DE102012203356B4 - Method for initializing a memory area associated with a smart meter - Google Patents

Abstract

A method of initializing a memory area (136), wherein the memory area (136) is associated with a smart meter (142; 144; 146; 148), the method comprising the steps of:
Establishing a first communication channel between a first computer system (150) and a security module (100), wherein the security module (100) is associated with the storage area (136), the first computer system (150) being associated with a network-connected set of computer systems .
Authenticating the first computer system (150) to the security module (100), wherein the initialization is for enabling communication of the security module (100) with other computer systems (166) of the set of computer systems, prior to initializing the storage area (136) exclusively for the first computer system (150) of the set of computer systems is capable of successful authentication to the security module (100),
After successful authentication of the first computer system (150) to the security module (100), receipt of data from the first computer system (150) by the security module (100) by secure transmission and storage of the data in the memory area (136) to initialize the security module (100) Memory area (136), wherein only due to the stored data communication of a second computer system (166) of an energy supplier and / or meter operator and the security module (100) bypassing the first computer system (150) is enabled, wherein the second computer system (166) a Computer system from the set of computer systems is, wherein
the memory area (136) and the security module (100) are contained in the smart meter (142; 144; 146; 148) or
the memory area (136) and the security module (100) are contained in a smart meter gateway (138), the smart meter (142; 144; 146; 148) being connectable to the smart meter gateway (138),
- the smart meter configuration data for the operation of the smart meter and / or the gateway are associated with, by the smart meter (142; 144; 146; 148) energy consumption-specific measurement data can be detected, wherein the data received from the first computer system (150) an indication (125) contains those measured data elements and / or configuration data for which the energy supplier and / or the measuring point operator is authorized for read access,
the data received from the first computer system (150) includes an indication (125) of the time frequency of detection of the measurement data items by the smart meter (142; 144; 146; 148) and / or an indication (125) of the time frequency of the smart meter Transmission of the measured data elements and / or configuration data to the second computer system (166),
the data received from the first computer system (150) comprises an energy sensing application (130; 132; 134; 174), the device being associated with the indication (125) in the form of the energy sensing application (130; 132; 134; 174),
the indication (125) contained in the received data from the first computer system (150) is included in the energy sensing application, the energy sensing application (130; 132; 134; 174) accessing the sensing data elements and / or the second computer system (166) Configuration data monitored by indication (125).

Description

The invention relates to a method for initializing a memory area, wherein the memory area is associated with a smart meter, a computer program product and a security module, and a computer system for initializing a memory area, wherein the memory area is associated with a smart meter.

The term "smart metering" is generally understood as the idea of equipping customers with electronic energy consumption recording devices, in order to provide not only simple detection of the amount of energy consumed, for example via a network, to both the customer and the energy supplier.

It is possible that the customer can inform himself in real time about his current energy consumption. The term "energy consumption" is understood to mean the consumption of the customer with regard to any kind of energy that is delivered to households and companies. In addition to the forms of electricity, water and gas, this also includes any other forms of energy such as district heating.

To record the energy consumption, smart metering systems, also called smart meters or "smart meters", are used by the respective consumer. Smart meters are meters of energy consumed. The consumer can be a natural or legal person who consumes various measurable forms of energy such as electricity, gas, water or heat. The goal of using Smart Meters is the implementation of intelligent metering systems, which would, for example, enable the levying of variable compensation depending on total demand and network load. As a result, energy supply networks can be better utilized overall.

It is known from the technical guideline of BSI TR-03109 to provide a so-called smart meter gateway, also called a concentrator, as a central communication unit which can communicate with individual or several smart meters. The gateway is able to communicate with devices in the so-called "Home Area Network" and with devices in the "Wide Area Network". The Home Area Network includes all smart meters, which are coupled to the gateway, as well as e.g. private computing units of consumers. The private computing units may e.g. for information on current energy consumption values recorded with the smart meters. The Wide Area Network is designed to allow communication from gateway and authorized market participants. For example, the gateway can collect the data of all smart meters and provide them to a higher-level collection point, for example an energy supplier or a metering point operator.

In general, the technical guideline of the BSI TR-03109 gives a technical recommendation for the implementation of the communication of smart meter gateways and deals with the security aspects and interoperability in the communication with the infrastructure of such a gateway.

The invention has for its object to provide a method for initializing a memory area, which is associated with a smart meter, a computer program product, a security module and a computer system for initializing a memory area, which is associated with a smart meter provide.

The objects underlying the invention are achieved by the features of the independent claims. Preferred embodiments of the invention are indicated in the dependent claims.

A method is provided for initializing a storage area, the storage area being associated with a smart meter, the method comprising the step of establishing a first communication channel between a first computer system and a security module, wherein the security module is associated with the storage area. The first computer system is assigned to a network-connected set of computer systems. The method further comprises the step of authenticating the first computer system to the security module, wherein the initialization is to enable communication of the security module with other computer systems of the set of computer systems, wherein prior to initializing the storage area exclusively for the first computer system of the set of computer systems Authentication to the security module is possible. After successful authentication of the first computer system relative to the security module, data is received from the first computer system by the security module by secure transmission and storage of the data in the memory area to initialize the memory area, wherein only based on the stored data, a communication of a second computer system of a power supplier and / or measuring point operator and the security module, bypassing the first computer system is made possible, the second Computer system is a computer system from the set of computer systems.

Embodiments of the invention may have the advantage that a possibility can be provided by the initialization process in a secure, unambiguous and comprehensible manner that enables secure communication between the smart meter and an authorized market participant such as an energy supplier or a metering point operator. In this case, the first computer system is preferably a computer system of a trustworthy entity, which is also referred to as "Trusted Service Manager" or "TSM".

For this purpose, the security module is preferably configured, for example in its delivery state, such that only this trustworthy entity is able to carry out a communication after successful authentication with the security module. This ensures that, in particular, a charge-relevant configuration of the smart metering is only left to a point which is classified as trustworthy both by the authorized market participants, that is, for example, the metering point operators and the actual energy suppliers, as well as the end users. "Charge-relevant configuration" is understood below to mean that this configuration determines with respect to a smart meter, for example, who is entitled to charge the amount of energy detected by the smart meter. Furthermore, it can also be determined which persons, such as end users and authorized market participants, are allowed to have access to the functions and information available with respect to the smart meter to what extent. Since this determination is made on the part of a trusted body, this ensures that abuse of these functions and information by unauthorized third parties is excluded. The information can be e.g. Location information of the smart meter, which includes values that are measured by Smart Meter and storage area location information.

