METHOD FOR PERSONALIZING A SMART METER DEVICE WITH A SECURITY MODULE

Description

[0001] The invention relates to a method for personalizing a smart meter device with a security module, a computer program product, a security module and a smart meter device.

[0002] The term "smart metering" generally refers to the idea of ​​equipping customers with electronic energy consumption recording devices in order to provide additional functionalities to both the customer and the energy supplier in addition to simply recording the amount of energy consumed, for example via a network.

[0003] This allows customers to obtain real-time information about their current energy consumption. The term "energy consumption" refers to the customer's consumption of any type of energy supplied to households and businesses. This includes electricity, water, and gas, as well as any other energy forms, such as district heating.

[0004] To record energy consumption, intelligent measuring systems, also known as smart meters, are used by consumers. Smart meters are meters for the energy consumed. The consumer can be a natural or legal person who consumes various measurable forms of energy such as electricity, gas, water, or heat. The goal of using smart meters is to implement intelligent measuring systems, which would, for example, enable the collection of variable service charges depending on overall demand and grid utilization. This would enable energy supply networks to be utilized more effectively overall.

[0005] The BSI technical guideline TR-03109 stipulates the provision of a so-called smart meter gateway, also known as a concentrator, as a central communications unit that can communicate with individual or multiple smart meters. The gateway is capable of communicating with devices in the so-called "home area network" and with devices in the "wide area network." The home area network includes all smart meters connected to the gateway, as well as, for example, consumers' private computing units. The private computing units can be used, for example, to provide information about current energy consumption values ​​recorded by the smart meters. The wide area network is designed to enable communication between the gateway and authorized market participants.For example, the gateway can collect the data from all smart meters and make it available to a higher-level collection point, such as an energy supplier or a metering point operator.

[0006] US 2005 / 039040 A1 (RANSOM DOUGLAS S [CA] ET AL) of February 17, 2005 (2005-02-17) discloses a system and method for detecting and responding to device tampering in an energy management device ("EM"). The EM device is equipped with mechanisms for detecting unauthorized tampering with the device. Furthermore, in response to detected unauthorized tampering, the device can take measures to protect the integrity of the data generated by the device as well as any confidential data stored in the device. Such measures include, in particular, deleting or deactivating data necessary for secure network communication.

[0007] From US 2005 / 033701 A1 (CHALLENER DAVID C [US] ET AL) February 10, 2005 (2005-02-10), a central system for receiving utility consumption reports from a number of remote meters is known. It ensures that a received report was actually transmitted by a meter registered with the central system. During the registration process, the meter transmits its public cryptographic code to the central system. With each utility consumption report, the meter sends a version of a message encrypted with its private cryptographic key. The central system decrypts this message using the meter's public key. If it matches an unencrypted version of the message, it is known that the meter sent the report.The unencrypted message can be generated by the central system and sent to the meter in a report request, or it can be generated by the meter and sent along with the encrypted version. In case of tampering, data necessary for secure network communication is deleted or deactivated.

[0008] The invention is based on the object of providing a method for personalizing a smart meter device with a security module, a computer program product, a security module and a smart meter device.

[0009] The objects underlying the invention are achieved by the features of the independent patent claims. Preferred embodiments of the invention are specified in the dependent patent claims.

[0010] A method is specified for personalizing a smart meter device with a security module, wherein the security module is designed as a communication interface of the device with an external computer system, wherein a unique identifier is stored in the security module, wherein the method comprises an inseparable connection of the security module to the device, wherein after the connection the device is identifiable by the unique identifier.

[0011] Embodiments of the invention could have the advantage that a unique identity can be permanently assigned to the device through the personalization process. For this purpose, it is not necessary, for example, to provide the device itself with an identity during a manufacturing process. This would be associated with high costs and considerable technical effort, particularly with regard to security requirements to be met during the manufacturing process. This is because the allocation of identities is typically linked to a particularly secure production environment, e.g., a so-called trust center. This could be necessary, in particular, when allocating identities for fee-related collection relating to the energy consumption values ​​recorded by the smart meter assigned to the device.Due to the irreversible connection of the device with a separately available security module, it is sufficient to simply create the security module in the secure production environment and assign it the identity. The subsequent coupling of the security module and the device then assigns the device the same identity that was also assigned to the security module. Since the security module also serves as a communication interface for external computer systems, it is ensured that a corresponding communication process, e.g., of consumption data to meter operators and / or energy suppliers, always includes the identity-establishing component "security module." In this case, for example, the security module can ensure that transmitted data always contains the unique identifier "Globally Unique Identifier" (GUID). This means that the device can always be uniquely identified in any communication network.

