Cyber-Physical Zero-Trust Architecture for the Grid Edge.

Table of Contents

• 01   Architectural Thesis & Threat Modeling
• 02   Hardware Specifications & Edge Computing
• 03   Hardware Root of Trust & Immutable Identity
• 04   Network Sovereignty & Financial Settlement
• 05   Physical Defense, Resilience & Compliance
• 06   Defense Against Adversarial AI (AAI)

Sovereign-grade financial enforcement.

The MEZURA UMS rejects the legacy perimeter-defense model in favour of a Cyber-Physical Zero-Trust Architecture (CP-ZTA). Trust is ephemeral, mathematically verified per-transaction, and anchored permanently in immutable silicon.

1.1 Executive Preamble

The prevailing architecture for Advanced Metering Infrastructure (AMI) relies on a Perimeter Defense model — assuming an inherent layer of trust within the utility network and relying on static cryptography (e.g. STS Token Identifiers) and perimeter firewalls for value transfer. This model is demonstrably obsolete in an era defined by generative algorithmic attacks, supply-chain interdiction, and physical edge compromise.

Within the MEZURA paradigm, no device, user, or network packet is implicitly trusted based on location or ownership. The HRoT, MKRE, and ARDP converge to create a decentralised utility node resistant to state-level intrusion and algorithmic counterfeiting.

1.2 The Sovereign Node Concept

The fundamental unit of the MEZURA architecture is the Sovereign Node (the UMS). Unlike legacy smart meters, which function as passive telemetry endpoints, the MEZURA UMS is engineered as an active Distributed Financial Enforcement Node.

1.2.1 The Tri-Plane Integrity Model

The UMS architecture enforces strict isolation across three operational planes, physically converging only at the secure element (TPM) boundary:

1.2.2 Defense-in-Depth Topology

Five concentric layers of defense isolate the core settlement engine from external threat vectors:

1.3 Adversarial Threat Model · STRIDE Framework

The MEZURA architecture is preemptively hardened against specific, high-sophistication threat vectors relevant to Critical National Infrastructure (CNI). Each STRIDE category is mapped directly to architectural mitigations:

S · Spoofing — The "Cloning" Attack

Threat Vector: An adversary physically extracts firmware from a legitimate meter and flashes it onto generic, unauthorised hardware to create a clone meter designed to falsify consumption data or siphon credit.

MEZURA Mitigation — Hardware-Bound Identity: Identity private keys (PrK_ID) are generated on-die within the Infineon OPTIGA™ TPM SLB 9672 and flagged as non-exportable at silicon level. MKRE firmware sends signing requests but never possesses the key. A cloned binary on generic hardware fails Secure Boot and cannot sign — rendering the unit completely inert.

T · Tampering — Man-in-the-Middle Attack

Threat Vector: An adversary intercepts communication between the Head End System (HES) and the UMS to inject false tariff commands or replay old, valid credit tokens.

Mitigation — Cryptographic Non-Repudiation & Nonce Freshness: All traffic via WireGuard Sovereign Tunnel (Noise Protocol Framework) with key rotation every few minutes (Perfect Forward Secrecy). Critical commands require mTLS signatures. ARDP enforces Nonce-Based Challenge/Response — every packet wraps a unique time-bounded nonce from the UMS TPM's TRNG. Replays are mathematically invalid.

R · Repudiation — "I Didn't Use That" Attack

Threat Vector: A consumer claims they did not consume a specific amount of energy, or a municipality denies receiving a distributed revenue split.

Mitigation — Atomic Ledger Synchronisation: Every consumption event triggers a micro-transaction signed by the device's physical TPM. Signed receipts are pushed to the Immutable Audit Log at the National Audit Node. Because signature generation requires the physical chip, mathematical non-repudiation is achieved.

I · Disclosure — RAM Scraping Attack

Threat Vector: A sophisticated attacker gains root access to the OS and scans Random Access Memory (RAM) to locate and extract the Wallet Private Key during an active transaction.

Mitigation — Memory-Safe Key Handling: The Wallet Private Key (PrK_Wallet) never enters system RAM (DDR). All cryptographic signing (RSA-PSS or ECDSA) occurs entirely inside the shielded memory of the TPM SLB 9672. The ARM Cortex-A76 receives only the resulting signature — the secret is never exposed to the host OS.

E · Elevation — "Ghost Token" / AI Attack

Threat Vector: Using Generative AI, machine learning, or brute-force compute to reverse-engineer legacy symmetric key generation algorithms (such as STS) to create valid-looking but fraudulent electricity tokens.

Mitigation — Algorithm Retirement & Asymmetric PKI: MEZURA completely deprecates the STS token standard. Value transfer relies exclusively on ISO 20022 digitally signed messages, anchored by asymmetric cryptography (RSA-2048 / ECC-256). There is no static algorithm to reverse-engineer. To forge a token, an attacker (or AI) would need to break standard PKI — computationally infeasible.

Laptop-class compute at the grid edge.

The MEZURA UMS deploys laptop-class edge computing directly at the grid edge — transcending the 8-bit/sub-100MHz constraints of legacy AMI infrastructure.

