Data: the lifeblood of the modern smart grid

A trusted and futureproof device key management platform has been developed by Thales to simplify and enhance the smart grid security process.

The latest generation smart meters provide data to both the customer and the grid operator. Coupled with data from other grid-edge and grid-centric devices, smart meters are paving the way for a dynamically managed energy system for a net zero world.

But for system security, both the devices and data must be similarly secure, with protections against bad actors with criminal or worse intent.

Understanding how industry players are addressing smart grid security for distribution system operators, smart meter manufacturers, system integrators and other players, Smart Energy International talked to embedded software engineer Antoine Thomas, Product Line Manager for Mobility and Cybersecurity solutions at Thales.

Why is trustworthy data the essence of a successful smart grid?

Smart grids are a critical infrastructure and are now a key component of our societies globally and we need to have them secure and to have trust in the data they provide for many reasons, economic, public safety and more. For example, utilities need to ensure that the data collected from smart meters is correct, pertains to the correct customer and is billed correctly.

Grid operators who must ensure the balance between supply and demand need to ascertain that a fault or attack on a portion of the grid does not lead to a system-wide shutdown. They also need to have the trust to operate the grids remotely and that it is safe, that the equipment is ‘on’ when it is supposed to be, and that the data being received is trustworthy.

There is this double notion around the economic aspect but also the critical infrastructure element that the grids can be attacked and must be protected from such attacks. They can be damaging and put a country and people at risk.

“Smart grids are a critical infrastructure and are now a key component of our societies globally.”

What are the main standards and regulations for cybersecurity?

There are guidelines around the Internet of Things (IoT). In Europe and the US, institutions and governments have been putting in rules and recommendations around IoT in general, and, in some cases, regulation around critical infrastructure.

The European Commission has been extending its recommendations around IoT within Europe, specifically critical infrastructure security. I expect North America to follow, although the region is somewhat more complicated with the higher fragmentation among distribution companies.

In Europe, we also have the GDPR for personal data because of the collection of personal data when dealing with cybersecurity on smart meters. Another programme is the European Programme for Critical Infrastructure Protection (EPCIP).

All these bodies issue regulations and recommendations, and on top of that, there are different regulation bodies country by country potentially adding to the cybersecurity requirements, for example, BSI in Germany and ANSSI in France.

Therefore, we must follow certain sets of rules and regulations; however, our approach at Thales is to be ahead of the regulations. While it’s important to comply with security standards and practices, being pushed by regulation will always give a tough deadline to meet and implementing a strong cybersecurity system on a smart grid is not something one can do overnight.

As an example, quantum computing technologies potentially could break certain algorithms that are in use today but at Thales, we are already working on post-quantum algorithms and will have them ready to counter these threats.

What are the four main threats for an AMI/the four main principles for data security?

Firstly, only authorised entities can read the data. In other words, the ecosystem is composed only of devices that one knows and trusts so that only authorised data is fed in. For this one can put in place mutual authentication, which will ensure that all the equipment is trustable.

Then there is the need to trust in the source of the data, so one needs to have a strong device identity and well-diversified private keys. These will ensure that the security between the device and the system is not compromised, and the equipment is not tampered with, or the data intercepted.

“[…] implementing a strong cybersecurity system on a smart grid is not something one can do overnight.”

The third is the security of the data exchange between devices so the data must be encrypted. There also is the standard for metering data, the DLMS standard, which we are following to ensure that all the data is secured correctly.

The fourth is the updating of the algorithms and of the firmware of the devices in the field. A system is needed that is secure, trustworthy and convenient to use where there is a desire to push updates. With lifetimes of 20 years or more, if the system is too complex then the whole infrastructure would be exposed to vulnerabilities.

Why is lifecycle management so important in this ecosystem?

The lifecycle approach starts with manufacturing, and one needs to ensure that the way the keys are injected is highly secure. The diversification from one device to another is also important as one doesn’t want to use one key for a set of devices. If one key is compromised then the whole ecosystem is compromised.

Thereafter, the activation of the device needs to be managed.  When a device leaves the manufacturer’s factory it will have a set of keys but when the utility activates the device it may rotate the keys or load new keys so the security may not be the same in operation.

Then once in the field, the keys should be updated to avoid using the same keys in the same device for too long.

Finally, when the device is decommissioned, one needs to ensure that it is not updated again and if it becomes compromised it won’t impact the ecosystem.

The lifecycle of devices in the smart grid is very important, with updates at each stage of their life. In the case of smart meters already in the field, these usually have a set of keys and a system to update them but if they have a minimum level of security they can be provisioned on the Thales Trusted Key Manager platform.

What future proofing is enabled?

We know that cryptography is evolving fast and the phrase that is making the most buzz in the ecosystem today is ‘post-quantum’, which I mentioned earlier. Quantum computers are enhancing very much the cryptographic capacity of computers and most of the security algorithms that are in use today will be easily breakable so cryptographic researchers have been working on new algorithms that will be resistant to this type of computing power.

Theoretically, we are already able to update the cryptography we use for generating and securing certificates and keys using certain of these algorithms, as some are not yet fully implemented and more will be coming later.

The advantage of using a platform like ours is that utilities would be able to rotate and update the keys to update the security level in their devices with whatever new cryptography will be issued in the market.

Today it is post-quantum and maybe in the future there will be another leap in terms of computing power or cryptography, but we always try to ensure that we are at the forefront to meet the demands across the energy industry.

We leverage our hardware devices, using a hardware security module (HSM)-based approach to secure many cloud-based solutions and can offer the latest cryptographic innovations to our utility customers.

Can the solution be extended to other edge devices or other systems?

We have deployed the platform so far in smart metering, but it was developed for the IoT in general and can be used for securing any type of device in any IoT ecosystem.

But there is also the need for similar levels of cybersecurity on the transmission and generation sides where the equipment tends to be both numerically smaller but more complicated.

To date, these businesses appear to have been less prone to attacks but it’s only a matter of time before people find out how to attack anything.

Can you describe any specific deployments?

We have several deployments in Europe as well as a few in Asia, where we are deploying the solution for advanced metering infrastructure.

In many cases, our solution is being deployed at the head-end system where we add the security layer to this device management platform. We also are integrating platforms from different smart meter vendors, and our solution was developed to meet this interoperability requirement.

A country in Eastern Europe has issued a new national regulation that all the utilities there will need to have their smart metering infrastructure secured in a certain way and following certain standards by 2026 and they have been focussing on updating the infrastructure and the security into this.

What is the future outlook as cyber attacks appear to be becoming both more frequent and more sophisticated?

We certainly see more and more cyber attacks coming but whereas up to now they have tended not to be publicised, we expect to hear about them more and more as people become increasingly aware of the potential political and other conflicts that they can bring.

That doesn’t mean that an individual company must report an attack but it can be communicated through a group or increasingly the attacker may report it.

With the types of attacks and the sizes and surfaces increasing, securing the ecosystem properly is the only way to try to stay ahead of the game in terms of cryptography.

View the latest Thales whitepaper:
How trusted key managers can protect smart meters from cyber attacks

Thales will be attending Enlit Europe in Paris from 28-30 November 2023, where you can connect with the team in person. Register for your free event pass here.