DLMSUA TPAK1_Intro

1
IEC 62056 DLMS/COSEMworkshopPart 6 Protocols
CBIP Conference on Advanced Metering
Infrastructure 17-19th February 2009, New
Delhi Gyozo Kmethy, DLMS UA, President
2
Contents

• xDLMS the messaging protocol
• Communication profiles
• COSEM Application layer
• 3-layer HDLC based profile
• TCP-UDP/IP based profile
• Data security

3
IEC 62056 DLMS/COSEM
The xDLMS messaging protocolaccesing attributes
and methods of COSEM objects
4
Referencing Logical name / Short name
Read / Write / Unconfirmed Write named variable

• Interoperability negotiation of contexts and
  conformance block (list of services)

5
Common services for all objects
GET
SET
ACTION

• Client-server environment
• Request identifies the (list of) data selective
  access possible
• Response supplies the data with data type
• Requests and responses must be paired in the DCS
• Event notification
• Common service set for all objects
• new interface classes can be easily added

Object
Read
Name
Attribute 1
Write
...
Attribute n
UnconfWrite
Method(s)

• Interoperable and future proof

6
xDLMS service set
New
7
xDLMS conformance block

• Contains the services supported

• Services for SN referencing

• Services for LN referencing

• The conformance block is proposedby the Client.
  ex All SN services 1C0320

• Client and the Server negotiate conformance
  block logical AND between proposed and
  supportedex Read and Write 180000

• The conformance block must not be zero and
  should be meaningful

8
Block transfer (here LN referencing)
Buffer size
COSEM Client AP
COSEM Server AP
Protocol stack
Data
GET.req(NORMAL)
GET.ind(NORMAL)
B1
B1
B2
B3
GET.conf(ONE-BLOCK, B.No 1, B1)
GET.res(ONE-BLOCK, B.No 1, B1)
GET.req(NEXT, B.No1)
GET.ind(NEXT, B.No 1)
B1
B2
GET.conf(ONE-BLOCK, B.No 2, B2)
GET.res(ONE-BLOCK, success, B.No 2, B2)
GET.req(NEXT, B.no2)
GET.ind(NEXT, B.no 2)
B1
B2
B3
GET.res(LAST-BLOCK, success, B.No 3, B3)
GET.conf(LAST-BLOCK, B.No
3, B3)
Data
9
xDLMS LN service types

• A request/response may refer to one element or
  to a list of elements
• The information can be delivered in one block or
  several blocks

10
xDLMS SN service types

• ReadRequest SEQUENCE OF Variable-Access-Specifi
  cation
• ReadResponse SEQUENCE OF CHOICE
• data 0 Data,
• data-access-error 1 IMPLICIT
  Data-Access-Result
• WriteRequest SEQUENCE
• variable-access-specification
  SEQUENCE OF Variable-Access- Specification,
• list-of-data SEQUENCE OF
  Data
• WriteResponse SEQUENCE OF CHOICE
• success 0 IMPLICIT NULL,
• data-access-error 1 IMPLICIT
  Data-Access-Result
• UnconfirmedWriteRequest SEQUENCE
• variable-access-specification
  SEQUENCE OF Variable-Access-
  Specification,
• list-of-data SEQUENCE OF
  Data

References one or more named variables (short
names)
Delivers data or info about the failure
References one or more named variables and sends
data
Reports succes or info about the failure
Same as Write, but without response
11
Event notification
Event
PDU pending
12
Optimization of data access

• GET-WITH-LIST list of attributes delivers a
  list of attribute values

• GET attribute delivers the value of a single
  attribute

• GET attribute_0 delivers all attributes of an
  object

• Objective comply with media specific
  restrictions, minimize overhead and number of
  round trips
• Tools
• Selective access access just to relevant
  portion of the data
• Block transfer allows transporting long APDUs
  in fragments
• also lower layer segmentation may be available
  (e.g. HDLC)
• APDU length can be negotiated

