DaPriM

EU-Kommission: Datenschutzrechtliche Bedenken gegenüber intelligenten Stromzählern

daprim — Tue, 14 Aug 2012 08:59:47 +0000

“Die datenschutzbezüglichen Angriffspunkte werden seit Jahren immer größer, was im Wesentlichen der fortschreitenden Technik zugeschrieben wird, die sich durch Vernetzung und Kommunikationsmöglichkeiten immer häufiger von einfachen mechanischen Vorrichtungen zu interagierenden Rechnern entwickelt. Eines der neuesten Beispiele dafür dürften die von der EU-Kommission zum Einsatz in ganz Europa geplanten intelligenten Stromzähler sein.

(…)”

Vollständiger Artikel auf datenschutzticker.de mit Bezug zum DaPriM-Projekt: http://www.datenschutzticker.de/index.php/2012/06/eu-kommission-datenschutzrechtliche-bedenken-gegenueber-intelligenten-stromzaehlern/

Forensic Content Detection through Power Consumption

greveler — Fri, 10 Aug 2012 19:11:15 +0000

Digital forensic investigators are facing challenging problems of finding clues and solving crimes involving digital data. Advanced metering devices (smart meters) are being installed throughout electric networks in Europe and in the United States. The high-resolution energy consumption data which are transmitted by some smart meters to the utility company allow identification and monitoring of equipment within consumers’ homes. Our research shows that the analysis of the household’s electricity usage profile at a 0.5 Hz sample rate permits identification of audiovisual content.

Conference: IEEE International Workshop on Security and Forensics in Communication Systems, Ottawa, Canada. 2012.

PDF online.

Identifikation von Videoinhalten über granulare Stromverbrauchsdaten

daprim — Tue, 10 Jul 2012 08:03:43 +0000

Deutsche Zusammenfassung wichtiger Forschungsergebnisse bzgl. der Datenschutzproblematik bei Smartmetern, insbesondere der Möglichkeit, Videodaten über das Stromverbrauchsprofil zu identifizieren.

Sekundenscharfe Ablese-Intervalle bei elektronischen Stromzahlern stellen einen erheblichen Eingriff in die Privatsphare der Stromkunden dar. Das datenschutzrechtliche Gebot der Datensparsamkeit und Datenvermeidung steht einer feingranularen Messgenauigkeit und der vollständigen Speicherung der Stromverbrauchsdaten entgegen. Wir können experimentell nachweisen, dass neben der Erkennung von im Haushalt befindlichen Geräten eine Erkennung des Fernsehprogramms und eine Identifikation des abgespielten Videoinhalts möglich ist. Alle Mess- und Testergebnisse wurden mithilfe eines geeichten und operativen Smart Meters, der alle zwei Sekunden Messwerte aufzeichnet, gewonnen.

Konferenz: Sicherheit 2012 – Sicherheit, Schutz und Zuverlässigkeit, Darmstadt. 2012.
GI Proceedings 195, ISBN 978-3885792895

PDF ist online.

Multimedia Content Identification Through Smart Meter Power Usage Profiles

greveler — Thu, 12 Jan 2012 12:19:20 +0000

Using granular smart metering data it is possible to identify multimedia content by analyzing smart meter generated consumption data. We will discuss our findings at the conference Computers, Privacy and Data Protection (CPDP 2012) on Wednesday, 25 January 2012 in Brussels, Belgium.

Our research shows that the analysis of the household’s electricity usage profile at a 2s sample rate does reveal what content was displayed on a CRT, a Plasma display TV or a LCD television set with dynamic backlighting. Our test results show that two 5 minutes-chunks of consecutive viewing without major interference by other appliances is sufficient to identify the content (e. g. DVD movie).

A preprint online publication can be found here (PDF).

Selbstauskunft für Discovergy-Kunden

greveler — Thu, 12 Jan 2012 11:30:58 +0000

Kunden des Smart-Meter-Dienstleisters Discovergy können seit heute über unseren experimentellen Selbstauskunftsdienst ihre Verbrauchsdaten grafisch abfragen und als Tabellendaten herunterladen.

Hintergrund: Das Kundenportal zeigt die Verbrauchsdaten derzeit konsolidiert an. Es ist daher für die Kunden nicht möglich, alle über sie gespeicherten Daten im Detail über diesen Weg abzufragen. Da wir für unsere Forschungsarbeiten ohnehin ein Abfragetool erstellen mussten, um über die volle Datenmenge zu verfügen, stellen wir über diesen Dienst nun diese Möglichkeit auch anderen Kunden zur Verfügung.

Wir danken an dieser Stelle dem Projektmitarbeiter Dennis Löhr MSc, der die zugrundeliegende Software erstellt und für diesen experimentellen Webdienst zur Verfügung gestellt hat.

