Smart Meters in the context of Smart Grid and AMI architecture. Security, Vulnerability and Best Practice – Part 1

Over the next four Thursdays, SEQRED’s blog entries will be devoted to the topic of Smart Meter security in the wider context of the Smart Grid and the AMI architecture.

We will

present a synopsis of the AMI architecture
conduct a vulnerability assessment of the AMI system
- including a security overview of a Smart Meter
execute a controlled attack on a Smart Meter
present the Cybersecurity best practice for AMI infrastructure

The blog entries are based on an article by Krzysztof Swaczyński, board member of SEQRED, published in late May in the Data Cybersecurity & Privacy Magazine under the title

“Smart Meters – managing critical infrastructure cyber risks requires diligence, focus and deep expertise! It’s time to act for Power and Utilities across the EU!”

Part 1 – Introduction and a synopsis of the AMI architecture

Introduction

According to annex 1 to the Electricity Directive 2009/72/EC (currently replaced by Directive (EU) 2019/944 of the European Parliament and of the Council of 5 June 2019 on common rules for the internal market for electricity), 80% of the electricity meters rolled out to consumers by 2024 are required to be meters of a new generation, commonly named ‘smart meters’ (subject to a Cost Benefits Analysis), as a part of the ‘smart grid’ concept. While the deployment of the electrical ‘smart grid’ infrastructure increases its functionality, at the same time the risk associated with its operation increases. Complex solutions which are implemented to run it require an advanced approach to the identification and management of cybersecurity risks. The power grid, which is one of the most crucial pieces of critical infrastructure, is on top of the list of interest to various APTs (Advanced Persistent Threat – stealthy threat actor, typically nation or state-sponsored) and other threat actors. Hence the security testing of such solutions as Advanced Metering Infrastructure (AMI) and Smart Meters as well as their security solutions must be of the highest standards.

Recent tragic events of acts of unprecedented violence waged by Russia against Ukraine were preceded by countless cyber-attacks on Ukrainian infrastructure dating as far back as 2015 when the Ukrainian power grid was hacked resulting in a power outage of up to 6 hours for approximately 230,000 people. This tragically demonstrates that critical infrastructure is under heavy stress from potential cybersecurity attacks and demands even more care now that the physical security of Europe has been questioned.

For nearly four years now SEQRED has been actively researching cybersecurity solutions in the fields of Operational Technology and the Energy sector.

Based on experience gained in numerous projects SEQRED’s analysts and researchers tested a range of Smart Meter solutions components. This article provides conclusions on the security of this solution class with the hope that it will contribute to build a safer electric sector Europe-wide.

A synopsis of the AMI architecture

The most important element of the AMI is the actual electricity meter, or as it has been fashionably named – ‘the smart meter’. The main functional addition of a smart meter in comparison to its traditional counterpart is the remote communication capability, i.e., sending the meter readings to the operator.

Where buildings are dispersed, GSM / LTE modems or soon 5G modems are integrated into smart meters; data transfer takes place via the cellular network.

In places where the building arrangement is quite compact, i.e., housing estates/blocks of flats, the meters can communicate using existing electric cables using PLC (Power Line Communication) technology. If the distance to the nearest low-voltage (LV) distribution station is quite large, a GSM modem is connected to the meters communication hub and then communication takes place via a cellular network.

Where the distance to the LV station or switchgear is small and there are sufficient technical conditions, the PLC module is connected directly to the operator’s hard infrastructure – network. At the very end, we have the heart of AMI systems: the Head End System (HES), the Metering Data Management elements, build of more generic IT components such as database servers, operator panels, servers hosting web applications, etc. This architecture is nothing new, but in recent years new elements have appeared, or will appear soon:- AMI integration into the users’ home network – Home Area Network (HAN)- mobile applications, and web applications that allow users to manage their energy operator accounts, check current consumption, and receivables, eventually also manage some of the devices on the HAN.

Next week, we will present the vulnerability analysis of the AMI infrastructure and conduct a security overview of s Smart Meter