13
Efficient encoding A-XDR

• For example 12345678

k
Wh
Value
Scaler
Unit
14
IEC 62056 DLMS/COSEM
Some examples
15
Reading LDN from 4 meters
Actaris (LN)C001C1000100002A0000FF0200 C401C1000A1
0534C423736314D413336303136383839 SLB761MA36016889

Enermet(LN)C001C1000100002A0000FF0200 C401C1000A10
454D4F30303130303236303032383233 EMO0010026002823
Iskraemeco(LN)C001C1000100002A0000FF0200
C401C100091049534B54333732503030303030303030
ISKT372P00000000
Landis (SN) 050102FD08 0C010009104C475A383531353
73739360000000000 LGZ851577960000
16
Get attributes of L3 voltage object using the
GET service (LN)

• C00181//Get.request normal, invoke_id, priority
• 0003// class_if 3, register
• 0101480700FF//logical name 1.1.72.7.0.255
• 0100//get attribute 1 (logical name) no selective
  access
• C40181//Get.response normal, invoke_id, priority
• 000906//data, octet string(6)
• 0101480700FF//logical name 1.1.72.7.0.255, L3
  voltage inst.
• C00181 0003 0101480700FF 0200//Get attribute 2,
  value
• C40181//
• 000600000905//data double long unsigned,2309D
• C00181 0003 0101480700FF 0300//Get attribute 3,
  scaler_unit
• C40181//
• 000202//data, structure of 2 elements
• 0FFF//integer, FF (-1 in 2s complement)gtgt2309x0,1
  230,9
• 1623//enum 23H35D, Volts

17
...and the same using the Read service (SN)

• Object 1.1.72.7.0.255 is mapped to Base_name C440
• 7EA0119575BEE498E6E600// I frame header
• 0501//Read.request
• 02//CHOICE variable-name
• C440//base name of object 1.1.72.7.0.255 (logical
  name)
• E67C7E//I frame trailer
• 0C01//Read.response
• 00//Data
• 09060101480700FF//Octet string(6), 1.1.72.7.0.255
• 050102 C448//Read base name8, attribute 2
• 0C01000600000937//Read.response,double long
  unsigned, 2359
• 050102 C450//Read base name 16, attribute 3
• 0C010002020FFF1623//Read.response,structure of 2,
  first element is integer FF -1, second element
  is enum 23HVoltsgtgt L3 voltage is 235,9 V

18
IEC 62056 DLMS/COSEM
Data transport
19
Client-server environment
Profile 1
Profile 2
Profile n

20
Data access and transport

• services to access the objects

• and protocols to transport the information

GET
COSEM Application
COSEM Application
SET
COSEM Application
...
...
...
Data link layer
ACTION
Data link layer
Data link layer
Physical layer
Physical layer
Physical layer
Report
COMM. MEDIA
C4010009060101480700FF
Value
Type
Result (success)
Service
21
Communication profiles

• Application layer common in any communication
  profile
• connection between the metering and data
  collection applications
• prepares the messages for transport encoding,
  block transfer
• cryptographic protection

Profile 1
Profile 2
Profile n
Lower layersMedia 1PSTN, GSM
Lower layersMedia 2TCP/IP
Lower layersMedia n
Lower layers ensure that he messages are
correctly delivered
Identification of the profile used by the meter
ensures interoperability (available in 3-layer
HDLC profile)
22
DLMS/COSEM communication profiles
23
The HDLC based profile
Server Application Process
Client Application Process

Primary Station
LD 1
LD 2
Secondary Station
Application layer
Application layer
DL-DATA.req/.ind
DL-CONNECT/ DISCONNECT.req/.cnf
DL-CONNECT/ DISCONNECT.ind/.res
DL-DATA.req/.ind
Data Link Layer
Data Link Layer
LLC
LLC
MA-CONNECT/ DISCONNECT.ind/.res
MA-DATA.req/.ind
MA-DATA.req/.ind/.cnf
MA-CONNECT/ DISCONNECT.req/.cnf/(.ind)
MAC-HDLC
MAC-HDLC
PH-DATA.req/.ind
PH-DATA.req/.ind
PH-ABORT .ind
PH-ABORT .ind
Physical layer
Physical layer
24
HDLC Frame types

• ...and values

• Frame types...
• I ltgt Information,
• RR ltgt Receive Ready,
• RNR ltgt Receive Not Ready,
• SNRM ltgt Set Normal Response Mode,
• DISC ltgt Disconnect,
• UA ltgt Unnumbered Acknowledge,
• DM ltgt Disconnected Mode,
• FRMR ltgt Frame Reject Response,
• UI ltgt Unnumbered Information.

