Open Access

Internet of Thing (IoT) and Smart Grid (SG) are separate technologies. The digital transformation of the energy industry and the increasing digitalization in the private sector connect these technologies. Currently in Germany, the SG is under construction. In order to use future innovative services, SG and IoT must be combined. For this, we connect the SG Infrastructure with the IoT. A potential insecure device and network (IoT) should be able to transfer data to and from a critical infrastructure (SG). Open research question in this context are the security requirements architecture SG and IoT and the mechanism for authentication and authorisation in future application (SG and IoT). Due to the increasing networking of the systems (SG and IoT) new threats and attack vectors arise. The attacks to the architecture influence the target of authenticity, security and privacy. For the security analysis we focus on two communication points: the communication between the smart meter gateway, and the IoT device. In our example, a connected charging station with cloud services is connected with a SG infrastructure. To create a really smart service, the charging station needs a connection to the SG to get the current amount of renewable energy in the grid. With this two connections, new threats emerge. A security analysis over all the connections, including the vulnerability and the ability of an attacker, is developed in this paper. The analysis shows us challenges of the communication between IoT and SG. For this, we defined technical and organizational requirements for authentication and authorization. Current authentication and authorization mechanisms are no longer sufficient for the defined requirements. We present the Role-based trust model for Safety-critical Systems for these defined requirements. The new trust model is integrated into a role-based access control model. It defines data classes, which separate the sensitive and non-sensitive information.

Internet of Things (IoT) devices are critical to operate and maintain, because of their number and high connectivity. A lot of security issues concern IoT devices and the networks they are integrated. To help getting an overview of an IoT network, the devices and the security, we propose a scoring system to get a good impression of IT security. This system generates single scores for each device, using features like encryption, update behavior, etc. Furthermore, a summarized score for the whole network is calculated, to show the status of the network security in an easy way for the administrator. To enable the scoring system, a precise list of the existing devices and their operating status is necessary. To achieve this, we present an open standard for the IoT Device IdentificAtion and RecoGnition (short IoTAG), which requires that devices report, e.g., their name, an unique ID, the firmware version and the supported encryption. The proposed standard is described in detail and an implementation guideline is given in this paper. Additionally, information about how to realize the serialization, the integrity and the communication with IoTAG.

Since IoT devices are potentially insecure and offer great attack potential, in our past research we presented IoTAG, a solution where devices communicate security-related information about themselves. However, since this information can also be exploited by attackers, we present in this paper a solution against the misuse of IoTAG. In doing so, we address the two biggest problems: authentication and pairing with a trusted device. This is solved by introducing a pairing process, which uses the simultaneous authentication of equals algorithm to securely exchange and verify each others signature, and by using the server and client authentication provided by HTTP over TLS. We provide the minimum requirements and evaluate the methods used. The emphasis is on known and already proven methods. Additionally, we analyze the potential consequences of an attacker tapping the IoTAG information. Finally, we conclude that the solution successfully prevents access to IoTAG by unauthorized clients on the same network.

This paper explores the mitigation of the compliance burdens faced by manufacturers of digital products under the Cyber Resilience Act. After providing a concise overview of the Cyber Resilience Act and pinpointing pivotal areas where tool-based interventions could reduce the regulatory strain on manufacturers, we introduce two prototypes: a digital checklist for product classification and a prototype to streamline the analysis and monitoring of the security state of software along the software development life cycle. As the second prototype is based on Static Application Software Testing and Software Component Analysis, we validate the approach through benchmark tests. While Static Application Software Testing tools show promise in identifying vulnerabilities, additional tests are needed for full compliance with the Cyber Resilience Act. In general, the prototypes serve as an entry point for identifying possible automation potential to alleviate the compliance burdens of manufacturers.