With an increasingly digitalized energy sector and the associated emergence of new business models, topics such as intra-day trading, dynamic electricity tariffs, balancing to increase grid efficiency and the use of the CLS interface (Controllable Local Systems) of an SMGW infrastructure (Smart Meter Gateway) are coming into focus. The aim is to make the energy system more flexible while creating the possibility of involving end customers in the energy distribution and generation system in a simpler and more effective manner.

The energy transition is shifting energy supply from being primarily based on fossil and nuclear fuels to a more environmentally friendly and sustainable energy supply based on renewable energies. In the process, the previously centralised energy supply is becoming more and more decentralised. This brings new challenges into focus: for example, there is an increasing need for intelligent and efficient monitoring and coordination between the generation, distribution and consumption of energy by all actors along the energy value chain. To realise such an intelligent energy system (called smart grid), appropriate information and communication technologies (ICTs) are needed. By making it possible to exchange operation-critical data in near real time, ICTs provide the basis for effective and efficient coordination to maintain the current grid stability and supply.

New needs and challenges for IT security

With this far-reaching transformation of the energy system, IT security must not be limited to established models and solutions. The tension between secrecy, integrity and availability as the foundation of IT security must be rethought and adapted to the new global cyber world. In this networked world, formerly autarkic systems are increasingly part of a global, cross-system environment. If heterogeneous application systems continue to grow together, the attack surface and the potential damage from cyber-attacks will increase. Above all, security gaps in software and hardware often pose a major challenge. In addition, new attack vectors arise when ICTs are increasingly interconnected, increasing the need for Innovative defence concepts.

Many areas of the energy industry are therefore classified as so-called "critical infrastructure" (KRITIS) according to BSI-Kritis-V. They must provide adequate protection against threats to telecommunications and electronic data processing systems that are necessary for secure network operation.

IT security for smart meter gateways

The Technical Guideline (TR) 03109-1 V1.01 of the Federal Office for Information Security (BSI) describes the minimum requirements for decentralised metering value processing as well as transmission of smart meter gateways (SMGW) in 13 tariff use cases (TAF). In SINTEG, certified and non-certified SMGWs were used in the smart metering public key infrastructure (SM-PKI) to test the two use cases TAF 9 (retrieval of the actual feed-in of a generation plant) and TAF 10 (retrieval of grid status data). Various control boxes were used, for example via the Controllable Local Systems channel (CLS channel) of the SMGW.

The results were satisfactory. Crucial information was gathered both during the testing of TAF 9 and TAF 10 and during the connection of the control box via the CLS channel of the gateway. The control boxes could be successfully connected to the SMGW and tested via the CLS connection. Within the testing scope, the control boxes could be controlled reliably and the CLS connection could be used just as well.

The implementation of TAF 9 in particular is often required. It concerns the actual feed-in of power plants in 60-second cycles. It was tested with power plants and with a consumption system in the SM test PKI. As it turned out, certified SMGWs are not yet TAF 9-capable by default but can be upgraded subsequently through a software update. Such a software update has also been successfully carried out on a consumption unit. The 60-second values arrive reliably at the destination point. TAF 9 thus basically also works with consumption systems.


"In order to make IT and OT systems resilient for the energy domain and to develop an overall resilient energy system, it is essential to consider information security holistically - in the development process, during operation and after incidents. Standardised procedures and specifications are ideal for this."

Christine Rosinger, enera, WP 12 Management

What remains after SINTEG?

International standards and the BSI's IT-Grundschutz are not identical. It is recommended to harmonise them as much as possible.

A conflict between IT security and data protection is to be expected. Both issues can be in conflict with functionalities (especially data protection) and the performance of a solution (IT security, e.g. complex encryption or error-preventing redundant but slower protocols). This becomes relevant if, for example, data protection prevents IT log files from being created, but their evaluation could improve a function.

However, this potential conflict could not be examined in SINTEG. Therefore, the predominant finding is that compliance with data protection requirements is costly, but basically feasible. However, the requirements of the Metering Point Operation Act (Messstellenbetriebsgesetz, MsbG) and their practical implementation prove to be very resource-consuming - both in terms of time and personnel.

However, due to the use cases selected in the projects and the metering solutions, some of which were developed independently, not all findings can be fully transferred to the target architecture of the MsbG.