Security tests on smart meter and issues

Security tests

1. Overview of DLMS/COSEM & Cybersecurity Issues in DLMS Presented by: D. Shankar Eng g. O fficer Gr.2 MUAD, CPRI, Bengaluru

2. IEC 62056 – DLMS/COSEM Set of Protocols for electricity metering data exchange (IEC TC13 WG14). International version of DLMS (Device Language Message Specification)/COSEM (Companion Specification for Energy Metering). COSEM contains set of specifications that define the Transport and Application layer of DLMS protocol. Not only applicable to electricity metering, it is equally applicable to water, gas, and heating metering systems also. All the data in electronic meters and associated devices are represented by means of mapping them to appropriate classes and attributes. Specifies an interface model and communication protocols for data exchange with metering equipment.

3. Electricity metering standards

4. The DLMS/COSEM standards Blue book - IEC 62056 - 61 and IEC 62056 - 62 : Specifies the DATA MODEL comprising the COSEM interface classes and OBIS codes for the various energy types. Green book - IEC 62056 - 42, IEC 62056 - 46, IEC 62056 - 47 and IEC 62056 - 53 : Specifies the PROTOCOLS with DLMS on top, for the various media-specific communication profiles, based on widely used ISO/IEC, Internet, NIST and FIPS standards. White book - IEC 62051-1 : GLOSSARY OF TERMS helps to understand the specification. Yellow book: Specifies CONFORMANCE TEST plans for the COSEM object model and the communication layers, and describes the testing and certification process. NIST - National Institute of Standards & Technology; FIPS - Federal Information Processing Standards

5. DLMS/COSEM The DLMS/COSEM specification follows a three‐step approach: Step 1, Modelling: Covers the interface model of metering equipment and rules for data identification; Step 2, Messaging: Covers the services for mapping the interface model to application layer protocol data units (APDU) and the encoding of this APDUs. Step 3, Transporting: Covers the transportation of the messages through the communication channel. Source: DLMS/COSEM Green Book

6. Companion Specification for Energy Metering COSEM - Companion Specification for Energy Metering Addresses the challenges by looking at the utility meter as part of a complex measurement and control system. COSEM achieves this by using object modelling techniques to model all functions of the meter, without making any assumptions about which functions need to be supported, how those functions are implemented and how the data are transported. The formal specification of COSEM interface classes forms a major part of COSEM.

7. COSEM Server Model The COSEM server is structured into three hierarchical levels Level 1: Physical device Level 2: Logical device Level 3: Accessible COSEM objects Source: DLMS/COSEM Green Book

8. Client - Server Model and Communication Protocols DLMS/COSEM uses the concepts of the Open Systems Interconnection (OSI) model to model information exchange between meters and data collection systems. Source: DLMS/COSEM Green Book

9. A Complete Communication Session in the CO Environment Step 2: Once the AA is established, message exchange can take place; Step 3: At the end of the data exchange, the AA is released. Source: DLMS/COSEM Green Book A communication session consists of three phases Step 1: first, an application level connection, called Application Association (AA), is established between a client and a server AE. Before initiating the establishment of an AA, the peer PhLs of the client and server side protocol stacks have to be connected or not. Each layer, which needs to be connected, may support one or more connections simultaneously;

10. DLMS/COSEM messaging patterns Source: IS/IEC 62056-5-3 : 2017 In confirmed AAs: • The client can send confirmed service requests and the server responds: pull operation ; The server can send unsolicited service requests to the client: push operation . • The client can send unconfirmed service requests. The server does not respond; In unconfirmed AAs: • Only the client can initiate service requests and only unconfirmed ones. The server cannot respond and it cannot initiate service requests.

11. DLMS/COSEM Server Model ACSE - Association Control Service Element ASE - Association Service Element CO - Connection Oriented xDLMS - Extra DLMS PPP - Point to Point Protocol FTP - File Transport Protocol HTTP - Hyper Text Transfer Protocol ATM - Asynchronous Transfer Mode

12. Smart Meter Smart Metering - and more generally, smart devices - needs interoperability, efficiency and security. Smart meters have the capacity to collect the information about energy, water and gas usage at various intervals and transmitting the data through fixed communication networks to utility, as well as receiving information like pricing signal from utility and conveying to customer. Smart meter for indoor use & capable of forward (import) or both forward (import) and reverse (export) energy measurement. Static Meter + Load switch + Communication Module (In place of Electrical Port) + IHD (Optional) = Smart Meter

13. Smart Meter Standards - IS 16444 IS 16444 was adopted by the BIS in 2015 and consists of Two parts - IS 16444 (Part 1): 2015 Static Watthour direct connected meters consisting of measuring element(s), time of use register (s), display, load switch, and built in / plug in type bidirectional communication module all integral with the meter housing. Smart meter for indoor use & capable of forward (import) or both forward (import) and reverse (export) energy measurement. Covers the general requirements and tests for a.c . static direct connected Watthour smart meter, class 1 & 2. IS 16444 (Part 2): 2017 Transformer operated static watt-hour meters & Var -Hour meters consisting of measuring element(s), time of use register(s), display and built in / plug in type bidirectional communication module all integral with the meter housing. Smart meter for indoor use & capable of forward (import) or import and export energy measurement. Covers the general requirements and tests for a.c . Static Transformer operated Watthour & Var -Hour Smart Meters, Class 0.2S, 0.5S & 1.0S.