[0012] According to one embodiment of the invention, the inseparable connection of the security module to the device comprises a mechanical connection. A mechanical connection can, for example, involve a soldering process, a welding process, or an adhesive process between the security element and the device. A permanent mechanical locking of the security element in the device is also possible. In the simplest case, the security module could be cast into a housing of the device, so that the "breaking" of this cast connection would result in the destruction of the security module and / or the device.

[0013] Preferably, the mechanical connection should be made in such a way that subsequent removal of the security module from the device leads to at least partial – preferably automatic – inoperability of the device and / or the security module. For example, the mechanical contact between the security element and the device could be designed such that subsequent removal of the security module from the device inevitably and automatically irreparably interrupts electrical contacts in the device and / or the security module. In the case of a soldering process, the mechanical contact between the security element and the device could be designed such that when the security element is "unsoldered" the resulting heat would irreparably destroy electronic components of the device and / or the security module.Preferably, these electronic components are absolutely necessary during operation of the device in order to ensure the basic functions of the device, including the transmission of smart meter measurement data to metering point operators and / or energy suppliers.

[0014] Preferably, the inoperability of the device and / or the safety module occurs automatically in the event of subsequent removal of the safety module from the device, at the latest after the device and / or the safety module is put back into operation.

[0015] According to one embodiment of the invention, the partial inoperability comprises a permanent disruption of the device's ability to communicate with the external computer system. If the external computer system is a meter operator and / or energy supplier, the latter will thus determine that there is a problem with the device due to the lack of communication capability. In this case, the meter operator and / or energy supplier will automatically take action on the device, e.g., have a technician on-site inspect the device. This allows tampering with the device to be reliably and quickly detected.

[0016] According to one embodiment of the invention, the partial inoperability results from mechanical destruction of the device and / or the security module due to subsequent removal.

[0017] According to one embodiment of the invention, the subsequent removal initiates an electronic deactivation process on the device and / or the security module, with the partial inoperability resulting from the deactivation process. This deactivation process can be hardware and / or software controlled. For example, a module of the device can regularly check for the presence of the security module. If it is determined that the security module has been removed, this module can then deactivate the device or individual functions of the device, as described above. It is also possible for the module to initiate a partial self-destruction of its electrical circuits or elements.

[0018] According to one embodiment of the invention, due to the connection of the security module to the device, a linking process is started on the device and / or the security module, wherein the inseparable connection of the security module to the device as a result of the linking process comprises a logical link between the security module and the device. A logical link is understood to be a software-controlled process which uniquely couples the device to the security module. For example, the logical link is made via an identifier which links the device and the security module. This can be an identifier which is identical for the device and the security module. However, it is also possible that a new identifier is generated from, for example, a device ID of the device and a module ID of the security module, which uniquely links the device ID and the module ID.A hash process using the device ID and the module ID would be possible here. Using an identifier generally has the advantage that embodiments can be implemented without significant mechanical effort, resulting in significant cost savings.

[0019] For example, the use of an identifier can ensure that the gateway cannot be subsequently replaced with another gateway without authorization. For example, this could prevent a meter operator from receiving data from a "hacked" gateway that is only sporadically connected to the corresponding smart meters and therefore does not actually perform any real energy consumption measurement at all.

[0020] Preferably, the linking process can only be performed once for a given security module. An internal counter of the security module could be used for this purpose, thus preventing multiple use of the security module—for example, in different devices.

[0021] According to one embodiment of the invention, the linking process comprises transmitting the security module's identifier to the device and subsequently irreversibly storing the identifier received by the device in the device. For example, the identifier is transmitted automatically when the device connected to the security module is first put into operation. This ensures that, on the one hand, the device can be equipped with current security modules at any time before commissioning, but is uniquely personalized after commissioning.

