The present invention relates to a method of establishing a data audit trail for meter data of a meter.

Furthermore, the present invention relates to a meter and a computer program according to the present invention and to a computer-readable data carrier having stored thereon the computer program. The present invention relates further to a metering system com prising at least one meter for performing the method according to the present invention.

Technological Background

Meters and meter data are known and widely used in households and industry. Such meter measure for example the consumption of electricity, gas, or water.

The trusted source of billing relevant data is the meter. A utility can only bill what is in the meter and the meter readings and further information are to be checked at the meter, e.g., energy, demand, tariffs, load profiles, etc. This is inflexible and has certain re strictions. It is thus desirable for future billing that relevant data or tariffs be composed flexibly at a central system using raw billing data from the meter.

To move tariffication to a central system the utility must prove that the bill is based on authentic meter data and the tariffication in the system works as defined in the contract between the utility and a customer. Today, it is required to guarantee that the raw billing data from the meter is from the correct meter, i.e., authentic of source, and has not been altered in any way. i.e., authentic of data. In other words, authenticity of meter data has to be guaranteed.

Going beyond data authenticity while providing a full audit trail of meter data will become relevant. This may become increasingly important in an loT world, where meter data will be shared and used by different parties and for different use cases or applications. It is thus a task of the present disclosure to prove the authenticity of the meter data as well as to create a full audit trail of relevant data in a meter or classical smart metering system and for any third-party system which uses data originated in a meter or smart meter and connected devices.

Description of the Invention

An object of the present invention is to overcome the disadvantages of the prior art. In particular, it is an object of the present invention to provide and to establish a data audit trail for meter data of a meter. The meter data should be verifiable outside of the meter. This object is achieved by a method, meter, computer program, computer-readable data and metering system according to independent claims, respectively.

In particular, according to the present invention, the object is achieved by a method of establishing a data audit trail for meter data of a meter. The method comprises the steps of capturing a meter dataset comprising at least a first value and a second value, signing the meter dataset with a first digital signature, and subsequently signing a next meter dataset and the first digital signature with a second digital signature.

The method may also comprise the steps of capturing a meter dataset comprising a time stamp value and at least one of a consumption measurement value and an event related value, signing the meter dataset with a first digital signature, and subsequently signing a next meter dataset and the first digital signature with a second digital signature.

A further alternative method of establishing a data audit trail of meter data with a utility meter may comprise the steps of generating a meter dataset comprising a time stamp value and at least one of a utility consumption value and an event related value, providing the meter dataset with a first digital signature, and validating the signed meter dataset with a second digital signature.

With a signature over a whole row of data, it is possible to prove authenticity of meter data in a profile and event log. By adding a signature of the previous capturing row to each row it is possible to form an audit trail, which links all data from the first entry to the last one. With such structure of signatures, it is possible to maintain a full audit trail over all levels of meter or smart metering systems and associated third party systems. The authenticity and correctness of the meter data can be verified externally, i.e., remote from the meter. Even if only the latest data is available at its origin, i.e., in the meter, all data in any upper system can be validated against the data and/or signature in the meter and systems.

In a world of loT, where data flows between many systems and parties to allow applica tions and business opportunity audit trails for data become relevant. It is advantageous that the audit trail can be implemented using little recourses, which qualifies it for any modern meter or smart meter.

In an embodiment a further meter dataset and the second digital signature is subse quently signed with a third digital signature. By doing so the data audit trail for meter data of the meter is further developed. Further meter datasets are processed similarly to es- tablish a verifiable trail.

The meter can be any meter or utility meter that measures for example the consumption of electricity, gas, or water. The meter signs the values it creates.

In a further embodiment a hash value is generated from the meter dataset before sub sequently signing the meter dataset. This allows to map the meter dataset of arbitrary size to fixed-size values. The fixed-size hash values are then signed by the digital signa ture using a private key of the meter.

When the meter dataset comprises a time stamp value or time reference, the exact time of when the meter dataset was captured is known and can be restored at a later point in time. The meter data with time stamp values may be recoded in a profile log. The meter dataset can comprise various or multiple measurement values, also referred to as meas urement or measured value tuples. The values may refer to demand and supply.

