基于DLMS/COSEM协议的集中器通信安全防护技术

Communication Security Protective Technology of Concentrator using DLMS/COSEM

针对高级计量架构(Advanced Metering Infrastructure,AMI)系统中集中器通信安全风险,文章从集中器通信报文的机密性、完整性和可用性的安全需求出发,结合国际规约设备语言报文规范/能量计量配套技术规范(Device Language Message Specification/Companion Specification for Energy Metering,DLMS/COSEM)安全机制,对集中器通信安全防护进行详细设计,具体包括用于通信双方进行身份验证的数据访问控制与对数据传输进行加密带认证保护的数据传输安全,并提出嵌入式安全模块(Embedded Secure Access Module,ESAM)、加密机在内的上行、下行数据交互的硬件加密方案。为降低上行、下行通信过程中密钥的破译风险,采用密钥分散机制生成集中器的全局对称密钥并应用椭圆曲线集成加密方案(Elliptic Curve Integrated Encryption Scheme,ECIES)进行密钥更新,增加了系统硬件加密方案的可行性。研究表明,基于DLMS/COSEM协议的集中器通信安全防护技术能够提高AMI的信息安全防护水平,保证数据传输的机密性、完整性和可用性。

Focusing on communication security risks of the concentrator in AMI（advanced metering infrastructure） system, from the confidentiality, integrity and availability of safety requirement of concentrator communicated message, combining with the DLMS/COSEM（Device Language Message Specification/ Companion Specification for Energy Metering）security mechanism, this paper designs a protective communication security scheme of concentrator, including data access control that used in communication authenticate and data transmission protection which is encrypted with certification. This paper proposes an hardware encryption scheme used for uplink and downlink data interaction, which includes embedded ESAM security chip and encryption machine. To reduce the key decipher risks in upward and downward communication process, this paper adopts the key mechanism of dispersion that generates global symmetric key of concentrator, and applies ECIES to update key, thus reinforces the feasibility of the system hardware encryption scheme. The research result shows that protective technology of communication security of concentrator based on DLMS/COSEM can improve the level of the AMI system of information security protection, and ensure the confidentiality, integrity and availability of data transmission.