Login
Book a demo

COSEM

COSEM (Companion Specification for Energy Metering) Security Testing & Validation

COSEM (Companion Specification for Energy Metering) is the globally recognised interface model that defines how to communicate with energy metering equipment, forming the foundation of the DLMS/COSEM protocol suite standardised as IEC 62056. Used extensively across electricity, gas, water, and heat metering applications worldwide, DLMS/COSEM enables interoperable communication between smart meters and head-end systems, supporting critical functions including remote meter reading, tariff management, load profiling, and meter configuration. However, the protocol’s complexity and widespread deployment make COSEM implementations attractive targets for cyberattacks that could compromise billing accuracy, enable energy theft, disrupt service, or facilitate broader attacks on critical infrastructure. At CyTAL, we specialise in comprehensive COSEM security testing through ProtoCrawler, identifying implementation vulnerabilities, protocol parsing flaws, and cryptographic weaknesses before attackers can exploit them to compromise your smart metering infrastructure.

What is COSEM and DLMS/COSEM?

COSEM represents the data model and application layer specification within the broader DLMS/COSEM protocol suite. Understanding the relationship between these components is essential for comprehending the protocol’s security implications.

The COSEM Object Model:

COSEM defines an object-oriented approach to representing all data and functionality within energy metering devices. Every measurable parameter, configuration setting, historical data point, and device function is modelled as a COSEM object belonging to a specific interface class. Each object has attributes (data values) and methods (operations that can be invoked). This abstraction creates a standardised way to access meter functionality regardless of the underlying hardware or manufacturer implementation.

The COSEM object model uses OBIS (Object Identification System) codes to uniquely identify each data item. OBIS codes follow a structured format that indicates the type of measurement, the processing applied, and other characteristics. For example, different OBIS codes represent active energy import, reactive energy export, instantaneous voltage, historical load profiles, and thousands of other parameters. This standardisation enables head-end systems to communicate with meters from different manufacturers using consistent addressing schemes.

DLMS Application Layer Protocol:

DLMS (Device Language Message Specification) provides the application layer protocol that operates on top of the COSEM object model. DLMS defines how to encode service requests and responses, including operations to read attributes, write attributes, execute methods, and perform complex transactions. The protocol supports various authentication mechanisms, encryption options, and data compression techniques.

DLMS operates independently of the underlying transport layer, making it adaptable to diverse communication media including RS-232 serial connections, RS-485 multi-drop networks, TCP/IP ethernet, GPRS cellular, PLC (power line communication), and RF mesh networks. This flexibility has contributed to DLMS/COSEM’s global adoption across utilities with different infrastructure capabilities and requirements.

Communication Profiles and Transport Layers:

IEC 62056 defines multiple communication profiles that specify how DLMS/COSEM operates over different physical and data link layers. Common profiles include HDLC (High-Level Data Link Control) for serial and optical connections, TCP/IP wrapper for ethernet and cellular networks, and specialised profiles for PLC technologies like Prime and G3-PLC. Each profile addresses the specific characteristics and constraints of its transport medium while maintaining compatibility with the COSEM object model and DLMS application protocol.

Security Suites:

DLMS/COSEM security has evolved through multiple security suites providing progressively stronger protection. Security Suite 0 offers basic authentication using passwords but provides no encryption or message authentication, making it unsuitable for modern deployments. Security Suite 1 implements authenticated encryption using AES-128 in Galois/Counter Mode (GCM), providing both confidentiality and integrity protection for messages. More recent Security Suite 2 adds support for ECDSA digital signatures and enhanced key management, addressing limitations in earlier security approaches.

The global nature of DLMS/COSEM deployment means meters must often support multiple security suites for backwards compatibility or to meet different regional regulatory requirements. This multi-suite support increases implementation complexity and expands the attack surface that security testing must address.

Critical Security Vulnerabilities in DLMS/COSEM Implementations

Despite comprehensive security specifications, DLMS/COSEM implementations frequently contain vulnerabilities that attackers can exploit to compromise smart metering systems. These vulnerabilities arise from implementation errors, specification ambiguities, and the inherent complexity of the protocol stack.