The meter dataset can also comprise one or more event related values. The meter data with event related values may be recoded in an event log. This allows to subsequently trace back which events have occurred. If one or more signed meter datasets are transmitted to an external device, then the signed meter datasets or meter data and data consistency over the whole data chain can be authenticated remotely while the established data audit trail of the meter data can be verified. The transmission can be performed in intervals. The intervals can be defined by time or an event. The registration period can be set to e.g. 15 minutes. The meter may transmit the signed meter data via wired or wireless communication means and can use a com munication module. Each digital signature can comprise a public key of the meter. The key is meter specific. The use of asymmetric cryptography, also referred to as public-key cryptography and in particular the use of elliptic curve cryptography, is considered to be secure and trusted. With public-key cryptography, robust authentication is possible.

It is advantageous that the signed meter data can be validated by private-key cryptog- raphy. That means only the person or entity having the respective private key and being authorised is allowed to verify the data.

If hash values of signed meter data can be decrypted, the original meter data can be authenticated. Depending on the jurisdiction, such data may not be allowed to be stored after a certain time. A further aspect of the present invention concerns a meter or utility meter that is config ured to carry out the steps of capturing a meter dataset comprising at least a first value and a second value, signing the meter dataset with a first digital signature, and subse quently signing a next meter dataset and the first digital signature with a second digital signature. In yet a further aspect of the present invention a metering system may comprise at least one meter and at least one administration device which can be any external system in cluding a head end system (HES).

With a computer program for establishing a data audit trail for metering data of a meter, the object is achieved in that the computer program comprises instructions which, when the computer program is executed by a meter and/or an administration device in a me tering system, cause the meter and/or the administration device to carry out the steps of a method according to the present invention.

A computer-readable data carrier according to the present invention has stored thereon a computer program according to the present invention. A meter or electricity meter according to the present invention achieves the object in that the meter is configured to carry out a method according to the present invention.

The object is also achieved by a metering system, in that the metering system comprising at least one meter according to the present invention and/or at least one administration device configured to carry out a method according to the present invention.

These solutions according to the present invention have the advantage over technolo gies known from the prior art in that meter data and data consistency over the whole data chain becomes verifiable outside of the meter. Data integrity and data consistency issues can be detected by effective means. The solutions according to the present invention can be combined as desired and further improved by the following embodiments that are advantageous on their own in each case. Unless specified to the contrary, the embodiments can be readily combined with each other. A skilled person will easily understand that all apparatus features of devices and systems according to the present invention may as well be implemented as and/or constitute steps of a method and/or computer program according to the present invention and vice versa.

Brief Description of the accompanying Drawings

The invention will be described hereinafter in more detail and in an exemplary manner using advantageous embodiments and with reference to the drawings. The described embodiments are only possible configurations in which, however, individual features as described above can be provided independently of one another or can be omitted.

In the drawings:

Fig. 1 shows a schematic diagram illustrating an exemplary schematic architectural illustration of an electricity metering system comprising an electricity meter according to an embodiment of the present invention; Fig. 2 shows a further schematic diagram illustrating an exemplary schematic ar chitectural illustration of an electricity metering system comprising an elec tricity meter according to an embodiment of the present invention;

Fig. 3 shows an exemplary structure of smart meter profile log according to the present invention; Fig. 4 shows an exemplary structure of smart meter event log according to the pre sent invention;

Fig. 5 shows an exemplary illustration of signing and transmitting of meter data from the profile log and the inversion for verification;

Fig. 6 shows an exemplary illustration of signed meter data with the omission of plain meter data;

Fig. 7 shows an exemplary illustration of an electricity meter;

Fig. 8 shows an exemplary flowchart illustrating steps of establishing a data audit trail for meter data according to the present invention; Ways of Executing the Invention

Fig. 1 shows a schematic diagram illustrating an exemplary schematic architectural il lustration of an electricity metering system 1 comprising an electricity meter 2, a commu nication infrastructure device 3, an administration device 4, such as a Head-End system (HES) in the form of a computer, server, or alike, for administrating and controlling the electricity metering system 1 . The electricity metering system 1 may further comprise an additional system or admin device 5. The electricity meter 2 is also referred to as smart meter 2 or meter 2.

