DATA COLLECTION WITH HYBRID SECURITY MODE

Description

[0001] The present invention relates to a measurement infrastructure, in particular an intelligent measurement infrastructure for collecting measurement data generated by a plurality of terminal devices, comprising at least one data collection device configured as a data concentrator and at least one head-end system, wherein the terminal devices, the at least one data collection device and the at least one head-end system communicate with each other by means of operating messages, according to the preamble of claim 1. Technological background

[0002] Digitalized intelligent metering infrastructures (Advanced Metering Infrastructures - AMI) are increasingly being used to collect consumption data and manage consumers of electricity, gas, water, and other energy. Such metering infrastructures comprise digital smart meters (smart meters) as end devices (EDs) that record metering data at the points of consumption. The metering data is transmitted digitally from the end devices to so-called head-end systems (HESs), which manage the consumption data and control the end devices.

[0003] Since a smart metering infrastructure can comprise a large number – up to millions – of end devices, a simultaneous direct communication connection from all end devices to the head-end system is often not possible because the available communication means are insufficient, particularly because bandwidths are too low. To ensure that data collected and sent by the end devices can be transmitted to the head-end system as securely and losslessly as possible, data collection devices, so-called data concentrators (DCs), are used.

[0004] The data collection devices are located on a communication path between the end devices and the head-end system. They collect consumption data sent by the end devices and perform a type of buffering until the buffered data is retrieved by the head-end system. The data collection devices can also be involved in other communication tasks, such as querying the status of the end devices and providing them with information and program code, such as communication schedules, software, or firmware updates.

[0005] Both consumption and operational data are usually confidential and therefore subject to certain security requirements. These security requirements may, in particular, require that consumption data be sent and handled encrypted within the metering infrastructure to prevent unauthorized access. General security requirements and other specifications for communication processes in metering infrastructures are laid down, for example, in IEC Standard No. 52056-5-3 Ed.3.0 (Specification for Energy Metering) of the International Electrotechnical Commission (IEC).

[0006] For highly sensitive data, special security requirements may apply, such as end-to-end encryption between the head-end system and the end devices, so that only these devices can interpret the highly sensitive data. This can be particularly problematic when using data collection devices. Data collection devices have a wider range of functions than, for example, simple protocol converters (gateways) and are capable of temporarily storing and interpreting certain amounts of data. Furthermore, they can generally allow remote and / or local access to the data by operating personnel. Consequently, the data handled by the data collection devices must be particularly well protected against unauthorized access.

[0007] Methods for secure communication between head-end systems and terminal devices are disclosed in DE 10 2014 102 007 A1, DE 10 2013 205 091 A1, US 2015 / 0101016 A1, US 2014 0207854 A1, and Landis + Gyr: "Gridstream Solution Security Overview White Paper." Furthermore, technical note "RSA laboratories technical note: Cryptographic message syntax standard, version 1.5," XP002952160, describes a syntax for data for which encryption can be applied, as well as digital signatures and digital envelopes. MELEK ÖNEN ET AL: "Secure Data Aggregation with Multiple Encryption," January 29, 2007 (2007-01-29), WIRELESS SENSOR NETWORKS; [LECTURE NOTES IN COMPUTER SCIENCE;;LNCS], SPRINGER BERLIN HEIDELBERG, BERLIN, HEIDELBERG, PAGE(S) 117 - 132, XP019076931, describes data aggregation using multiple encryption. Description of the invention

[0008] The object of the invention is to provide a measurement infrastructure that meets particularly high security requirements. These and other objects are achieved by a measurement infrastructure according to the invention as claimed in claim 1.

[0009] The surprisingly simple solution according to the invention has the advantage that security messages are handled by the data collection device in an uninterpreted form, which is therefore inaccessible without a corresponding security key. Even in the event of unauthorized access to the data collection device, the security messages would still be encrypted, and their content would not be readily accessible to unauthorized persons. Thus, the inventive handling of security messages meets high security standards for the exchange of sensitive data within the measurement infrastructure.

[0010] Because the security device is not capable of interpreting the security messages, it cannot be manipulated in the event of unauthorized access. The data collection device itself does not have any means of interpreting the security message.