DLMS Message Parsing Vulnerabilities

DLMS uses ASN.1 (Abstract Syntax Notation One) with BER (Basic Encoding Rules) for encoding application protocol data units (APDUs). This introduces all the parsing complexity and vulnerability potential associated with ASN.1 implementations. Buffer overflow vulnerabilities occur when parsers fail to validate length fields before processing message components, allowing attackers to overflow buffers and potentially execute arbitrary code on meter processors.

Integer overflow vulnerabilities arise when parsing arithmetic on attacker-controlled length values wraps around integer limits, causing undersized memory allocations. Type confusion attacks exploit insufficient type validation to cause parsers to misinterpret message structure. The complexity of DLMS service requests—particularly composite data types with nested structures—creates numerous opportunities for parsing errors that compromise security before cryptographic validation occurs.

Authentication and Key Management Weaknesses

DLMS/COSEM security depends critically on proper authentication and key management implementation. Weak authentication implementations accepting default passwords, hardcoded credentials, or insufficiently random authentication challenges enable unauthorised access. Research has documented numerous deployed meters with default passwords unchanged from factory settings, making them trivially compromisable.

Key management vulnerabilities include improper random number generation for cryptographic operations, insecure key storage allowing extraction through physical attacks, inadequate key rotation procedures, and flawed certificate validation in systems using public key infrastructure. The complexity of managing multiple keys (encryption keys, authentication keys, master keys, global keys) across large meter populations creates operational challenges that sometimes lead to insecure shortcuts.

Cryptographic Implementation Flaws

Even when using strong cryptographic algorithms like AES-128-GCM, implementation errors can undermine security. Nonce reuse in GCM encryption catastrophically breaks confidentiality and integrity protections—a vulnerability that has affected numerous cryptographic implementations across different protocols and applications. Improper validation of authentication tags allows attackers to modify encrypted messages without detection.

Side-channel vulnerabilities exploiting timing variations, power consumption patterns, or electromagnetic emissions during cryptographic operations can leak sensitive keys. Resource-constrained meter processors often lack hardware cryptographic accelerators with side-channel protections, making software implementations more vulnerable to these attacks.

Access Control Bypass Vulnerabilities

DLMS/COSEM implements hierarchical access control using association objects that define what operations different client types can perform. Vulnerabilities in access control enforcement allow attackers to perform privileged operations without proper authorisation. This includes reading sensitive data intended only for utility access, modifying meter configuration parameters, executing administrative methods, or updating firmware.

Logic errors in association state management can leave meters in states where security checks are bypassed. Race conditions in multi-threaded implementations may allow attackers to exploit timing windows where access control validation is incomplete. The complexity of COSEM’s object-oriented model with inheritance hierarchies and access right combinations creates opportunities for subtle access control mistakes.

Physical and Local Network Attacks

Smart meters typically provide optical communication ports for maintenance and meter reading. These interfaces usually implement less stringent security than remote WAN connections, creating local attack vectors. Attackers with physical access can potentially extract cryptographic keys from meter memory, modify firmware through debug interfaces, or perform timing attacks on cryptographic operations.

In HAN environments where multiple meters and devices communicate, attackers compromising one device can potentially attack others on the same network. The transition from isolated meters to networked smart metering infrastructure expands the attack surface beyond individual device compromise to include network-level attacks.

Denial of Service Vulnerabilities

DLMS/COSEM implementations must handle various error conditions and malformed messages gracefully. Vulnerabilities that cause meters to crash, enter endless loops, or consume excessive resources enable denial of service attacks. Indefinite length encoding in ASN.1/BER allows messages without predetermined size, potentially causing parsers to exhaust memory or processing time. Deeply nested structures or excessively large arrays can trigger resource exhaustion.

For utilities managing millions of meters, denial of service vulnerabilities are particularly concerning when amplification or cascading effects could disrupt large numbers of devices simultaneously. Recent research has identified vulnerabilities where carefully crafted messages can cause meters to become unresponsive, requiring manual intervention to restore functionality.

Real-World Impact of COSEM Vulnerabilities

DLMS/COSEM vulnerabilities have demonstrated serious real-world consequences across smart metering deployments globally, highlighting the importance of comprehensive security testing.