The communication infrastructure device 3 that may comprise a data concentrator is located at remote sites and can be a range of devices such as computers, PLCs, or other devices that connect to field instruments, such as the electricity meter 2 or gas or what ever meter 2.

Control and administration of the metering system 1 , in particular of the electricity meter 2, hereafter also referred to as meter 2, and the administration device 4 and/or admin device 5 is performed with the help of a computer program. The computer program can be provided on a computer-readable data carrier configured to be accessed by the elec tricity meter 2 and/or the administration device 4, 5. Alternatively, or additionally, the computer program can be provided as being carried on a data carrier signal. The data carrier signal or any other kind of data and/or information, can be exchanged between the meter 2 and the administration device 4 or admin device 5 via energy and/or infor mation transmission lines. The energy and/or information transmission lines may be es tablished in a wired and/or wireless manner. For receiving and sending data and infor mation via the energy and/or information transmission line, the electricity meter 2 is pro vided with transmission means, in the form of a wired or wireless communication line, antenna, or alike. Furthermore, the electricity metering system 1 comprises electrical lines in the form of cables or wires for transmitting electrical power to be metered by the electricity meter 2.

Fig. 2 shows a further schematic diagram illustrating an exemplary schematic architec tural illustration of an electricity metering system 1 comprising an electricity or smart me ter 2, a Head-End system (HES) device 4, an additional system or admin device 5, and a storage device 6. All devices or systems are connected to and via a network 7. Fig. 3 shows an exemplary structure of smart meter profile log according to the present invention generated by an electricity meter 2.

Fig. 3 illustrates meter data 30 with meter datasets 300, 301 , 302, ...300n in various columns and rows. As a first value 31 in the first column are indicated time values cap- tured and sorted by sequence. As a second value 32 values or event numbers are indi cates. Further columns may indicate status or further values. At the right-hand side of the table a first digital signature D1 is shown. This first digital signature D1 results from signing the meter dataset 300. Subsequently a next meter dataset 301 is shown which is signed including the first digital signature D1 with a second digital signature D2 as indicated at the right-hand column. A further meter dataset 302 and the second digital signature D2 are singed with a third digital signature D3 and so on.

With the respective signature D1 , D2, D3, ... Dn over the whole row of data, it is possible to prove authenticity of the meter data 30 in the profile log. In other words, by adding and using the signature of the previous capturing row to each row it is possible to form an audit trail 10, which links all data from the first entry to the last one.

Fig. 4 shows an exemplary structure of smart meter event log according to the present invention.

Fig. 4 shows meter data 40 with multiple meter datasets 400, 401, 402, ...400n in various columns. As a first value 41 in the first column are indicated events captured and listed by sequence. As a second value 42 event values or event information may be stored. Further columns may indicate a status and/or further values such as time and/or dates. At the right-hand side of the illustration a first digital signature D1 is shown. This first digital signature D1 results from signing the meter dataset 400 with event 245. Subse quently a next meter dataset 401 is shown which is signed including event 280 and the first digital signature D1 with a second digital signature D2 as indicated at the right-hand column. A further meter dataset 402 with event no. 2 and the second digital signature D2 are singed with a third digital signature D3.

With the respective signature D1 , D2, D3, ... Dn over the whole row of data, it is possible to prove authenticity of the meter data 40 in the event log. In other words, by adding and using the signature of the previous capturing row to each row it is possible to form an audit trail 10, which links all data from the first entry to the last one.