[0011] By embedding the safety messages in the operational messages, the data collection device can process operational messages according to the corresponding specifications and thus handle the safety messages simultaneously. The embedded safety messages can thus be handled automatically or simultaneously with the operational messages according to the respective specifications. For example, a file header of the operational message can be used to handle the operational messages according to the specifications and intended purpose, whereby a data part of the operational message can contain the safety message.

[0012] The data collection device comprises an operational memory area for storing operational messages and a security memory area. By separating the operational memory area and the security memory area, these can be designed according to different security requirements. The security memory area is equipped with more complex security measures than the operational memory area. Thus, the security memory area is better protected against unauthorized access than the operational memory area.

[0013] The security memory area is not designed to store security messages. This prevents security messages from being interpreted or stored unencrypted in the security memory area from the outset. The security messages are therefore only temporarily stored or buffered in the operational memory area. There is no storage or storage and forwarding of the security messages. The security memory area itself can, of course, be protected from unauthorized access by appropriate security measures.

[0014] The operational encryption layer of the operational message surrounds the security encryption layer of the security message. As mentioned above, the security message is embedded within the operational message. This provides a kind of hybrid or double protection for the information contained in the security message, since both a matching operational key and a matching security key are required to interpret it.

[0015] In normal mode, the data management module is configured to decrypt the operational encryption layer of the operational messages. The required operational key is stored in the data collection device. Thus, the data collection device has full access to the operational messages. The operational encryption layer can surround an operational data portion of the operational data. The operational data portion can include the file header and data portion of the operational message.

[0016] The storage space required by the security messages exceeds the available storage space in the security storage area. The storage space in the security storage area is therefore so small that no security message can fit in it and therefore cannot be stored. Minimizing the security storage area allows for particularly economical provision.

[0017] In security mode, the data management module is unable to decrypt the security encryption layer of the security messages. Thus, in the event of unauthorized access, the data management module cannot be manipulated to decrypt the security encryption layer. The security key required for this is unknown to the data collection device or is not stored there.

[0018] The security message includes a security message part that is protected by the security encryption layer.

[0019] According to one embodiment, the security message may be embedded in an operational information part of the operational message.

[0020] According to the invention, the data management module of the data collection device does not have a security key for decrypting the security messages. Thus, the security key cannot be stolen or acquired in an unauthorized manner in the event of unauthorized access to the data collection device. Security messages handled by the data collection device cannot be decrypted and therefore cannot be opened by the data collection device itself.

[0021] The operational message is decrypted using an operational key in the data management module, and the operational message and the security message are decrypted using the operational key and a security key in the head-end system and / or in at least one of the end devices. Head-end devices and end devices can therefore have both an operational key and a security key. They are capable of double encryption, whereby at least one of the two encryption methods can be end-to-end encryption. Short description of the drawings

[0022] To understand the present invention, reference is made to the following drawings. These merely show exemplary embodiments of the subject matter of the invention. Figure 1 : shows a schematic block diagram of a data collection device. Figure 2 : shows a schematic block diagram of a measurement infrastructure according to the invention. Figure 3 : shows schematically a transmission of operating messages between the head-end system and the data collection device of a measurement infrastructure according to the invention. Figure 4 : shows schematically a transmission of operating messages between data collection device and terminal of a measurement infrastructure according to the invention. Figure 5 : shows schematically a transmission of security messages from the head-end system via the data collection device to the terminal device of a measurement infrastructure according to the invention. Figure 6 : shows schematically a transmission of security messages from the terminal via the data collection device to a head-end system of a measurement infrastructure according to the invention. Implementation of the invention

[0023] Figure 1shows a schematic block diagram of a data collection device 1. The data collection device 1 comprises a data reception module 2, a data management module 3 and a data transmission module 4, which are each connected to one another via internal data and / or supply lines 5 for data and / or power supply. Furthermore, the data management module 3 has an operational memory area 6 and a security memory area 7. The operational memory area 6 is used for storing data in general. The security memory area is used for storing sensitive data, which is protected from unauthorized access by special security devices. External data and / or supply lines 10 are used for communication of the data collection device 1 within a measurement infrastructure 100 according to the invention, which is schematically shown in Figure 2 is shown.

