DE102012203034A1 - Method for personalizing smart meters and smart meter gateway for measuring consumed e.g. current of household, involves identifying meters and gateway by identifier after inseparable connection of security module to gateway and meters - Google Patents

Abstract

The method involves inseparably connecting a security module (100) e.g. chip card, to a smart meter gateway (138) and smart meters (142, 144). The module is designed as a communication interface of the gateway and the meters with an external computer system (166). A unique identifier (108) e.g. Internet protocol (IP) version 6 address, is stored in the module. The meters and the gateway are identified by the identifier after connection. Partial function disability of the meters, the gateway and/or the module is achieved by removal of the module from the meters and the gateway. Independent claims are also included for the following: (1) a computer program product for performing a method for personalizing smart meters and a smart meter gateway by a security module (2) a security module.

Description

The invention relates to a method for personalizing a smart meter device with a security module, a computer program product, a security module and a smart meter device.

The term "smart metering" is generally understood as the idea of equipping customers with electronic energy consumption recording devices, in order to provide not only simple detection of the amount of energy consumed, for example via a network, to both the customer and the energy supplier.

It is possible that the customer can inform himself in real time about his current energy consumption. The term "energy consumption" is understood to mean the consumption of the customer with regard to any kind of energy that is delivered to households and companies. In addition to the forms of electricity, water and gas, this also includes any other forms of energy such as district heating.

To record the energy consumption, smart metering systems, also called smart meters or "smart meters", are used by the respective consumer. Smart meters are meters of energy consumed. The consumer can be a natural or legal person who consumes various measurable forms of energy such as electricity, gas, water or heat. The goal of using Smart Meters is the implementation of intelligent metering systems, which would, for example, enable the levying of variable compensation depending on total demand and network load. As a result, energy supply networks can be better utilized overall.

From the technical Guideline of BSI TR-03109 It is known to provide a so-called smart meter gateway, also called concentrator, as a central communication unit which can communicate with single or multiple smart meters. The gateway is able to communicate with devices in the so-called "Home Area Network" and with devices in the "Wide Area Network". The Home Area Network includes all smart meters, which are coupled to the gateway, and z. B. private computing units of consumers. The private computing units can, for. B. for information about current, recorded with the smart meters energy consumption values are used. The Wide Area Network is designed to allow communication from gateway and authorized market participants. For example, the gateway can collect the data of all smart meters and provide them to a higher-level collection point, for example an energy supplier or a metering point operator.

The invention has for its object to provide a method for personalizing a smart meter device with a security module, a computer program product, a security module and a smart meter device.

The objects underlying the invention are achieved by the features of the independent claims. Preferred embodiments of the invention are indicated in the dependent claims.

The invention relates to a method for personalizing a smart meter device with a security module, wherein the security module is designed as a communication interface of the device with an external computer system, wherein a unique identifier is stored in the security module, the method comprising inseparably connecting the security module to the device comprises, wherein after connecting the device is identifiable by the unique identifier.

Embodiments of the invention could have the advantage that the personalization process can permanently assign a unique identity to the device. For this it is not necessary, for. B. to provide the device itself in a manufacturing process with an identity. This would be associated with high costs and high technical complexity, in particular with regard to safety requirements to be met during the production process. Because typically the assignment of identities is coupled to a particularly secure production environment, eg. B. a so-called Trust Center. This could be necessary, in particular, when assigning identities to fee-based surveys with respect to the energy consumption values recorded with the smart meter assigned to the device. Due to the irreversible connection of the device with a separately available security module, it is sufficient to produce only the security module in the secure production environment and to provide the identity. The subsequent coupling of security module and device then provides the device with the same identity that was also assigned to the security module. In addition, since the security module serves as a communication interface for external computer systems, it is ensured that a corresponding communication process of z. B. Consumption data to meter operators and / or energy suppliers always the identity-forming component "Security module" includes. In this case, for example, the security module can ensure that transmitted data basically also has the unique identifier "Globally Unique Identifier" (GUID). Thus, a unique identification of the device in any communication networks is always possible.

According to one embodiment of the invention, the inseparable connection of the security module to the device comprises a mechanical connection thereof. Mechanical bonding may include, for example, a soldering operation, a welding operation, or a bonding operation of the security element and device. Also possible is a permanent mechanical locking of the security element in the device. In the simplest case, the security module could be cast in a housing of the device, so that the destruction of the security module and / or the device results due to the "breaking" of this cast connection.

