jaseg/master-thesis
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ma: finish intro draft

Browse source
This commit is contained in:
jaseg 2020-05-15 20:54:09 +02:00
parent 9cc84c766c
commit a2ac379013
1 changed files with 41 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

49
ma/safety_reset.tex
View file

@ -115,7 +115,7 @@ unpredictable way of the forces of nature.
Along with this change in dynamic behavior renewable energies have brought forth the advance of distributed generation.
In distributed generation end-customers that previously only consumed energy have started to feed energy into the grid
from small solar installations on their property. Distributed generation is a chance for customers to gain autonomy and
shift from a purely passive role to being active participants of the electricity market.
shift from a purely passive role to being active participants of the electricity market\cite{crastan03}.
To match this new landscape of decentralized generation and unpredictable renewable resources the utility industry has
had to adapt itself in major ways. One aspect of this adaption that is particularly visible to ordinary people is the
@ -124,11 +124,44 @@ electrical grid and the far-reaching diffusion of computers into people's everyd
one of the last remnants of an offline, analog time. Until the 2010s many of the world's households were still served
through electromechanical Ferraris-style meters that have their origin in the late 19th century. % FIXME citation.
Today, under the terms \emph{Smart Grid} and \emph{Smart metering} the shift towards fully computerized, often networked
meters has been largely accomplished.
% FIXME continue here.
Today under the umbrella term \emph{Smart Grid} the shift towards fully computerized, often networked meters has been
partially accomplished. The roll out of these \emph{Smart Meters} has not been very smooth overall with some countries
severely lagging behind other countries. As a safety-critical technology smart meter technology is usually standardized
on a per-country basis. This leads to an inhomogenous landscape with in some instances wildly incompatible systems.
Often vendors only serve a single country or have a separate model of their meter for each country. This complex
standardization landscape and market situation has led to a proliferation of highly complex, custom-coded
microcontroller firwmare. The complexity and scale of this often network-connected firmware makes for a ripe substrate
for bugs to surface.
\cite{crastan03}
A remotely exploitable flaw inside a smart meter's firmware\footnote{
There are several smart metering architectures that ascribe different roles to the component called \emph{smart
meter}. Coarsely divided into two camps these are systems where all metering and communication code resides within
one physical unit and systems where metering and communication are separated into two units, the \emph{smart meter}
and the \emph{smart meter gateway}. An example for the former are setups in the USA, an example of the latter is the
one in Germany. For clarity in this introductory chapter we use \emph{smart meter} to describe the entire system at
the customer premises including both the meter and a potential gateway.
} could have consequences ranging from impaired billing
functionality to an existential threat to grid stability. A coördinated attack on meters in a country where load
switches are common could at worst cause widespread activation of grid safety systems by repeatedly connecting and
disconnecting megawatts of load capacity in just the wrong moments.
Mitigation of these attacks through firmware security measures is unlikely to yield satisfactory results. The enormous
complexity of smart meter firmware makes firmware security extremely labor-intensive. The diverse standardization
landscape makes a coördinated, comprehensive response unlikely.
In this thesis instead of lamenting the state of firmware security we introduce a pragmatic solution to the in our minds
likely scenario of a large-scale compromise of smart meter firmware. In our proposal the components of the smart meter
that are threatened by remote compromise are equipped with a physically separate \emph{safety reset controller} that
listens for a reset command transmitted through the electrical grid itself and on reception forcibly resets the smart
meter's entire firmware to a known-good state. Our safety reset controller receives commands through Direct Sequence
Spread Spectrum (DSSS) modulation carried out on grid frequency through a large controllable load such as an aluminium
smelter. After forward error correction and cryptographic verification it re-flashes the target application
microcontroller over the standard JTAG interface.
In this thesis starting from a high-level architecture we have carried out extensive simulations of our proposal's
performance under real-world conditions. Based on these simulations we implemented an end-to-end prototype of our
proposed safety reset controller as part of a realistic smart meter demonstrator. Finally we experimentally validate our
results and give an outline of further steps towards practical implementation.
\section{Structure and operation of the electrical grid}
@ -1707,7 +1740,7 @@ data. Re-using segements of this data as background noise in multiple simulation
simulation results depending on individual features of this particular capture that would be common between all runs. To
estimate the impact of this problem we re-ran some of our simulations with artificial random noise synthesized with a
power spectral density matching that of our capture. To do this, we first measured our capture's PSD, then fitted a
low-resolution spline to the PSD curve in log-log coordinates. We then generated white noise, multiplied the resampled
low-resolution spline to the PSD curve in log-log coördinates. We then generated white noise, multiplied the resampled
spline with the DFT of the synthetic noise and performed an iDFT on the result. The resulting time-domain signal is our
synthetic grid frequency data. Figure \ref{freq_meas_spectrum} shows the PSD of our measured grid frequency signal. The
red line indicates the low-resolution log-log spline interpolation used for shaping our artificial noise. Figure
@ -2199,7 +2232,7 @@ over long periods of time at cost of a slight increase in system complexity.
The description of a safety reset system provided in this work could be translated into a formalized technical standard
with relatively low effort. Our system is very simple compared to e.g. a full smart meter communication standard and
thus can conceivably be described in a single, concise document. The much more complicated side of standardization would
be the standardization of the backend operation including key management, coordination and command authorization.
be the standardization of the backend operation including key management, coördination and command authorization.
\section{Regulatory adoption}
@ -2254,7 +2287,7 @@ TrustZone is a virtualization technology that provides a hardware-assisted privi
of the microcontrollers cores. In traditional virtualization setups a privileged hypervisor is managing several
unprivileged applications sharing resources between them. Separation between applications in this setup is longitudinal
between adjacent virtual machines. Two applications would both be running in unprivileged mode sharing the same cpu and
the hypervisor would merely schedule them, configure hardware resource access and coordinate communication. This
the hypervisor would merely schedule them, configure hardware resource access and coördinate communication. This
longitudinal virtualization simplifies application development since from the application's perspective the virtual
machine looks very similar to a physical one. In addition, in general this setup reciprocally isolates two applications
with neither one being able to gain control over the other.