1 Why do Smart Meters need a Local Port?

Transcription

1 Memorandum To cc Prepared by DECC Smart Metering Programme Subject: All GB Smart Metering Equipment should have a LocalPort 1 Why do Smart Meters need a Local Port? Avoid bricked meters Only interface that will work in all installations for decades Will ease installation and maintenance 3 2 Should the LocalPort be Wired or Optical? 3 3 Is there a Security Problem with an Opto Port? Existing meters contain opto ports Opto ports have not been banned Opto v RS Opto v RF HAN How to make an Opto Port secure 5 4 Conclusion 6 1 Why do Smart Meters need a Local Port? At present DECC mandates (SMETS1) that all domestic smart metering equipment should contain a HAN interface. DECC does not prevent smart metering equipment from containing a LocalPort, but it does not mandate that they must. We think there are a number of reasons why it would be sensible for DECC to mandate that all domestic smart metering equipment must contain a LocalPort (certainly for the electricity and gas meters, and maybe for the comms hub and IHD too). 1.1 Avoid bricked meters There is a danger that if Smart Meters contain a HAN, but no LocalPort, that there will be an occasion where some are bricked as a result of a software upgrade. We will require some software upgrades to be of the HAN itself (e.g from ZigBee Pro to 6LoWPAN). i.e the software upgrade is done via the HAN, yet modifies that very same HAN channel. If something goes wrong in this process, we would end up with a meter that cannot communicate at all. i.e it will not be possible to make a further software upgrade to rectify the problem. In such a case, the device is considered to be bricked, as the only thing it could be used as is a brick! We need to allow for human error. With 100M devices (E and G meters, displays, comms hubs) it is likely that something will go wrong at some point. esmart-m-039 v1.4 Page 1 of 7

2 Most devices that support RF software upgrades, provide a secondary LocalPort as a get out of jail card. No matter how corrupt the internal software has become, it is always possible to boot up new software via the LocalPort. All mobile phones contain a wired LocalPort (normally USB). This allows them to boot up new software from scratch if the radio links stop working. It is not really good engineering practise for any RF device to be manufactured without any LocalPort. If the meters contain a LocalPort, then that could be used to install new software if the HAN has been corrupted. This will require a house visit, but this will still be cheaper than a house visit to remove the old meter and install a new one. The software upgrade can be performed by less qualified technicians than would be required for a full meter change. It also reduces the inconvenience to the consumer as the energy supply does not need to be disconnected. A full meter change is very bad PR for the energy suppliers as it exposes any system error very publicly. If a software upgrade does corrupt the HAN, it is likely to affect a number of houses in a geographic cluster, so the cost of visiting each house (to install new software via the LocalPort) should not be so high, as the houses are likely to be close to each other. A bricked meter without a LocalPort has a problem for resolving bill disputes between a consumer and a supplier. It is very hard work to get 13 months of 30-minute time-ofuse readings out of the meter via the user interface alone. The requirement for a LocalPort exists on all the devices that have software upgrades via the HAN (for the reasons given above). So it might apply to the Comms Hub and the IHD, as well as the electricity and gas meters. 1.2 Only interface that will work in all installations for decades We are struggling to find a single RF HAN interface that will work well enough in all GB homes. Indeed we are struggling to find a HAN that will even work everywhere at the start, let alone for decades to come. We believe that the comms interfaces need to operate correctly in a backward compatible manner for 2 or 3 meter lives (30 or 45 years), not just for one meter life (15 years). This is because the 4 devices in a single home are unlikely to all be changed at the same time. So there will be a rolling requirement for new devices to operate correctly with old devices. We don t seem to be able to find an RF technology that is able to meet all the above functional requirements. But we can easily meet the above requirements with several wired or opto interface options. We think the only way to have a single interface that will work to all GB smart metering devices for several decades, is for that interface to be wired or opto. Wired and opto interfaces are much simpler than RF interfaces. As the years go by, RF interfaces can suffer from more and more interference problems, but wired and opto interfaces don t. They are much simpler, defined and controlled interfaces than RF. The chips required for an RF interface also have a shorter lifetime esmart-m-039 v1.4 Page 2 of 7

3 than the components needed for a wired or opto interface. It will be possible to build meters with the same LocalPort for many decades. 1.3 Will ease installation and maintenance Ongoing costs of installation and maintenance will be lower if national systems can be developed on the assumption that there is a single interface that will always be available into all the devices. This is why we think it would be good if all devices contained a single standardised LocalPort. This is the logic that was being applied to the HAN. The intention (a good one) was that the HAN would be that single standardised interface available into every GB smart metering device. The problem is that we have not been able to find a single HAN interface that can work in every installation, even from the start, let alone for decades into the future. The idea to have a single standardised interface available to every device is still a good one. Even if we can t achieve this with an RF HAN, we can with a wired or opto LocalPort. It will be much easier for the installers if they can have a single HHT (Hand Held Terminal) that will work with every smart metering device in every home. They can achieve this if every HHT contains the agreed LocalPort. Indeed it is much more sensible for the HHT to contain a LocalPort than the HAN. There is a bootstrap problem if the installer tries to connect and pair the smart metering devices to the HAN, with commands from the same HAN. The bootstrap problem is avoided if the HHT connects the devices to the HAN with commands via the LocalPort. 2 Should the LocalPort be Wired or Optical? The LocalPort could be wired or opto. We would be happy with either solution, so long as we agree on a single interface that can be used universally into all the GB smart metering devices. Many consumer products use USB successfully as a LocalPort. However, energy suppliers don t like wired connectors as they fear tampering with a screwdriver by bad customers. An opto port is also safer (ATEX) in a gas meter than a wired connector. This is why most meters have used an opto port as the LocalPort. The European standard for an opto port is EN :2002. You can download the spec for this from the BSI at : Most domestic electricity meters already contain this opto port. Most current domestic gas meters are mechanical and so do not contain any electronic interface. However, most of the new smart gas meters do already contain this opto port. esmart-m-039 v1.4 Page 3 of 7