By storing the received data in the memory area for initializing the memory area, one or more smart meters associated with this memory area can thus be used, for example. determine to whom, for example, detected quantities of energy are reported, how the amounts of energy are to be recorded in terms of time and what information or "attributes" an authorized market participant with respect to the smart meter can capture and / or interrogate. Furthermore, it can also be determined to what extent an end user, for example, has access to the information stored with respect to the smart meter either in the smart meter itself or in a device assigned to the smart meter, such as a gateway or the security module.

Thus, embodiments of the invention are particularly advantageous overall, since a particularly high degree of trustworthiness both with regard to the data "configuration data" stored with regard to the smart meter and with regard to the data protection of the measured data elements acquired by the smart meter both for end consumers and for meter operators and Energy supplier is guaranteed.

According to one embodiment of the invention, the secure transmission takes place by an end-to-end encryption between the first computer system and the security module. This makes it possible to establish the connection between the security module and the first computer system over any networks, since due to the end-to-end encryption, no changes of data transmitted over the connection by third parties can be made. In general terms, the invention can be implemented by allowing all communication between the first computer system and the security module to occur over any type of network. This includes communication over the Internet, communication through wireless network connections such as cellular, as well as communication using a carrier-frequency system. The latter is also known under the name: "Powerline data transmission" and includes devices for data transmission over existing power grids.

According to a further embodiment of the invention, the authentication of the first computer system relative to the security module takes place with the aid of a first certificate of the first computer system. The security module can then verify from this first certificate whether the first computer system has the necessary authority to write to the storage area before such write access can be performed by the first computer system.

According to a further embodiment of the invention, prior to the initialization of the memory area, the successful authentication against the security module is possible only when the first certificate is present. Thus, for example, only by the storage of the data in the memory area for initializing the memory area, the security module for communication with the second computer system is enabled, with the data stored in the memory area itself, the communication with the second computer system is enabled. So it's not writing any data into the memory area, what causes the activation, but it is the contents of the data itself, which cause the activation. For example, a concrete authorization for the second computer system could be contained in the data, which enables the security module to recognize the second computer system as authorized to access particular measured data elements or configuration data. This ensures that, in principle, only the trusted authority in the form of the first computer system for commissioning the security module and thus the associated smart meter is capable of. This prevents manipulation or even spying attempts - without initial use of the first computer system and thus a device which all participants trust, communication with the security module is not possible.

According to a further embodiment of the invention, a write access to the memory area is possible only for the first computer system of the set of computer systems. This would ensure that never an untrusted instance gets write access to the memory area. However, it is also possible that this restriction only applies for the period before the initialization of the memory area and that after initialization the write access for computer systems other than the first computer system to e.g. simple, not the basic functionality of the smart meter and / or the gateway related write functions is limited. Possible would be here, for example setting flags and writing log entries to the memory area. In this case, after initialization, the write access for computer systems other than the first computer system is restricted to a non-configuring write access. In addition, of course, the general access control is still used here, as described above with regard to the second computer system and which regulates in principle whether the second computer system is allowed to access the memory area at all.

According to one embodiment of the invention, the authentication comprises a challenge-response method. For example, For example, a cryptographic protocol, for example based on a symmetric key or an asymmetric key pair, may be used to authenticate the first computer system to the security module.

According to the invention, either the memory area and the security module are contained in the smart meter itself or else the memory area and the security module are contained in a smart meter gateway, wherein the smart meter can be coupled to the smart meter gateway. For example, it is possible that the smart meter and the smart meter gateway are coupled together via a wireless and / or wired communication link.

In all cases, the memory area serves, inter alia, to permanently store such data as certificates and cryptographic keys, which ensure reliable and secure data exchange between the end users operating the smart meters and the energy suppliers or meter operators assigned to these smart meters.

In particular, in the case where the memory area is included in the smart meter gateway, there is the advantage that a single central unit can be provided for any communication with subscribers outside of the smart meter smart meter gateway network provides a single central communication interface.

According to the smart meter configuration data for the operation of the smart meter and / or gateways are assigned. This configuration data may be stored in the memory area. Configuration data is understood to be any type of data that configures the operation of the smart meter and / or gateway. This includes the type and
Method of data acquisition such as the timing of data acquisition, measurement data evaluation, data aggregation, measurement data conversion, as well as location-specific data for Smart Meter and Gateway.

According to the invention, energy meter-specific measurement data elements can be detected by the smart meter. By "measured data elements" is meant any type of data resulting from energy metering with a smart meter. This includes e.g. a time of acquisition of energy consumption measurement data, individual measurement data points at each time, and information about the occurrence of measurement data such as current, voltage, water pressure, water temperature or gas pressure.

According to one embodiment of the invention, the data received from the first computer system include an indication of those measured data elements and / or configuration data, which are preferably transmitted independently and thus automatically by the smart meter or the gateway using the security module to the second computer system.

By providing such an authorization concept in the form of the "information" can Specifically, for each energy supplier and / or metering point operator to be determined in advance which metering data elements and / or configuration data may even be read out or recorded by this energy provider and / or metering point operator. This ensures a high degree of privacy. An acceptance of such a data protection concept is in particular given by the fact that the read authorization is authorized by a trusted authority, namely the first computer system.

According to the invention, the data received by the first computer system also include an indication of the temporal frequency of a detection of the measured data elements by the smart meter and / or an indication of the temporal frequency of the transmission of the measured data elements and / or configuration data to the second computer system. Thus, by the first computer system, a complete basic configuration of the smart meter or the gateway can be carried out - the end customer does not need to worry about whether the second computer system does not make any unwanted configurations regarding its smart meter.

The aim is preferably to enable the construction of a second communication channel between a second computer system of the energy supplier and / or measuring point operator and the security module. This is followed by a mutual authentication of the second computer system and the security module, wherein the authentication takes place with the aid of the second certificate and with the aid of a third certificate of the security module. After successful mutual authentication, at least part of the measured data elements specified in the data and / or configuration data are transmitted from the security module to the second computer system by secure transmission. Alternatively or additionally, it is also possible for measurement data elements and / or configuration data to also be specified in the second certificate, for which the energy provider and / or the measuring point operator is authorized for read access. In this case additionally or alternatively, the transfer of at least part of the measurement data elements specified in the second certificate and / or configuration data from the security module to the second computer system takes place through the secure transmission.

