Smart Meter Gateway and procedures for operating a Smart Meter Gateway

Abstract

A smart meter gateway (1) is provided with a mobile radio module (9) that is configured to forward measurement data to an authorized recipient via a mobile radio network (14), and with a processor (3) that interacts with a main memory (4) and / or a flash memory (5) to run application software for SMGWs (19) on an operating system (18), with which application software measurement data is read out and encrypted and transferred to the mobile radio module (9) for forwarding to the authorized recipient, wherein the mobile radio module (9) further comprises an embedded system (11) configured to operate a network management client (12) that communicates with a network management server (17) via the mobile radio network (14), in which an additional security module (13) is directly connected to the mobile radio module (9), with which the network management client (12) interacts,to communicate with the network management server (17) in an encrypted manner and a method for operating such a smart meter gateway (1).,

Description

[0001] Smart Meter Gateways (SMGW) are the central components of intelligent metering systems. They receive meter data, store it, and prepare it for market participants. Accordingly, they serve as the central communication unit of intelligent metering systems, through which communication - with the Local Metrological Network (LMN) with consumption measuring points of one or more consumers, - with the home network (Home Area Network, HAN) of the end user, in particular with controllable energy consumers or energy producers, and - with the Wide Area Network (WAN), in particular with the SMGW administrator and external market participants.

[0002] Smart Meter Gateways are subject to strict security guidelines. Compliance with these guidelines must be demonstrated in a certification process conducted by the BSI. All security-critical elements subject to certification are summarized in the so-called "Target of Evaluation" (TOE). This TOE is outlined by the Protection Profile (PP) for Smart Meter Gateways.

[0003] According to the current state of the art, the connection of network communication is usually realized via mobile radio modules outside the TOE.

[0004] One problem arises from the fact that for the operational operation of the SMGWs, (large) metering point operators need the ability to monitor the operation of the SMGW and, if necessary, correct configurations and parameters that are important for operation. Examples of such situations include monitoring LTE signal quality or changing the metering APN when metering operations are to be moved from gateways to another subnet. The functions required for this are summarized below under the term "Network Management (NwMgmt) functions."

[0005] For security and organizational reasons, this is usually done in completely separate departments that have nothing to do with the actual power grid monitoring and do not exercise any official Gateway Administrator (GWA) rights.

[0006] In order to implement such network management (NwMgmt) functions, it is known to use separate communication modules which, with their own operating system - typically an embedded Linux system - connect the modem of the mobile radio module with the functionality of a router and network management, so that the communication module can forward data relating to network management functions and data relating to communication with the gateway administrator or external market participants in a differentiated manner.

[0007] During the certification of an SMGW, care is taken to ensure that the secure communication channels provided by the SMGW cannot be compromised, thus preventing any influence on the transmitted measured values ​​and switching operations. However, communication to the SMGW could be deliberately disrupted by a compromised NwMgmt, which could prevent the availability of services and ultimately affect the stability of the entire power grid.

[0008] Known technical systems that are or can be used as smart meter gateways, as well as methods for their operation, are described, for example, in DE 10 2012 203 034 A1, DE 10 2012 008 519 A1, US 2015 / 0 365 238 A1, and EP 3 937 451 A1, as well as in the standard TR-03109-1 "Technical Guideline - Requirements for the Interoperability of the Communication Unit of an Intelligent Metering System, Version 1.1, September 17, 2021," and the standard TR-03109-2 "Technical Guideline - Requirements for the Interoperability of the Security Module, Version 1.1, December 15, 2014," the standard TR-03109-2. "Technical Guideline - Appendix: Smart Meter Gateway Security Module - Use Cases, Version 1.1, December 17, 2014," the TR-03109-6 standard, "Technical Guideline - Smart Meter Gateway Administration, Version 1.0, November 26, 2015," the BSI-CC-PP-0073-2014 standard, "Protection Profile for the Gateway of a Smart Metering System (Smart Meter Gateway PP), v1.3, March 31, 2014," and the BSI-CC-PP-0077-2014 standard.“Protection Profile for the Security Module of a Smart Meter Gateway (Security Module PP), v1.03, December 11, 2014.”

[0009] The object of the invention is therefore to provide a smart meter gateway and a method for operating a smart meter gateway on or with which a network management with improved security can be operated.

[0010] This object is achieved by a smart meter gateway having the features of claim 1 and a method for operating a smart meter gateway having the features of claim 5.

[0011] Advantageous developments of the invention are the subject of the respective dependent claims.

[0012] The smart meter gateway according to the invention comprises a mobile communications module configured to forward measurement data to an authorized recipient via a mobile network. More specifically, the mobile communications module typically provides an "insecure" LTE connection for data transmission, which is used by the smart meter gateway to establish several "secure" TLS channels for communication.