Beachten Sie: Der Dienst wurde experimentell und ohne Kooperation mit der Discovergy GmbH eingerichtet. Es ist nicht absehbar, inwieweit die Funktionsfähigkeit mittelfristig gegeben ist bzw. ob oder wann diese Abfrage unterbunden werden wird. Alle Angaben erfolgen ohne Gewähr.

Beitrag über DaPriM (Smart-Meter und Datenschutz) in 3SAT.

greveler — Thu, 12 Jan 2012 07:58:22 +0000

“Verräterische Daten: Smartmeter können Nutzungsverhalten preisgeben”.
11. Januar 2012, 18.30h. Wissenschaftssendung nano.

28C3 lecture video: Smart Hacking for Privacy

greveler — Sat, 31 Dec 2011 08:01:41 +0000

On the 28th Chaos Communication Congress (annual conference of the Chaos Computer Club Germany) in Berlin a lecture on smart meter security and privacy issues was given. The video is available via Youtube below.

Smart Hacking for Privacy (Vortrag am 30.12.2011)

loehr — Tue, 27 Dec 2011 15:19:04 +0000

Smart Hacking for Privacy: Smart Meter and Privacy Concerns.

At the 28th Chaos Communication Congress Stephan Brinkhaus BSc. gives a lecture on smart meter security issues at 16:00h 30.Dec.2011.

Advanced metering devices (aka smart meters) are nowadays being installed throughout electric networks in Germany, in other parts of Europe and in the United States. Due to a recent amendment especially in Germany they become more and more popular and are obligatory for new and refurbished buildings.

Unfortunately, smart meters are able to become surveillance devices that monitor the behavior of the customers leading to unprecedented invasions of consumer privacy. High-resolution energy consumption data is transmitted to the utility company in principle allowing intrusive identification and monitoring of equipment within consumers’ homes (e. g., TV set, refrigerator, toaster, and oven) as was already shown in different reports.

This talk is about the Discovergy / EasyMeter smart meter used for electricity metering in private homes in Germany. During our analysis we found several security bugs that range from problems with the certificate management of the website to missing security features for the metering data in transit. For example (un)fortunately the metering data is unsigned and unencrypted, although otherwise stated explicitly on the manufacturer’s homepage. It has to be pointed out that all tests were performed on a sealed, fully functionally device.

In our presentation we will mainly focus on two aspects which we revealed during our analysis: first the privacy issues resulting in even allowing to identify the TV program out of the metering data and second the “problem” that one can easily alter data transmitted even for a third party and thereby potentially fake the amount of consumed power being billed.

In the first part of the talk we show that the analysis of the household’s electricity usage profile can reveal what channel the TV set in the household is displaying. We will also give some test-based assessments whether it is possible to scan for copyright-protected material in the data collected by the smart meter.

In the second part we focus on the data being transmitted by the smart meter via the Internet. We show to what extent the consumption data can be altered and transmitted to the server and visualize this by transmitting some kind of picture data to Discovergy’s consumption data server in a way that the picture content will become visible in the electricity profile. Moreover, we show what happens if the faked power consumption data reflects unrealistic extreme high or negative power consumptions and how that might influence the database and service robustness

abstract

Direct Anonymous Attestation: Enhancing Cloud Service User Privacy (paper)

justus — Wed, 02 Nov 2011 11:07:13 +0000

We introduce a privacy enhancing cloud service architecture based on the Direct Anonymous Attestation (DAA) scheme. In order to protect user data, the architecture provides cloud users with the abilities of controlling the extent of data sharing among their service accounts.

A user is then enabled to link Cloud Service applications in such a way, that his/her personal data are shared only among designated applications. The anonymity of the platform identity is preserved while the integrity of the hardware platform (represented by Trusted Computing conﬁguration register values) is proven to the remote servers. Moreover, the cloud service provider can assess user account activities, which leads to efficient security enforcement measures.

Read full paper here (PDF).

A Privacy Preserving System for Cloud Computing (paper)

daprim — Tue, 04 Oct 2011 16:02:56 +0000

Cloud computing is changing the way that organizations manage their data, due to its robustness, low cost and ubiquitous nature. Privacy concerns arise whenever sensitive data is outsourced to the cloud. Our paper introduces a cloud database storage architecture that prevents the local administrator as well as the cloud administrator to learn about the outsourced database content.

Moreover, machine readable rights expressions are used in order to limit users of the database to a need-to-know basis. These limitations are not changeable by administrators after the database related application is launched, since a new role of rights editors is deﬁned once an application is launced. Furthermore, trusted computing is applied to bind cryptographic key information to trusted states. By limiting the necessary trust in both corporate as well as external administrators and service providers, we counteract the often criticized privacy and conﬁdentiality risks of corporate cloud computing.

Read full paper here (PDF).