The method steps mentioned ensure that measurement data elements and / or configuration data are transmitted between the second computer system of the energy provider and / or measuring point operator and the security module only if both energy suppliers or metering point operators and end users are interested in such a data transfer at all and if both sides in have previously consented to such data transfer. Only then will the said memory area be provided with the authorization information for the second computer system by the trustworthy entity. Since the instance of the first computer system is indeed trustworthy, end consumers can assume that for their smart meter without consent no unwanted activation of second computer systems by appropriate deposit of said information in the memory area. If such mutual consent is not available, the energy supplier or metering point operator, for example, can not confirm the authenticity of the third certificate of the security module, or the security module is in turn unable to recognize the second certificate of the energy supplier or metering point operator as genuine and trustworthy , Preferably, during the initialization of the memory area, the security module could be provided with information which would enable the security module to confirm the authenticity of the second certificate. However, even if the security module and the utility company or metering point operators trust each other, it is nevertheless ensured for the end user that the metering point operator or utility can only read out the data that was previously unambiguously defined as "metering data elements" and / or "configuration data" for this purpose ,

An acceptance of such a data protection concept is in particular given by the fact that measured data elements and / or configuration data according to an embodiment of the invention are additionally or alternatively contained in an official document, namely a certificate. Since the certificate is forgery-proof and its authenticity can be easily checked by the end user, this also makes possible a particularly high degree of trustworthiness with regard to the communication of the specified measured data elements and / or configuration data. Preferably, again, said certificate is signed by the first computer system. The certificate can be the second certificate.

It should be noted that throughout the description, preferably all certificates should be issued by the operator of the first computer system. This also ensures the reliability of both the first and second computer system and the security module.

According to one embodiment of the invention, the construction of the second takes place Communication channel through the security module, wherein the transmission of the part of the specified in the data and / or in the second certificate measured data elements and / or configuration data is carried out by a push method. As a result, it is thus possible, for example, for the security module to set up the second communication channel in the time intervals defined, for example, during initialization of the memory area, in order to transmit energy consumption values to the second computer system at regular intervals, for example. It is also possible, for example, for the second communication channel to be set up only under certain conditions established when the memory area is initialized. Such conditions may include, for example, an aggregation of sensed amounts of energy above a predetermined threshold.

In accordance with the invention, the data received from the first computer system includes a power sensing application, wherein the power sensing application has received the data from the first computer system through the security module. This makes it possible, when the memory area is initialized by the first computer system, to provide an energy detection application which enables energy detection and energy accounting in a manner previously specified by, for example, the metering point operator and / or the energy provider. In addition, such an energy detection application could determine how energy detection should occur. This can, for example, record billing to the nearest second or billing with aggregated energy consumption over a predetermined period of time. Further, the energy sensing application may also include an interface, e.g. provide a web interface, via which an end user in a predefined way can monitor its energy consumption itself.

According to the invention, the device is assigned the information in the form of the energy detection application. That is, the energy acquisition application is able to monitor, by means of appropriate program instructions, whether and to what extent the second computer system is allowed access to the measurement data elements and / or the configuration data. Furthermore, these program instructions can be used to independently transmit the measured data elements to the second computer system using the security module as the communication interface. Further, the energy sensing application may provide a utility specific user interface to the end user who is the user of the security module. The end user can therefore use this interface, e.g. a web interface to inform about their own consumption-specific details.

According to the invention, the information contained in the received data from the first computer system is contained in the energy acquisition application itself, the energy acquisition application monitoring the access of the second computer system to the measurement data elements and / or configuration data on the basis of the information. Alternatively or additionally, the information may be stored in a separate file, e.g. a permission table that is accessed by the access monitoring power collection application.

It should be noted at this point that embodiments of the invention are particularly advantageous if the memory area and the security module are contained in a smart meter gateway. In this case, e.g. it is possible to couple the smart meter gateway to various smart meters so that during an initialization process, specific energy metering applications and / or configuration data can be provided for each smart meter and, optionally, each smart meter for different utility companies or meter operators. This also includes the reuse of the steps of initializing the memory area for updating the contents of the memory area, for example, due to an update of a power sensing application. Further, this includes the ability to later add one or more energy sensing applications to the memory area. As a result of the provision of a single gateway, a virtually unlimited expandability with a large number of different smart meters and the possibility of access control to the gateway for a large number of different energy suppliers and / or metering point operators is possible. This is particularly relevant with regard to the use, for example, in multi-family houses in which different subscribers have determined different energy suppliers or metering point operators for energy billing and supply at different times and weekdays.

The procedure described with regard to the energy detection application can alternatively or additionally be carried out analogously also with regard to the configuration data and / or the authorization information itself. This includes, e.g. an update of the configuration data by the first computer system and the addition of new configuration data by the first computer system, as well as a change of the authorization concept by the first computer system. It should be ensured that at any one time only the first computer system is allowed to change, update or delete the authorization and configuration information.

According to another embodiment of the invention, the energy detection application initiates the construction of the second communication channel. As already mentioned above, it is thus possible to send a message of the detected amounts of energy to the energy supplier or metering point operator, in particular at previously specified time intervals. This saves the energy supplier or measuring point operator the necessity of making a timely query of the recorded energy consumption. If, for example, the energy consumption is only reported to the second computer system when a minimum energy consumption is exceeded, the second computer system thus saves a possibly superfluous query because the total energy consumption has not yet exceeded this threshold value. Nevertheless, it is of course possible at regular intervals, for example when creating a final bill, to set up a communication with the security module on the part of the second computer system and thus to transfer the measured data elements from the security module to the second computer system.

According to another embodiment of the invention, the method further comprises the steps of establishing a third communication channel between the second computer system and the first computer system, authenticating the second computer system to the first computer system, and upon successful authentication of the second computer system to the first computer system receiving a request for initializing the memory area from the second computer system by the first computer system, wherein the request comprises an identifier of the memory area, wherein the identifier uniquely identifies the memory area.

This makes it possible for the second computer system of the energy supplier or measuring point operator to initiate the initialization of the memory area using the first computer system. However, only when the first computer system has classified the second computer system as trustworthy will the second computer system set up the first communication channel to the security module and perform the initialization process. Characterized in that is transmitted by the second computer system, a unique identifier of the memory area to be initialized to the first computer system, the first computer system is also clearly able to address exactly the security module, which is actually assigned to the desired memory area to be initialized. This creates a simple and efficient possibility overall, by means of which it is possible to communicate which smart meters are to be used and configured by end users for data acquisition with regard to corresponding measuring point operators and / or energy suppliers.