[0024] The Figure 2The measurement infrastructure 100 shown comprises, in addition to a plurality of data collection devices 1, a head-end system 102 and a plurality of terminal devices 103. The head-end system 102 is, for example, a so-called head-end system (HES) for digital remote reading of the terminal devices 103, which may be, for example, electricity, gas, water meters, or the like. The terminal devices are installed at the respective consumption points. The data collection devices 1 can be designed as so-called data concentrators (DC) to query data collected by the terminal devices and to concentrate the data on its way between the head-end system 102 and the terminal devices 103.

[0025] Communication between head-end system 102 and data collection device 1 typically occurs via a wide area network (WAN) 104, to which head-end system 102 and data collection device 1 are connected via respective external data and / or supply lines 10. Head-end system 102 is typically configured as a client and the data collection device as a server. Communication between data collection devices 1 and terminals 103 typically occurs via a network environment 105, to which they are also connected via respective external data and / or supply lines 10.

[0026] In the Figures 3 and 4The communication between head-end system 102 and terminals 103 is shown in a normal mode A. In normal mode A, the data collection device 1 collects data from the terminals 103 and stores the data independently of a connection to the head-end system 102. The data collection device 1 sends commands to the terminals 103 independently of the head-end system 102 according to a predetermined sequence recorded in a communication schedule.

[0027] This independence from the connection to the head-end system 102 is particularly advantageous when, for economic and / or technical reasons, communication via the wide-area network 104 is not continuously available. The data collection device 1 performs its communication tasks via the network environment 105 even during times when communication via the wide-area network 104 is not immediately available. When the wide-area network 104 is available, the data collected by the data collection device 1 is transmitted to the head-end system 102, which can perform configuration tasks, such as specifying communication schedules for the terminal devices 103 or performing program updates.

[0028] Figure 3schematically shows communication between head-end system 102 and data collection device 1. The communication between head-end system 102 and data collection device 1 takes place in a normal mode A using operational messages 200A. The operational messages 200A each comprise an operational information part 201 and an operational encryption layer 202 to protect the communication between head-end system 102, data collection device 1, and terminal 103 from unauthorized access in normal mode A. The operational information part 201 is, so to speak, embedded in the operational encryption layer 202.

[0029] The operational information part 201 is provided, for example, in the head-end system 102, and the operational message 200A is created by encrypting the operational information part 201 using an operational key available in the head-end system 102. After being sent to the data collection device 1, the latter can decrypt the operational message part 201 using the operational key, which is also known to it, and thus process or interpret it. In the opposite direction, when sent from the data collection device 1 to the head-end system 102, an operational information part 201' generated in the data collection device 1 is provided with the corresponding operational key with the operational encryption layer 202 and sent to the head-end system 102 as operational message 200A'.In the head-end system 102, the operational information part 201' of the data collection device 1 can in turn be decrypted by the operational key and the operational information part 201' can be interpreted.

[0030] Figure 4 schematically shows communication using further operating messages 203A between the data collection device 1 and the terminal 103. A further operating message 203A is generated by the data collection device 1 by encrypting a further operating information part 204 using a corresponding further operating key and thus embedding it in a further operating encryption layer 205. The further operating message 203A is sent from the data collection device 1 to the terminal 103, which has the corresponding further operating key and can interpret the further operating information part 204 after decrypting the further operating encryption layer 205.

[0031] In a similar manner, further operational messages 203A' are generated in the terminal device 103 in reverse by encrypting operational message portions 204' using the further operational key and thus providing them with a further operational encryption layer 205. The further operational messages 203A' sent to the data collection device 1 are decrypted by the data collection device 1 using the further operational key. Thus, the data collection device 1 can open the further operational messages 203A' sent by the terminal devices 103 and interpret the further operational information portion 204' contained therein.

[0032] In the Figures 5 and 61 shows communication between head-end system 102 and terminal devices 103 via data collection devices 1 in a security mode B. Security mode B can be used to exchange highly sensitive data or highly critical commands between head-end system 102 and terminal devices 103.

[0033] Figure 5 schematically shows a transmission of security messages 300 from the head-end system 102 via the data collection device 1 to the terminal 103. The security messages 300 comprise a security message part 301, which is specially protected by a security encryption layer 302 generated using a corresponding security key. The security key is present in the head-end system 102 and the terminal 103 in order to encrypt and decrypt the security message 300 there.