Fig. 5 shows an exemplary illustration of signing and transmitting of meter data 30 from the profile log and the inversion for verification. Row I. from left to right indicates the evolution of a meter dataset 300. From the meter dataset 300 a hash value 300H is generated. This hash value 300H is signed with a first digital signature D1. The value 300H/D1 also referred to as signed meter data 30’ is transmitted to the HES or administration device 4 and/or admin device 5. Subsequently as indicated in row II. from a next meter dataset 301 a hash value 301 H+D1 is generated. This hash value 300H+D1 is signed with a second digital signature D2. The value 301 H/D1 D2 or signed meter data 30’ is transmitted to the HES or administration device 4 and/or admin device 5. Subsequently in a further step as indicated in row III. from a further meter dataset 302 a hash value 302H+D2 is generated. This hash value 302H+D2 is signed with a third digital signature D3. The value 302H/D2D3 or signed meter data 30’ is transmitted to the HES or administration device 4 and/or admin device 5. The value 302H/D2D3 includes the first digital signature D1 and second digital signa ture D2.

The signed meter data 30’ may be stored at the HES device 4 and/or another admin device 5 and/or the storage device 6 as shown in Fig. 2. With a respective public key PK, as indicated in row III’, an inversion for verification can be performed to derive the value 302H and the meter data set 302. In a further step, as indicated in row II’, an inversion for verification can be performed by the HES device 4 and/or another admin device 5 to derive the value 301 H and/or the meter data set 301. In yet a further step, as indicated in row G, an inversion for verification can be performed by the HES device 4 and/or an- other admin device 5 to derive the value 300H and the meter data set 300.

All data from the first entry to the last one is linked such that a data audit trail 10 is established and the meter data 30 or meter datasets 300, 301 , 302 etc. are verifiable.

Fig. 6 shows an exemplary illustration of signed meter data with the omission of plain meter data 300, 301 , 302. It might be requested that meter data after a certain time is not accessible anymore. In that case the plain meter data 300, 301 , 302 can be deleted but the integrity of the meter data is still verifiable via the trail 10 as indicated.

With the proposed structure of signatures, it is possible to maintain a full audit trail 10 over all levels of metering or smart metering systems 1 and associated third party sys- terns 4, 5. Even if only the latest data are available at its origin, e.g. in the meter 2, all data in any upper system 4, 5, 6 can be validated against the data/signature in the meter 2.

Fig. 7 shows an exemplary illustration of an electricity meter 2 or meter 2. The diagram illustrates various functions of the meter 2. Main inputs 70 of the meter 2 are connections for phase voltages (U1 , U2, U3), phase currents (11 , I2, I3), and neutral conductor N for processing in a measuring system 71 and for a three-phase power supply 72 of the meter 2 and other modules 73. The meter 2 comprises a microprocessor 74.

The meter 2 has as outputs a local interface 73, an optical test output 76, and an LCD display 7 for local reading of registered values.

The measuring system 71 comprises three independent single phase measuring sys tems. The input circuits, voltage divider and sensor-chip, capture voltage and current of the individual phases. A/D-converters digitise these values and feed them to signal pro cessors, which calculate the digital raw values and pass them on to the microprocessor 74. The signal processor calibrates the raw values from the measuring system 71 and determines the following measuring values averaged over a second: active and reactive power per phase; and phase voltages, currents and angles.

The temperature values which are passed on by a temperature sensor 75 to the micro processor 74 are used for temperature compensation. A seconds index 78 can be used instead of a device clock. The seconds index 78 can be used to generate a capture period of the load profile, for the transmission of the cap ture period, as a time stamp in load profiles and event logs, and as a time base. The seconds index 78 is a strictly monotonic increasing natural number which is incremented each second by one with the clock accuracy of the clock generator. It is an unsigned integer number with 32-Bit and is able to cover a time span of approximately 135 years. The seconds index 78 cannot be reset during the lifetime of the meter 2 and therefore does not require any setting or synchronisation mechanisms in contrast to a conventional device clock. A power reserve allows for power >150 h. A non-volatile flash memory 79 serves to record the load profile and also contains con figuration data. An additional flash memory contains the former and, if present, the re cently downloaded firmware. In this way, meter data 30, 40 as well as the firmware are secured against loss from voltage failures.

