Security analysis of Dutch smart metering systems - Multiple Choices

4.4 Port P3 4 PRACTICAL ANALYSIS
mobile device registers itself at base station with at least an Access Point Name (APN) and its
GPRS authentication credentials to get access to the GPRS network. An APN is a hostname
which is associated with the GPRS connection and resolves to the Gateway GPRS Support Node
(GGSN) that provides the connectivity between GPRS core network and the telecom operators
or corporate router. This connectivity is often, but not necessarily, realized by means of a GRE
tunnel between the GGSN and corporate router [34]. A schematic overview of a GPRS smart
metering system is shown in figure 15.
GPRS
E G W
Electricity
Gas
Water
CAS
RADIUS server
GPRS
E G W
Tunnel
GSM
antenna
GGSN
GPRS
E G W
GPRS
Figure 15: GPRS smart metering implementation
E G W
The GSM security model is considered as broken, because of weaknesses found in the A5 stream
encryption algorithms that GSM utilizes [57]. The GPRS system uses a new implementation of the
A5 stream encryption which should improve the security of the network. Currently, decryption
of wireless GPRS signals is not feasible, but could be in the future when details of the new
A5 algorithm becomes publicly available [5]. Therefore it is important that besides the GPRS
encryption, additional end-to-end encryption between the meter and back-end system is realized.
Some grid operators use the telecom provider’s APN for their smart metering systems to connect
to, which gives the meter an IP address that could be accessible from the public Internet. Other
operators have their own private APN and RADIUS server which gives the meter an internal IP
address from the grid operator.
Smart metering systems usually connect only once a day for a small period of time to communicate
with the CAS and function only as a client, which makes direct attacks from the public Internet
to a smart GPRS meter unlikely.
Attacks on the P3 back-end systems could be possible when someone tries to log in to the grid
operator’s private APN using a smart meter’s credentials. Therefore it is important that every
meter uses unique and strong credentials to log into the APN. This risk is even bigger when the
grid operator uses the APN of the telecom provider which is accessible to all customers of the
32