Preferably, the mechanical connection should take place in such a way that a subsequent removal of the security module from the device leads to an at least partial - preferably automatic - functional inability of the device and / or the security module. For example, the mechanical contact between the security element and the device could be designed so that inevitably and automatically also electrical contacts in the device and / or the security module are irreparably interrupted in the subsequent removal of the security module of the device. In the case of a soldering operation, the mechanical contacting between the security element and the device could be designed such that irreparable destruction of electronic components of the device and / or the security module takes place during "desoldering" of the security element due to the heat development taking place. During operation of the device, these electronic components are preferably absolutely necessary in order to ensure the basic functions of the device, including the transmission of smart meter measurement data to metering point operators and / or energy suppliers.

Preferably, the malfunction of the device and / or the security module automatically occurs in the event of subsequent removal of the security module from the device at the latest after restarting the device and / or the security module.

According to one embodiment of the invention, the partial malfunctioning comprises a permanent failure of the communication capability of the device with the external computer system. Thus, if the external computer system is a meter operator and / or utility, it will discover that there is a problem with the device due to lack of communication capability. In this case, the meter operator and / or utility will automatically seek this device, e.g. For example, have a technician on site check the device. Thus, manipulations of the device can be detected reliably and quickly.

According to one embodiment of the invention, the partial inoperability results from a mechanical destruction of the device and / or the security module due to the subsequent removal.

According to one embodiment of the invention, the subsequent removal starts an electronic deactivation process on the device and / or the security module, the partial inoperability resulting from the deactivation process. This deactivation process may be hardware and / or software controlled. For example, a module of the device can make a regular check for the presence of the security module. If it is determined that the security module has been removed, then this module may deactivate the device or individual functions of the device as described above. It is also possible that the module initiates a partial self-destruction of its electrical circuits or elements.

According to one embodiment of the invention, a connection process on the device and / or the security module is started due to the connection of the security module with the device, wherein the inseparable connection of the security module with the device as a result of the linking process comprises a logical connection of the security module with the device. A logical link is understood to be a software-controlled process which uniquely couples the device to the security module. For example, the logical link is via an identifier, which device and security module connects to each other. This may be an identifier which is identical for device and security module. It is also possible that from z. B. a device ID of the device and a module ID of the security module, a new identifier is generated, which uniquely links the device ID and the module ID. Possible here would be a hash process on the device ID and the module ID. The use of an identifier generally has the advantage that embodiments can be realized without great mechanical expense, which results in a high cost savings.

For example, due to the use of an identifier, it can be ensured that the gateway can not subsequently be replaced by another gateway in an unauthorized manner. For example, this could prevent a measuring point operator from providing values from a "hacked" gateway, which is only sporadically connected to corresponding smart meters and thus actually does not carry out any real energy consumption recording at all.

Preferably, for a given security module, the linking process may be performed only once. For this purpose, an internal counter of the security module could be used, so that a multiple - whatever - use of the security module z. B. is prevented in various devices.

According to one embodiment of the invention, the linking process comprises a transmission of the identifier of the security module to the device and subsequently an irreversible storage of the identifier received by the device in the device. For example, the transmission of the identifier takes place automatically at the time of the first startup of the device connected to the security module. This ensures that, on the one hand, the device can be equipped with current security modules at any time prior to commissioning, but is clearly personalized after commissioning.

According to one embodiment of the invention, the identifier of the security module and / or the irreversibly stored identifier can not be changed. A change of the identifier is thus possible only by replacing the security module and device.

According to one embodiment of the invention, after the security module has been connected to the device, a regular automatic check is made as to whether the identifier stored in the security module is still identical to the identifier stored in the device, in the event of a lack of identity sending a message to the external computer system is transmitted and / or an electronic deactivation process on the device and / or the security module is started, wherein a partial inoperability of the device and / or the security module results from the deactivation process. This z. B. deactivation process implemented as software or hardware has already been described above and can be implemented in this embodiment analog.

The regular automatic check can take place at fixed times, at random times or even with predefined events. A predefined event could, for. B. a transmission of recorded with the smart meter consumption data via the security module to a meter operator and / or energy suppliers or generally any read access to the recorded consumption data by external systems. External systems can be the devices in the "Home Area Network" and the "Wide Area Network".