The input signals of the meter 2 are the analog current values 11 , 12 and I3 and the analog voltage values U1 , U2 and U3. The measuring system 71 generates calibrated digital raw values for voltage and current of each phase from the analog input signals. The signal processor (DSP) calculates the following digital mean values from the voltage and current raw values of each phase, each averaged over one second:

Active powers P1 , P2 and P3 (with energy direction sign) Reactive powers Q1 , Q2 and Q3 (with energy direction sign)

Phase voltages U1 , U2, U3

Phase currents 11 , I2, I3 and neutral conductor current IN

Phase angle between voltage U1 and U2 as well as between U1 and U3

It is possible to register the sum of the three phases, the individual phases, phase angles between voltage and current as well as the angle between the voltages U1 - U2 and U1 - U3.

The microprocessor 74 calibrates the raw values from the signal processors and calcu lates the following measuring values averaged over 1 second:

Active powers P1 , P2 and P3 Active power P, sum of L1 , L2, L3

Active energy import +A, sum of L1 , L2, L3

Active energy export -A, sum of L1 , L2, L3

Reactive energies R1 , R2, R3, R4

Phase currents 11 , I2, I3 and Neutral conductor current IN Phase voltages U1 , U2, U3

Phase angle U2 to U1 ; Phase angle U3 to U1

Phase angle 11 to U1

Phase angle I2 to U2

Phase angle I3 to U3

The data periodically generated in the measuring system 71 is further processed by the microprocessor or processing unit 74 to signed measuring data or data tuples.

The measuring data is sent each second via a local bus containing the following values: current contents of the total registers: +A, -A, R1 , R2, R3, R4 current status current seconds index device identification (MAC-address) signature for +A, R1 , R4 (import data packet) signature for -A, R2, R3 (export data packet)

There are signatures to enable an interest group (import/export) dependent data evalu ation. The signature procedure is based on an ECC (Elliptic Curve Cryptography) method. The secret key used for signing is stored in the meter 2 and cannot be read out. The public key used for the verification of the signature can be read out via the local communication interface 3 and may be printed on a type plate of the meter 2.

In a further embodiment the microprocessor or processing unit 74 of the electricity meter 2 comprises at least one microelectronic primary processor, memory, oscillator and/or supporting circuitry. A communications unit comprises communications microelectronics, such as at least one transceiver or radio transmitter for communication via transmission means or the local interface 73. The power supply unit 72 of the electricity meter 2 com prises power supply circuitry and microelectronics for converting grid supply voltage to voltages suitable for operating internal meter circuitry and components. The supply volt ages for the meter electronics are derived from the three-phase network. Phase voltages between 46 V to 1500 V can be used. Fig. 8 shows an exemplary flowchart illustrating steps of establishing a data audit trail 10 according to the present invention. The runtime logic are computer-readable instruc tions, such as software and/or firmware, constituting at least a part of the computer pro gram, to be executed by the meter 2. In a first step S1 a meter dataset 300, 400 comprising at least a first value 31 , 41 and a second value 32, 42 is captured. In a second step S2 the meter dataset 300, 400 is singed with a first digital signature D1 . In a subsequently signing step S3 a next meter dataset 301 , 401 and the first digital signature D1 are signed with a second digital sig nature D2. In yet a further subsequently signing step S4 a further meter dataset 302, 402 and the second digital signature D2 are singed with a third digital signature D3 thereby creating the verifiable data audit trail 10.

In a preferred embodiment, before subsequently signing the meter dataset 300, 301 , 302, ... 300n; 400, 401 , 402, ... 400n a hash value 300h, 301 h, 302h, ... ; 400h, 401 h, 402h, ... is generated. Digital signatures are usually applied to hash values that repre- sent larger data.

With hash and digital signature functions, the meter data 30, 40 can be digitally signed to signed meter data 30’, 40’ so that any other user can verify that the data has not been changed since it was signed. The identity of the meter 2 that signed the data can also be verified. A digital signature may comprise a small amount of binary data, typically less than 256 bytes. The signature is bundled with the meter dataset and stored. The next meter dataset is signed including the previous signature and so on.