According to a further embodiment of the invention, the identifier of the memory area is given by an identifier of the security module. This ensures that the security module and storage area are inextricably linked. A clear addressing of the security module thus corresponds to a unique addressing of the memory area. If the memory area is located in a smart meter gateway, this ensures that the gateway can not subsequently be replaced by another gateway in an unauthorized manner. For example, this could prevent a measuring point operator from providing values from a "hacked" gateway, which is only sporadically connected to corresponding smart meters and thus actually does not carry out any real energy consumption recording at all. The said memory area can be described exclusively via the security module by the first computer system, and an addressing of this memory area is unique due to the identifier. The use of another gateway with a different memory area would thus be fundamentally impossible in this case, since uploading the data relevant for energy acquisition would never take place on the part of the first computer system.

According to one embodiment of the invention, the identifier of the security module is a public key of the security module or an IPv6 address of the security module. The use of the public key of the security module as an identifier of the security module and thus as an identifier of the memory area has the advantage that thereby a GUID (Globally Unique Identifier) can be provided, which is unique with almost absolute certainty. Simple management of the identifiers would e.g. by simply assigning as long a public key as possible. In the case where the identifier of the security module is an IPv6 address, it would be possible in a simple manner to make a clear addressing of the security module via existing networks.

According to another embodiment of the invention, the third certificate includes the public key of the security module. This public key is assigned to a private key which is stored in a protected memory area in the security module. The certificate may have been created according to a Public Key Infrastructure (PKI) standard, for example according to the X.509 standard.

It should be noted at this point that the described certificates (first, second and third certificate) do not necessarily have to be stored in a memory of the device provided for this purpose (first computer system, second computer system, security module). Alternatively or additionally, it is also possible that the certificates are stored on a public directory server.

According to one embodiment of the invention, the security module is inseparably connected to the smart meter or the smart meter gateway. Under "inseparable" is understood as a permanent link between security module and smart meter or smart meter gateway, which ensures a functionality of the security module. As soon as an attempt is made to remove the security module from the smart meter or the smart meter gateway, the security module enters a useless, i. inoperative condition over. This can be ensured either by an electronic self-destruction, self-deactivation or a physical destruction or deactivation of the security module in the expansion. In the simplest case, the security module could be embedded in a housing of the smart meter or smart meter gateway, so that due to the "breaking" of this cast connection destruction of the security module results.

Preferably, as a result of connecting the security module to the smart meter or the smart meter gateway, a linkage process is started on the smart meter or the smart meter gateway, whereby the linkage process creates an inseparable logical link between the security module and the smart meter gateway. Meter or the smart meter gateway. For example, this indivisible logical link comprises an irreversible copy operation of the third certificate or the identifier of the security module in the memory area.

According to one embodiment of the invention, the security module is provided in the form of a chip card. For example, the security module could be preconfigured in the form of a chip card by the operator of the first computer system by storing on the chip card that information which makes it possible to authenticate the first computer system to the security module for later execution of the initialization process.

According to one embodiment of the invention, the first computer system is an officially certified trust center.

In a further aspect, the invention relates to a security module, wherein the security module can be assigned to a memory area, the memory area being assignable to a smart meter, wherein the security module is designed to initialize the memory area, wherein the security module comprises means for establishing a first communication channel with a first computer system wherein the first computer system is associated with a network-connected set of computer systems. The security module further comprises means for authenticating the first computer system to the security module, wherein the initialization is for facilitating communication of the security module with other computer systems of the set of computer systems, wherein the security module is configured such that prior to initialization of the storage area exclusively for the first computer system of the set of computer systems a successful authentication to the security module is possible. Finally, the security module also has means for receiving data from the first computer system by the security module by secure transmission and storage of the data in the memory area for initialization of the memory area after successful authentication of the first computer system to the security module, wherein the security module is designed such that only on the basis of the stored data is a communication of a second computer system of an energy provider and / or measuring point operator and the security module bypassing the first computer system possible, wherein the second computer system is a computer system from the set of computer systems.

• - Mittel zum Aufbau eines ersten Kommunikationskanals zwischen dem ersten Computersystem und einem Sicherheitsmodul, wobei das Sicherheitsmodul dem Speicherbereich zugeordnet ist, wobei das erste Computersystem einem über ein Netzwerk verbundenen Satz von Computersystemen zugeordnet ist,
• - Mittel zur Authentifizierung des ersten Computersystems gegenüber dem Sicherheitsmodul,
• - Mittel zum Senden von Daten von dem ersten Computersystem an das Sicherheitsmodul durch eine gesicherte Übertragung zur Speicherung der Daten durch das Sicherheitsmodul in dem Speicherbereich zur Initialisierung des Speicherbereichs nach erfolgreicher Authentifizierung des ersten Computersystems gegenüber dem Sicherheitsmodul, wobei durch die gesendeten Daten ein zweites Computersystem eines Energieversorgers und/oder Messstellenbetreibers spezifiziert wird, wobei die Spezifikation der Freischaltung einer Kommunikation zwischen dem Sicherheitsmodul und dem zweiten Computersystem unter Umgehung des ersten Computersystems dient, wobei das zweite Computersystem ein Computersystem aus dem Satz von Computersystemen ist.

In another aspect, the invention relates to a first computer system for initializing a storage area, the storage area being associated with a smart meter, the first computer system comprising:

• Means for establishing a first communication channel between the first computer system and a security module, the security module being associated with the storage area, the first computer system being associated with a network-connected set of computer systems,
• Means for authenticating the first computer system to the security module,
• - means for sending data from the first computer system to the security module by a secure transfer for storing the data by the security module in the memory area for initialization of the memory area after successful authentication of the first computer system to the security module, wherein by the transmitted data, a second computer system an energy provider and / or meter operator, the specification of enabling communication between the security module and the second computer system bypassing the first computer system, wherein the second computer system is a computer system of the set of computer systems.