[0022] According to one embodiment of the invention, the identifier of the security module and / or the irreversibly stored identifier cannot be changed. Changing the identifier is therefore only possible by replacing the security module and the device.

[0023] According to one embodiment of the invention, after the security module is connected to the device, a regular automatic check is performed to determine whether the identifier stored in the security module is still identical to the identifier stored in the device. In the event of a lack of identity, a notification of this is transmitted to the external computer system and / or an electronic deactivation process is initiated on the device and / or the security module, whereby a partial inoperability of the device and / or the security module results from the deactivation process. This deactivation process, which can be implemented, for example, as software or hardware, has already been described above and can be implemented analogously in this embodiment.

[0024] Regular automatic checks can occur at set times, at random times, or even upon predefined events. A predefined event could, for example, include the transmission of consumption data recorded by the smart meter via the security module to a meter operator and / or energy supplier, or generally any read access to the recorded consumption data by external systems. External systems can be devices in the home area network and the wide area network.

[0025] According to one embodiment of the invention, the device is a smart meter or a smart meter gateway assigned to the smart meter or multiple smart meters. A gateway is assigned to a smart meter if the smart meter makes its recorded energy consumption values ​​available to an energy supplier or metering point operator via the gateway. However, the gateway can also act solely as the central communications interface for one or more connectable smart meters. Whether access to the measurement data recorded by the smart meters occurs indirectly via the gateway to the smart meters or whether the smart meters store the measurement data in the gateway is irrelevant; both are possible.

[0026] According to one embodiment of the invention, the security module is a chip card.

[0027] According to one embodiment of the invention, the identifier is a public key of the security module and / or an IPv6 address of the security module. The latter has the particular advantage that the identifier also enables unique addressing of the security module and thus of the device on the Internet. This could be relevant for the automated retrieval of consumption data recorded by the smart meter. The use of the public key has the advantage of automatically ensuring unique and personalized identification of the security module. Since a trust center or a trusted service manager will preferably also assign trusted certificates to the security module at the same time, it is "officially" ensured that the required public key was actually issued by this trusted authority. The authenticity of the key is, for example,Verifiable via public directory servers. The use of fake IDs is thus verifiably excluded.

[0028] It is also possible that the identifier is a certificate of the security module. The certificate, in turn, could contain the public key of the security module. This has the advantage that the authenticity of the identifier can be verified by third parties. Furthermore, it has the advantage that the certificate, which would have to be transmitted anyway in the event of communication, can be used to simultaneously ensure unique identification of the security module. For example, a challenge-response procedure could generally be used to communicate measurement data recorded by the smart meter, which requires prior mutual certificate verification. This means that certificates are used anyway, eliminating the need for the additional explicit and separate transmission of identifiers.

[0029] Finally, it is also possible for the identifier itself to be contained in a certificate of the security module. This also ensures that the authenticity of the identifier can be officially verified by third parties.

[0030] In principle, the certificates mentioned can be created according to a Public Key Infrastructure (PKI) standard, for example, the X.509 standard. It should be noted that the certificates described can be stored on a public directory server.

[0031] In a further aspect, the invention relates to a computer program product with instructions executable by a processor for carrying out the method steps described above.

[0032] In a further aspect, the invention relates to a security module for use in the method described above.

[0033] In a further aspect, the invention relates to a smart meter device for receiving a security module described above.

[0034] The security module and the smart meter device have analogous capabilities and functionalities to those described above with regard to the procedure.

[0035] It should also be noted that the security module is preferably configured, for example, in its delivery state, in such a way that only a trusted entity is capable of communicating with the security module after successful authentication. This trusted entity can be the entity that previously assigned the security module the identifier. This ensures that, in particular, a fee-relevant configuration of the smart metering system is only entrusted to an entity that is classified as trustworthy by both the authorized market participants, i.e., for example, the metering point operators and the actual energy suppliers, as well as the end consumers. "Fee-relevant configuration" is understood below to mean that this configuration, with regard to a smart meter, determines who is authorized, for example, to bill the energy quantities recorded by the smart meter.Furthermore, it can also be used to determine which individuals, such as end users and authorized market participants, are allowed to access the functions and information available regarding the smart meter, and to what extent. Since this determination is made by a trusted entity, it ensures that misuse of these functions and information by unauthorized third parties is excluded. This information can include, for example, location information of the smart meter, values ​​measured by the smart meter, location information of the storage area, or any values ​​contained in the storage area.

