Transcript PPT - Illinois Security Lab

Low Cost and Secure Smart
Meter Communications using
the TV White Spaces
Omid Fatemieh (UIUC)
Ranveer Chandra (Microsoft Research)
Carl A. Gunter (UIUC)
Advanced Meter Infrastructure (AMI)
• AMI: integral part of smart grid
• Reconfigurable nature and communication capabilities
of advanced (smart) meters allow for deploying a rich
set of applications
–
–
–
–
–
Automated meter reading
Outage management
Demand response
Electricity theft detection
Support for distributed power generation
2
Existing AMI Communications
• ISM bands
– Crowded in urban areas
– Short distances not
suitable for rural areas
•
Cellular links
– Expensive and low bandwidth
– Crowded in urban areas and limited in rural areas
• Proprietary mesh network technology reduces
inter-operability and impedes meter diversity
• Idea: Use white spaces for AMI communications
• Propose a secure architecture that yields benefits in cost,
bandwidth, and deployment
3
White Spaces
• White spaces are unused portions of TV spectrum (54-698 MHz)
– Excellent long-range communication and penetration properties
• FCC’s recent rulings (Nov ‘08, Sep ‘10) allows for unlicensed
communication in white spaces
– Spectrum sensing helps with identifying and assessing quality of unused
channels
• Standards and research prototypes
– IEEE 802.22 Wireless Broadband Regional Area Network
• Point to multipoint architecture
• Typical range: 17 - 33 km (but up to 100 km)
– WhiteFi [BahlCMMW09 - Sigcomm ‘09]
• Wi-Fi like connectivity over white spaces for up to 2km
• Adaptively operates in most efficient chunk of available spectrum
• Both require centrally aggregating spectrum sensing data
4
Proposed Architecture
• Utility operates WhiteFi networks
• Utility buys service from independent 802.22 service provider
• Large number and geographical spread of meters -> great for spectrum
sensing -> utility can offer data to 802.22 provider
5
Benefits
• High data rates (at low cost)
• Single hop from meters to WhiteFi base station
– No need for complex meshes
– Saves energy used in mesh maintenance and routing
• Large base of sensors for the 802.22 provider
– Lowers cost for 802.22 service provider
– Lowers 802.22 service cost for utility
• Lowers cost for providing broadband service to rural areas
• Facilitates additional meters deployments in rural areas
(particularly along power lines)
6
Challenges and Security Considerations
• Cost of equipping meters with CRs and antennas
– Will be lowered with large-scale production
– May be lowered for utility by contract with 802.22 provider
• Limited availability of white-spaces
– Unlikely in rural and suburban areas
– Can use ISM or narrow licensed bands as backup
• Primary emulation / unauthorized spectrum usage attacks
– Transmitter localization [ChenPR – JSAC ‘08], Anomaly detection [LiuCTG09 Infocom ‘09], Signal authentication [LiuND10 - Oakland ‘10]
• Malicious false spectrum sensing report attacks
– Vandalism: falsely declare a frequency as free
– Exploitation: falsely declare a frequency as occupied
7
Detecting False Reports
• Particularly important for AMI
– Errors will disrupt AMI communication
• 802.22 provider cannot only rely on meters
– Meters owned by a different entity (utility)
– Meters may not be well-distributed, or get compromised
– Must use additional sources for spectrum sensing:
mobile units, consumer premise equipment, or deployed sensors
• Sensors have unknown integrity and or get compromised
• Detecting false reports
– Based on propagation models [FatemiehCG – DySPAN ‘10]
– Based on propagation data [FatemiehFCG – NDSS ‘11]
8
Data-based (Classification-based) Detection
• Model-based schemes: not clear
which signal propagation models,
parameters, or outlier thresholds
should be used
• Idea: Let data speak for itself
• Provide natural and un-natural
signal propagation patterns to
train a machine learning SVM
classifier
• Subsequently use classifier to
detect unnatural propagation
patterns -> attacker-dominated
cells
FatemiehFCG – NDSS 2011
9
Evaluation
Flat East-Central Illinois
Hilly Southwest Pennsylvania (Stress Test)
• Transmitter data from FCC
• Terrain data from NASA
• House density data from US Census Bureau
FatemiehFCG – NDSS 2011
10
Pennsylvania Stress Test Results
•
•
•
•
•
20km by 20km area
Data from 37 transmitters in 150km radius
Train using data from 29
Test on the data from 8
Represent un-accounted fading and other signal variations: add
Gaussian variations with mean 0 and std. dev up to 6 (dB-Spread)
only to test data
FatemiehFCG – NDSS 2011
11
Summary
• AMI communications a key part of smart grid
• Proposed communication architecture that offers improvements
in bandwidth, deployment, and cost
• Discussed security and reliability challenges
• Identified exploitation/vandalism as important attacks and
proposed techniques to detect them
• References
1.
2.
3.
O. Fatemieh, R. Chandra, C. A. Gunter, Low Cost and Secure Smart Meter
Communications using the TV White Spaces, ISRCS ’10.
O. Fatemieh, R. Chandra, C. A. Gunter, Secure Collaborative Sensing for
Crowdsoucing Spectrum Data in White Space Networks, DySPAN ’10.
O. Fatemieh, A. Farhadi, R. Chandra, C. A. Gunter, Using Classification to
Protect the Integrity of Spectrum Measurements in White Space
Networks, NDSS ’11.
12
Backup
13
Standards and Research Prototypes for
White-Space Communications
• IEEE 802.22 standard draft
– Wireless broadband regional area networks over TV white spaces
– Point to multipoint architecture (base station to up to 255 clients), with the
possibility of having repeaters in between
– Each access point covers 17 - 33 km (typical) but up to 100 km
– Antennas 10m above the ground, similar to TV antennas
– Support for co-existence between cells
• WhiteFi [BahlCMMW09 - Sicgomm ‘09]
–
–
–
–
Wi-Fi like connectivity over white spaces for up to 2km
Adaptively operates in most efficient contiguous chunk of available spectrum
Client to access point communication: using modified stock Wi-Fi cards
Requires a separate antenna and board for spectrum sensing
• For spectrum allocation, both techniques support spectrum sensing
and using transmitter databases
14