Applicability Statement for the Routing Protocol for Low-Power and Lossy Networks (RPL) in Advanced Metering Infrastructure (AMI) Networks
Extracted elements (32)
AES-CCM-32 (32-bit MAC) is chosen as the most common cipher in AMI because it balances security requirements against network throughput constraints; longer MACs improve resiliency but increase packet size and consume bandwidth in constrained metering networks.
AMI deployments may not need RPL's built-in security mechanisms because, unlike many LLNs, smart grid networks have centralized administrative control and permanent secure infrastructure, enabling link-layer and application-layer security instead.
DIOIntervalMin is set larger than RFC 6206 recommendations to prevent short-term congestion bursts when inconsistencies are detected and large numbers of neighboring nodes send DIO updates simultaneously in dense AMI deployments.
Multiple RPL instances can be supported in AMI multi-service networks where different applications (e.g., SMD and DA traffic) require different routing metrics and constraints, though a single instance suffices for most deployments.
RPL non-storing mode (rather than storing mode) is specified for AMI because AMI electric meters are the primary target, are AC-powered (not battery-constrained), and require the centralized path computation that non-storing mode enables through source routing from the DODAG root.
AMI implementations based on IEEE 1901.2 and 802.15.4 can utilize all IPv6 Header Compression schemes in RFC 6282 Section 3 and Next Header compression in Section 4 to reduce over-air/wire overhead.
IEEE 1901.2 uses a variable PHY MTU dependent on modulation and FEC settings; for CENELEC A/B ROBO/Super-ROBO modulations the threshold is 247 octets, and for other modulations 239 octets, before MAC-layer segmentation is required.
All DIO messages SHOULD contain a Metric Container option for disseminating the metrics and metric values used for DODAG setup.
AMI deployments MUST include, at a minimum, link-layer security such as that defined by IEEE 1901.2 and IEEE 802.15.4, even if RPL's own security mechanisms are not implemented.
AMI deployments SHOULD set DIOIntervalDoublings such that the Trickle Imax is at least 2 hours or more.
AMI deployments SHOULD set DIOIntervalMin such that the Trickle Imin is at least 50 times as long as it takes to transmit a link-local multicast packet, to avoid congestion in dense urban deployments.
AMI deployments SHOULD set DIORedundancyConstant to a value of at least 10, due to the larger chosen value for DIOIntervalMin and its proportional relationship with k.
AMI deployments SHOULD set MinHopRankIncrease to 256, resulting in 8 bits of resolution (e.g., for the ETX metric).
AMI deployments SHOULD utilize the local repair mechanisms in RPL to handle time-varying link characteristics and availability, triggered by broken link detection.
An AMI deployment MUST include the use of the security schemes as defined by IEEE 1901.2 and IEEE 802.15.4 to provide mutual authentication, access control, and transport confidentiality and integrity.
DIO messages SHOULD contain a DODAG Configuration option for disseminating the Trickle Timer parameters throughout the network.
Information Elements, Enhanced Beacons, and frame version 2 as defined in IEEE 802.15.4e MUST be supported in IEEE 802.15.4g/e-based AMI deployments.
Nodes SHOULD send Destination Advertisement Object (DAO) messages to establish downward paths from the DODAG root to themselves, as two-way communication is a requirement in AMI systems.
The MAC frame payload MUST be able to carry a full IPv6 packet of 1280 octets without upper-layer fragmentation and reassembly.
To enable local repair, AMI deployments SHOULD set MaxRankIncrease to a value that allows a device to move a small number of hops away from the root; with MinHopRankIncrease of 256, a value of 1024 allows up to 4 hops.
Privacy of information flowing through smart grid networks is subject to ongoing regulatory development; the privacy considerations from draft-ietf-6lo-privacy-considerations and EU privacy requirements apply to AMI deployments using RPL.
AMI traffic is classified into five priority classes: C1 (high-priority critical, <5s, <100 bytes), C2 (critical, <10s, <150 bytes), C3 (normal, <30s, <200 bytes), C4 (low priority, 2-hour window, <400 bytes), and C5 (background, firmware updates within 7 days).
DODAG repair in AMI uses two mechanisms: (1) node poisoning by advertising infinite rank so children select a different parent, and (2) controlled rank increase via DAGMaxRankIncrease to limit count-to-infinity scenarios.
IEEE 1901.2 MAC frames are derived from IEEE 802.15.4 MAC frames by prepending a Segment Control Field, and use only 16-bit and 64-bit 802.15.4 MAC addresses.
IEEE 802.15.4 defines eight security suites: Null, AES-CTR (encryption only), AES-CBC-MAC-128/64 (authentication only), and AES-CCM-128/64/32 (encryption and authentication). AES-CCM-32 is the most commonly used suite in AMI deployments.
RPL non-storing mode is the specified mode of operation for AMI deployments. It builds a Directed Acyclic Graph (DAG) rooted at an LBR, supports upstream and downstream unicast, and downstream multicast forwarding with scope larger than link-local.
RPL supports two objective functions suitable for AMI: Objective Function 0 (OF0, RFC 6552) and Minimum Rank with Hysteresis Objective Function (MRHOF, RFC 6719), both defining preferred and backup parent selection.
The ETX (Expected Transmission Count) metric as defined in RFC 6551 is recommended for AMI deployments to characterize paths over link technologies exhibiting significant packet loss.
Device addresses in IEEE 802.15.4 are always transmitted unencrypted, making attacks that rely on device identity somewhat easier to launch even when data encryption and authentication are in use.
During initial deployment, meters are loaded with security credentials (keys and certificates) during manufacturing; these are used for authentication and to negotiate operational security credentials for network and application layers.
Smart grid networks are critical infrastructure subject to stringent security requirements; failure to authenticate devices can lead to unauthorized access, while unprotected communication layers enable passive eavesdropping (wireless), man-in-the-middle, and active attacks.
When a device is replaced due to failure or compromise, the new device does not inherit the security identity of the old device, and credentials associated with the failed/compromised device are removed from security appliances.