Uma análise da segurança do padrão IEEE 2030.5

Abstract

The fast evolution and dissemination of the Internet of Things (IoT) and of Distributed Energy Resources (DER) are bringing to the market several smart electrical devices, both in the residential and industrial spheres, mainly meters and inverters. As a result, there is also a need for standardization in order to promote interoperability, security and efficient communication between different types and manufacturers of devices. In this context, the IEEE 2030.5-2018 standard emerges, which aims to meet these demands as well as the growing demand from electricity utilities and consumers to manage electricity production and consumption more efficiently. The IEEE 2030.5-2018 standard defines an application layer on top of a TCP/IP stack to allow management of the user’s electrical environment. In addition, it also defines the mechanisms to be used for the exchange of messages and the security features to protect such messages. Among the security features, the standard’s public key infrastructure stands out by working with certificates that do not expire and cannot be revoked. Since security is a fundamental requirement for the management of devices and for the traffic of sensitive data, this work aims to perform an analysis of this aspect of the IEEE 2030.5-2018, highlighting potential security gaps — in particular, due to the lack of support for the revocation and expiration of digital certificates from the public key infrastructure itself. A proof of concept is also carried out where possible attacks are demonstrated in practice exploiting such a security gap. In addition, this work also describes the standard providing an overview presenting aspects related to architecture, topology and how devices communicate.