According to one embodiment of the invention, the device is a smart meter or a smart meter gateway associated with the smart meter or multiple smart meters. A gateway is assigned to a smart meter if the smart meter makes its recorded energy consumption values available via the gateway to an energy supplier or metering point operator. However, the gateway may also act only as the central communication interface for one or more connectable smart meters. Whether access to the measurement data captured by the smart meter takes place indirectly via the gateway to the smart meter, or whether the smart meter stores the measurement data in the gateway is insignificant and both possible.

According to one embodiment of the invention, the security module is a chip card.

According to one embodiment of the invention, the identifier is a public key of the security module and / or an IPv6 address of the security module. The latter has the particular advantage that it is also possible at the same time to clearly address the security module and thus the device in the Internet via the identifier. This could be relevant for the automated retrieval of consumption data collected by the smart meters. The use of the public key has the advantage that this automatically ensures a clear and personalized identification of the security module. Since preferably a trust center or a trusted service manager will at the same time allocate trustworthy certificates to the security module, the "official side" ensures that the public key required for this purpose has actually been assigned by this trusted authority. The authenticity of the key is z. B. verifiable via public directory server. The use of forged identifiers is thus excluded verifiable.

It is also possible that the identifier is a certificate of the security module. The certificate could in turn have the public key of the security module. this has First, the advantage that the authenticity of the identifier can be checked by third parties. Furthermore, this has the advantage that in the case of a communication anyway to be transmitted certificate can be used to ensure at the same time a clear identification of the security module. For example, a challenge-response method could be used to communicate measured data acquired with the smart meter, which requires a prior mutual certificate check. This certificate is used anyway, so that the additional explicit and separate transfer of identifiers deleted.

Finally, it is also possible that the identifier itself is included in a certificate of the security module. This also ensures an official verifiability of the authenticity of the identifier by third parties.

Basically, the said certificates can have been created according to a Public Key Infrastructure (PKI) standard, for example according to the X.509 standard , It should be noted that the described certificates can be stored on a public directory server.

In another aspect, the invention relates to a computer program product having instructions executable by a processor for performing the method steps described above.

In another aspect, the invention relates to a security module for use in the method described above.

In another aspect, the invention relates to a smart meter device for receiving a security module as described above.

The security module and the smart meter device have analogous capabilities and functionalities, which were described above with regard to the method.

It should also be noted that, for example, the security module is preferably configured in its delivery state such that only a trustworthy entity is able to perform a communication after successful authentication with the security module. This trusted instance may be that which the security module previously provided with the identifier. This ensures that, in particular, a charge-relevant configuration of the smart metering is only left to a point which is classified as trustworthy both by the authorized market participants, that is, for example, the metering point operators and the actual energy suppliers, as well as the end users. "Charge-relevant configuration" is understood below to mean that this configuration determines with respect to a smart meter, for example, who is entitled to charge the amount of energy detected by the smart meter. Furthermore, it can also be determined which persons, such as end users and authorized market participants, are allowed to have access to the functions and information available with respect to the smart meter to what extent. Since this determination is made on the part of a trusted body, this ensures that abuse of these functions and information by unauthorized third parties is excluded. The information can be z. Smart meter location information, values measured by the smart meter, location information of the storage area, or any values contained in the storage area.

According to one embodiment of the invention, communication over the communication interface of the device with the external computer system is through a secure transmission using end-to-end encryption between the computer system and the security module. This makes it possible to establish the connection between the security module and the computer system over any networks, since, due to the end-to-end encryption, no changes of the data transmitted over the connection can be made by third parties. In general, the invention can be implemented by allowing all communication between the computer system and the security module to be via any type of network. This includes communication over the Internet, communication through wireless network connections such as cellular, as well as communication using a carrier-frequency system. The latter is also known under the name: "Powerline data transmission" and includes devices for data transmission over existing communication or power grids.

In the following, preferred embodiments of the invention are explained in more detail with reference to the drawings. Show it:

1 a block diagram of a system for implementing the method described above,

2 a flow chart of a method for personalization of a smart meter device,

3 a flowchart of a method for checking a personalization of a smart meter device,

4 a block diagram of a smart meter system,

5 a flowchart of a method for initializing a memory area,

6 a flowchart of a method for providing a security module.

