Today the SunSpec Alliance announced creation of the Blockchain Work Group to further secure the distributed energy grid. Specifically, the blockchain specification will ensure that credentials (e.g.- private keys) used to secure communications have not been compromised somewhere in the supply chain. It’s an often-overlooked part of cybersecurity, but thanks to the diligence of another SunSpec effort- the Cybersecurity Work Group- the problem was identified and targeted. For more details on the raison d’etre for the workgroup, you can read our position paper. In this post I’ll give you a high-level perspective on how the SunSpec Blockchain Work Group fits into the energy ecosystem and the broader IoT industry.
There’s a right way and a wrong way to create (“provision”) credentials. Unfortunately most developers don’t understand the difference, and tutorials ignore it. For example, Amazon IoT uses certificates to authenticate devices, which is state of the art, but its Security Best Practices page does not give recommendations on how to create and protect the private key used to generate the certificate. Luckily there are good solutions out there. The most secure is to use hardware chips that generate internal keys that no one can access. The next step down are solutions like secure provisioning APIs and provisioning appliances. A truly awful way to provision credentials is to bulk generate keys in the cloud, download them in plain text, and hand them over to an unknown resource on a manufacturing line. That unknown resource can take those keys and sell them to the highest bidder on the dark webs, just like hackers make money on the online passwords they steal in data breaches.
As a user of such devices, you have no idea how these credentials are created. Even if you did know, you’re probably not a security expert that can accurately judge the process. Enter the SunSpec Blockchain Work Group. The goal of the workgroup is to create specifications for a decentralized app (DApp) and requirements for a blockchain to run it. The DApp will track how every DER communication certificate is created, and do it in a way that allows provisioning processes to be compared programmatically. This will allow anyone to see the integrity of a DER credential when it communicates to the grid. If a manufacturer uses a poor provisioning processes, it will be transparent to all. Peter Drucker said “you can’t manage what you can’t measure”. The output of the Blockchain Work Group will be a DApp that gives organizations such as the California Public Utility Commission (CPUC) a tool to measure and manage security credentials.
Once the DApp is created, organizations outside of the energy space could find value in it- the integrity of credentials is important to all industries, not just energy. Standards bodies that require Public Key Infrastructure (PKI) can put credential information into extensions of the X.509 certificates they specify. IoT cloud providers can query the blockchain to check the security of devices that connect to them. In fact, many of the companies that will provide provisioning solutions to DER manufacturers supply to the rest of IoT as well. The rapid growth of DERs in California make energy the ideal first market for the DApp, but the DApp can very well be used in other markets in the near future.
