Electricity meter and system hardened against attack vectors

One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by one or more processors, configure a metering device to perform actions comprising:

• generating, by operation of the metering device, a random identification (ID) of the metering device, and a secret, wherein the random ID is selected to be different from a real ID of the metering device;
• transmitting, by operation of the metering device, to a headend device, the random ID and the secret, wherein the transmitting is performed at least in part over a private network to an AMI headend device, wherein the random ID is sent for use in a mapping process performed by a cloud server that associates random IDs of metering devices with respective real IDs of the metering devices, and wherein the private network comprises an Advanced Metering Infrastructure (AMI) network;
• receiving, at the metering device, a first certificate from the cloud server;
• validating the first certificate, by operation of the metering device, wherein the validating results in a first authentication factor;
• sending, from the metering device to the cloud server, a second certificate associated with a second authentication factor;
• sending, by operation of the metering device, a challenge request to the cloud server;
• receiving, at the metering device and from the cloud server, a challenge response comprising information based on the secret from the cloud server connected to the internet;
• validating, by operation of the metering device, that the cloud server had possession of the secret, wherein the validating results in a third authentication factor;
• and
• responsive to success of the first, second, and third authentication factors, transmitting data generated by the metering device to the cloud server, wherein the transmitting includes the random ID of the metering device.

A metering device, comprising:

• a processor;
• and
• a memory device in communication with the processor,
• wherein the memory device comprises non-transitory processor-readable and processor-executable instructions that, when executed by the processor perform actions comprising:
• generating a random identification (ID) of the metering device and a secret, wherein the random ID is selected to be different from a real ID of the metering device;
• transmitting to a headend device, the random ID and the secret, wherein the transmitting is performed at least in part over a private network to an AMI headend device, wherein the random ID is sent to a headend device for use in a mapping process performed by the headend device that associates random IDs of metering devices with respective real IDs of the metering devices, and wherein the private network comprises an Advanced Metering Infrastructure (AMI) network;
• receiving a first certificate from a cloud server;
• validating the first certificate wherein the validating results in a first authentication factor;
• sending, from the metering device to the cloud server, a second certificate associated with a second authentication factor;
• sending a challenge request to the cloud server;
• receiving, at the metering device and from the cloud server, a challenge response comprising information based on the secret from the cloud server connected to the internet;
• validating that the cloud server had possession of the secret, wherein the validating results in a third authentication factor;
• and
• responsive to success of the first, second, and third authentication factors, transmitting data generated by the metering device to the cloud server, wherein the transmitting includes the random ID of the metering device.