From the customer domain perspective, interoperation implies that external systems are able to control customer's energy resources as well as to read energy-related information. These two types of accesses to an energy resource affect the operation of the customer domain differently. However, most existing security mechanisms were designed at individual resource level and cannot efficiently handle such fine-grained access. To resolve the issue of fine granularity, this paper proposes a new security mechanism, Resource Centric Security, that leverages the concept of a filesystem Access Control List. Three privileges of read, write, and execute are defined on each energy resource, and a set of attributes is assigned to each privilege. Each external user also maintains his own set of attributes. He can access the privilege only if his attribute set matches the privilege's set. In this way, the user may receive permission to read data of a resource but not to invoke operations. We have implemented the proposed scheme on a real testbed and have run experiments. The results and following analysis discover that our scheme can provide a proper level of data protection with reasonable overhead.
展开▼