Hereinafter, similar elements will be denoted by like reference numerals.

The 1 shows a block diagram of a system for implementing a method for personalization of a smart meter device with a security module. In the following, it is assumed that the smart meter device is a smart meter gateway 138 which acts on smart meters 142 . 144 via the interface 118 is coupled. A security module 100 serves as communication interface of the gateway 138 with an external computer system 166 , Communication takes place via an interface 116 of the security module 100 , For example, the computer system is the system of a meter operator and / or an energy supplier, which with the smart meters 142 . 144 would like to charge collected energy consumption data. The data transfer is z. B. by the software module 120 of the processor 126 of the gateway 138 controlled.

The security module 100 can over the network 600 , z. As a powerline connection or the Internet with the computer system 166 communicate. Likewise, communication is via the interface 116 with the computer system 150 of the 4 possible. This is described in detail below.

In the security module 100 is a unique identifier 108 saved. The security module 100 is z. B. in the form of a smart card or an integrated circuit IC, ASIC or "chip" pre-personalized, ie with identifier 108 and equipped with cryptographic key material not described here. This key material is in 4 described in more detail.

The security module is used according to the in 2 described method steps in step 700 in the gateway 138 used. The gateway provides a corresponding with contacts for this purpose 604 provided receptacle for the security module 100 ready. About the contacts 604 can the processor 126 of the gateway 138 by means of the interface 118 communicate with the security module via its non-illustrated counterpart contacts.

After inserting the security module 100 in step 700 is preferably done in step 702 a mechanical locking of the security module in the gateway 138 , As a result, it is no longer possible without destroying the contacts 604 the security module later from the gateway 138 to remove. This is automatically the identifier 108 of the security module to the gateway 138 assigned.

The steps 704 and 706 are optional and could be used instead of or in addition to the mechanical locking process. In step 704 the commissioning of the gateway takes place 138 , which automatically in step 706 a copy of the identifier 108 from the security module to a storage area 136 of the gateway 138 is initiated. The copy process becomes a copy 128 the identifier 108 in the store 136 stored. The copying process can be done, for example, via program instructions 602 when commissioning for the first time, ie initiating the gateway 138 to be controlled.

This results in an inseparable connection of the security module by the steps described 100 with the gateway 138 , wherein after connecting the gateway by the unique identifier 128 is identifiable.

The 3 shows a flowchart of a method for checking a personalization of a smart meter device, in this case the gateway 138 out 1 , For example, the module 120 at each data transfer process of energy consumption data to the computer 166 over the interfaces 118 and 116 in step 800 Make a check to see if the identifiers 128 and 108 are identical or if at all an identifier 108 is available. Would that be the security module 100 be replaced by another security module, the identifiers 128 and 108 no longer match. Because the identifier 128 preferably irreversible in the memory 136 is stored, can not easily by the replacement of the security module, the identifier 128 be replaced by another.

Checking for the presence of an identifier is required if only an inseparable mechanical connection between the security module and the gateway 138 consists. If the security module were to be removed, deactivating that function to query the identifier from the gateway could ensure that the gateway 138 no longer receives any information about any identifiers. This then corresponds to the state of non-existence of an identifier.

Will in step 802 If the identifiers are found to be identical, the process returns to step 800 and is quasi in a loop again, possibly time-triggered, carried out.

Will, however, in step 802 found that the identifier 108 either missing or no identity between the identifiers 108 and 128 can pass the steps 804 - 808 be performed. step 804 This includes the notification of the probable presence of a manipulation or malfunction to an external computer system, eg. For example, the system 166 in 1 , step 806 includes the partial deactivation of the functions of the gateway, so that in particular an energy supplier or meter operator independently the manipulation due to z. B. erroneous transmitted data or even the absence of data transmission can determine.

step 808 is also optional and involves outputting a local signal at the gateway so that a user is visually or acoustically able to detect a partial inoperability that has occurred. One to the gateway 138 Connected local computer of the end user could also by means of the signal in step 808 be informed about this.

