# US 10,455,420 B2 · Physically secured authorization for utility applications

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,455,420 B2
- Document ID: US10455420B2
- Status: Granted
- Kind: B2
- Application number: 15/144,118
- Filed: 2016-05-02
- Published: 2016-08-25
- Granted: 2019-10-22
- Earliest claimed: 2010-11-04
- Assignees: Itron Networked Solutions, Inc.
- Applicants: Silver Spring Networks, Inc.
- Inventors: Raj Vaswani; Wilson Chuen Yew Yeung; Cristina Seibert; Nelson Bruce Bolyard; Benjamin N. Damm; Michael C. StJohns
- Web page: https://patentgrep.com/patent/US10455420B2

## CPC

- H04W 12/08: Access security
- G06F 21/33: using certificates
- G06F 21/602: {Providing cryptographic facilities or services}
- G06F 21/629: {to features or functions of an application}
- G07C 9/22: in combination with an identity check of the pass holder
- H04L 9/0897: {involving additional devices, e.g. trusted platform module [TPM], smartcard or USB}
- H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]}
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06Q 50/06: Energy or water supply
- Y04S 40/20: Information technology specific aspects, e.g. CAD, simulation, modelling, system security
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G07C: TIME OR ATTENDANCE REGISTERS; REGISTERING OR INDICATING THE WORKING OF MACHINES; GENERATING RANDOM NUMBERS; VOTING OR LOTTERY APPARATUS; ARRANGEMENTS, SYSTEMS OR APPARATUS FOR CHECKING NOT PROVIDED FOR ELSEWHERE
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- Y04S: SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS

## Abstract

To provide overall security to a utility management system, critical command and control messages that are issued to components of the system are explicitly approved by a secure authority. The explicit approval authenticates the requested action and authorizes the performance of the specific action indicated in a message. Key components of the utility management and control system that are associated with access control are placed in a physical bunker. With this approach, it only becomes necessary to bunker those subsystems that are responsible for approving network actions. Other management modules can remain outside the bunker, thereby avoiding the need to partition them into bunkered and non-bunkered components. Access to critical components of each of the non-bunkered subsystems is controlled through the bunkered approval system.

## Claims

### Claim 1

A back office system for utility applications, the system comprising:
a data center configured to communicate with a plurality of nodes in a first wireless network via at least one access point which serves as an interface between the nodes in the first wireless network and a second wireless network through which the data center and the least one access point communicate, the data center being configured to transmit commands to the nodes and receive requests from the nodes via the at least one access point;
a physically secure environment in the data center, the physically secure environment having access restricted thereto;
at least one server external to said physically secure environment in the data center, the at least one server configured to execute one or more application programs associated with operations of a utility, at least some of said application programs having an interface for receiving remote requests from the nodes outside of the data center to perform functions pertaining to the operations of the utility;
a hardware security module located within said physically secure environment and storing a secret key;
an authorization engine, located within said physically secure environment, configured to receive remote requests directed to said application programs and to provide authorized requests, that are signed in accordance with said secret key; a policy module, located within said physically secure environment, configured to process the remote requests in accordance with business logic associated with said application programs, and to selectively enable the requests to be authorized by said authorization engine based on the business logic and a type of the remote requests, the business logic including a type requirement in which remote requests are categorized according to one of a first type in which the requests are required to be signed with the
secret key in order to be authorized by the authorization engine, and a second type in which the requests are not required to be signed with the secret key in order to be authorized by the authorization engine; and at least one secure server, external to the data center, that, in response to an indication that security of the physically secure environment at the data center has been compromised, issues a command to the at least one access point to configure a certificate revocation list indicating that a certificate associated with the physically secure environment, whose security is compromised, is invalid, and issues a command to the nodes to load the certificate revocation list from any one of the at least one access point.

### Claim 2 (depends on 1)

The back office system of claim 1, wherein the data center includes a proxy for said interface, located within said physically secure environment, said proxy operating to receive remote requests that are received at said data center and that are intended for said application programs, and to forward said received requests to said policy module.

### Claim 3 (depends on 1)

The back office system of claim 1, wherein said application programs are configured to redirect remote requests, which are received by said application programs, to said policy module.

### Claim 4 (depends on 1)

The back office system of claim 1, wherein the policy module is configured to determine whether a number of remote requests containing commands to disconnect electrical power, that are issued within a predetermined time period, exceeds a limit value, and to block the commands from being executed if the number of requests exceeds the limit value.

### Claim 5 (depends on 1)

The back office system of claim 1, wherein the policy module is configured to determine whether a sequence of remote requests containing commands to disconnect and reconnect electrical power are associated with the same customer, and to block the commands from being executed if they meet such a condition.

### Claim 6 (depends on 1)

The back office system of claim 1, wherein the policy module is configured to determine whether a remote request containing a command to disconnect or reconnect electrical power is inconsistent with the current status of a customer, and to bock the command from being executed if it is inconsistent.

### Claim 7 (depends on 1)

The back office system of claim 1, wherein the policy module is configured to determine whether a remote request is received from an authenticated source, and to block the request from being processed if the source is not authenticated.

### Claim 8 (depends on 1)

The back office system of claim 1, wherein the policy module is configured to determine whether a remote request to perform an operation is received from an application having permission to request such operation, and to block the request from being processed if the requesting application does not have such permission.

### Claim 9 (depends on 1)

The back office system of claim 1, wherein the policy module is reconfigurable by commands entered from within the physically secure environment.

### Claim 10 (depends on 1)

The back office system of claim 1, wherein said at least one secure server further issues a command to the at least one access point to disregard communications originating from the data center whose physically secure environment has been compromised, in response to an indication that the security of the physically secure environment at the data center has been compromised.

### Claim 11 (depends on 1)

The back office system of claim 1, wherein the nodes are configured to determine whether a received command is authorized by using a public key associated with the secret key.

### Claim 12

A utility control and communications network, comprising:
a plurality of endpoint nodes; a data center including:
a physically secure environment having an associated certificate of authentication, the physically secure environment having access restricted thereto;
at least one server configured to execute one or more application programs associated with operations of a utility, at least some of said application programs having an interface for receiving remote requests from locations outside of the data center to perform functions pertaining to the operations of the utility;
a hardware security module located within said physically secure environment and storing a cryptographic key; and an authorization engine, located within said physically secure environment, configured to receive remote requests directed to said application programs and to provide authorized requests that are signed in accordance with said cryptographic key, the authorization engine being configured to authorize the requests according to a type requirement in which the remote requests are categorized according to one of a first type in which the requests are required to be signed with the cryptographic key in order to be authorized by the authorization engine, and a second type in which the requests are not required to be signed with the cryptographic key in order to be authorized by the authorization engine; at least one access point via which said endpoint nodes communicate with the application programs located in said data center, the at least one access point serving as an interface between the endpoint nodes and the data center, the at least one access point being configured to communicate with the endpoint nodes in a first wireless network, and to communicate with the data center in a second wireless network distinct from the first wireless network; and
a server that, in response to an indication that the security of the physically secure environment at the data center has been compromised, issues a command to access points to configure a certificate revocation list indicating that the certificate associated with the physically secure environment, whose security is compromised, is invalid, and issues a command to said endpoint nodes to load the certificate revocation list from an access point.

### Claim 13 (depends on 12)

The network of claim 12, wherein said server further issues a command to the access points to disregard communications originating from the data center whose physically secure environment has been compromised, in response to an indication that the security of the physically secure environment at a data center has been compromised.

### Claim 14 (depends on 12)

The network of claim 12, wherein the endpoint nodes are configured to determine whether a received command is authorized by using a public key associated with the cryptographic key.