25
HDLC Addressing
Physical Device 2
Physical Device 1
Log Dev B
Log Dev A
Log Dev B
Log Dev A
Upper
Lower

• Client always 1 byte address
• Server 1, 2 (11) or 4 (22) byte address
• Lower HDLC address - Physical device
• Upper HDLC address - Logical device
• Reserved addresses NO_STATION, Mgmt. Logical
  Device, CALLING Phy device, ALL_STATION

LSB
Extension
Example Upper 1234HLower 3FFFH(ALL-STATION)
26
Reserved Client addresses
27
Reserved Server addresses
28
HDLC layer connect SNRM/UA exchange
Flag, 7E
Header and frame length
Source address
Destination address
Control field
Header check sequence
Max info field length transmit
Max info field length receive
Window size, transmit
Window size, receive
Frame check sequence
Flag, 7E
Formatgroup id, group length
7E
H, L
S.A.
D.A.
93
HCS
FCS
7E
Min. 9, max. 39 bytes
7E
H, L
S.A.
D.A.
73
HCS
FCS
7E
Optional information field, optional elements
for parameter negotiation
Header
29
HDLC segmentation
Client Application Process
ServerApplicationProcess
Client AL
ServerDL
Client AL
Client DL
GET.req
DL-DATA.req
I (I 0,0, P 1, S 0)
DL-DATA.ind
GET.ind
GET.res (FIRST_ FRAGMENT)
DL-DATA.req (FIRST_FRAGMENT)
I frames (S 1)
F1
F1
D
RR frame
DL-DATA.ind (FiRST_FRAG OK)
DL-DATA.req (FRAGMENT)
I frames (S 1)
F2
F2
RR frame
DL-DATA.ind (FRAGMENT OK)
DL-DATA.req (LAST-FRAGMENT)
I frames
F3
D
F3
Last I frame S 0
DL-DATA.cnf
GET.cnf
30
The TCP/IP based profile
New interface classes to set up communication
channels
Minor changes to better adapt to TCP/IP
environment
Wrapper layer
Provides logical device addressing and APDU
length
TCP/UDP
Internet standards
IP
Media dependent lower layers Ethernet, PPP...
31
COSEM as a standard internet application

• Port number
• dlms/cosem 4059/TCP
• dlms/cosem 4059/UDP

32
TCP / UDP based transport layers
33
TCP based transport layer services
34
The wrapper frame

• only one TCP/UDP port provided
• logical device / client AP addressing by wrapper
  port numbers
• TCP/UDP is a streaming protocol,
• length byte helps to locate the end of the APDU

35
Association and service types
36
TCP-UDP/IP profile AL protocol changes

• TCP connection can be estabilshed either by the
  server or the client
• Association release ACSE Release.request /
  Release.response services
• Conformed / unconfirmed services
• LN referencing invoke-id-and-priority parameter
  bit 6
• SN referencing Read and Write are confirmed,
  UnconfirmedWrite is unconfirmed

37
TCP/IP, Protocol stack definition

• Each layer setup objects references the setup
  object of the supporting layer

Transport layer
TCP setup
TCP setup
Network layer
IPv4 setup
IPv4 setup
Data link layer
Ethernet setup
PPP setup
Phy layer
Phy layer
38
Negotiable contexts and capabilities

• Application context
• referencing method
• ciphering yes / no

• Authentication context
• peer authentication, LLS / HLS

Protocol stack

• xDLMS context
• conformance block (list of services)
• APDU length

• Layer parameters e.g.
• PDU length
• window size

39
IEC 62056 DLMS/COSEM
Data security
40
Data security key requirements
Access control
Encryption for confidentiality
Authentication to verify the origin and integrity
of messages
Key management
Selective application of these tools
41
DLMS/COSEM security toolbox