The 4 shows the block diagram of 1 in detailed form. Together with the in 5 The method steps shown below will be shown below without limiting the generality, such as a memory area 136 a gateway 138 , which is a variety of smart meters 142 . 144 . 146 . 148 is assigned, can be initialized. This initialization process, in conjunction with the personalization described above, serves to provide end users and utilities with a convenient way of communicating energy usage data in a secure manner. Through the described initialization process, a possibility can be provided in a secure, unambiguous and comprehensible manner which enables secure communication between the smart meters and an authorized market participant such as an energy supplier or a metering point operator. Preferably, this is the described computer system 150 a trusted instance computer system, also referred to as a trusted service manager or TSM.

The smart meter 142 - 148 serve to record various energy consumption values with respect to, for example, gas (smart meters 142 ), Water (smart meter 144 ), Electricity (smart meter 146 ) and other unspecified energy forms (smart meter 148 ). The smart meters are via appropriate communication links 192 with the interface 118 of the gateway 138 connected.

It was now assumed that the security module 100 already fixed and inseparable from the gateway 138 connected, so in total by the combination of the gateway 138 and the security module 100 an inseparable unit 140 given is. The gateway 138 and the security module 100 communicate via respective interfaces 118 respectively. 116 together. About the interface 116 Furthermore, communication takes place with authorized market participants and third persons or entities, which are not within the scope of the entity 140 and the smart meters 142 - 148 formed network are located. The communication between interface 116 of the security module 100 and further communication participants takes place via a communication connection 190 , This may be, for example, a power line connection or a communication connection via a mobile telecommunications network or the Internet.

The security module 100 has an electronic memory 102 with protected storage area 106 and 108 , The protected memory area 106 is used to store a private key of the security module 100 and the storage area 108 is used to store the identifier of the security module "GUID" (Globally Unique Identifier). For example, the GUID may be an IPv6 address of the security module 100 act.

The electronic memory 102 may further include a memory area 104 to store a certificate. The certificate includes a public key similar to the one in the protected space 106 stored private key is assigned. The certificate may have been created according to a Public Key Infrastructure (PKI) standard, for example, the X.509 standard ,

The certificate does not necessarily have to be with the electronic memory 102 of the security module 100 be saved. Alternatively or additionally, the certificate can also be stored in a public directory server.

The security module 100 has a processor 110 for executing program instructions 112 and 114 , By executing the program instructions 112 For example, "cryptographic protocol" is an authentication of a trusted entity 150 or an energy supplier 166 opposite the security module 100 allows. The cryptographic protocol may, for example, be a challenge-response protocol based on a symmetric key or an asymmetric key pair.

It is also possible, of course, mutual authentication of security module and trusted entity or energy supplier.

The program instructions 114 serve for end-to-end encryption of between the security module 100 and the trusted instance 150 or the energy supplier 166 data to be transferred. For the end-to-end encryption, a symmetric key can be used, for example, when the cryptographic protocol is executed between the security module 100 and the other participants 150 respectively. 166 is agreed.

Similar to the security module 100 also assigns the trusted instance 150 the electronic memory already described 152 and a protected storage area 156 to store a private key of the trusted instance. In the store 152 can also have a certificate 154 be included in the trusted instance. However, this certificate can also be stored on a central certificate server.

A processor 158 the trusted instance 150 again indicates the above with regard to the security module 100 described program instructions 112 and 114 to implement a cryptographic protocol and to perform end-to-end encryption. The cryptographic protocol and the end-to-end encryption can be used for communication via the interface 164 with the energy provider 166 or with the security module 100 be used. The certificate 154 in turn, contains a public key similar to the one in the protected storage area 156 stored private key is assigned.

At the "energy supplier" 166 it is a computer system of the energy supplier, which in turn has an electronic memory 168 and a processor 178 having. Furthermore, this computer system is an interface 186 assigned via which a communication with the trusted entity 150 or the security module is enabled.

The electronic memory 168 of the energy supplier 166 indicates a protected storage area 172 with a private key, where the private key is associated with a public key, which is in a certificate 170 also in electronic memory 168 is included. Further, in memory 168 a memory area for one or more applications provided, these applications, for example, a fee-relevant configuration of the gateway 138 enable. Also in electronic memory 168 can measure data 176 stored previously by the gateway 138 were received.

The processor 178 has program instructions 180 to capture the through the gateway 138 optionally supplied for consumption billing in dependence on the determined measurement data (program instructions 182 ) on. The program instructions for performing steps of a cryptographic protocol 112 Program instructions (not shown) for carrying out an end-to-end encryption may also be provided, whereby these program instructions provide secure communication with the trustworthy entity 150 or the security module 100 is possible.