Billing Fraud and Energy Theft: Vulnerabilities enabling unauthorised modification of meter readings or tariff parameters facilitate sophisticated energy theft. Unlike traditional meter tampering that requires physical access and often leaves evidence, remote attacks exploiting DLMS/COSEM vulnerabilities can be performed covertly from outside premises. Large-scale exploitation could result in significant revenue losses for utilities. Security testing has revealed meters vulnerable to reading manipulation through accessible communication interfaces, emphasising the need for robust cryptographic protection and access control validation.

Consumer Privacy Violations: Smart meters collect granular energy consumption data revealing detailed information about household activities, occupancy patterns, and appliance usage. Vulnerabilities allowing unauthorised access to this data threaten consumer privacy. Load profile data analysis can infer daily routines, identify when premises are unoccupied, and even recognise specific appliances based on consumption signatures. Some jurisdictions mandate strict data protection requirements for smart metering systems, making privacy vulnerabilities potential regulatory compliance failures.

Service Disruption and Infrastructure Attacks: Vulnerabilities enabling remote meter disconnection could allow attackers to disrupt energy supply to multiple premises simultaneously. While utilities implement safeguards preventing unauthorised disconnection, weaknesses in these protections have been identified in some deployments. Denial of service attacks exploiting parsing vulnerabilities or resource exhaustion could render meters unresponsive, preventing legitimate utility operations and potentially requiring expensive truck rolls to restore functionality.

Lateral Movement to Utility Networks: Compromised smart meters can potentially serve as entry points for broader attacks against utility infrastructure. Attackers establishing persistent access to meters connected to utility head-end systems could use them as pivots to probe for vulnerabilities in back-end networks, extract sensitive operational data, or position themselves for more significant attacks. The large-scale deployment of smart meters creates numerous potential entry points that attackers can probe for weaknesses.

Supply Chain and Firmware Compromise: Vulnerabilities in firmware update mechanisms could allow attackers to install malicious firmware on deployed meters. Supply chain attacks introducing compromised components or firmware during manufacturing could affect thousands of meters before detection. The long operational lifetime of smart meters means vulnerabilities may persist for years unless secure update mechanisms enable rapid patching.

Testing DLMS/COSEM Implementations with ProtoCrawler

CyTAL’s ProtoCrawler provides comprehensive DLMS/COSEM security testing capabilities specifically designed to identify vulnerabilities in smart meter implementations before deployment. Our approach combines intelligent fuzzing, protocol-aware testing, and security suite validation to ensure robust meter security.

Multi-Layer Protocol Fuzzing

ProtoCrawler generates sophisticated test cases targeting all layers of the DLMS/COSEM protocol stack. Transport layer fuzzing tests HDLC frame parsing, TCP/IP wrapper handling, and communication profile implementations. Application layer fuzzing targets DLMS APDU parsing, service request handling, and response generation. Data model fuzzing exercises COSEM object attribute access, method invocation, and OBIS code handling.

Our fuzzing engine understands DLMS/COSEM message structure, enabling generation of syntactically valid messages with targeted mutations that exercise specific code paths. This protocol-aware approach achieves deeper testing coverage than blind fuzzing while identifying vulnerabilities that only appear when processing structurally valid but semantically malicious messages.

Security Suite Compliance Testing

ProtoCrawler validates correct implementation of DLMS/COSEM security suites including authentication mechanisms, encryption algorithms, and message authentication. We test that meters properly reject messages with invalid authentication credentials, detect and reject messages with manipulated authentication tags, correctly handle key updates and key rotation scenarios, and enforce access control policies across different association types.

Security suite testing identifies implementation errors that could allow authentication bypass, message tampering, or unauthorised access. We verify that meters correctly implement all mandatory security features specified for their target security suite and validate proper handling of edge cases in cryptographic operations.

ASN.1/BER Parser Testing

Given DLMS’s reliance on [LINK: ASN.1] with BER encoding, ProtoCrawler includes specialised testing for ASN.1 parser vulnerabilities. We generate malformed ASN.1 structures with invalid length encodings, type mismatches, deeply nested elements, and indefinite length constructions. This testing identifies buffer overflows, integer overflows, and denial of service vulnerabilities in message parsing code that processes data before authentication validation.

Our testing specifically targets message components decoded before security validation—the attack surface most accessible to remote attackers without valid credentials.

