security profile for openadr - Open Smart Grid - OpenSG - UCA ...

Table of Contents
INTRODUCTION....................................................................................................................................................10
1.1 SCOPE ........................................................................................................................................................ 11
1.1.1 Explicit Exclusions................................................................................................................................ 12
1.2 APPROACH .................................................................................................................................................. 12
1.3 AUDIENCE & RECOMMENDED USE................................................................................................................... 14
1.3.1 Electric Utility and Demand Response Aggregators............................................................................ 15
1.3.2 OpenADR Vendors ............................................................................................................................... 15
2 FUNCTIONAL ANALYSIS...............................................................................................................................16
2.1 LOGICAL ARCHITECTURE................................................................................................................................. 17
2.2 ROLE DEFINITIONS ........................................................................................................................................ 19
2.2.1 Demand Response (DR) Controlling Entity .......................................................................................... 19
2.2.2 Demand Response (DR) Resource........................................................................................................ 20
2.2.3 Demand Response (DR) Asset ............................................................................................................. 20
2.3 ROLE MAPPINGS........................................................................................................................................... 21
2.4 USE CASES................................................................................................................................................... 21
Use Case 1: Demand Response Resource Registers with a Demand Response Controlling Entity..................... 24
Use Case 2: DR Controlling Entity Notifies DR Resource of DR Event (Point-to-point Push).............................. 26
Use Case 3: DR Controlling Entity Notifies DR Resource of DR Event – (Broadcast).......................................... 28
Use Case 4: DR Resource Requests New DR Event from DR Controlling Entity (Point-to-point Pull)................. 30
Use Case 5: DR Resource Requests New DR Event from DR Controlling Entity (Anonymous Pull)..................... 32
Use Case 6: DR Controlling Entity Schedules DR Resource for Periodic Feedback (Point-to-point Push)........... 34
Use Case 7: DR Resource Notifies DR Controlling Entity of Event Performance with Feedback by Request
(Point-to-point Pull) ........................................................................................................................................... 36
Use Case 8: DR Resource Notifies DR Controlling Entity of Event Performance with Feedback Self-Scheduled
(Point-to-point Push) ......................................................................................................................................... 38
3 FAILURE ANALYSIS ......................................................................................................................................40
3.1 FAILURE ANALYSIS PROCESS............................................................................................................................ 40
3.2 SECURITY AND OPERATIONAL OBJECTIVES.......................................................................................................... 41
3.2.1 Contextual Assumptions...................................................................................................................... 42
3.2.2 Security Principles................................................................................................................................ 43
3.3 FAILURES..................................................................................................................................................... 45
4 SECURITY CONTROLS...................................................................................................................................50
4.1 SCOPE OF SECURITY CONTROLS........................................................................................................................ 50
4.2 CONTROL DEFINITIONS................................................................................................................................... 51
4.2.1 Access Control ..................................................................................................................................... 53
4.2.2 Audit and Accountability..................................................................................................................... 54
4.2.3 Configuration Management................................................................................................................ 55
4.2.4 Continuity of Operation....................................................................................................................... 56
4.2.5 Identification & Authentication........................................................................................................... 57
4.2.6 Physical & Environment Security......................................................................................................... 58
4.2.7 System & Communications Protection ................................................................................................ 58
4.2.8 System & Information Integrity........................................................................................................... 60
SECURITY PROFILE FOR OPENADR
Version – 0.02
UCA International Users Group December 15, 2011
iv