[0034] To send the security messages 300 from the head-end system 102 to the data collection device 1, the security message 300 is embedded in an operational information part 201, which is provided with the operational encryption layer 202 in the head-end system 102 by the operational key. Thus, a special operational message 200B for security mode B is formed. The special operational message 200B is sent to the data collection device 1.

[0035] In the data collection device 1, the operational encryption layer 202 is decrypted similarly to normal mode A, and at least the operational information part 201 is interpretable by the data collection device. The interpretable portion of the operational information part 201 can be, for example, a file header. However, the security message 300 embedded in the operational information part 201 cannot be interpreted by the data collection device 1 because it does not have the security key for decrypting the security encryption layer 302.

[0036] Thus, the data collection device 1 cannot access the security information part 301 or interpret it. Therefore, the data collection device 1 leaves the security message 300 untouched, so to speak, and stores it in the security memory area 7, which is not accessible from the outside. The memory space of the security memory area 7 can therefore be dimensioned such that it is smaller than would be necessary to accommodate the decrypted security information part 301. The security message 300 can remain encrypted in the operational memory area 6 without it being able to be interpreted by unauthorized persons, or without the operational memory area 6 requiring special access protection like the security memory area, because the security message 300 continues to be present in encrypted form, and a key required to decrypt the security message 300 orThe security key required for its security encryption layer 302 is only available to the head-end system 102 and the terminal device 103. Therefore, communication in security mode B involves end-to-end encryption between the head-end system 102 and the terminal device 103.

[0037] To send the security message 300 from the data collection device 1 to the terminal 103, the data collection device 1 in turn generates the further operational information part 204, in which the security message 300 is embedded. The further operational information part 204 is in turn encrypted by the data collection device 1 with the aid of the further operational encryption layer 205 using a corresponding further operational key and sent in the form of a further special operational message 203B from the data collection device 1 to the terminal 103.

[0038] The terminal device 103 first decrypts the further special operational message 203B by decrypting the further operational encryption layer 205 using its corresponding operational key. It thus has access to the further operational information part 204. Furthermore, the terminal device 103 has the security key, which allows it to decrypt the security encryption layer 302 and thereby access the security message part 301 in order to interpret it.

[0039] Figure 6 shows schematically a sending of a security message 300' from the terminal 103 via the data collection device 1 to the head-end system 102 in security mode B. In an analogous manner to the Figure 5In the transmission shown, a security message part 301' is created in the terminal 103 and provided with a security encryption layer 302' by means of a corresponding security key. The security message 300' formed in this way is in turn embedded in a further operational information part 204, which is provided with the further operational encryption layer 205 by means of a corresponding further operational key.

[0040] Thus, another special operational message 203B' is generated, in which the security message 300' is embedded. The further special operational message 203B' is sent to the data collection device 1.

[0041] In the data collection device 1, the further operational encryption layer 205 is decrypted using a corresponding operational key, and thus the further operational information part 204', in which the security message 300' is embedded, can be interpreted. Again, the data collection device 1 does not have the corresponding security key to decrypt the security encryption layer 302' and thus cannot interpret the security message part 301'. To forward the security message 300' to the head-end system 102, the data collection device 1 generates an operational information part 201' containing the security message 300', which is provided with the operational encryption layer 202 using a corresponding operational key and is thus sent to the head-end system 102 as a special operational message 200B' in security mode B.

[0042] The head-end system 102, in turn, uses the operational key to decrypt the operational encryption layer 202 and thus interpret the operational information part 201'. To access the security message 300' contained in the operational information part 201', the head-end system 102 decrypts the security encryption layer 302' using the corresponding security key and can then access and interpret the security message part 301'.

[0043] Deviations from the embodiments described above are possible within the scope of the inventive concept. Thus, a data collection device 1 can be provided with any number of data reception modules 2, data management modules 3, and data transmission modules 4, depending on the respective requirements. These modules can be interconnected via internal data and / or supply lines 5 and can have operational memory areas 6 and security memory areas 7 in order to send and receive operational messages 200A, 200A', 200B, 200B', 203A, 203A', 203B, 203B' via external data and / or supply lines 10, depending on the respective requirements. Furthermore, the data collection device 1 can have input and output devices such as screens, keyboards, drives, and interfaces to allow an operator to communicate with or control the data collection device 1 according to the respective requirements.