14. Smart Meter Architecture - Variant 1 (NAN)

15. Smart Meter Architecture - Variant 2 (WAN)

16. Conformance to DLMS / COSEM (IEC 62056) Purpose - To increase the probability that different implementations are able to interwork. It covers COSEM interface object model and the DLMS/COSEM application layer, including the security suites (Right now security suite 0) . Testing can be performed using either the 3-layer, CO, HDLC based profile or using the TCP/IP based profile .

17. Existing test tools in India – Present Practice India has adopted IEC 62056 Conformance to DLMS/COSEM since 2002-2004 : tested for open protocol implementation Indian Standard IS 15959 was formulated during 2011 for Conformance to DLMS/COSEM & parameterization tests as per Indian utility requirements. Parameterization Test tool supplied & maintained by M/ s.Kalkitech for third party testing Expensive test tools adds cost on Smart Meters Test tools to reflect technology changes as per BIS

18. Existing test tools in India – Present Practice Existing Tool: DLMS – UA (User Association) & IEC 62056 DLMS-UA: team decides on incorporating technical advancements like communication technologies, etc. Changes into the coloured books (White, Yellow, Blue & Green Books) IEC 62056 is derived from these coloured books BIS adopts IEC 62056 for Conformance test Test Tool for Conformance test by DLMS-UA

19. Existing test tools in India Test - Conformance to DLMS / COSEM (IEC 62056) Development Test Tool (DTT) supplied by M/s. EuroDCS GmbH, Germany Tests - Parameter Verification DLMS Functional Evaluation Tool (FET) - Automatic tool ASE DLMS Meter Explorer - Manual tool Both the test tools are supplied by M/s. Kalki Communication Technologies Private Ltd.

20. Introduction - Indian Smart Meter Deployment India is rapidly deploying DLMS/COSEM based smart meters under the Smart Meter National Programme (SMNP ). Major utilities include TANGEDCO, Tata Power, UPPCL, and NDMC . Cybersecurity is critical to prevent power theft, unauthorized access, and data breaches . Indian utilities face unique challenges like large-scale deployment, legacy infrastructure, and lack of skilled cybersecurity experts.

21. Cyber Attacks on Indian Power Infrastructure 2019 : Kudankulam Nuclear Power Plant cyber attack (malware infiltration ). Source: https://www.thehindu.com/news/national/npcil-acknowledges-computer-breach-at-kudankulam-nuclear-power-plant/article61968950.ece 202 : Suspected cyber attack on Mumbai's power grid causing blackout . Source: https://www.thehindu.com/news/cities/mumbai/cyber-sabotage-led-to-october-2020-outage-in-mumbai-minister/article33964939.ece 2023 : D ISCOM s facing cybersecurity threats in India due to smart meter vulnerabilities.

22. Importance of Cybersecurity in Smart Metering Smart meters are critical for energy management and crucial for India's power sector modernization. Smart meters are vulnerable to various cyber threats . However, it is vulnerable to multiple cyber threats that can compromise energy data, system reliability, and billing integrity . Cyber threats can disrupt energy supply and lead to financial losses. Ensuring security protects consumer data and prevents tampering.

23. Key Cybersecurity Issues Weak authentication mechanisms (password-based access). Man-in-the-Middle ( MitM ) attacks . Jamming and Denial of Service ( DoS ) attacks. Firmware manipulation and unauthorized updates. Supply chain risks and insider threats . Interception of DLMS/COSEM messages. Lack of encryption in some implementations. Risk of optical port exploitation for unauthorized access. Wireless communication (RF, PLC, GPRS) susceptible to attacks.

24. Data Integrity and Privacy Risks Tampering with meter readings leading to revenue losses. Non-compliance with data protection regulations. Unauthorized access to critical infrastructure data . Attackers modify OBIS registers to reduce billing amounts. Fake data can mislead utilities about power usage.

25. Vulnerability Issues in Smart Meter 1) Weak Authentication & Authorization Issues: Use of default or weak passwords makes meters vulnerable. Example : Reports of hacking attempts on prepaid smart meters in Delhi. Mitigation: Strong authentication (HLS, digital certificates) is needed . 2) Firmware Tampering & Secure Boot Concerns: Attackers can install malicious firmware. Example: Tamil Nadu utilities identified firmware vulnerabilities in smart meters. Mitigation: Implement digital signature verification for updates.