• - Aufbau eines ersten Kommunikationskanals zwischen dem ersten Computersystem und einem Sicherheitsmodul, wobei das Sicherheitsmodul dem Speicherbereich zugeordnet ist, wobei das erste Computersystem einem über ein Netzwerk verbundenen Satz von Computersystemen zugeordnet ist,
• - Authentifizierung des ersten Computersystems gegenüber dem Sicherheitsmodul,
• - Senden von Daten von dem ersten Computersystem an das Sicherheitsmodul durch eine gesicherte Übertragung zur Speicherung der Daten durch das Sicherheitsmodul in dem Speicherbereich zur Initialisierung des Speicherbereichs nach erfolgreicher Authentifizierung des ersten Computersystems gegenüber dem Sicherheitsmodul, wobei durch die gesendeten Daten ein zweites Computersystem eines Energieversorgers und/oder Messstellenbetreibers spezifiziert wird, wobei durch die Spezifikation der Freischaltung einer Kommunikation zwischen dem Sicherheitsmodul und dem zweiten Computersystem unter Umgehung des ersten Computersystems freigeschaltet wird, wobei das zweite Computersystem ein Computersystem aus dem Satz von Computersystemen ist.

In a further aspect, the invention relates to a method for initializing a memory area executed on a first computer system, wherein the memory area is assigned to a smart meter, the method comprising on the first computer system:

• Establishing a first communication channel between the first computer system and a security module, the security module being associated with the storage area, the first computer system being associated with a network-connected set of computer systems,
• Authentication of the first computer system to the security module,
• Transmitting data from the first computer system to the security module through secure transmission for storing the data by the security module in the memory area to initialize the memory area upon successful authentication of the first computer system to the security module, wherein the transmitted data comprises a second computer system of a power company is specified by the specification of the activation of a communication between the security module and the second computer system, bypassing the first computer system, wherein the second computer system is a computer system from the set of computer systems.

In a further aspect, the invention relates to a computer program product with instructions executable by a processor for carrying out the method steps described above.

• 1 ein Blockdiagramm eines Systems zur Implementierung des obig beschriebenen Verfahrens,
• 2 ein Flussdiagramm einer Ausführungsform eines Verfahrens zur Initialisierung eines Speicherbereichs,
• 3 ein Flussdiagramm eines Verfahrens zur Bereitstellung eines Sicherheitsmoduls.

In the following, preferred embodiments of the invention are explained in more detail with reference to the drawings. Show it:

• 1 a block diagram of a system for implementing the method described above,
• 2 a flowchart of an embodiment of a method for initializing a memory area,
• 3 a flowchart of a method for providing a security module.

Hereinafter, similar elements will be denoted by like reference numerals.

The 1 shows a block diagram of an overall system for initializing a memory area. Together with the in 2 In the following, the process steps for initializing a memory area shown without the restriction of generality, such as a memory area 136 a gateway 138 , which is a variety of smart meters 142 . 144 . 146 . 148 is assigned, can be initialized.

The smart meter 142 - 148 serve to capture various energy consumption values with regard to, for example, gas (smart meter 142 ), Water (smart meter 144), electricity (smart meter 146 ) and other unspecified energy forms (smart meter 148 ). The smart meters are via corresponding communication links 192 with the interface 118 of the gateway 138 connected.

It was assumed that a security module 100 firm and inseparable from the gateway 138 total, so through the combination of the gateway 138 and the security module 100 an inseparable unit 140 given is. The gateway 138 and the security module 100 communicate with each other via respective interfaces 118 and 116, respectively. About the interface 116 Furthermore, communication takes place with authorized market participants and third persons or entities, which are not within the scope of the entity 140 and the smart meters 142-148 of the formed network. The communication between interface 116 of the security module 100 and further communication participants takes place via a communication connection 190 , This may be, for example, a power line connection or a communication connection via a mobile telecommunications network or the Internet.

The security module 100 has an electronic memory 102 with protected memory area 106 and 108. The protected memory area 106 is used to store a private key of the security module 100 and the memory area 108 is used to store an identifier of the security module "GUID" (Globally Unique Identifier). at For example, the GUID may be an IPv6 address of the security module 100 act.

The electronic memory 102 may further include a memory area 104 to store a certificate. The certificate includes a public key similar to the one in the protected space 106 stored private key is assigned. The certificate may have been created according to a Public Key Infrastructure (PKI) standard, for example according to the X.509 standard.

The certificate does not necessarily have to be with the electronic memory 102 of the security module 100. Alternatively or additionally, the certificate can also be stored in a public directory server.

The security module 100 has a processor 110 to execute program instructions 112 and 114. By executing the program instructions 112 For example, "cryptographic protocol" is an authentication of a trusted entity 150 or an energy supplier 166 relative to the security module 100 allows. The cryptographic protocol may, for example, be a challenge-response protocol based on a symmetric key or an asymmetric key pair.

It is also possible, of course, mutual authentication of security module and trusted entity or energy supplier.

The program instructions 114 serve for end-to-end encryption of between the security module 100 and the trusted instance 150 or the energy supplier 166 data to be transferred. For the end-to-end encryption, a symmetric key can be used, for example, when the cryptographic protocol is executed between the security module 100 and the other participants 150 respectively. 166 is agreed.

Similar to the security module 100 Also, the trusted entity 150 has an electronic memory 152 and a protected storage area 156 for storing a private key of the trusted entity. In the store 152 can also have a certificate 154 be included in the trusted instance. However, this certificate can also be stored on a central certificate server.

A processor 158 the trusted instance 150 again indicates the above with regard to the security module 100 described program instructions 112 and 114 to implement a cryptographic protocol and to perform end-to-end encryption. The cryptographic protocol and the end-to-end encryption may communicate with the utility over the interface 164 166 or with the security module 100 be used. The certificate 154 in turn, contains a public key similar to the one in the protected storage area 156 stored private key is assigned.

The "utility company" 166 is a computer system of the energy supplier, which in turn has an electronic memory 168 and a processor 178. Furthermore, this computer system is an interface 186 assigned via which a communication with the trusted entity 150 or the security module is enabled.

The electronic memory 168 of the energy supplier 166 has a protected storage area 172 with a private key, the private key being associated with a public key stored in a certificate 170 also in electronic memory 168 is included. Further, in memory 168 a memory area is provided for one or more applications, for example, these applications enable a fee-relevant configuration of the gateway 138. Also in electronic memory 168 Measured data 176 may be stored previously by the gateway 138 were received.

