Physically secured authorization for utility applications
To provide overall security to a utility management system, critical command and control messages that are issued to components of the system are explicitly approved by a secure authority. The explicit approval authenticates the requested action and authorizes the performance of the specific action indicated in a message. Key components of the utility management and control system that are associated with access control are placed in a physical bunker. With this approach, it only becomes necessary to bunker those subsystems that are responsible for approving network actions. Other management modules can remain outside the bunker, thereby avoiding the need to partition them into bunkered and non-bunkered components. Access to critical components of each of the non-bunkered subsystems is controlled through the bunkered approval system.
1. A back office system for utility applications, the system comprising:
a data center configured to communicate with a plurality of nodes in a first wireless network via at least one access point which serves as an interface between the nodes in the first wireless network and a second wireless network through which the data center and the least one access point communicate, the data center being configured to transmit commands to the nodes and receive requests from the nodes via the at least one access point;
a physically secure environment in the data center, the physically secure environment having access restricted thereto;
at least one server external to said physically secure environment in the data center, the at least one server configured to execute one or more application programs associated with operations of a utility, at least some of said application programs having an interface for receiving remote requests from the nodes outside of the data center to perform functions pertaining to the operations of the utility;
a hardware security module located within said physically secure environment and storing a secret key;
an authorization engine, located within said physically secure environment, configured to receive remote requests directed to said application programs and to provide authorized requests, that are signed in accordance with said secret key; a policy module, located within said physically secure environment, configured to process the remote requests in accordance with business logic associated with said application programs, and to selectively enable the requests to be authorized by said authorization engine based on the business logic and a type of the remote requests, the business logic including a type requirement in which remote requests are categorized according to one of a first type in which the requests are required to be signed with the
secret key in order to be authorized by the authorization engine, and a second type in which the requests are not required to be signed with the secret key in order to be authorized by the authorization engine; and at least one secure server, external to the data center, that, in response to an indication that security of the physically secure environment at the data center has been compromised, issues a command to the at least one access point to configure a certificate revocation list indicating that a certificate associated with the physically secure environment, whose security is compromised, is invalid, and issues a command to the nodes to load the certificate revocation list from any one of the at least one access point.
2. The back office system of claim 1 , wherein the data center includes a proxy for said interface, located within said physically secure environment, said proxy operating to receive remote requests that are received at said data center and that are intended for said application programs, and to forward said received requests to said policy module.
3. The back office system of claim 1 , wherein said application programs are configured to redirect remote requests, which are received by said application programs, to said policy module.
4. The back office system of claim 1 , wherein the policy module is configured to determine whether a number of remote requests containing commands to disconnect electrical power, that are issued within a predetermined time period, exceeds a limit value, and to block the commands from being executed if the number of requests exceeds the limit value.
5. The back office system of claim 1 , wherein the policy module is configured to determine whether a sequence of remote requests containing commands to disconnect and reconnect electrical power are associated with the same customer, and to block the commands from being executed if they meet such a condition.
6. The back office system of claim 1 , wherein the policy module is configured to determine whether a remote request containing a command to disconnect or reconnect electrical power is inconsistent with the current status of a customer, and to bock the command from being executed if it is inconsistent.
7. The back office system of claim 1 , wherein the policy module is configured to determine whether a remote request is received from an authenticated source, and to block the request from being processed if the source is not authenticated.
8. The back office system of claim 1 , wherein the policy module is configured to determine whether a remote request to perform an operation is received from an application having permission to request such operation, and to block the request from being processed if the requesting application does not have such permission.
9. The back office system of claim 1 , wherein the policy module is reconfigurable by commands entered from within the physically secure environment.
10. The back office system of claim 1 , wherein said at least one secure server further issues a command to the at least one access point to disregard communications originating from the data center whose physically secure environment has been compromised, in response to an indication that the security of the physically secure environment at the data center has been compromised.
11. The back office system of claim 1 , wherein the nodes are configured to determine whether a received command is authorized by using a public key associated with the secret key.
12. A utility control and communications network, comprising:
a plurality of endpoint nodes; a data center including:
a physically secure environment having an associated certificate of authentication, the physically secure environment having access restricted thereto;
at least one server configured to execute one or more application programs associated with operations of a utility, at least some of said application programs having an interface for receiving remote requests from locations outside of the data center to perform functions pertaining to the operations of the utility;
a hardware security module located within said physically secure environment and storing a cryptographic key; and an authorization engine, located within said physically secure environment, configured to receive remote requests directed to said application programs and to provide authorized requests that are signed in accordance with said cryptographic key, the authorization engine being configured to authorize the requests according to a type requirement in which the remote requests are categorized according to one of a first type in which the requests are required to be signed with the cryptographic key in order to be authorized by the authorization engine, and a second type in which the requests are not required to be signed with the cryptographic key in order to be authorized by the authorization engine; at least one access point via which said endpoint nodes communicate with the application programs located in said data center, the at least one access point serving as an interface between the endpoint nodes and the data center, the at least one access point being configured to communicate with the endpoint nodes in a first wireless network, and to communicate with the data center in a second wireless network distinct from the first wireless network; and
a server that, in response to an indication that the security of the physically secure environment at the data center has been compromised, issues a command to access points to configure a certificate revocation list indicating that the certificate associated with the physically secure environment, whose security is compromised, is invalid, and issues a command to said endpoint nodes to load the certificate revocation list from an access point.
13. The network of claim 12 , wherein said server further issues a command to the access points to disregard communications originating from the data center whose physically secure environment has been compromised, in response to an indication that the security of the physically secure environment at a data center has been compromised.
14. The network of claim 12 , wherein the endpoint nodes are configured to determine whether a received command is authorized by using a public key associated with the cryptographic key.