1. David Grochocki et al

2.  Lures Potential attackers  Smartmeters do two way communication  Millions of Meters has to be replaced  Serious damages just a click away

3. Survey Various Threats Identify Common Attack Techniques Decompose the data to form a Attack Tree Identify the required information which would detech the attacks Model an IDS

5.  Communication between NAN and Gateway (DCU) – Mostly 802.15.4 or sometimes 802.11  Communication between Gateway (DCU) and Utility company – 3G, Edge, WiMax.  NAN Mesh offers reliability and robustness  But.,  Complicates Security Monitoring Solution  Few smart meter vendors distribute meters which can report to the utility company directly through user’s home internet.

6.  Access to a communication infrastructure other than Internet  Access to millions of low computation devices  Access to sensitive customer information  High visibility and Impact  Financial Value of Consumption data

7.  5 Attack motivations  30 Unique attack techniques  Relevant ones to AMI are alone considered

8. Survey Various Threats Identify Common Attack Techniques Decompose the data to form a Attack Tree Identify the required information which would detech the attacks Model an IDS

9.  DDoS attack  Stealing Customer Information  Remote Disconnection

10.  Why?  Results in data outage for many Meters  How?  Install malware on meter or remote network exploit  Co-ordinate DDoS among compromised meters  Flood DCU with large packets

11.  Why?  Eavesdropping, Social Engineering  How?  Stealing encryption keys of the smart meter by physically tampering or bruteforcing the cryptosystem  Capture AMI traffic  Decrypt to obtain clear text information

12.  Why?  Distrupt Business, Inflict loss  How?  Installing malware on the DCU through physical tampering or by exploiting a network vulnerability  Identify the meters with corresponding address information  Use that information to disconnect targeted users

14. Survey Various Threats Identify Common Attack Techniques Decompose the data to form a Attack Tree Identify the required information which would detech the attacks Model an IDS

15.  System Information  CPU Usage, Battery Level, Firmware Intergrity, Clock Synchronisation  Network Information  NAN Collision rate, Packet loss  Policy Information  Authorized AMI devices, Authorized Updates, Address Mappings, Authorized services

17. Survey Various Threats Identify Common Attack Techniques Decompose the data to form a Attack Tree Identify the required information which would detech the attacks Model an IDS

18.  Centralized IDS Model Utility Company IDS DCU

19.  Can detect attacks against Utility network  But, will miss attacks against smart meters

20. DCU Meter + IDS Meter Meter + IDS

21.  Will have access to meter specific information  But.,  Attacks on DCU cannot be detected  Functioning both as a meter and IDS can be resource intensive  Keys of all other meters have to be stored in Meter + IDS devices to inspect data  Not a good idea to store some one’s decryption key on some one else’s meter

22. DCU Meter IDS Meter IDS

23.  More processing power  Less number of IDS sensors required  So less number of places where keys are stored  But still, Attacks on DCU are not detected

24. DCU Meter IDS Meter IDS Utility Company IDS

25.  Either Centralized + Embedded or Centralized + Dedicated sensors  Can detect both attacks at both (DCS and NAN) ends

26.  According to the architecure discussed in this paper, DCU is the device which is more likely to have a Public IP address  Smart meter vendors or third parties may soon start integrating 802.11 or GSM/3G into smart meters  But, why?

28.  Banner Grabbing!  SHODAN – Exponse Online Devices  Ipv4 computer search engine  Webcams, Routers, Power Plants, iPhones, Wind Turbines, Refrigerators, VoIP Phones