Cryptographic digital signatures use public key algorithms to provide data integrity. When the meter data 30, 40, i.e. a meter dataset is signed with a digital signature and the next meter dataset with a further digital signature, someone else can verify the signatures, and can prove that the data originated from the meter 2 and was not altered after it was signed, i.e. verify data integrity.

Deviations from the above-described embodiments are possible within the scope of the present invention. The electricity metering system 1 may comprise electricity meters 2, administration de vices 4, 5, computer programs, computer-readable data carriers, data carrier signal, en ergy and/or information transmission lines, transmission means, and/or electrical lines, in any number and form required for implementing a desired configuration for operating, monitoring and/or controlling the electricity metering system 1 and in particular any elec tricity meters 2 therein.

The administration device 4, 5, transmission means, processing unit 74, communication unit or local interface 73, and/or power supply units 72 may comprise any kind of elec tronic data processing, storage, interface and/or operation means in any number and form desired. The energy and/or information transmission lines can be embodied as any kind of wired and/or wireless means for transferring energy, in particular electrical en ergy, and/or information, such as analogue and/or digital data, including any kind of com puter software programs, interfaces, modules and/or functions, as well as communica tion systems, such as e.g. the Global System for Mobile Communications (GSM), DLMS/COSEM, Power-line communication (PLC), and alike.

The functions performed by the elements, units and modules of the metering system 1 may be implemented as hardware and/or software in order to be carried out by a single entity and/or multiple entities within the electricity meter 2 and/or the administration de vice 4, 5. The electricity meter 2 and/or administration device 4, 5 may therefore com prise at least one computer, (micro)processor or other type of processor, and at least one computer-readable medium, such as the computer readable data carrier, which may be embodied as any kind of internal and/or external RAM and/or ROM memory device or data storage as well as corresponding permanent or non-permanent computer and/or machine-readable media, including but not limited to e.g. cloud storage devices, micro chips, flash drives, EEPROM, disks, cards, tapes, and drums, tapes, optical discs that stores computer-readable program code (e.g., software or firmware), such as the com puter program, executable by the (micro)processor, logic gates, switches, interfaces, gateways, transceivers, an application specific integrated circuit (ASIC), a programmable logic controller, and/or an embedded microcontroller, for example. In particular, the elec tricity meter 2 and/or the administration device 4, 5 may be configured to perform any kind of measurement, computation, calculation, processing, generation, determination, decision, monitoring and/or control step as described herein. A method according to the present invention may comprise steps S1 to S4 as required and in any number and form desired to establish a data audit trail 10. Besides electricity meters 2 as described herein, a method according to the present invention as well as corresponding systems 1 comprising administration devices 4, 5, computer programs, computer readable data carriers, data carrier signals, energy and/or information trans mission lines, transmission means, and/or electrical lines may be used to establish data audit trails for communications between any kind of electrical appliances, apparatuses, and/or devices, such as household devices, computers, transformers, generators, mo tors, or alike, in particular devices with a relatively large power input, throughput and/or output. Respective electrical appliances, apparatuses, and/or devices themselves and/or respective administration devices may be configured to carry out a method according to the present invention.

Reference Signs

1 electricity metering system 40 h, H hash value

2 electricity meter

3 communication infrastructure S1 first step device S2 second step

4 HES or administration device S3 third step

5 any system or admin device 45 S4 fourth step

6 data storage

7 network

30, 40 meter data

30’ signed meter data 50

31 , 41 first value

32, 42 second value

300 meter dataset

301 next meter dataset 55

302 further meter dataset 400 meter dataset

401 next meter dataset

402 further meter dataset 60

70 main inputs 71 measuring system

72 power supply

73 outputs, other modules, or local in- 65 terface

74 microprocessor or processing unit 75 temperature sensor

76 optical test output

77 LCD display 70

78 seconds index

79 non-volatile flash memory

D1 first digital signature

D2 second digital signature 75

D3 third digital signature