Markus Bartsch. German Smart Metering and European Privacy Needs

Transcription

1 Markus Bartsch German Smart Metering and European Privacy Needs

2 Smart Grid (and Metering) Customer Satisfaction 3 Years 3 10 Years Identity Management Asset Management Feeder Automation Smart Meters Privacy Web- Services In-Home Display HAN Energy Pattern Access Management Smart Sensors Station Automation Theft of Power Detection Smart Home Automated Read-out Cyber Security Network Automation Self Healing Grid Outage Management Communication Fault Indicators Smart Appliances Dynamic Billing Real Time Simulation WAN Prosumer Role Phase Balancing Real Time Condition based Maintenance Smart Meter Infrastructure Vault Monitoring Power Quality Management Years Decentralized Energy and Intelligence Microgrid Distribution Energy Management System Network Optimization More Renewables Line Loss Minimization Energy Storage Fault Anticipation 100% Electrified Transportation Distributed Energy Supply V2G BEV Bidirectional Power Flow Energy Security Climate Protection 1

3 Problems Privacy

4 Current Activities in the Energy Sector IT Security for Smart Meter IT Security Functionalities have been specified for Smart Meter Systems by TÜViT and the Federal Office for Information Security (BSI) together with Ministry of Economics BNetzA (Federal Network Agency) PTB (Physical Technical Authority) BfDI (Federal Commissioner for Data Protection and Freedom of Information) Protection Profiles acc. to the international 1/16/2013 TÜV Informationstechnik GmbH Member of TÜV NORD Group 3

5 The technical challenge 4

6 The System Approach Gateway Central component of the smart metering system Rich in functionality Evaluated in depth Security Module Implementation of cryptographic primitives Secure Handling of key material Facilitate a fast rollout by re-use of existing technologies Smart Metering System Comprising a Gateway and multiple meters 5

7 The main Functionality of the Gateway Firewalling The Gateway has control over all information flows Connections may only have their origin locally The Gateway is not directly contactable Metering Policies The Gateway receives data from meters The Gateway processes the data according to installed profiles The Gateway submits the processed data to external parties in the WAN Privacy Protection All information flows are transparent for the user The Gateway only allows encrypted and authenticated information flows The Gateway is able to conceal information flows if necessary Communication for CLS The Gateway allow Controllable Local Systems to contact parties in the WAN The CLS have to follow the policies for information flow of the Gateway 6

8 SMGW Interfaces 7

9 The Functionality of the Security Module Cryptography Key Negotiation for TLS Key Transport for content data Signature Generation and Verification Storage of Key Material Asymmetric key material as the identity of the Gateway Symmetric keys to be used by the Gateway Random Number Generation For internal use For various purposes to be used by the Gateway 8

10 Privacy by Design -PbD Respecting the user In the area of new technologies for the smart grid consumers do often not have a choice to participate or not Respecting the privacy of the consumers and prosumersis therefore a key aspect for the success of all large rollouts of smart grid technologies PbD-Key Aspects Privacy has got highest priority-the personal data of the consumers shall notbe seen as part of a business case Design Feature: Centralfunctionalities of smart meter systems support privacy Privacy by default - PbDef: Standard configuration is in privacy-friendly mode Transparency: Privacy is comprehensible for the consumer Privacy shall be considered during the whole life cycle (specification - roll-out - operation) PbD- Verification Common Criteria: IT Security Functionalities ISO 27001: Secure rollout and operation PIA (Privacy Impact Assessments): Privacy of the life-cycle 9

11 Commission Recommendation ( ) on preparations for the roll-out of smart metering systems Motivation EU Directive Article 8 of the Charter of Fundamental Rights of the EU Implementation of Privacy and IT Security features Cooperation with national data protection authorities No traceability of personal data Processing of personal data is minimised PIA (Privacy Impact Assessment) Template for data protection impact assessment appropriate Protective Measures Comment of EDPS ( ) 10

12 Commission Recommendation ( ) on preparations for the roll-out of smart metering systems Recommendations PIA Privacy by Design / Privacy by Default Systematic Approach / Methodical Process 3 Levels: legislative, technical, organisational Privacy friendly option Standard configuration Preference to PbD /PbDef Reference architecture Privacy Principles Data Minimisation Transparency Empowerment of the Individual Security cryptographic channel 11

13 Commission Recommendation ( ) on preparations for the roll-out of smart metering systems Minimal Functional Requirements Consumer s view Direct Readings Frequent Update Metering Operator s view Remote Reading (with respect to privacy) Two-way communication (maintenance/control) Frequent Reading for network planning Commercial aspects Advanced tariff systems Remote on/off Security / Privacy Secure data communication Fraud prevention and detection Distributed Generation Reactive Metering 12 () () ()

14 Thank you very much for your attention! TÜV Informationstechnik GmbH Member of TÜV NORD Group Markus Bartsch IT Security Langemarckstr Essen Germany Phone: Fax: URL: 1/16/2013 TÜV Informationstechnik GmbH Member of TÜV NORD Group 13