Energy Sector Digitilisation: A Security Framework Application for Role-Based Access Management

Data security and privacy in the energy sector and especially in buildings' energy management, is an emerging issue which cannot be underestimated, thus, calls for solid and robust solutions. The reliable functioning of energy management data platforms is essential for the efficient operation and performance of buildings, as well as the well-being of occupants. The fast-paced digital advances have aided this direction, but they have also created increased challenges for operation disruption mitigation and immutable services and outcomes. Data obtained from energy management systems frequently comprises highly sensitive and personal information. Consequently, access to such data, whether for reading purposes or for conducting experiments and research, must be strictly restricted and clearly defined. Through security frameworks data protection and information privacy, mitigation of risks and vulnerabilities can be ensured. In this paper, an end-to-end Security Framework is proposed for securing sensitive resources in energy management systems using Keycloak, OAuth2 and UMA 2 protocols as well as an extra security layer on top of the Keycloak, so as to enhance the overall security and avoid immediate interaction with Keycloak, which is the main user storage and access management component. The main concept of this framework is the controlled access of sensitive data and services, such as datasets, databases, functionalities, URLs, APIs, etc., leveraging the OAuth2 access tokens capabilities and the roles of the users. Our proposed architecture ensures that all the functionalities of the involved tools and protocols are properly secured end-to-end. The several existing functionalities of a number of tools and related protocols are properly leveraged and further extended, resulting to a fine-grained architecture with an extra security layer that offers administrative, security and identity access management and orchestration.