[0044] The measurement infrastructure 100 can comprise any number of data collection devices 1, head-end systems 102, and terminal devices 103, depending on the respective requirements. These devices can be interconnected via wide area networks 104 and / or network environments 105 for data and / or energy transmission, depending on the respective requirements, in order to exchange operating messages 200A, 200A', 200B, 200B', 203A, 203A', 203B, 203B'. Internal data and / or supply lines 5 and external data and / or supply lines 10 can comprise any wired or wireless connection, such as radio connections and corresponding converters, adapters, and any accessories, depending on the respective requirements, to enable data and / or energy transport.

[0045] The operational messages 200A, 200A', 200B, 200B', 203A, 203A', 203B, 203B' may, according to the respective requirements, include any number of operational information parts 201, 201', which are encrypted by corresponding operational encryption layers 202, 205 in normal mode A as well as in security mode B. The security messages 300, 300' may, according to the respective requirements, include any number of security message parts 301, 300', which may be provided with respective security encryption layers 302, 302' and may be embedded accordingly in special operational messages 203B, 203B'. List of reference symbols

[0046] 1 Data collection device 2 Data reception module 3 Data management module 4 Data transmission module 5 Internal data and / or supply line 6 Operational storage area 7 Security storage area 10 External data and / or supply line 100 Measurement infrastructure 102 Head-end system 103 Terminal device 104 Wide area network 105 Network environment 200A, 200A' Operational message 200B, 200B' Special operational message 201, 201' Operational information part 202 Operational encryption layer 203A, 203A Further operational message 203B, 203B' Further special operational message 204, 204' Further operational information part 205 Further operational encryption layer 300, 300' Security message 301, 301' Security information part 302, 302' Security encryption layer A Normal mode / Normal mode B Safety mode / safety operating mode

Claims

1. A measurement infrastructure (100), in particular intelligent measurement infrastructure (100), for collecting measurement data generated by a plurality of terminals (103) having at least one data collection apparatus (1) which is configured as a data concentrator, and at least one head-end system (102), wherein the measurement infrastructure (100) comprises the plurality of terminals (103), the at least one data collection apparatus (1) and the at least one head-end system (102), wherein the terminals (103), the at least one data collection apparatus (1) and the at least one head-end system (102) are designed to communicate with each other by means of operation messages (200A, 200A', 200B, 200B', 203A, 203A', 203B, 203B') via the at least one data collection apparatus (1) and the at least one data collection apparatus comprises a data management module (3) which, in a normal mode (A), interprets operation messages (200A, 200A', 200B, 200B', 203A, 203A', 203B, 203B') transmitted by the head-end system and / or terminals, wherein the data management module (3) is designed to leave security messages (300, 300') transmitted from the head-end system (102) and / or terminals (103) in an uninterpreted state in a security mode (B), the security messages (300, 300') comprise a securing message portion (301, 301') which is protected by means of a security encryption layer (302, 302'), which is produced by means of a corresponding security key which is present in the head-end system (102) and terminal (103), wherein the data collection apparatus (1) does not have the security key for decrypting the security encryption layer (302, 302'), wherein the security messages (300, 300') are embedded in the operation messages (200A, 200A', 200B, 200B', 203A, 203A', 203B, 203B') and, an operating encryption layer (202, 205) of the operation message (200A, 200A', 200B, 200B', 203A, 203A', 203B, 203B') surrounds the security encryption layer (302, 302') of the security message (300, 300'), wherein the data management module (3) is designed, in normal mode, to decrypt an operating encryption layer of the operating messages by means of an operating key which is stored in the data collection apparatus (1), wherein the data collection apparatus (1) comprises an operating storage region (6) for storing the operation messages (200A, 200A', 200B, 200B', 203A, 203A', 203B, 203B'), characterised in that the data collection apparatus (1) comprises a security storage region (7), which is provided with more complex security measures than the operating storage region for protection from unauthorised access, wherein the security storage region (7) is not designed to store non-encrypted security messages, and wherein the data collection apparatus (1) is configured to temporarily store or buffer the encrypted security messages only in the operating storage region (6), wherein storage of the security messages does not take place, and wherein a storage space of the security storage region (7) is sized in such a manner that the security messages cannot be stored in the storage space.