The processor 178 has program instructions 180 for detecting the consumption data supplied by the gateway 138 and, furthermore, optionally for carrying out process steps for consumption billing as a function of the determined measurement data (program instructions 182 ) on. The program instructions for performing steps of a cryptographic protocol 112 Program instructions (not shown) for carrying out an end-to-end encryption may also be provided, whereby these program instructions provide secure communication with the trustworthy entity 150 or the security module 100 is possible.

Should now a new customer to the energy supplier 166 For example, after a first installation of the smart meter could be assigned 142 - 148 and the deployment of Gateway 138 with security module 102 an initialization process of the security module take place. This initialization process could be triggered by the fact that the new customer (an end user) or a specific technical entity, which had installed the smart meter, to the utility 166 to report accordingly. This message should preferably be the GUID 108 of the security module 100 include, as a result clear identification of the security module 100 towards the utility 166 is possible.

After the energy provider 166 this message about his interface 186 , For example, has received a web page of a corresponding website, builds the energy supplier 166 a communication channel to the trusted entity 150. This step is in 2 designated by reference numeral 200. In this case, the trustworthy entity can be, for example, a so-called "Trusted Service Manager TSM", ie an officially certified entity which certifies the respective identity of the communication partner in electronic communication processes.

After the communication channel has been set up in step 200, the energy provider is authenticated 166 in step 202. This is the certificate 170 of the utility by the trusted authority 150 checked. For example, the trusted instance 150 if the certificate is valid, carry out a challenge-response procedure in which a random number is generated, which is one in the certificate 170 included public key of the utility company 166 is encrypted and sent to the utility company 166 is transmitted. The energy provider 166 can then decrypt the random number with his private key 172 and send it back in plain text. That's right from the trustworthy instance 150 received random number with the random number described above, is the authenticity of the utility 166 actually secured.

After performing step 202 and the optional challenge-response method, a channel may then be end-to-end encrypted over the communication link in step 204 188 between power supply 166 and the trusted entity 150 being constructed. Here are the program instructions 114 of the processor 158 the trusted instance are used.

After establishing the channel in step 204, the trusted entity receives 150 in step 206, a request to load a power collection application 174 of the power utility 166 and the memory 136 of the gateway 138 , To the memory 136 or the gateway 138 to uniquely specify is with the request to initialize the memory 136 also the GUID 128 of the gateway 138, which is in memory 136 is sent to the trusted entity. Preferably, the GUID 128 of the memory 136 identical to the GUID 108 of the memory 102 of the security module 100 ,

Receiving the GUID in step 206 is the trusted instance 150 able to clearly identify the desired gateway 138 to address the application 174 to address. For this purpose, in a next step 208, the trustworthy entity is established 150 over the communication connection 190 a communication channel to the security module 100 on. The trusted instance 150 authenticates to the security module 100 , wherein the authentication and a verification of the certificate 154 by the security module, for example, in turn, a challenge-response method by the security module 100 includes. This could be the security module 100 generate a random number again, encrypt it with the public key of the trusted instance 150, and send it to the trusted instance 150 send. The trusted instance 150 would decrypt the encrypted random number with its private key 156 and the decrypted random number in plaintext back to the security module 100 send. If the security module determines that the thus-received decrypted random number matches the originally encrypted random number, authentication of the trustworthy entity is given.

The method then proceeds to step 212, namely, establishing a communication channel with end-to-end encryption between the trusted entity 150 and the security module 100 , This in turn can be done by using the program instructions 114 of the processor 110 of the security module 100.

In step 214, the security module receives 100 the energy collection application 174 from the trusted entity.

It should be noted here that it may be advantageous, for example, for the trusted entity to stock the most frequently sent energy-sensing applications in a trusted instance's local store so that it is not necessary to continually open applications 174 from the utility as new customers are opened 166 to the trusted instance 150 transferred to.

Upon receipt of the power sensing application in step 214, the security module 100 stores the application in memory 136 of the gateway 138 , Is it the application 174 For example, for an application to capture power consumption in terms of water and power, the application will be considered as the application 132 In the storage room 136 stored. This application is capable of energy consumption data from the smart meter 144 to process. Analogous to this, the memory 136 appropriate applications for the Energy detection of gas (134) and other applications 130 for the capture of other forms of energy. Storing the energy sensing application by the security module 100 in the gateway 138 is in 2 indicated by step 216.

In addition to receiving the energy detection application in step 214 by the security module 100 it is also possible for the trusted entity 150 to receive separate information in the form of energy provider-specific authorizations or precise specifications of measurement data elements, which are also in a broader area 125 of the memory 136 be filed. These authorizations or specifications of measured data elements make it possible to determine in advance which information the energy supplier has 166 from the gateway 138 may receive at all. For this it is possible, for example, that in advance by the trusted entity 150 specific authorizations are defined for each energy supplier which apply globally to all energy suppliers 166 and which, in principle, to the transmission of energy acquisition applications to the security module and thus to the gateway 138 be transmitted.

It is also possible for configuration data to be obtained from the trusted entity 150. This configuration data may relate to the technical configuration of the smart meter and / or the gateway.

Instead of or in addition to these authorizations or specifications in the form of a separate entry, it is also possible to implement these authorizations or specifications in the energy recording application itself. The application thus independently controls, based on its program instructions, which data to the energy supplier 166 be communicated.

By means of the program instructions for data acquisition 122 of the processor 126 is now the gateway 138 capable of measuring data relating to energy consumption, for example, from the smart meter 144 and the smart meter 146 capture. The corresponding measurement data are in the memory area 124 the memory 136 stored. Basically, the measurement data exists 124 from various measurement data elements, which may include, for example: time of acquisition of the measurement data, individual measurement data points at the respective time, information on the occurrence of the measurement data (for example, current, voltage, water pressure, water temperature, gas pressure). The measured data 124 can about the applications 130 . 132 and 134 be subjected to a further evaluation, resulting in evaluated measurement data, which also as "measured data elements" in the memory area 124 can be stored. For example, the evaluated measurement data may be accumulated energy consumption values.

The permissions described above 125 or the specifications of the measured data elements make it possible to determine from the outset which of these measured data elements 124 of the energy supplier 126 may retrieve at all, or which of these measured data elements 124 to the energy provider 126 to be communicated at all. Furthermore, this makes it possible to determine in advance how much such retrieval is permitted. An overly detailed and timely retrieval of the measured data 124 could be undesirable, for example, because short periods of measurements lead to insights into the use of electronic devices and thus user profiles can be created, but an end customer might not be interested in doing so.