[0013] Furthermore, according to the invention, the smart meter gateway comprises a processor that interacts with a RAM and / or a flash memory to run, in particular, application software for SMGWs on an operating system. This software is used to read measurement data and transfer it to the mobile communications module in encrypted form for forwarding to the authorized recipient. Furthermore, logging and process control programs can also run on the operating system. All of these functions can be combined into application software for SMGWs.

[0014] Typically, the processor, memory and / or flash memory form the essential components of the Target of Evaluation and are designed to comply with the Protection Profile for the SMGW.

[0015] The cellular module also includes an embedded system (a combination of hardware and software developed to perform this function within the larger cellular module system) configured to operate a network management client. When in operation, this network management client communicates with a network management server via the cellular network.

[0016] Essential to the invention is that an additional security module is directly connected to the mobile radio module, with which the network management client interacts to communicate encrypted with the network management server. This additional security module serves to provide security-relevant functionalities; in particular, it generates random numbers with high entropy, provides secure storage for keys, and offers a basis for implementing encryption methods. This security module preferably meets the requirements of the EAL 6+ level according to the Common Criteria (CC).

[0017] Directly connected means, in particular, that the security module is located on the mobile communications module's circuit board and communicates directly with the mobile communications module. It may also be implemented on the mobile communications module, but in this case, it must not be involved in the other operations of the mobile communications module and / or be used solely to implement proprietary algorithms.

[0018] Components of the Smart Meter Gateway from its TOE, which offer such functions, for example to enable encrypted transmission of metering data, are not directly connected to the mobile communications module.

[0019] The provision of an additional security module directly connected to the mobile radio module independently secures communication during operation of the network management client and can thus significantly reduce security risks arising from this operation. In particular, such a security module allows for a high degree of control over encryption algorithms and keys and permits security certification.

[0020] In a preferred embodiment, the mobile communications module of the smart meter gateway is connected via a serialized USB interface, which is designed—especially within the TOEso—to prevent commands from being sent to the processor from the modem. This can be achieved, in particular, by ensuring that the software on the processor does not accept command calls from this interface. This provides additional protection against third-party interference with proper functionality.

[0021] Because of the associated increase in security, it is further preferred if the mobile radio module is configured to have a first communication channel for communication with the authorized receiver and a second communication channel for communication with the network management server, so that the WAN connection for network management is completely separate from the WAN connection used for metering operation.

[0022] Another advantageous feature is that the mobile communications module is configured for configuration via AT commands sent from the processor to the mobile communications module, as well as for configuration via the network management client. This allows the smart meter gateway to be properly commissioned, even if it is not yet integrated into a network management system.

[0023] The method according to the invention serves to operate a smart meter gateway with a mobile radio module to which a security module is directly connected, and with a processor that interacts with a main memory and / or a flash memory to run application software for SMGWs on an operating system, wherein the mobile radio module further comprises an embedded system. In the method, measurement data, in particular from consumption measuring points, are read out using the application software for SMGWs and transferred to the mobile radio module in encrypted form for forwarding to an authorized recipient. Furthermore, in the method with the embedded system, a network management client is operated on the mobile radio module, which communicates with a network management server via the mobile radio network.Essential to the method according to the invention is that the communication between the network management client and the network management server is encrypted with the security module directly connected to the mobile radio module. This independently secures communication during operation of the network management client and can thus significantly reduce security risks arising from this operation. In particular, the use of encryption with such a security module allows for a high degree of control over encryption algorithms and keys and permits security certification.

[0024] Preferably, the mobile communications module is configured either via AT commands from the processor or via the network management client. This ensures proper commissioning of the smart meter gateway even if it is not yet integrated into the network management system.

[0025] It is also preferable for network management communication to take place via a separate communication channel with a separate target network, e.g., using Dual APN on LTE technology. This measure also reduces the vulnerability of the smart meter gateway to third-party attacks.

[0026] In a preferred variant of the invention, the method uses a standard network management protocol, in particular SNMP or LwM2M, to provide the network management functionality. This allows the monitoring and configuration of parameters important for the operation of the SMGW.

[0027] Because the implementation, including the encryption, is carried out by the user and does not rely on the built-in encryption mechanisms of the LTE module itself, the disclosure of the source code, which is necessary to demonstrate compliance with the security requirements and / or for certification, is possible, in contrast to the situation when using special, proprietary solutions.

[0028] Preferably, strong encryption methods are used for encryption with the security module directly connected to the mobile radio module.

[0029] It is also preferred that the complete source code of the software for operating the smart meter gateway, including the mobile communications module, be disclosed for certification.

[0030] The invention is explained in more detail below with reference to a figure.

[0031] Fig. 1 shows an embodiment of a smart meter gateway.

