaces for AMI communications Propose a secure architecture that yields benefits in cost, bandwidth, and deployment Existing AMI Communications 3

White spaces are unused portions of TV spectrum ( MHz) – Excellent long-range communication and penetration properties FCC’s recent rulings (Nov ‘08, Sep ‘10) allows for unlicensed communication in white spaces – Spectrum sensing helps with identifying and assessing quality of unused channels Standards and research prototypes – IEEE Wireless Broadband Regional Area Network Point to multipoint architecture Typical range: km (but up to 100 km) – WhiteFi [BahlCMMW09 - Sigcomm ‘09] Wi-Fi like connectivity over white spaces for up to 2km Adaptively operates in most efficient chunk of available spectrum Both require centrally aggregating spectrum sensing data White Spaces 4

Utility operates WhiteFi networks Utility buys service from independent service provider Large number and geographical spread of meters -> great for spectrum sensing -> utility can offer data to provider Proposed Architecture 5

High data rates (at low cost) Single hop from meters to WhiteFi base station – No need for complex meshes – Saves energy used in mesh maintenance and routing Large base of sensors for the provider – Lowers cost for service provider – Lowers service cost for utility Lowers cost for providing broadband service to rural areas Facilitates additional meters deployments in rural areas (particularly along power lines) Benefits 6

Cost of equipping meters with CRs and antennas – Will be lowered with large-scale production – May be lowered for utility by contract with provider Limited availability of white-spaces – Unlikely in rural and suburban areas – Can use ISM or narrow licensed bands as backup Primary emulation / unauthorized spectrum usage attacks – Transmitter localization [ChenPR – JSAC ‘08], Anomaly detection [LiuCTG09 - Infocom ‘09], S ignal authentication [LiuND10 - Oakland ‘10] Malicious false spectrum sensing report attacks – Vandalism: falsely declare a frequency as free – Exploitation: falsely declare a frequency as occupied Challenges and Security Considerations 7

Particularly important for AMI – Errors will disrupt AMI communication provider cannot only rely on meters – Meters owned by a different entity (utility) – Meters may not be well-distributed, or get compromised – Must use additional sources for spectrum sensing: mobile units, consumer premise equipment, or deployed sensors Sensors have unknown integrity and or get compromised Detecting false reports – Based on propagation models [FatemiehCG – DySPAN ‘10] – Based on propagation data [FatemiehFCG – NDSS ‘11] Detecting False Reports 8

Data-based (Classification-based) Detection 9 Model-based schemes: not clear which signal propagation models, parameters, or outlier thresholds should be used Idea: Let data speak for itself Provide natural and un-natural signal propagation patterns to train a machine learning SVM classifier Subsequently use classifier to detect unnatural propagation patterns -> attacker-dominated cells FatemiehFCG – NDSS 2011

Evaluation 10 Flat East-Central Illinois Hilly Southwest Pennsylvania (Stress Test) Transmitter data from FCC Terrain data from NASA House density data from US Census Bureau FatemiehFCG – NDSS 2011

20km by 20km area Data from 37 transmitters in 150km radius Train using data from 29 Test on the data from 8 Represent un-accounted fading and other signal variations: add Gaussian variations with mean 0 and std. dev up to 6 (dB-Spread) only to test data Pennsylvania Stress Test Results 11 FatemiehFCG – NDSS 2011

AMI communications a key part of smart grid Proposed communication architecture that offers improvements in bandwidth, deployment, and cost Discussed security and reliability challenges Identified exploitation/vandalism as important attacks and proposed techniques to detect them References 1.O. Fatemieh, R. Chandra, C. A. Gunter, Low Cost and Secure Smart Meter Communications using the TV White Spaces, ISRCS ’10. 2.O. Fatemieh, R. Chandra, C. A. Gunter, Secure Collaborative Sensing for Crowdsoucing Spectrum Data in White Space Networks, DySPAN ’10. 3.O. Fatemieh, A. Farhadi, R. Chandra, C. A. Gunter, Using Classification to Protect the Integrity of Spectrum Measurements in White Space Networks, NDSS ’11. Summary 12

Backup 13

IEEE standard draft – Wireless broadband regional area networks over TV white spaces – Point to multipoint architecture (base station to up to 255 clients), with the possibility of having repeaters in between – Each access point covers km (typical) but up to 100 km – Antennas 10m above the ground, similar to TV antennas – Support for co-existence between cells WhiteFi [BahlCMMW09 - Sicgomm ‘09] – Wi-Fi like connectivity over white spaces for up to 2km – Adaptively operates in most efficient contiguous chunk of available spectrum – Client to access point communication: using modified stock Wi-Fi cards – Requires a separate antenna and board for spectrum sensing For spectrum allocation, both techniques support spectrum sensing and using transmitter databases Standards and Research Prototypes for White-Space Communications 14