Should now a new customer to the energy supplier 166 For example, after a first installation of the smart meter could be assigned 142 - 148 and the deployment of Gateway 138 with security module 102 an initialization process of the security module take place. This initialization process could be triggered by the fact that the new customer (an end user) or a specific technical entity who had installed the smart meter, the power utility 166 to report accordingly. This message should preferably be the GUID 108 of the security module 100 include, as a result, a clear identification of the security module 100 opposite the utility 166 is possible.

After the energy provider 166 this message about his interface 186 , For example, has received a web page of a corresponding website, builds the energy supplier 166 a communication channel to the trusted entity 150 on. This step is in 5 with reference number 200 designated. In this case, the trustworthy entity can be, for example, a so-called "Trusted Service Manager TSM", ie an officially certified entity which certifies the respective identity of the communication partner in electronic communication processes.

After establishing the communication channel in step 200 an authentication of the energy supplier takes place 166 in step 202 , This is the certificate 170 of the utility by the trusted authority 150 checked. For example, the trusted instance 150 if the certificate is valid, carry out a challenge-response procedure in which a random number is generated, which is one in the certificate 170 included public key of the utility company 166 is encrypted and sent to the utility company 166 is transmitted. The energy provider 166 can then with his private key 172 decode the random number and send it back in plain text. That's right from the trustworthy instance 150 received random number with the random number described above, is the authenticity of the utility 166 actually secured.

After completion of the step 202 and the optional challenge-response method may then in step 204 a channel with end-to-end encryption over the communication link 188 between energy supply 166 and the trusted instance 150 being constructed. Here are the program instructions 114 of the processor 158 the trusted instance are used.

After building the channel in step 204 receives the trusted instance 150 in step 206 a request to upload an energy collection application 174 of the energy supplier 166 and the memory 136 of the gateway 138 , To the memory 136 or the gateway 138 to uniquely specify is with the request to initialize the memory 136 also the GUID 128 of the gateway 138 which in the store 136 is sent to the trusted entity. Preferably, the GUID 128 of the memory 136 identical to the GUID 108 of the memory 102 of the security module 100 ,

Receiving the GUID in step 206 is the trustworthy instance 150 able to clearly identify the desired gateway 138 for recording the application 174 to address. For this builds in a next step 208 the trusted instance 150 over the communication connection 190 a communication channel to the security module 100 on. The trusted instance 150 authenticates to the security module 100 , wherein the authentication and a verification of the certificate 154 by the security module, for example, again a challenge-response procedure by the security module 100 includes. This could be the security module 100 generate a random number again with the public key of the trusted instance 150 encrypt and send to the trusted instance 150 send. The trusted instance 150 would encrypt the random number with her private key 156 decrypt and the decrypted random number in plain text back to the security module 100 send. If the security module determines that the thus-received decrypted random number matches the originally encrypted random number, authentication of the trustworthy entity is given.

The process then sets in step 212 that is, establishing a communication channel with end-to-end encryption between the trusted entity 150 and the security module 100 , This in turn can be done by using the program instructions 114 of the processor 110 of the security module 100 respectively.

In step 214 receives the security module 100 the energy detection application 174 from the trusted instance.

It should be noted here that it may be advantageous, for example, for the trusted entity to stock the most frequently sent energy-sensing applications in a trusted instance's local store so that it is not necessary to continually open the applications as new customers are opened up 174 from the utility company 166 to the trusted instance 150 transferred to.

Upon receipt of the energy collection application in step 214 saves the security module 100 the application in the store 136 of the gateway 138 , Is it the application 174 For example, for an application to capture power consumption in terms of water and power, the application will be considered as the application 132 In the storage room 136 stored. This application is capable of energy consumption data from the smart meter 144 to process. Analogous to this, the memory 136 corresponding applications for the energy capture of gas ( 134 ) as well as other applications 130 for the capture of other forms of energy. Storing the energy collection application by the security module 100 in the gateway 138 is in 2 through the step 216 characterized.