[0036] According to one embodiment of the invention, communication via the device's communication interface with the external computer system takes place through a secure transmission that uses end-to-end encryption between the computer system and the security module. This makes it possible to establish the connection between the security module and the computer system over any network, since the end-to-end encryption prevents third parties from making changes to the data transmitted over the connection. In general, the invention can be implemented in such a way that all communication between the computer system and the security module can take place over any type of network. This includes communication via the Internet, communication via wireless network connections such as mobile radio, and communication using a carrier frequency system.The latter is also known as "Powerline data transmission" and includes devices for data transmission via existing communication or power networks.

[0037] Preferred embodiments of the invention are explained in more detail below with reference to the drawings. They show: Figure 1 is a block diagram of a system for implementing the method described above, Figure 2 is a flow diagram of a method for personalizing a smart meter device, Figure 3 is a flow diagram of a method for checking a personalization of a smart meter device, Figure 4 is a block diagram of a smart meter system, Figure 5 is a flow diagram of a method for initializing a memory area, Figure 6 is a flow diagram of a method for providing a security module.

[0038] In the following, similar elements are marked with the same reference numerals.

[0039] TheFigure 1 shows a block diagram of a system for implementing a method for personalizing a smart meter device with a security module. In the following, it is assumed that the smart meter device is a smart meter gateway 138, which is coupled to smart meters 142, 144 via interface 118. A security module 100 serves as the communication interface of the gateway 138 with an external computer system 166. Communication takes place via an interface 116 of the security module 100. For example, the computer system is the system of a meter operator and / or an energy supplier who wishes to charge for energy consumption data recorded with the smart meters 142, 144. The data transmission is controlled, for example, by the software module 120 of the processor 126 of the gateway 138.

[0040] The security module 100 can communicate with the computer system 166 via the network 600, e.g. a powerline connection or the Internet. Likewise, communication via the interface 116 with the computer system 150 of the Fig. 4 possible. This is described in detail below.

[0041] A unique identifier 108 is stored in the security module 100. The security module 100 is provided, for example, in the form of a chip card or an integrated circuit (IC, ASIC, or "chip"), pre-personalized, i.e., equipped with identifier 108 and cryptographic key material not described in detail here. This key material is stored in Figure 4 described in more detail.

[0042] The security module is installed in accordance with Fig. 2The gateway 138 is inserted into the gateway 138 in step 700 according to the method steps described above. For this purpose, the gateway provides a corresponding receptacle for the security module 100, provided with contacts 604. Via the contacts 604, the processor 126 of the gateway 138 can communicate with the security module by means of the interface 118 via its mating contacts (not shown in detail).

[0043] After inserting the security module 100 in step 700, the security module is mechanically locked in the gateway 138, preferably in step 702. This makes it impossible to subsequently remove the security module from the gateway 138 without destroying the contacts 604. This automatically assigns the security module's identifier 108 to the gateway 138.

[0044] Steps 704 and 706 are optional and could be used instead of or in addition to the mechanical locking process. In step 704, the gateway 138 is commissioned, which automatically initiates a copying process of the identifier 108 from the security module to a memory area 136 of the gateway 138 in step 706. The copying process stores a copy 128 of the identifier 108 in the memory 136. The copying process can be controlled, for example, via program instructions 602 during initial commissioning, i.e., initialization, of the gateway 138.

[0045] The described steps thus result in an inseparable connection of the security module 100 with the gateway 138, wherein after the connection the gateway can be identified by the unique identifier 128.

[0046] The Figure 3shows a flowchart of a method for checking a personalization of a smart meter device, in this case the gateway 138 from Figure 1 For example, during each data transmission process of energy consumption data to computer 166 via interfaces 118 and 116, module 120 can perform a check in step 800 to determine whether identifiers 128 and 108 are identical or whether an identifier 108 is present at all. If security module 100 were replaced by another security module, identifiers 128 and 108 would no longer match. Since identifier 128 is preferably irreversibly stored in memory 136, replacing the security module does not simply replace identifier 128 with another.