4 This opto port adds very little cost to the meter. It is a slow (e.g 4800 bps) UART interface connecting to an LED and a photo-diode. It is implemented with a standard UART interface in a microcontroller and all the protocol is done in software. The meter body has to contain a small circular clear window and a steel washer (that the magnetic read head attaches to). It is easy to see that this has added very little cost to the many meters that already use this interface. The interface is mature and has already been used in many European meters for many years. It would therefore seem to be a sensible option for the LocalPort in GB smart metering devices. 3 Is there a Security Problem with an Opto Port? Some people in the smart metering community seem to think that there is an inherent security risk for meters to contain an opto port. We do not agree with this. All communications interfaces consist of a 2-way data pipe that can be implemented in a secure or in an insecure manner. There is nothing inherently different between RF, wired and opto data pipes. 3.1 Existing meters contain opto ports Some of the energy suppliers are already installing smart metering systems in GB. There are already hundreds of thousands of GB homes that have had such systems installed. Most of these have electricity meters with opto ports. If there is an inherent risk for a meter to contain an opto port, why haven t such installations been banned? 3.2 Opto ports have not been banned If there is an inherent security risk for a meter to contain an opto port, why haven t the DECC specs (SMETS1) banned the use of opto ports? 3.3 Opto v RS232 An RS232 wired interface is based on a UART (Universal Asynchronous Receiver Transmitter). A simple protocol that connects 2 devices with plaintext is not secure. But the same physical link can adopt a protocol that uses symmetric or asymmetric cryptography to implement signatures and encryption. By adopting such techniques, the same wired interface can be made into a secure link. The opto port is exactly the same. It is just another UART link. It can adopt a simple protocol that is not secure, or it can adopt a more sophisticated protocol that is secure. We think the reason why some people think that opto ports are insecure, is that the way they are often used is with a simple DLMS protocol. We agree that such protocols are not secure enough. EN :2002 defines a set of low level requirements, including : esmart-m-039 v1.4 Page 4 of 7

5 Physical shape of circular read head and associated meter port. Light frequency range. Simple light-on/light-off UART connection. Standard sign on procedure. Branch to a proprietary protocol. The final protocol that is branched to, can be a secure one. DECC needs to agree on what this secure protocol should be for GB. 3.4 Opto v RF HAN The same argument can be made for a security comparison between an opto port and an RF HAN. Data can be transferred over the RF HAN as : Plaintext (insecure) Cryptotext (can be secure) There is nothing that makes an RF link inherently more secure than an opto link. Indeed it is actually harder to control the RF link, as unknown snoopers can connect, even when out of the line of sight. If an RF HAN link can be made secure, then so can an opto link. 3.5 How to make an Opto Port secure EN :2002 defines the low levels for an opto port. GB needs to agree on the higher level protocol to make the opto link secure. There are several ways in which this could be achieved. In practise, security is achieved with one or both of : Channel security. A device must provide some credentials before it is allowed to join a network (e.g WAP2 for WiFi). Endpoint security. Secure packets can be unicast tunnelled through one or more communications channels from one source node to one destination node. The packet can be signed and encrypted. This can achieve several goals : o The packet can only be read by the destination node and not by any other intermediate nodes. o The destination node can verify that the packet really did come from the source node, and not from some other node pretending to be the source node. o The destination node can verify that the packet has not been tampered with or modified. It can know that the packet it receives is exactly the same as the packet the source node sent. esmart-m-039 v1.4 Page 5 of 7

6 o The security between source and destination nodes does not rely on any of the intermediate channels being secure. Indeed for a long message journey, it is almost impossible to know that every intermediate channel is secure. It is better to build a system that does not require any of the intermediate channels to be secure. This has the added benefit that it enables cheaper communications channels to be adopted. This enables new communications technologies to be adopted earlier (as they do not have to be secure). o Endpoint security is easier to implement if every node has a globally unique identifier (or address). One option is the 64-bit ID scheme (EUI- 64) managed by the IEEE. Equipment manufacturers apply to the IEEE for an OUI-24 prefix, then allocate unique 40-bit suffixes to each device they produce. More information on this scheme can be found at : These security solutions can be based on asymmetric (e.g ECC) or symmetric (e.g AES) cryptography. The security protocol for the opto port can adopt any of these techniques. It would be best if the opto port security was based on the same security strategy as that chosen by DECC for all communications interface between GB smart metering devices. i.e the security method between 2 endpoints is the same whether the communications is between : Meter and HHT via opto port. Meter and Comms Hub via HAN. Meter and DCC via HAN and WAN. DECC and the equipment manufacturers can achieve this by developing or selecting a new high level protocol to make the opto link secure. Such protocols do already exist and are freely available. One of the major meter manufacturers has already used this approach to make the EN :2002 opto port in their smart domestic gas meter secure. 4 Conclusion We recommend that DECC mandates that all GB smart metering equipment should contain a LocalPort. We think that the metrological devices (electricity and gas meters) should adopt an opto port based on : EN :2002. This defines the low layers. A high level protocol that makes the opto port secure. DECC should develop or select the required protocol. esmart-m-039 v1.4 Page 6 of 7

7 We think that the Comms Hub and IHD should also contain a LocalPort, but we don t have enough information to recommend what type yet. It is likely to be USB or the same opto port as recommended for the meters above. esmart-m-039 v1.4 Page 7 of 7