OBIS Code and Object Model Testing

ProtoCrawler tests COSEM object model implementations by accessing objects using malformed OBIS codes, invoking methods with invalid parameters, and attempting operations exceeding authorised access levels. This identifies vulnerabilities in object access validation, parameter handling, and state management within the COSEM object-oriented framework.

We test boundary conditions including accessing non-existent objects, reading write-only attributes, writing read-only attributes, and invoking methods in inappropriate states. These tests reveal access control weaknesses and error handling vulnerabilities.

Communication Profile Coverage

ProtoCrawler supports testing across multiple DLMS/COSEM communication profiles including HDLC over optical and serial interfaces, TCP/IP wrapper for ethernet and cellular, and  PRIME and G3-PLC profiles. This ensures security validation across all communication paths that deployed meters will use, as vulnerabilities may exist in one communication profile implementation while others remain secure.

Denial of Service and Resource Exhaustion

We systematically test meter resilience against denial of service attacks by sending messages designed to consume excessive processing time, memory, or other resources. Tests include deeply nested structures, extremely large arrays, indefinite length encodings, and rapid message sequences. ProtoCrawler monitors meter responsiveness, resource consumption, and recovery behaviour to identify conditions causing service disruption.

Automated Regression Testing

ProtoCrawler integrates into continuous integration workflows, automatically testing meter firmware with every build. This catches vulnerabilities introduced during development and validates that security fixes don’t inadvertently break existing functionality. Automated testing enables rapid iteration while maintaining security assurance throughout the development lifecycle.

Best Practices for DLMS/COSEM Security

Organisations developing, deploying, or operating DLMS/COSEM smart metering systems should implement comprehensive security practices addressing all aspects of the protocol stack and operational environment.

Implement Latest Security Suite

Deploy meters supporting the strongest security suite appropriate for your operational requirements and infrastructure. Migrate away from Security Suite 0 which provides no encryption or message authentication. Implement Security Suite 1 at minimum, using AES-128-GCM for authenticated encryption. Consider Security Suite 2 for applications requiring additional protections including ECDSA signatures and enhanced key management.

Ensure backward compatibility considerations don’t inadvertently weaken security by allowing fallback to weaker security suites without explicit authorisation and logging.

Strong Key Management Practices

Implement robust cryptographic key management including secure key generation using hardware random number generators, protected key storage in secure elements or encrypted memory, regular key rotation following defined schedules, and secure key distribution procedures for initial provisioning and updates.

Avoid hardcoded keys, default passwords, or keys derived from predictable values like serial numbers. Implement separate keys for different security contexts and roles, preventing key compromise from affecting all system functions.

Rigorous Input Validation

Validate all input at multiple layers. Perform preliminary message structure validation before cryptographic processing to catch obviously malformed messages early. After decryption and authentication, validate semantic correctness including OBIS code validity, parameter ranges, type consistency, and state appropriateness before executing operations.

Implement comprehensive error handling that fails securely, logging security-relevant events without leaking sensitive information in error messages that attackers could exploit.

Minimal Attack Surface

Disable unnecessary communication interfaces and protocols. If optical communication isn’t required in your deployment, disable it. Implement network segmentation separating meter communication from other networks. Use firewalls and access controls restricting which systems can communicate with meters.

Limit available COSEM objects and methods to only those required for operational needs. Disable administrative functions on production meters when not actively needed.

Secure Development Lifecycle

Integrate security throughout the development process including threat modelling during design, secure coding training for developers, automated security testing with tools like  ProtoCrawler, manual code review focusing on security-critical components, and independent security assessment by external experts.

Maintain security awareness of DLMS/COSEM vulnerability research and promptly address applicable issues in your implementations.

Firmware Update Security

Implement secure firmware update mechanisms including digital signature verification of update packages, rollback protection preventing installation of older firmware versions, atomic update procedures that maintain operational state if updates fail, and secure delivery channels for distributing updates.

Test firmware updates thoroughly before deployment, including security regression testing to ensure updates don’t reintroduce previously fixed vulnerabilities.

Physical Security Controls

Implement tamper detection and response mechanisms. While DLMS/COSEM addresses communication security, physical attacks remain threats. Use tamper-evident seals, detect and log physical access attempts, and implement secure boot mechanisms preventing unauthorised firmware modification.

