## 3 Smart Metering in Germany
### Secure Bidirectional Communication for Value-Added Services  
The transparent data tunnel enables the use of services other than the transmission of meter data to the EMP, and configuration by the GWA. It is the core for designing value-added services, such as smart grid applications. By providing the transparent data tunnel, that is, a secure and bidirectional communication channel, the SMGW acts as mediator between CLS in the HAN and aEMP in the WAN. The utilization of this function distinguishes the active EMP from the passive EMP. The passive EMP only receives meter data and is not allowed to communicate via the transparent data tunnel. There are three HAN communication scenarios (\"HAN-Kommunikationsszenario\", HKSs), HKS3, HKS4, and HKS5, for the communication between a CLS and an aEMP. Each scenario differs in who is responsible for the initiation of the transparent data tunnel. The different steps required are depicted in Figure 2. To configure and establish the transparent data tunnel via the SMGW, a communication profile is required for each CLS and aEMP. The communication profile consists of several parameters, including the IP address and port, the communication scenario, the physical interface of the SMGW, the TLS certificate of the communication partner, and time specifications, such as the maximum duration of the connection. It must be added that the connection must not last longer than 48 h; otherwise the SMGW must reject the communication profile [6]. This means that the transparent data tunnel has to be reestablished at least every second day. Furthermore, a proxy profile is required for all of the HKS3-5. The proxy profile references the HAN and WAN communication profiles and specifies further information depending on the scenario if necessary. A transparent data tunnel may only be established to the end points referenced in the proxy profile and specified in the communication profile. Because of the overall importance for the prototype, in the following, HKS3-5 are described in more detail:  
**HAN Communication Scenario HKS3:**: In HKS3 the CLS initiates the transparent data tunnel using the SOCKSv5 protocol. It implements a proxy server application in which the CLS as client requests the SMGW (the proxy server) to connect to the aEMP. The \"TLS for SOCKSv5\" protocol is used for authentication. The complete TLS communication is thus embedded in SOCKSv5 messages. In the WAN the SMGW acts as a TLS client, the aEMP as a TLS server. There are several conditions that need to be met before a connection is established. Firstly, the SMGW must be configured using a communication and proxy profile. Secondly, the parameters of the connection request must match a configured proxy profile; that is, only the CLS referenced in the configuration can request a data tunnel, and it can only connect to an aEMP specified in the profile. Thirdly, a connection is only established if both CLS and aEMP have valid TLS certificates that meet the corresponding SM-PKI requirements and technical guidelines [29; 30]. Lastly, the SMGW must possess a HAN and a WAN TLS certificate with the corresponding private keys. **HAN Communication Scenario HKS4:**: In HKS4 the aEMP initiates the connection. Since only the GWA is able to contact the SMGW from the WAN, the aEMP needs the help of the GWA to get a connection established. Hence, in the first step, the aEMP contacts the GWA. It is, however, worth noting that there is no standardized interface for contacting the GWA. If the SMGW is not currently connected to the GWA, the wake-up service is used to initiate a TLS connection. Once the SMGW is connected, meaning a \"management-channel\" is established, the GWA sendsthe command to establish the transparent data tunnel. The command references the proxy profile which contains the connection parameters for the aEMP and CLS. The SMGW acts as a TLS client in the HAN and in the WAN, and initiates the TLS connections. In this communication scenario, both CLS and aEMP must act as TLS servers and listen for connections.