In addition to receiving the energy detection application in step 214 through the security module 100 It is also possible that from the trusted instance 150 Power provider-specific entitlements or precise specifications of network data elements are received, which are also in another area 125 of the memory 136 be filed. These authorizations or specifications of measured data elements make it possible to determine in advance which information the energy supplier has 166 from the gateway 138 may receive at all. For this it is possible, for example, that in advance by the trusted entity 150 for each energy supplier specific permissions are defined which are global for all utilities 166 apply and which in principle with the transmission of energy detection applications the security module and thus the gateway 138 be transmitted.

It is also possible that configuration data from the trusted instance 150 to be obtained. This configuration data may relate to the technical configuration of the smart meter and / or the gateway.

By means of the program instructions for data acquisition 122 of the processor 126 is now the gateway 138 capable of measuring data relating to energy consumption, for example, from the smart meter 144 and the smart meter 146 capture. The corresponding measurement data are in the memory area 124 of the memory 136 stored. Basically, the measurement data exists 124 from various measurement data elements, which may include, for example: time of acquisition of the measurement data, individual measurement data points at the respective time, information on the occurrence of the measurement data (for example, current, voltage, water pressure, water temperature, gas pressure). The measured data 124 can about the applications 130 . 132 and 134 be subjected to a further evaluation, resulting in evaluated measurement data, which also as "measured data elements" in the memory area 124 can be stored. For example, the evaluated measurement data may be accumulated energy consumption values.

The permissions described above 125 or the specifications of the measured data elements make it possible to determine from the outset which of these measured data elements 124 the energy provider 126 may call at all. Furthermore, this makes it possible to determine in advance how much such retrieval is permitted. Such a detailed and timely retrieval of the measured data 124 This could be undesirable, since knowledge of the use of electronic devices gain by short time intervals of measurements and thus user profiles can be created, to which an end customer may not be interested.

As mentioned above, the security module 100 and the gateway 138 inseparable. For example, these form a structural unit 140 like this in 1 is shown schematically. To this unit 140 that could be generated in the flowchart of FIG 4 simplified again explained method steps are performed.

In step 400 first becomes the security module 100 provided. This is done in step 402 storing key material and certificates in the security module. For example, for this purpose, the security module could have a corresponding cryptographic unit, by means of which independently the private key 106 is produced. Alternatively, it is also possible for the trustworthy entity to generate the private key and store it in the security module in a storage area that is not accessible from the outside. The public key belonging to the private key is attached to the certificate, which is then signed by the trusted entity and in the memory 102 of the security module is stored.

The security module will then step in 404 used in the gateway, for example in the form of a smart card and it is made an inseparable connection of security module and gateway. For example, security module and gateway could be electronically coupled to each other such that removal of the security module from the gateway would result in automatic destruction of the security module.

After inserting the security module in the gateway 404 done in step 406 an automatic logical link of security module 100 and gateway 138 , For example, this could be done by using the GUID 108 of the security module irreversibly in the memory 136 of the gateway 138 as a GUID 128 is written. This should be done on the part of, for example, the security module 100 Be sure to communicate with the gateway 138 for the provision of measured data elements and via the energy supplier 166 only takes place if an identity of the GUID 108 and 128 given is.

LIST OF REFERENCE NUMBERS

100

security module

102

Storage

104

certificate

106

private key

108

GUID

110

processor

112

cryptographic protocol

114

End-to-end encryption

116

interface

118

interface

120

data transmission

122

data collection

124

measurement data

125

authorization

126

processor

128

GUID

130

application

132

application

134

application

136

Storage

138

Storage

140

unit

142

Smart meter

144

Smart meter

146

Smart meter

148

Smart meter

150

trusted instance

152

Storage

154

certificate

156

private key

158

processor

164

interface

166

utilities

168

Storage

170

certificate

172

private key

174

application

176

measurement data

178

processor

180

data collection

182

consumption billing

186

interface

188

communication link

190

communication link

192

communication link

600

network

602

module

604

connections

QUOTES INCLUDE IN THE DESCRIPTION

This list of the documents listed by the applicant has been generated automatically and is included solely for the better information of the reader. The list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions.