As already mentioned above, the security module is preferably 100 and the gateway 138 inseparably connected. For example, these form a structural unit 140 like this in 1 is shown schematically. In order to produce this unit 140, those in the flowchart of FIG 3 explained method steps are performed.

In step 400, first the security module 100 provided. Thereupon, in step 402, storage of key material and certificates in the security module occurs. For example, for this purpose, the security module could have a corresponding cryptographic unit, by means of which the private key 106 is generated automatically. Alternatively, it is also possible for the trustworthy entity to generate the private key and store it in the security module in a storage area that is not accessible from the outside. The public key belonging to the private key is attached to the certificate, which is then signed by the trusted entity and in the memory 102 of the security module is stored.

The security module is then inserted into the gateway in step 404, for example in the form of a chip card, and an inseparable connection between security module and gateway is made. For example, security module and gateway could be electronically coupled to each other such that removal of the security module from the gateway would result in automatic destruction of the security module.

After inserting the security module into the gateway 404, an automatic logical connection of security module takes place in step 406 100 and gateway 138. For example, this could be done by having the GUID 108 of the security module irreversibly in the memory 136 of the gateway 138 as a GUID 128 is written. This should be done on the part of, for example, the security module 100 Be sure to communicate with the gateway 138 for the provision of measured data elements and via the energy supplier 166 only takes place if an identity of the GUID 108 and 128 given is.

LIST OF REFERENCE NUMBERS

100

security module

102

Storage

104

certificate

106

private key

108

GUID

110

processor

112

cryptographic protocol

114

End-to-end encryption

116

interface

118

interface

120

data transmission

122

data collection

124

measurement data

125

authorization

126

processor

128

GUID

130

application

132

application

134

application

136

Storage

138

Storage

140

unit

142

Smart meter

144

Smart meter

146

Smart meter

148

Smart meter

150

trusted instance

152

Storage

154

certificate

156

private key

158

processor

164

interface

166

utilities

168

Storage

170

certificate

172

private key

174

application

176

measurement data

178

processor

180

data collection

182

consumption billing

186

interface

188

communication link

190

communication link

192

communication link

Claims (16)

