Security analysis of Dutch smart metering systems - Multiple Choices

4.6 Port P5 4 PRACTICAL ANALYSIS
• Authorisation The P4 port should tightly control access to data and to smart meter control.
No supplier should be able to read information from other supplier’s customers, nor should
they be able to control other customers smart meters.
• Access The P4 port should only be accessible by suppliers and metering companies. No
access should be possible from the public Internet. Because of the small market and parties
in the energy market access should be controlled using a private network.
• Logging Because of the customers privacy and the impact of security breaches all access
and actions should be logged.
4.6 Port P5
Port P5 is the port we defined as the supplier’s website which enables customers to get access to
their usage data, or possibly upgrade their prepaid credit.
4.6.1 Implementation
At this moment only two suppliers offer access to usage data obtained from smart meters through
their website. Other suppliers do offer a personal website for their customers where they, among
others, can enter manual yearly meter readings, view their bills and, and view or change personal
information. It would be likely that the smart meter readouts will be made available on these
websites in the future. The websites which we analysed can be seen in table 14.
4.6.2 Practical research
Websites with metering data:
Websites without metering data:
Table 14: Suppliers websites
• Oxxio [54]
• Delta [10]
• Nuon [53]
• Essent [23]
• Eneco [18]
Web applications are a common victim of cyber crime and is an area in which a lot of research has
been done [65]. When a web application is compromised an attacker may be able to steal private
and personal information, carry out fraud, and perform malicious actions against other users.
A few common seen techniques to compromise a web application are:
• Broken authentication
• Broken access controls
• Cross-site scripting
• SQL injection
• Information leakage
Because of the information already available on web application security an in depth analysis or
penetration testing of the websites is out of the scope of this project. We made a general analysis
of the websites and how they could be compromised. Based on the theoretical analysis we looked
at the privacy and access aspects of the website:
42