Monitoring and Incident Response

Implement security monitoring detecting anomalous behaviour including repeated authentication failures, unexpected configuration changes, unusual communication patterns, and messages from unexpected sources. Define incident response procedures for security events and maintain relationships with security researchers and the DLMS User Association for vulnerability information sharing.

DLMS/COSEM Across Global Smart Metering Markets

DLMS/COSEM’s international standardisation has driven adoption across diverse markets with varying regulatory requirements, infrastructure characteristics, and security priorities.

European Deployments: European utilities have deployed DLMS/COSEM extensively, driven by EU directives promoting smart metering rollout. European implementations often emphasise strong security given privacy regulations like GDPR and  Smart Metering Security in Critical Infrastructure protection requirements. Many European deployments use PLC communication technologies PRIME, G3-PLC combining DLMS/COSEM application layers with PLC-specific physical and data link layers.

Security requirements vary across EU member states, with some mandating specific security suites, certification schemes, or security testing methodologies. Germany’s smart meter gateway specification defines particularly stringent security requirements including security modules certified under Common Criteria, though gateway architectures differ somewhat from direct DLMS/COSEM meter access models used elsewhere.

North American Markets: While North America has historically used diverse metering protocols including ANSI C12.18/C12.19, DLMS/COSEM adoption is increasing particularly in advanced metering infrastructure modernisation projects. North American deployments often use cellular (GPRS/4G/5G) communication for WAN connectivity, placing greater emphasis on cellular security alongside DLMS/COSEM application layer security.

Asia-Pacific Implementations: Massive smart metering programmes in countries like India and China use DLMS/COSEM extensively. These deployments face unique challenges including vast scale, diverse geography, varied infrastructure quality, and wide-ranging use cases. Security priorities balance technical requirements with operational realities of managing millions of meters across challenging environments.

African and Middle Eastern Markets: Growing smart metering adoption in these regions often uses DLMS/COSEM for standardisation and interoperability benefits. Pre-paid metering applications are particularly common, raising specific security concerns around payment systems and credit management. Mobile network connectivity (including 2G/3G where still available) provides practical communication options in areas lacking fixed infrastructure.

Water and Gas Metering: While electricity metering dominates DLMS/COSEM deployment, the protocol’s multi-utility capabilities support water and gas applications. Battery-powered water and gas meters face additional constraints including limited processing power for cryptography, infrequent communication cycles affecting key management, and harsh deployment environments. Security testing must account for these resource-constrained implementations.

The Future of DLMS/COSEM Security

DLMS/COSEM continues evolving to address emerging security challenges and accommodate new technologies reshaping smart metering and smart grid infrastructure.

Enhanced Security Suites: Future DLMS/COSEM security suite evolution will address emerging cryptographic threats including post-quantum cryptography considerations as quantum computing advances threaten current public key algorithms. Development of Security Suite 3 and beyond will incorporate lessons learned from vulnerability research and operational experience with earlier suites.

IoT and Edge Computing Integration: Smart meters increasingly integrate with broader IoT ecosystems and edge computing infrastructure. Future DLMS/COSEM development will address security implications of these integrations including secure APIs for third-party applications, blockchain-based solutions for decentralised energy markets, and edge analytics processing sensitive consumption data locally.

5G and Advanced Connectivity: 5G network capabilities enable new smart metering applications including real-time grid management, vehicle-to-grid integration, and distributed energy resource coordination. DLMS/COSEM evolution will accommodate these use cases while addressing security implications of increased connectivity and reduced latency tolerances.

Standardised Security Testing: Industry recognition of security testing importance is driving development of standardised testing methodologies and certification schemes. The DLMS User Association’s qualification programme includes security testing requirements. Future developments may include more comprehensive test suites, reference implementations for validation, and harmonised certification schemes recognised across multiple markets.

Artificial Intelligence and Anomaly Detection: Machine learning applications for detecting anomalous meter behaviour, identifying attack patterns, and predicting security incidents will become increasingly sophisticated. Integration of AI-driven security monitoring with DLMS/COSEM infrastructure offers potential for earlier threat detection and automated response capabilities.

Despite these advances, the large installed base of existing meters means legacy DLMS/COSEM implementations will remain operational for years. Ongoing security testing, vulnerability monitoring, and patch management will remain essential even as newer security technologies deploy.

Frequently Asked Questions About COSEM Security Testing

Q: What’s the difference between COSEM and DLMS?