[0047] Checking for the presence of an identifier is necessary if there is only an inseparable mechanical connection between the security module and the gateway 138. If the security module were removed, deactivating the identifier query function on the gateway side could ensure that the gateway 138 no longer receives any information about any identifiers. This then corresponds to the state of no identifier.

[0048] If it is determined in step 802 that the identifiers are identical, the method jumps back to step 800 and is executed again in a loop, possibly triggered by time.

[0049] If, however, it is determined in step 802 that the identifier 108 is either not present or there is no identity between the identifiers 108 and 128, steps 804 - 808 can be carried out. Step 804 includes the notification of the presumed presence of a manipulation or malfunction to an external computer system, e.g., the system 166 in Fig. 1 . Step 806 involves the partial deactivation of the gateway's functions so that, in particular, an energy supplier or metering point operator can independently detect manipulation due to, for example, incorrectly transmitted data or even the absence of data transmission.

[0050] Step 808 is also optional and involves emitting a local signal at the gateway so that a user can visually or audibly detect a partial inoperability that has occurred. A local computer of the end user connected to the gateway 138 could also be notified of this via the signal in step 808.

[0051] The Figure 4 shows the block diagram of the Fig. 1 in detailed form. Together with the Figure 5The method steps shown below are intended to demonstrate, without limiting the generality, how a memory area 136 of a gateway 138, which is assigned to a plurality of smart meters 142, 144, 146, 148, can be initialized. This initialization process, in conjunction with the personalization described above, serves to provide end consumers and energy suppliers with a convenient way of communicating energy consumption data in a secure manner. The initialization process described can provide a secure, unambiguous, and traceable way that enables secure communication between the smart meters and an authorized market participant such as an energy supplier or a metering point operator.Preferably, the described computer system 150 is a computer system of a trusted entity, which is also referred to as a "Trusted Service Manager" or "TSM".

[0052] Smart meters 142-148 are used to record various energy consumption values, for example, gas (smart meter 142), water (smart meter 144), electricity (smart meter 146), and other unspecified energy sources (smart meter 148). The smart meters are connected to the interface 118 of the gateway 138 via corresponding communication connections 192.

[0053] It is now assumed that the security module 100 is already permanently and inseparably connected to the gateway 138, so that the combination of the gateway 138 and the security module 100 creates an inseparable unit 140. The gateway 138 and the security module 100 communicate with each other via respective interfaces 118 and 116, respectively. Furthermore, communication with authorized market participants and third parties or entities that are not located within the network formed by the unit 140 and the smart meters 142-148 takes place via the interface 116. The communication between interface 116 of the security module 100 and other communication participants takes place via a communication connection 190. This can be, for example, a powerline connection or a communication connection via a mobile telecommunications network or the Internet.

[0054] The security module 100 has an electronic memory 102 with protected memory areas 106 and 108. The protected memory area 106 is used to store a private key of the security module 100, and the memory area 108 is used to store the security module's identifier, the "GUID" (Globally Unique Identifier). The GUID can be, for example, an IPv6 address of the security module 100.

[0055] The electronic storage 102 may further include a storage area 104 for storing a certificate. The certificate contains a public key associated with the private key stored in the protected storage area 106. The certificate may have been created according to a Public Key Infrastructure (PKI) standard, for example, the X.509 standard.

[0056] The certificate does not necessarily have to be stored in the electronic memory 102 of the security module 100. Alternatively or additionally, the certificate can also be stored in a public directory server.

[0057] The security module 100 has a processor 110 for executing program instructions 112 and 114. Executing the "cryptographic protocol" program instructions 112 enables, for example, authentication of a trusted entity 150 or an energy supplier 166 to the security module 100. The cryptographic protocol can be, for example, a challenge-response protocol based on a symmetric key or an asymmetric key pair.

[0058] Mutual authentication of the security module and the trusted authority or energy supplier is also possible.