• Access control
• role-based access list of objects, access
  rights
• Access security - peer authentication
• client only (LLS) or
• client / server (HLS)
• Security event logs
• Data transfer security

42
Access security

• Authentication identification of the peers
  before data exchange
• Partners are identified by their addresses
  (Service Access Point)
• no security public access, no identification
  takes place
• LLS, Low Level Security Client supplies
  passport, Server verifies
• HLS, High Level Security mutual identification
• exchange challenges
• exchange result of secret processing
• Different Associations may use different
  Authentication contexts
• All Association events may be logged in Event
  logs

43
Application Associations

• Control the access to data
• Modelled by Association LN / Association SN
  objects

• Identify partners

• Provides the list of visible objects, with
  access rights

• Describes the rules and resources for the
  data exchange

• Controls peer authentication

44
Access control
Utility A device
45
Security event logs

• Log each application association establishment
  (successful and failed)
• date_time
• event code
• event data
• Log changes of security management information

46
Data transport security

• Provide cryptographic protection for messages
  during transport
• authentication to ensure integrity and
  authenticity (legitimate source)
• encryption to ensure confidentiality
• authenticated encryption

47
Data transport security tools

• Non-cryptographic Protection against
  unintentional changes
• Parity bits
• Cyclic Redundancy Check (CRC)
• suitable for larger streams of data

• Cryptographic Protection against attacks
• Hash functions (digest)
• integrity
• Symmetric key cryptography
• confidentiality
• authentication
• authenticated encryption
• Asymmetric (public) key cryptography
• (encryption)
• digital signature
• non-repudiation (with TTP)

48
Symmetric / asymmetric key cryptography

• Asymmetric keys
• private / public key pair
• to encrypt data
• to sign data
• to distribute keys
• no unique key needed for each relationship
• computation intensive
• best suited for open multi-user environment

• Symmetric keys
• same key to apply and check/remove protection
• keys must be kept secret
• must be unique key for each relationship and for
  each purpose
• encryption
• authentication
• key wrapping
• not computation intensive
• suitable for single-authority single-user
  environments

49
Confidentiality Encryption and decryption
50
Authenticity origin and integrity
51
Ciphered APDUs
52
Security implementation (1)

• Association objects control acces data
  represented by the objects
• Security setup objects control security policy
  and manage keys

• Association Control Service Element (ACSE)
  controls contexts
• Application context
• LN or SN referencing
• ciphered / unciphered APDUs
• Authentication context
• One way / two way peer authentication (LLS /
  HLS)
• Security context controls ciphering, as defined
  by the security setup object

53
Security
implementation (2)

• xDLMS ASE builds the messages
• Symmetric key algorithm Advanced Encryption
  Standard (AES), 128 bit key, Galois/Counter Mode
  (NIST 800-38D)
• Plain message
• Authenticated message for integrity and/or
• Encrypted message for confidentiality
• AES Key wrapping

54
Security key management
DCS
Concentrator

• Encryption keys
• Global key used in several sessions (AAs)
  unicast - broadcast
• global unicast key encrypts dedicated key
• Dedicated key used in a single session (AA),
  then destroyed
• Authentication key (optional with GCM)
• Global, unicast and broadcast
• Master key pre-established, used only to wrap
  global keys

55
Galois-Counter mode

• NIST 800-38D
• Authenticated encryption with Associated data
• Provides assurance of confidentiality of data
• Provides assurance of authenticity of
  confidential data
• Provides assurance of authenticity of additional
  data

56
Cryptographic protection using AES-128-GCM
57
Summary

• xDLMS messaging services to work with COSEM
  objects
• Client-server approach
• Event Notification
• Communication profiles, to transport xDLMS APDUs
  over various media
• 3-layer HDLC local port, PSTN /GSM
• TCPUDP/IP Internet, GPRS
• S-FSK PLC