Enterprise security in meters
The present disclosure provides for enterprise security in intelligent electronic devices such as electric power meters. In accordance with the present disclosure, enterprise security is a security system in which each individual device, instead of configuring and storing security configurations locally, use a security server for security verifications. Such a security server of the present disclosure may be a dedicated computer on a network, that is used to manage the security configuration for all users. This makes it simpler for administrators to configure users and devices, which in turn improves security by encouraging security to be properly configured.
1. A system comprising:
a network for coupling devices and enabling the transmission of data between the devices;
at least one security server coupled to the network including a first memory, the first memory configured to store security configurations for a plurality of meters; and
the plurality of meters, each meter of the plurality of meters including:
a communication device for coupling the meter to the network and receiving the security configuration for the meter, and
a second memory for storing the security configuration in a local database,
wherein the security server sends a notification to each meter when a security configuration has changes and the meter pulls the changed security configuration after receiving the notification, the notification being sent via at least one of a Modbus command and/or a HTTP POST command.
2. The system of claim 1 , wherein the first memory further includes a mapping of each meter to security credentials of individual users.
3. The system of claim 1 , wherein the communication device of each meter is configured to pull the security configuration from the security server without the security server knowing the network address of the meter.
4. The system of claim 1 , wherein the notification is broadcast as a UDP (user datagram protocol) message to the plurality of meters.
5. The system of claim 1 , wherein the security configuration for each meter includes a device profile for the meter, the device profile including security and non-security parameters.
6. The system of claim 5 , wherein the device profile is configured via a Lightweight Directory Access Protocol (LDAP) setting profile of the meter.
7. The system of claim 1 , wherein the security configuration is a single list of user credentials applicable to each meter.
8. The system of claim 7 , wherein the list identifies which specific meter of the plurality of meters a specific user has access to.
9. The system of claim 1 , wherein the security configuration includes a plurality of users arranged in at least one group, access permissions to the plurality of meters being based on the at least one group.
10. The system of claim 9 , wherein the at least one groups is configured via Windows Active Directories and features of the meter are managed as Active Directory objects.
11. The system of claim 1 , wherein the communication device transmits a security event to the security server for storage in a log.
12. A system comprising:
a network for coupling devices and enabling the transmission of data between the devices;
at least one security server coupled to the network including a first memory, the first memory configured to store security configurations for a plurality of meters; and
the plurality of meters, each meter of the plurality of meters including:
a communication device for coupling the meter to the network and receiving the security configuration for the meter, and
a second memory for storing the security configuration in a local database, wherein the communication device transmits a security event to the security server for storage in a log and the security event is transmitted via a Lightweight Directory Access Protocol (LDAP).
13. The system of claim 12 , wherein the log is fed into a security information and event management (SIEM) system for analysis, wherein the SIEM system generates an alert based on at least one of when a specified event is detected, a threshold of event occurrences has been exceeded and/or a combination of events has occurred.
14. The system of claim 12 , wherein the log is fed into an intrusion detection system (IDS) for analysis, wherein the IDS system generates an alert based events indicative of an intrusion by an attacker.
15. An electric power meter comprising:
at least one sensor coupled an electrical power distribution system, the at least one sensor configured to measure at least one parameter of the electrical power distribution system and generate at least one analog signal indicative of the at least one parameter;
at least one analog-to-digital converter configured to receive the at least one analog signal and convert the at least one analog signal to at least one digital signal;
at least one processor configured to receive the at least one digital signal and calculate at least one power parameter of the electrical power distribution system; and
a communication device for coupling the meter to a network, querying a security server for user credentials upon a user attempting to log into the meter and retrieving the user credentials,
wherein the at least one processor compares the retrieved user credentials to credentials used in the log in attempt to grant access to the meter,
wherein the at least one processor transmits a security event to the security server for storage in a log and
wherein the security event is transmitted via a Lightweight Directory Access Protocol (LDAP).
16. The meter of claim 15 , wherein the at least one processor caches the retrieved user credentials in a memory of the meter and requeries the security server upon the retrieved user credentials expiring.
17. The meter of claim 16 , wherein the at least one processor limits the number of user credentials stored in the memory.
18. A system comprising:
a network for coupling devices and enabling the transmission of data between the devices;
at least one security server coupled to the network including a first memory, the first memory configured to store security configurations for a plurality of meters; and
the plurality of meters, each meter of the plurality of meters including:
a communication device for coupling the meter to the network and receiving the security configuration for the meter, and
a second memory for storing the security configuration in a local database,
wherein the security server sends a notification to each meter when a security configuration has changes and the meter pulls the changed security configuration after receiving the notification, the notification being broadcast as a UDP (user datagram protocol) message to the plurality of meters.
19. A system comprising:
a network for coupling devices and enabling the transmission of data between the devices;
at least one security server coupled to the network including a first memory, the first memory configured to store security configurations for a plurality of meters; and
the plurality of meters, each meter of the plurality of meters including:
a communication device for coupling the meter to the network and receiving the security configuration for the meter, and
a second memory for storing the security configuration in a local database,
wherein the security configuration for each meter includes a device profile for the meter, the device profile including security and non-security parameters, and
wherein the device profile is configured via a Lightweight Directory Access Protocol (LDAP) setting profile of the meter.
20. A system comprising:
a network for coupling devices and enabling the transmission of data between the devices;
at least one security server coupled to the network including a first memory, the first memory configured to store security configurations for a plurality of meters; and
the plurality of meters, each meter of the plurality of meters including:
a communication device for coupling the meter to the network and receiving the security configuration for the meter, and
a second memory for storing the security configuration in a local database,
wherein the security configuration includes a plurality of users arranged in at least one group, access permissions to the plurality of meters being based on the at least one group, and
wherein the at least one groups is configured via Windows Active Directories and features of the meter are managed as Active Directory objects.
21. The system of claim 1 , wherein the plurality of meters includes at least one of a socket/S-base meter, a panel meter, a switchboard/draw-out meter and/or a A-base meter.
22. The system of claim 12 , wherein the plurality of meters includes at least one of a socket/S-base meter, a panel meter, a switchboard/draw-out meter and/or a A-base meter.
23. The system of claim 18 , wherein the plurality of meters includes at least one of a socket/S-base meter, a panel meter, a switchboard/draw-out meter and/or a A-base meter.
24. The system of claim 19 , wherein the plurality of meters includes at least one of a socket/S-base meter, a panel meter, a switchboard/draw-out meter and/or a A-base meter.
25. The system of claim 20 , wherein the plurality of meters includes at least one of a socket/S-base meter, a panel meter, a switchboard/draw-out meter and/or a A-base meter.