[0059] The program instructions 114 are used for end-to-end encryption of data to be transmitted between the security module 100 and the trusted entity 150 or the energy supplier 166. A symmetric key can be used for end-to-end encryption, which is agreed upon, for example, during the execution of the cryptographic protocol between the security module 100 and the other participants 150 or 166.

[0060] Similar to the security module 100, the trusted entity 150 also has the previously described electronic memory 152 and a protected memory area 156 for storing a private key of the trusted entity. The memory 152 can also contain a certificate 154 of the trusted entity. However, this certificate can also be stored on a central certificate server.

[0061] A processor 158 of the trusted entity 150, in turn, has the program instructions 112 and 114 described above with respect to the security module 100 for implementing a cryptographic protocol and performing end-to-end encryption. The cryptographic protocol and the end-to-end encryption can be used for communication via the interface 164 with the energy supplier 166 or with the security module 100. The certificate 154, in turn, contains a public key associated with the private key stored in the protected memory area 156.

[0062] The "energy supplier" 166 is a computer system of the energy supplier, which in turn has an electronic memory 168 and a processor 178. Furthermore, this computer system is assigned an interface 186, via which communication with the trusted entity 150 or the security module is enabled.

[0063] The electronic memory 168 of the energy supplier 166 has a protected memory area 172 with a private key, wherein the private key is assigned to a public key, which is also contained in a certificate 170 in the electronic memory 168. Furthermore, a memory area for one or more applications is provided in the memory 168, wherein these applications, for example, enable a fee-relevant configuration of the gateway 138. Measurement data 176, which were previously received by the gateway 138, can also be stored in the electronic memory 168.

[0064] The processor 178 has program instructions 180 for recording the consumption data supplied by the gateway 138 and, optionally, for executing process steps for consumption billing based on the determined measurement data (program instructions 182). Program instructions for executing steps of a cryptographic protocol 112, as well as program instructions (not shown) for implementing end-to-end encryption, may also be provided, whereby these program instructions enable secure communication with the trusted entity 150 or the security module 100.

[0065] If a new customer is to be assigned to the energy supplier 166, an initialization process of the security module could take place, for example, after an initial installation of the smart meters 142-148 and the provision of the gateway 138 with the security module 102. This initialization process could be initiated by the new customer (an end user) or a specific technical entity that installed the smart meters submitting a corresponding notification to the energy supplier 166. This notification should preferably include the GUID 108 of the security module 100, as this enables a unique identification of the security module 100 to the energy supplier 166.

[0066] After the energy supplier 166 has received this message via its interface 186, for example via a web interface of a corresponding website, the energy supplier 166 establishes a communication channel to the trusted entity 150. This step is described in Figure 5 designated by reference numeral 200. The trusted entity can, for example, be a so-called "Trusted Service Manager TSM," i.e., an officially certified entity that certifies the respective identity of the communication partner in electronic communication processes.

[0067] After establishing the communication channel in step 200, the energy supplier 166 is authenticated in step 202. For this purpose, the energy supplier's certificate 170 is verified by the trusted entity 150. For example, if the certificate verification is positive, the trusted entity 150 can perform a challenge-response procedure in which a random number is generated, which is encrypted with a public key of the energy supplier 166 contained in the certificate 170 and transmitted to the energy supplier 166. The energy supplier 166 can then decrypt the random number with its private key 172 and send it back in plain text. If the random number now received from the trusted entity 150 matches the previously described random number, the authenticity of the energy supplier 166 is indeed assured.

[0068] After performing step 202 and the optional challenge-response procedure, a channel with end-to-end encryption can then be established in step 204 via the communication connection 188 between the power supply 166 and the trusted entity 150. The program instructions 114 of the processor 158 of the trusted entity can be used for this purpose.

[0069] After establishing the channel in step 204, the trusted entity 150 receives a request in step 206 to load an energy metering application 174 from the energy supplier 166 and the memory 136 of the gateway 138. To uniquely specify the memory 136 or the gateway 138, the GUID 128 of the gateway 138, which is contained in the memory 136, is also transmitted to the trusted entity along with the request to initialize the memory 136. Preferably, the GUID 128 of the memory 136 is identical to the GUID 108 of the memory 102 of the security module 100.

