Sun Spec Security Recommendations DRAFT John Nunneley Security

Sun. Spec Security Recommendations (DRAFT) John Nunneley

Security Needs ² Increasing number and size of PV Plants ² Revenue tied to Meters significant ² Introduction of Inverter Control raises threat ² Requirement to participate as first class grid asset § Generation § Storage § Ancillary Services

Security Requirements ² Availability and Safety § Keep the power on, communications up § But don’t kill anybody! ² Confidentiality of Data § Authentication and Authorization § End-End. vs. In Transit ² Data Integrity & Reasonableness § Inability to modify data in transit § Authenticated source of data/control § Alarming data/control ² Non-repudiation of Data § Inability to deny an action took place or origin of data

Sun. Spec Architecture End-to-End Security Sun. Spec Devices Telemetry Meter Inverter Sun. Spec Applications Local SCADA Bulk Data Exchange Firewall / VPN Periodic Report String Module Storage Sun. Spec Gateway Internet Sun. Spec Data Store Cloud Grid Operations SCADA Environ Regulator Sun. Spec Field Bus Transport Security Control Custom

Sun. Spec Field Bus Security Issues ² Modbus itself has no security § Relies on physical security of connection ² May be layered over TCP with SSL § point-point encryption supports privacy and integrity while in transport § Not typically supported due to limited system resources ² ² ² Not end-end TCP not practical over RS-485 No non-repudiation support Multiple Masters / Man-in-the-Middle Wireless (Zigbee/WIFI) provides access control and privacy § Opens up proximity attack

Attacks ² RTU Man-In-The-Middle § Insecure facility (e. g. residence) § Modify data in transit ² TCP Multiple Masters § Tap into switch § Issue erroneous commands ² Replay Attack ² Supply Chain attack ² Consequences of a successful attack

Modbus RTU Daisy Chain Meter Inverter Slave Weather Slave Man-in. Middle Attacker Master|Slave Sun. Spec Gateway Master

Security Approach #1 ² Examine needs for secure metering using Modbus ² Add-on security block(s) to support needed services Security Header ² Easy to adopt / ignore Common Model ² Modbus max read limit 125 Meter Model § Sequence # / Timestamp § Constrained meter model § Digital Signature Vendor Model Security Trailer End Device Model

Security Approach #2 ² Extend Modbus protocol ² Private vendor functions ² Secure read/write, key management ² Symmetric Key(AES). vs. Public (RSA) § Encryption § Digital Signature ² Key management and length ² Adoption difficulty / compatibility

Issues List ² Number and types of keys ² Key Management ² Factory installed key ² Protection of keys ² Challenge – Response (Nonce) ² Timestamp (RT Clock? ) ² Sequence Id

Meter RTU TCP Local Logger HTTP POST SSL Host Application