COSEM (Companion Specification for Energy Metering) defines the object-oriented data model representing all meter functionality, while DLMS (Device Language Message Specification) defines the application protocol for accessing that model. Together they form DLMS/COSEM, the complete protocol suite standardised as IEC 62056. COSEM provides the “what” (the data structures and objects), while DLMS provides the “how” (the communication protocol). In security testing, both components require validation—COSEM object access control and DLMS message parsing both present potential vulnerability sources.

Q: Which DLMS/COSEM security suite should we implement?

At minimum, implement Security Suite 1 providing AES-128-GCM authenticated encryption. Security Suite 0 offers only basic password authentication without encryption and should be avoided for any deployment carrying security requirements. Security Suite 2 adds ECDSA digital signatures and enhanced key management, appropriate for high-security applications. Your choice depends on regulatory requirements, infrastructure capabilities, and threat model. ProtoCrawler can test implementations across all security suites, ensuring correct implementation regardless of your choice.

Q: How does DLMS/COSEM security testing differ from general protocol testing?

DLMS/COSEM testing requires specialised understanding of the multi-layer protocol stack including [LINK: ASN.1]/BER encoding, COSEM object model, OBIS addressing, various communication profiles, and multiple security suites. General protocol fuzzers lack this domain knowledge and cannot effectively generate test cases exercising deeper protocol logic where many vulnerabilities exist. [LINK: ProtoCrawler]‘s DLMS/COSEM-specific capabilities generate sophisticated test cases that reach vulnerability-prone code paths inaccessible to generic testing approaches.

Q: Can DLMS/COSEM vulnerabilities affect other utility infrastructure?

Yes, compromised meters can potentially serve as entry points for broader attacks. Meters communicate with head-end systems connected to utility back-end networks. Attackers establishing persistent access through meter vulnerabilities could use them as pivots to explore utility networks, probe for additional vulnerabilities, or position themselves for attacks on critical infrastructure. Defence-in-depth including network segmentation, intrusion detection, and comprehensive security monitoring helps limit the potential impact of meter compromises.

Q: How frequently should we test DLMS/COSEM implementations for vulnerabilities?

Conduct comprehensive security testing during initial development, before major firmware releases, and whenever updating DLMS/COSEM libraries or cryptographic components. Implement continuous fuzzing in development environments catching vulnerabilities early in the development cycle. Re-test quarterly or when security research discloses new vulnerability classes affecting DLMS/COSEM implementations. For critical infrastructure applications, maintain ongoing automated testing supplemented by annual independent security assessments. ProtoCrawler‘s CI/CD integration enables continuous validation throughout the development lifecycle.

Get Started with DLMS/COSEM Security Testing

Protect your smart metering infrastructure from DLMS/COSEM vulnerabilities before deployment. CyTAL’s ProtoCrawler provides comprehensive Protocol testing services specifically designed for DLMS/COSEM implementations, identifying parsing vulnerabilities, cryptographic weaknesses, and access control flaws.

Our DLMS/COSEM security testing services include:

  • Multi-layer protocol fuzzing covering transport, application, and data model layers
  • Security suite compliance validation across all authentication and encryption options
  • [LINK: ASN.1]/BER parser vulnerability testing
  • COSEM object model access control validation
  • Communication profile testing for HDLC, TCP/IP, PRIME, and G3-PLC variants
  • Denial of service and resource exhaustion testing
  • Automated regression testing integration for continuous validation
  • Detailed vulnerability reports with remediation guidance

Ready to secure your DLMS/COSEM smart meters? Contact CyTAL today to schedule a ProtoCrawler demonstration or discuss your Utility smart meter security testing requirements with our protocol security experts.

Request a Demo

Related Blog Posts & Resources

Explore COSEM/DLMS security testing for global smart metering and utility infrastructure:

Industrial & Utility Security:

Protocol Fuzzing & Testing:

Data Protection & Privacy:

Regulatory Compliance:

Comprehensive Security:

COSEM/DLMS security is essential for smart metering deployments worldwide. Discover ProtoCrawler’s COSEM testing capabilities or request a smart metering security assessment.

Related protocols

DLMS Client

DLMS Server

Related services

Evaluate a product or system

Related industries

Smart Energy