A method for initializing a memory area (136), wherein the memory area (136) is associated with a smart meter (142; 144; 146; 148), the method comprising the steps of: - establishing a first communication channel between a first computer system (150) and a security module (100), wherein the security module (100) is associated with the storage area (136), wherein the first computer system (150) is associated with a set of computer systems connected via a network, authenticating the first computer system (150) to the security module (100) 100), wherein the initialization is for enabling communication of the security module (100) with other computer systems (166) of the set of computer systems, wherein prior to initializing the storage area (136) only for the first computer system (150) of the set of computer systems Authentication to the security module (100) is possible sufficient authentication of the first computer system (150) to the security module (100), reception of data from the first computer system (150) by the security module (100) by secure transmission and storage of the data in the memory area (136) to initialize the memory area ( 136), wherein only based on the stored data communication of a second computer system (166) of an energy supplier and / or meter operator and the security module (100), bypassing the first computer system (150) is enabled, wherein the second computer system (166) a Computer system from the set of computer systems, wherein - the memory area (136) and the security module (100) are contained in the smart meter (142; 144; 146; 148) or - the memory area (136) and the security module (100) in a smart meter gateway (138), the smart meter (142; 144; 146; 148) being connectable to the smart meter gateway (138), - associated with smart meter configuration data for operating the smart meter and / or the gateway wherein the smart meter (142; 144; 146; 148) can record energy consumption specific measurement data elements, wherein the data received by the first computer system (150) includes an indication (125) of the measurement data elements and / or configuration data for which the energy provider and or the metering point operator is authorized for a read access, - the data received by the first computer system (150) is an indication (125) of the time frequency of a detection of the metering data items te by the smart meter (142; 144; 146; 148) and / or an indication (125) of the temporal frequency of the transmission of the measurement data elements and / or configuration data to the second computer system (166), - the data received from the first computer system (150), a power sensing application (130; 132; 134 174), the device being associated with the indication (125) in the form of the energy detection application (130; 132; 134; 174), - the indication (125) contained in the received data from the first computer system (150) in the energy detection application wherein the energy sensing application (130; 132; 134; 174) monitors the access of the second computer system (166) to the measurement data items and / or configuration data based on the indication (125). Method according to Claim 1 wherein the secure transmission is through an end-to-end encryption between the first computer system (150) and the security module (100). Method according to Claim 1 or 2 wherein the authentication of the first computer system (150) to the security module (100) is performed by means of a first certificate (154) of the first computer system (150). Method according to Claim 3 in which, prior to the initialization of the memory area (136), the successful authentication to the security module (100) is possible only when the first certificate (154) is present. Method according to one of the preceding claims, wherein only by storing the data in the memory area (136) for initializing the memory area (136) the security module for communication with the second computer system (166) is enabled, wherein the data stored in the memory area even the communication with the second computer system (166) is unlocked. Method according to one of the preceding claims, wherein only for the first computer system (150) of the set of computer systems a write access to the memory area (136) is possible. Method according to one of the preceding claims, wherein the authentication comprises a challenge-response method. Method according to Claim 1 wherein the data received from the first computer system (150) includes an indication (125) of the measurement data items and / or configuration data transmitted by the smart meter or apparatus to the second computer system (166) using the security module. Method according to one of the preceding claims, further comprising the following steps: Establishing a third communication channel between the second computer system (166) and the first computer system (150), Authenticating the second computer system (166) to the first computer system (150), Upon successful authentication of the second computer system (166) to the first computer system (150), receipt by the first computer system of a request to initialize the memory area (136) from the second computer system (166), the request having an identifier (108; 128) the memory area (136), wherein the identifier (108; 128) uniquely identifies the memory area (136). Method according to Claim 9 wherein the identifier (108; 128) of the memory area (136) is given by an identifier (108; 128) of the security module (100). Method according to Claim 10 wherein the identifier (108; 128) of the security module (100) is a public key of the security module (100) or an IPv6 address of the security module (100). Security module (100), wherein the security module (100) is assignable to a storage area (136), the storage area (136) being assignable to a smart meter (142; 144; 146; 148), the security module (100) for initializing the security module (100) Memory area (136), the security module (100) further comprising: - means for establishing a first communication channel with a first computer system (150), the first computer system (150) being associated with a set of computer systems connected via a network; Means (112) for authenticating the first computer system (150) to the security module (100), wherein the initialization is to enable communication of the security module (100) with other computer systems (166) of the set of computer systems, the security module (100) in that, prior to the initialization of the memory area (136), only for the first computer system (150) of the set of computer systems a successful authentication to the security module (100) is possible, - means (116) for receiving data from the first computer system ( 150) by the security module (100) by secure transmission and Storing the data in the memory area (136) to initialize the memory area (136) after successful authentication of the first computer system (150) to the security module (100), wherein the security module (100) is adapted to communicate only based on the stored data a second computer system (166) of a utility and / or meter operator and the security module (100) bypassing the first computer system (150), the second computer system (166) being a computer system of the set of computer systems, the storage area (136 ) and the security module (100) in the smart meter (142; 144; 146; 148), or - the memory area (136) and the security module (100) are included in a smart meter gateway (138), the smart meter (142; 144; 146; 148) being connectable to the smart meter gateway (138) in that smart meter is assigned configuration data for operation of the smart meter and / or the gateway, energy meter specific data items being detectable by the smart meter (142; 144; 146; 148), the data received from the first computer system (150) an indication (125) of those measured data elements and / or configuration data for which the energy provider and / or the measuring point operator is authorized for a read access, - the data received from the first computer system (150) an indication (125) of the time frequency of a detection the measured data elements by the smart meter (142; 144; 146; 148) and / or an indication (125) of the temporal frequency of the transmission of the measured data elements and / or con figure data to the second computer system (166), the data received from the first computer system (150) comprises an energy sensing application (130; 132; 134; 174) associated with the device (125) in the form of the energy sensing application (130; 132; 134; 174), - the indication (125) contained in the received data from the first computer system (150) is included in the energy sensing application wherein the energy acquisition application (130; 132; 134; 174) is adapted to monitor the access of the second computer system (166) to the measurement data elements and / or configuration data based on the indication (125). Security module (100) according to Claim 12 , wherein the security module (100) is a smart card. A first computer system for initializing a memory area (136), the memory area (136) being associated with a smart meter (142; 144; 146; 148), the first computer system (150) comprising: - means for establishing a first communication channel between the first A computer system (150) and a security module (100), wherein the security module (100) is associated with the storage area (136), the first computer system (150) being associated with a network-connected set of computer systems, - means (112) for authentication the first computer system (150) opposite the security module (100), means (164) for sending data from the first computer system (150) to the security module (100) by secure transmission for storing the data by the security module (100) in FIG the memory area (136) for initializing the memory area (136) after successful authentication of the first computer system (150) to the security tsmodul (100), wherein the transmitted data, a second computer system (166) of an energy supplier and / or meter operator is specified, the specification of the activation of communication between the security module (100) and the second computer system (166), bypassing the first computer system (150), wherein the second computer system (166) is a computer system of the set of computer systems wherein - the memory area (136) and the security module (100) in the smart meter (142; 144; 146; 148), or - the memory area (136) and the security module (100) are contained in a smart meter gateway (138), the smart meter (142; 144; 146; 148) can be coupled to the smart meter gateway (138), - smart meter configuration data for the operation of the smart meter and / or the gateway are assigned, wherein the smart meter (142; 144; 146; 148) energy consumption-specific measurement data can be detected wherein the data sent by the first computer system (150) to the security module (100) includes an indication (125) of those measurement data items and / or configuration data for which the utility and / or the meter operator is authorized for read access, that of the first Computer system (150) an indication (125) of the temporal frequency of detection of the measured data elements by the smart meter (142; 144; 146; 148) and / or an indication (125) of the temporal frequency of the transmission of the measured data elements and / or configuration data to the second computer system (166), the data sent by the first computer system (150) comprises energy sensing application (130; 132; 134; 174) associated with the device (125) in the form of the energy detection application (130; 132; 134; 174), - the indication (125) contained in the transmitted data from the first computer system (150) is included in the energy sensing application wherein the energy acquisition application (130; 132; 134; 174) is adapted to monitor the access of the second computer system (166) to the measurement data elements and / or configuration data based on the indication (125). A method of initializing a memory area (136) performed on a first computer system, wherein the memory area (136) is associated with a smart meter (142; 144; 146; 148), the method on the first computer system (150) comprising: Establishing a first communication channel between the first computer system (150) and a security module (100), wherein the security module (100) is associated with the storage area (136), the first computer system (150) being associated with a network-connected set of computer systems . Authentication of the first computer system (150) to the security module (100), - Sending data from the first computer system (150) to the security module (100) by a secure transfer for storing the data by the security module (100) in the memory area (136) to initialize the memory area (136) after successful authentication of the first computer system (150) opposite the security module (100), wherein the transmitted data specifies a second computer system (166) of a utility and / or meter operator, the specification of enabling communication between the security module (100) and the second computer system (166 ) is bypassed, bypassing the first computer system (150), wherein the second computer system (166) is a computer system of the set of computer systems in which the memory area (136) and the security module (100) are contained in the smart meter (142; 144; 146; 148) or the memory area (136) and the security module (100) are contained in a smart meter gateway (138), the smart meter (142; 144; 146; 148) being connectable to the smart meter gateway (138), - the smart meter is assigned configuration data for the operation of the smart meter and / or the gateway, wherein the smart meter (142; 144; 146; 148) can record energy consumption-specific measured data elements, the data being transferred from the first computer system (150) to the security module (150; 100) transmitted data includes an indication (125) of those measured data elements and / or configuration data for which the energy supplier and / or the measuring point operator is authorized for a read access, the data transmitted by the first computer system (150) includes an indication (125) of the temporal frequency of detection of the measurement data items by the smart meter (142; 144; 146; 148) and / or an indication (125) of the time frequency of the smart meter Transmission of the measured data elements and / or configuration data to the second computer system (166), - the data sent by the first computer system (150) comprises an energy sensing application (130; 132; 134; 174) associated with the device (125) in the form of the energy sensing application (130; 132; 134; 174), the indication (125) contained in the transmitted data from the first computer system (150) is included in the energy sensing application, the energy sensing application (130; 132; 134; 174) accessing the sensing data elements of the second computer system (166) and / or Configuration data monitored by indication (125). Computer program product with processor-executable instructions for performing the method steps according to one of the preceding Claims 1 - 11 . 15 ,

Images