Security is an increasingly important aspect of smart grids. Given the periodic attacks on smart grid infrastructure, there is a clear threat, and the stable electricity supply in all countries is at risk of being compromised by hostile forces. In response, significant attention is being paid to IT security; thus, many solutions rely on end-to-end encryption between devices dedicated to data collection in the smart grid and the supervisory control and data acquisition (SCADA) systems that analyze and react to the data. This focus on IT security is undoubtedly crucial, as data "in transit" must be protected using standards-based cryptography. However, even with the strongest end-to-end encryption, there are weaknesses in smart grid security: the installed devices themselves are highly vulnerable to attack.
Cryptography is security, right?
While encryption tools are essential for ensuring the privacy and authenticity of transmitted data and instructions, it's important to note that they are only one part of the solution. The greatest value of cryptography lies in protecting data while it is in circulation or stored to prevent decryption or falsification. While some believe that a complex RF carrier or a frequency-hopping power line carrier offers sufficient security to "hide" data, this protection can be easily breached by attackers. Imagine an attacker creating an arbitrary instruction to open the remote disconnect switch on a smart meter: electricity service could be interrupted for a large number of people, and the utility company would be overwhelmed with complaints. This would not only result in a significant drop in revenue and a major inconvenience for those affected, but it could also be life-threatening in regions where air conditioning is essential.
But what happens to the data before it enters the conduit and after it leaves? Encryption keys exist on both sides of the communication conduits to encrypt, decrypt, authenticate, or validate the transmitted data. While encrypting the data in the conduit is critically important for protecting information as it travels from the installed sensor to the control system, protecting the secret keys used in the encryption is even more important. If these keys are compromised, the security of the network can also be compromised. Endpoints installed in the smart network must consider key security to provide a more comprehensive security solution. Secure financial terminal technology places great importance on key protection and uses multiple layers of protection to safeguard the secret keys on the chip against physical and analytical attacks.
The validity of the data and instructions circulating on the smart grid is not the only source of attacks affecting the electricity supply. More advanced viruses like Stuxnet have demonstrated the danger of attacks that fundamentally alter the behavior of installed equipment in ways that are difficult to detect. A type of attack known as a "zero-day attack" exploits systems that can be erased or reprogrammed, thus compromising the system undetectably. We must be concerned not only about equipment when it is commissioned, but also whenever it is vulnerable to improper programming, for example, during its manufacturing.
But what could go wrong?
Designing with security in mind is difficult, time-consuming, and requires specialized security knowledge. Is it really worth the investment? Let's consider an already installed smart meter. Because meters are generally unprotected since they are located in our homes, they are easily accessible to an outsider. If a conventional microcontroller is used for application processing and communications in that meter, there is likely an attack vector through the programming interface, allowing an attacker to reprogram the meter or even read its contents. Given enough resources and time, someone could even create a program that behaves exactly like the meter's program but contains hidden viruses that collect key data or alter electricity consumption reports.
Installed meters must be protected to ensure their functions remain unaltered. However, looking back, we see a point where the meter is even more vulnerable: the manufacturing plant. There is always the possibility that social engineering could grant attackers access to its IP address and the manufacturing process. For just a few thousand dollars, an attacker could acquire the software, reverse engineer it, alter it, and deliver a new program to the manufacturing process. Furthermore, the attacker could sell the software to a competitor, thus providing another company with an unfair advantage gained from its research and development expenses.
How to protect the product lifecycle?
A well-designed lifecycle will consider threats at each stage of product development and manufacturing, and determine whether such threats warrant countermeasures. To implement a secure lifecycle, the following aspects must be evaluated:
Make sure you acquire valid silicon. Purchasing through authorized or direct channels can help ensure this, but cryptographic techniques also exist. Maxim Integrated sells secure microcontrollers and smart grid products that can be pre-programmed with a customer's key or certificate, thus guaranteeing that only the customer in question can unlock and program the IC.
Protect your IP. Provide your manufacturing department with signed and encrypted code. This requires embedding a secure bootloader in the system's microcontroller to decrypt and authenticate the software once it's loaded onto the chip. Encryption provides protection against reverse engineering or cloning.
Only run the code that was intended to be executed. A secure initial loader can use the digital signature in your software to validate the code's authenticity before loading or running the application.
Communicate with confidence. New configurations, firmware updates, and instructions should be encrypted and signed to validate that they are sent from a trusted source.
Protect your keys in the environment. Do not store encryption keys on a separate IC from where you use the key, such as an external EEPROM. If you have a secure microcontroller separate from the application processor, keep the keys on the secure chip and never send them anywhere else. It is easy for an attacker to extract keys transmitted through traces on the printed circuit board.
Protect your keys within your company. Use development keys for engineering purposes to add security features to your products. Protect access to production keys by requiring various users to authorize their use. A high-security module (HSM) can help implement some of these measures.
Don't rely on a single point of failure. If an attacker only needs to extract the keys from a meter to compromise the system, they may still invest more time and money in the attack if they know they can compromise the entire system. Sophisticated attackers could even decapsulate the IC and access the memories using microprobes in search of the keys. Use unique keys or asymmetric cryptographic techniques such as elliptic curve digital signatures.
With the current focus on IT security alone, we are leaving attackers with a huge opportunity to exploit the smart grid. By securing the lifecycle of this installed equipment, we will improve grid security and make it much harder for attackers to disrupt the electricity supply.
About the author:
Kris Ardis is the Business Director of Smart Grid Products at Maxim Integrated. He has been with Maxim for 15 years and holds a Bachelor of Science degree in Computer Science from the University of Texas.