[0070] Upon receipt of the GUID in step 206, the trusted entity 150 is able to uniquely address the desired gateway 138 for uploading the application 174. To this end, in a next step 208, the trusted entity 150 establishes a communication channel to the security module 100 via the communication connection 190. The trusted entity 150 authenticates itself to the security module 100. The authentication, in addition to a verification of the certificate 154 by the security module, may, for example, again include a challenge-response procedure on the part of the security module 100. For this purpose, the security module 100 could, in turn, generate a random number, encrypt it with the public key of the trusted entity 150, and send it to the trusted entity 150.The trusted entity 150 would decrypt the encrypted random number with its private key 156 and send the decrypted random number in plain text back to the security module 100. If the security module determines that the decrypted random number received in this way matches the random number originally encrypted by the security module, authentication of the trusted entity is provided.

[0071] The method then continues in step 212, namely the establishment of a communication channel with end-to-end encryption between the trusted entity 150 and the security module 100. This can again be done by using the program instructions 114 of the processor 110 of the security module 100.

[0072] In step 214, the security module 100 receives the energy sensing application 174 from the trusted entity.

[0073] At this point, it should be noted that it may be advantageous if, for example, the trusted entity keeps the most frequently sent energy measurement applications in a local storage of the trusted entity, so that it is not necessary to constantly transfer the applications 174 from the energy supplier 166 to the trusted entity 150 when new customers are added.

[0074] After receiving the energy recording application in step 214, the security module 100 stores the application in the memory 136 of the gateway 138. If, for example, the application 174 is an application for recording energy consumption with regard to water and electricity, the application is stored as application 132 in the memory 136. This application is capable of processing energy consumption data from the smart meter 144. Similarly, the memory 136 can include corresponding applications for the energy recording of gas (134) as well as further applications 130 for the recording of other forms of energy. The storage of the energy recording application by the security module 100 in the gateway 138 is Figure 2 marked by step 216.

[0075] In addition to the receipt of the energy measurement application in step 214 by the security module 100, it is also possible for the trusted entity 150 to receive energy supplier-specific authorizations or precise specifications of network data elements, which are also stored in a further area 125 of the memory 136. These authorizations or specifications of measurement data elements make it possible to determine in advance which information the energy supplier 166 may receive from the gateway 138. For this purpose, it is possible, for example, for the trusted entity 150 to define specific authorizations for each energy supplier in advance, which authorizations apply globally to all energy suppliers 166 and which are generally transmitted to the security module and thus to the gateway 138 with the transmission of energy measurement applications.

[0076] It is also possible that configuration data is received from the trusted entity 150. This configuration data can relate to the technical configuration of the smart meter and / or the gateway.

[0077] Using the data acquisition program instructions 122 of the processor 126, the gateway 138 is now able to acquire measurement data relating to energy consumption, for example, from the smart meter 144 and the smart meter 146. The corresponding measurement data is stored in the memory area 124 of the memory 136. The measurement data 124 essentially consists of various measurement data elements, which can include, for example, the time of acquisition of the measurement data, individual measurement data points at the respective time, and information about the generation of the measurement data (e.g., current, voltage, water pressure, water temperature, gas pressure). The measurement data 124 can be subjected to further analysis via the applications 130, 132, and 134, resulting in evaluated measurement data, which can also be stored as "measurement data elements" in the memory area 124.For example, the evaluated measurement data may be accumulated energy consumption values.

[0078] The authorizations 125 described above, or the specifications of the measurement data elements, make it possible to determine in advance which of these measurement data elements 124 the energy supplier 126 may retrieve. Furthermore, this makes it possible to determine in advance how detailed such retrieval is permitted. Such detailed and time-accurate retrieval of the measurement data 124 could be undesirable, since short measurement intervals could provide insights into the use of electronic devices and thus create user profiles, which an end customer might not be interested in.

[0079] As already mentioned above, the security module 100 and the gateway 138 are inseparably connected. For example, they form a structural unit 140, as shown in Figure 1To create this unit 140, the steps described in the flow chart of Figure 4 The procedural steps explained again in simplified form are carried out.