[0032] The Fig. The smart meter gateway 1 shown in Figure 1 has a target of evaluation 2, which includes a processor 3 that interacts with a RAM 4 and a flash memory 5. A mobile radio module 9 is connected via a serialized USB interface 8, which allows commands to be executed only from the target of evaluation 2.

[0033] The mobile radio module 9 has a modem 10 and an embedded system 11 on which a network management client 12 is executed, implementing a standard network management protocol such as SNMP or LwM2M.

[0034] An additional security module 13 is directly connected to the mobile radio module 9, which in this embodiment meets the EAL 6+ security level of the Common Criteria (CC) and in particular provides the security-relevant functionalities for encryption, which include in particular random number generation with high entropy, the provision of basic encryption methods and a secure memory for keys.

[0035] The additional security module 13 interacts with the network management client 12 to communicate in an encrypted manner via the mobile network 14, the network management APN (access point) 15 and the internal network management network 16 with its backend server, the network management server 17.

[0036] The processor 3 interacts in particular with the main memory 4 and the flash memory 5 in order to operate an application software for SMGWs 19 on an operating system 18, with which measurement data, in particular from devices from a local metrological network, is read out and encrypted for forwarding to the authorized recipient to the mobile radio module 9, which communicates it via the modem 10 and the mobile radio network 14 as well as the metering APN (access point) 20 and the internal metering network 21 with its backend server, the metering server 22, and thereby forwards the measurement data read out with the application software for SMGWs 19 in encrypted form to the authorized recipient.

[0037] Accordingly, when operating the Smart Meter Gateway 1 from Fig.1 the WAN connection for network management is completely separated from the WAN connection used for metering operation and the network management communication takes place via a separate communication channel. List of reference symbols 1 Smart Meter Gateway 2 Target of Evaluation 3 processor 4 RAM 5 flash memory 8 serialized USB interface 9 Mobile radio module 10 modems 11 embedded system 12 Network Management Client 13 additional security module 14 Mobile network 15 Network Management APN 16 Network management network 17 network management servers 18 Operating system 19 Application software for SMGWs 20 Metering APN 21 Metering Network 22 Metering Server

Claims

[1] Smart Meter Gateway (1) with a mobile radio module (9) which is set up to exchange electricity network-specific data to an authorized recipient via a mobile radio network (14), and with a processor (3) which interacts with a main memory (4) and / or a flash memory (5) in order to run an application software for SMGWs (19) on an operating system (18), with which measurement data is read out and encrypted for forwarding to the authorized recipient on the mobile radio module (9), wherein the mobile radio module (9) further comprises an embedded system (11) configured to operate a network management client (12) communicating with a network management server (17) via the mobile radio network (14), characterized bythat an additional security module (13) is directly connected to the mobile radio module (9), with which the network management client (12) interacts in order to communicate with the network management server (17) in an encrypted manner. [2] Smart Meter Gateway (1) according to claim 1, characterized by that the mobile radio module (9) is connected via a serialized USB interface (8) so that no commands can be sent from the mobile radio module (9) to the processor (3). [3] Smart Meter Gateway (1) according to claim 1, characterized by that the mobile radio module (9) is configured to have a first communication channel for communication with the authorized receiver and a second communication channel for communication with the network management server (17), so that the network management network is completely separated from the metering network. [4] Smart Meter Gateway (1) according to one of claims 1 to 3, characterized bythat the mobile radio module (9) is set up both for configuration by AT commands sent from the processor (3) to the mobile radio module (9) and for configuration by the network management client (12). [5] Method for operating a smart meter gateway (1) with a mobile radio module (9), to which a security module (13) is directly connected, and with a processor (3) which interacts with a main memory (4) and / or a flash memory (5) in order to operate an application software for SMGWs (19) on an operating system (18), wherein the mobile radio module (9) further comprises an embedded system (11), whereby in the process using the application software for SMGWs (19), measurement data is read out and encrypted for forwarding to an authorized recipient on the mobile radio module (9), and a network management client (12) is operated with the embedded system (11) on the mobile radio module (9), which communicates with a network management server (17) via the mobile radio network (14), characterized by that the communication between the network management client (12) and the network management server (17) is encrypted with the aid of the security module (13) directly connected to the mobile radio module (9). [6] Method according to claim 5, characterized by that the configuration of the mobile radio module (9) is carried out either by AT commands of the processor (3) or by the network management client (12). [7] Method according to claim 5 or 6, characterized by that network management communication takes place via a separate communication channel with a separate target network. [8] Method according to one of claims 5 to 7, characterized bythat a standard network management protocol is used to provide the network management functionality. [9] Method according to one of claims 5 to 8, characterized by that strong encryption methods are used for encryption with the security module (13) directly connected to the mobile radio module (9). [10] Method according to one of claims 5 to 9, characterized by that the complete source code of the software for operating the Smart Meter Gateway (1) including the network management application) is disclosed for certification.

Images