26. Vulnerability Issues in Smart M eter 3) Power Grid Disruption via Botnet Attacks Attackers can hijack multiple smart meters to form a botnet. Example : India’s power utilities warned against IoT -based botnet threats. Mitigation: Secure firmware and intrusion detection can mitigate risks . 4) Data Manipulation & Energy Theft Attacks Attackers modify OBIS registers to reduce billing amounts. Example: Reports of illegal meter hacking in Uttar Pradesh. Mitigation: Secure storage and cryptographic authentication can prevent this.

27. Vulnerability Issues in Smart Meter 5) Ransomware Attacks on Utility Systems Malware can lock access to Meter Data Management (MDM) systems. Example : Reports of ransomware threats to DISCOM data centers. Mitigation: Regular backups and cybersecurity training are necessary . 6) Fake Meter Data Injection & Replay Attacks Attackers capture valid DLMS packets and replay them. Example: Fraudulent energy consumption data injection detected in Indian smart grids. Mitigation: Time-stamping and sequence validation can prevent replay attacks.

28. Vulnerability Issues in Smart Meter 7) Exploiting Smart Meter Disconnection Commands: Remote disconnect/reconnect features can be abused. Example : Attempted remote shutdown of multiple meters in a South Indian city. Mitigation: Access control and strong authentication mechanisms are needed . 8) Communication Security Risks: Smart meters use GSM, RF Mesh, NB- IoT , PLC for data transmission. Example : Maharashtra Discoms reported attempts of unauthorized data interception. Mitigation : Encryption and secure channels (TLS, VPN) are essential.

29. Optical Port Attack in Indian Smart Meters Incident : Attackers in some regions gained access to the optical port of meters to alter data. How it Works: - Using specialized hardware and software, attackers extract authentication keys. - Modify stored consumption data before it is sent to utilities. Impact : - Incorrect bills and revenue loss. - Possible manipulation of demand forecasting by utilities. Mitigation : - Disable unused ports by default. - Implement tamper detection alerts when optical port is accessed.

30. Supply Chain Attack Risks in Indian Smart Meters Risk : Many Indian smart meters depend on imported components, which may contain hidden vulnerabilities. Example : - If firmware is tampered at the manufacturer level, backdoors can be installed before deployment. Mitigation : - Source components from trusted vendors. - Use cryptographic checks to verify firmware authenticity. - Government-mandated security audits before deployment.

31. Case Study: Energy Theft via Smart Meters Incident : In certain Indian states, hackers have modified smart meters to under-report consumption. How it Happened : - Attackers gained access through default credentials . - They altered tariff settings using unauthorized DLMS commands. Impact : - Revenue loss for DISCOMs. - Large-scale fraud affecting government subsidy programs. Mitigation : - Stronger authentication . - Regular firmware updates with security patches.

32. Man-in-the-Middle Attack on Indian Smart Meters Incident : Researchers found vulnerabilities in Indian smart meter networks where attackers could intercept data. How it Works: - Hacker sits between the meter and the Head-End System (HES). - Modifies energy consumption data before it reaches the utility. Possible Impact: - False billing complaints. - Unauthorized tariff manipulation. - Disruptions in demand-side management. Mitigation : - Implement s trong encryption . - Use end-to-end encrypted sessions in DLMS communication.

33. Indian Smart Meter Security Standards BIS & CEA Guidelines: - Bureau of Indian Standards (BIS) mandates DLMS/COSEM compliance. - Central Electricity Authority (CEA) guidelines emphasize cybersecurity in smart grid infrastructure. Govt . of India Initiatives: - National Smart Grid Mission (NSGM) promotes secure smart meter deployment. - CERT-In provides security advisories for power sector cybersecurity. Challenges : - Some utilities still use weak security configurations. - Delay in implementing secure firmware update mechanisms.

34. Mitigation Strategies for Indian Smart Meter Security Stronger Authentication: - Implement Public Key Infrastructure (PKI) for meter authentication. Secure Communication: - Enforce AES-256 encryption and TLS 1.3 in all smart meter communications. Firmware Security: - Require all firmware updates to be digitally signed. Anomaly Detection: - Deploy AI-based Detection Systems for real-time threat monitoring. Secure Meter Deployment: - Conduct regular security audits (IEC 62443, NIST 800-53).

35. Conclusion - Future of Smart Meter Security in India India’s smart meter program is crucial for efficient energy management but must be cyber-secure. Utilities must proactively address vulnerabilities before mass-scale cyberattacks occur. Stronger regulatory enforcement and adoption of global best practices can improve security. Investing in cybersecurity research and workforce training is necessary to protect India’s power sector.

36. Thank you