[0080] In step 400, the security module 100 is first provided. This is followed by the storage of key material and certificates in the security module in step 402. For example, the security module could have a corresponding cryptographic unit for this purpose, by means of which the private key 106 is independently generated. Alternatively, it is also possible for the trusted entity to generate the private key and store it in the security module in a memory area that is not accessible from the outside. The public key associated with the private key is attached to the certificate, which is then signed by the trusted entity and stored in the memory 102 of the security module.

[0081] Subsequently, in step 404, the security module is inserted into the gateway, for example, in the form of a chip card, and the security module and gateway are permanently connected. For example, the security module and gateway could be electronically coupled in such a way that removing the security module from the gateway would automatically destroy the security module.

[0082] After inserting the security module into the gateway 404, an automatic logical link between the security module 100 and the gateway 138 occurs in step 406. For example, this could be achieved by irreversibly writing the GUID 108 of the security module into the memory 136 of the gateway 138 as GUID 128. For example, the security module 100 should ensure that communication with the gateway 138 for providing measurement data elements and via the energy supplier 166 only takes place if the GUID 108 and 128 are identical. List of reference symbols

[0083] 100Security module 102Storage 104Certificate 106Private key 108GUID 110Processor 112Cryptographic protocol 114End-to-end encryption 116Interface 118Interface 120Data transmission 122Data acquisition 124Measurement data 125Authorization 126Processor 128GUID 130Application 132Application 134Application 136Storage 138Storage 140Unit 142Smart meter 144Smart meter 146Smart meter 148Smart meter 150Trusted entity 152Storage 154Certificate 156Private key 158Processor 164Interface 166Utilities provider 168Storage 170Certificate 172Private key 174Application 176Measurement data 178Processor 180Data acquisition 182Consumption billing 186Interface 188Communication connection 190Communication connection 192Communication connection 600Network 602Module 604Connections

Claims

1. A smart meter device (138) with a security module (100), wherein the device is a smart meter gateway (138) associated with a smart meter, wherein the security module (100) is configured as a communication interface of the gateway (138) with an external computer system (166; 150), wherein an IPv6 address (108) of the security module (100) for uniquely addressing the security module (100) on the Internet is stored in the security module (100), wherein the gateway (138) comprises a receptacle, provided with contacts (604), for the security module (100), wherein the contacts (604) are configured for communication between a processor (126) of the gateway (138), by means of an interface (118), and the security module (100) via counterpart contacts of the security module (100), wherein the security module (100) inserted into the gateway (138) is mechanically locked in the gateway (138), whereby it is no longer possible to remove the security module (100) subsequently from the gateway (138) without destroying the contacts (604) of the gateway (138), wherein the connection of security module (100) and gateway (138) provides the gateway (138) with the same identity that is also assigned to the security module (100), and following the connection the gateway (138) is identifiable by the IPv6 address (108) of the security module (100), wherein the gateway (138) is uniquely identifiable by the IPv6 address (108) in any communication networks, wherein the gateway (138), for protection against a replacement of the security module (100) by another security module, is configured with each data transmission operation of energy consumption data to the external computer system (166; 150), to perform a check to ascertain whether an IPv6 address (108) is present, in the event of a removal of the security module (100) by a deactivation of a function to query the IPv6 address (108) on the part of the gateway (138), to ensure that the gateway (138) no longer obtains information about any IPv6 address, wherein this corresponds to a state of absence of an IPv6 address for identification of the gateway.

2. The smart meter device (138) according to claim 1, wherein the manipulation on account of data transmitted defectively as a result of the partial deactivation of the functions of the gateway (138) is determinable automatically by an energy supplier or meter operator.

3. The smart meter device (138) according to any one of the preceding claims, wherein the gateway (138) for protection against a replacement of the security module (100) by another security module is further configured to output a local signal so that a user is optically or acoustically able to identify the partial functional incapacity that has occurred.

4. The smart meter device (138) according to claim 3, wherein the gateway (138) for protection against a replacement of the security module (100) by another security module is further configured, by means of the local signal, to also inform a local computer of an end consumer about the partial functional incapacity that has occurred, said computer being connected to the gateway (138) .