Cited non-patent literature

• Guideline of BSI TR-03109 [0005]
• X.509 standard [0028]
• X.509 standard [0059]

Claims (17)

Method for personalizing a smart meter device ( 138 ; 142 ; 144 ; 146 ; 148 ) with a security module, whereby the security module ( 100 ) as the communication interface of the device ( 138 ; 142 ; 144 ; 146 ; 148 ) with an external computer system ( 166 ; 150 ), wherein in the security module ( 100 ) a unique identifier ( 108 ), the method being an inseparable connection of the security module ( 100 ) with the device ( 138 ; 142 ; 144 ; 146 ; 148 ), after connecting the device ( 138 ; 142 ; 144 ; 146 ; 148 ) by the unique identifier ( 108 ) is identifiable. Method according to claim 1, wherein the inseparable connection of the security module ( 100 ) with the device ( 138 ; 142 ; 144 ; 146 ; 148 ) comprises a mechanical connection. The method of claim 2, wherein the mechanical connection is such that a subsequent removal of the security module ( 100 ) of the device ( 138 ; 142 ; 144 ; 146 ; 148 ) to an at least partial inability of the device ( 138 ; 142 ; 144 ; 146 ; 148 ) and / or the security module ( 100 ) leads. The method of claim 3, wherein the partial malfunctioning is a permanent failure of the communication capability of the device ( 138 ; 142 ; 144 ; 146 ; 148 ) with the external computer system ( 166 ; 150 ). Method according to one of the preceding claims 3-4, wherein the partial inability to function is due to a mechanical destruction of the device ( 138 ; 142 ; 144 ; 146 ; 148 ) and / or the security module ( 100 ) results due to the subsequent removal. Method according to one of the preceding claims 3-5, wherein the subsequent removal of an electronic deactivation process on the device ( 138 ; 142 ; 144 ; 146 ; 148 ) and / or the security module ( 100 ), the partial inability resulting from the deactivation process. Method according to one of the preceding claims, wherein due to the connection of the security module ( 100 ) with the device ( 138 ; 142 ; 144 ; 146 ; 148 ) a linking process on the device ( 138 ; 142 ; 144 ; 146 ; 148 ) and / or the security module ( 100 ), whereby the inseparable connection of the security module ( 100 ) with the device ( 138 ; 142 ; 144 ; 146 ; 148 ) as a result of the linking process a logical link of the security module ( 100 ) with the device ( 138 ; 142 ; 144 ; 146 ; 148 ). The method of claim 7, wherein the linking process comprises: - transmitting the identifier ( 108 ) of the security module ( 100 ) to the device ( 138 ; 142 ; 144 ; 146 ; 148 ), - Irreversible storage by the device ( 138 ; 142 ; 144 ; 146 ; 148 ) received identifier ( 108 ) in the device ( 138 ; 142 ; 144 ; 146 ; 148 ). Method according to claim 8, wherein the transmission of the identifier ( 108 ) at the time of the first commissioning of the security module ( 100 ) connected device ( 138 ; 142 ; 144 ; 146 ; 148 ) automatically. Method according to one of the preceding claims 7-9, wherein the identifier ( 108 ) of the security module ( 100 ) and / or the irreversibly stored identifier ( 128 ) subsequently can not be changed. Method according to one of the preceding claims 7-10, wherein after connecting the security module ( 100 ) with the device ( 138 ; 142 ; 144 ; 146 ; 148 ) a regular check is made, whether the security module ( 100 ) stored identifier ( 108 ) with the in the device ( 138 ; 142 ; 144 ; 146 ; 148 ) stored identifier ( 108 ) is identical, whereby in the case of a lack of identity, a message to the external computer system ( 166 ; 150 ) and / or an electronic deactivation process on the device ( 138 ; 142 ; 144 ; 146 ; 148 ) and / or the security module ( 100 ) is started, whereby a partial inability of the device ( 138 ; 142 ; 144 ; 146 ; 148 ) and / or the security module ( 100 ) results from the deactivation process. Method according to one of the preceding claims, wherein the device is a smart meter ( 142 ; 144 ; 146 ; 148 ) or a smart meter gateway ( 138 ). Method according to one of the preceding claims, wherein the security module ( 100 ) is a chip card. Method according to one of the preceding claims, wherein the identifier ( 108 ) to a public key of the security module ( 100 ) and / or an IPv6 address of the security module ( 100 ). Computer program product with instructions executable by a processor for carrying out the method steps according to one of the preceding claims. Security module ( 100 ) for use in a method according to any one of the preceding claims 1-14. Smart meter device ( 138 ; 142 ; 144 ; 146 ; 148 ) for receiving a security module ( 100 ) according to claim 16.

Images