2.1 Computational Superiority — The "Power Gap"

Traditional AMI and STS prepaid meters are constrained to 8-bit to 32-bit microcontrollers running at sub-100MHz frequencies — passive telemetry recorders entirely dependent on cloud servers for logic. The UMS transcends this limitation:

2.2 Memory & Sovereign Forensic Storage

Standard smart meters house 16MB–256MB of flash storage, retaining only days of telemetry before cloud offload. The UMS operates as an independent relational database node:

2.3 Multi-Utility & Dual-Source Logic

The legacy grid treats solar generation and municipal consumption as isolated systems requiring separate infrastructure. The UMS acts as a unified digital backbone, synchronising multiple utility streams concurrently.

• Dual-Source Inputs: Concurrent inputs from Grid (Eskom) and Solar (PV) sources at 230VAC, 80A Single Phase. High-accuracy, dual-path metering eliminates parallel hardware.
• Dynamic Load Control: Onboard AI and real-time price/availability signals shift heavy domestic loads (HVAC, geysers) to solar during peak generation — autonomously optimising LCOE.
• Universal Edge Gateway: Multi-channel remote metering integrations for Water, Gas, and Heat sensors. A single digital billing and management perimeter for the entire property.

2.4 The Connectivity Matrix · NNOC Node Infrastructure

Trust anchored in immutable silicon.

A rigorous Chain of Trust (CoT) originates within the immutable silicon of the SoC, ensuring no unauthorised, modified, or maliciously injected code can execute on the device.

3.1 The Secure Boot Pipeline · Chain of Trust

Stage 0 — Root Anchor · OTP Fusing: During manufacturing provisioning, the SHA-256 hash of the Mezura Product Authority Public Key (PUB_MPA) is permanently laser-fused into the One-Time Programmable memory array of the SoC. The Boot ROM retrieves this hash on power-up — immutable Trust Anchor.

Stage 1 — Bootloader Verification: Boot ROM loads the Second Stage Bootloader into SRAM and verifies its digital signature (RSA-2048-PSS) against the fused OTP hash. Failure triggers a silent halt (SIG_STOP) — boot execution is prevented.

Stage 2 — Kernel Handover: The bootloader performs a secondary cryptographic verification against the Mezura OS Signing Key stored in EEPROM — guaranteeing only a kernel signed by Mezura Engineering can interface with hardware peripherals.

3.2 TPM 2.0 Implementation & Measured Boot

The Infineon OPTIGA™ TPM SLB 9672 operates on the SPI bus as an isolated, tamper-resistant cryptographic vault. Each boot stage is "extended" into the TPM's Platform Configuration Registers (PCRs):

A unique state fingerprint is created. If a single bit of the kernel is maliciously modified (e.g. an attacker enabling SSH root access), PCR[4] permanently changes — flagging the system as compromised. The Identity Key (IdK) used to sign ARDP transactions carries the fixedTPM attribute, making the private key mathematically impossible to export.

3.3 The "Sealed Wallet" Cryptographic Logic

A critical vulnerability in legacy off-grid meters is offline extraction — where an attacker desolders the eMMC storage chip, mounts it to a Linux PC, and extracts wallet balances and cryptographic keys. MEZURA eliminates this via Data Sealing.

• PCR-Bound Sealing: The Wallet Database Encryption Key (K_DB) is not stored in a flat config file. It is cryptographically sealed inside the TPM against the system's PCR states.
• Unsealing Logic: At boot, the OS requests K_DB from the TPM. The TPM checks its own PCR values — if PCR[4] matches the factory hash (kernel untampered), the key is released. If an attacker modified the kernel to dump RAM, PCR[4] changes, the request is denied, and the SQLite wallet remains AES-256 ciphertext.
• Volatile Key Lifecycle: Once unsealed, K_DB resides strictly in protected MKRE container RAM. If the chassis tamper switch fires, an interrupt issues memset() to zero the RAM location of K_DB — locking the wallet before physical penetration completes.

3.4 Hardware Entropy & Nonce Generation

Financial security in decentralised networks relies on entropy quality. Standard Linux software generators (/dev/urandom) can be predictable on embedded edge devices.

• PRNG Disabled: The UMS completely disables the software pseudo-random number generator for cryptographic operations.
• Silicon Thermal Noise: All nonces utilised for ARDP Challenge/Response protocols are sourced directly from the TPM's physical TRNG, relying on the unpredictable thermal noise of the silicon mechanics.
• Auditability: TRNG output is fully compliant with NIST SP 800-90B entropy source requirements — mathematically ensuring that anti-replay nonces are unpredictable and statistically unique.

The "invisible grid".

The UMS rejects "Public IP Exposure" — operating exclusively within a Software-Defined Perimeter that renders the device invisible to unauthorised network entities, agentic AI scanners, and DPI probes.

4.1 Software-Defined Perimeter · The "Invisible Grid"

• Sovereign Tunnel: Encrypted overlay via Noise Protocol Framework (ChaCha20-Poly1305). Peer coordination by sovereign Headscale controller in the National Audit Node — no third-party SaaS relays.
• Key Rotation & NAT: STUN/DERP relaying traverses Carrier-Grade NAT without static public IPs. WireGuard ephemeral session keys rotate every 180 seconds — Perfect Forward Secrecy enforced.
• "Default Deny" Firewall: Linux nftables enforces strict whitelist. All inbound on WAN/4G is dropped — no SSH, HTTP, or ICMP. The device does not respond to external pings. To external attackers, the UMS is a "Black Hole".
• DPI Evasion: Application traffic (MQTT/HTTPS) encapsulated inside UDP WireGuard tunnel — packet sizes and timing padded to obfuscate flow, masking telemetry vs. financial transactions.

4.2 The ARDP Engine & ISO 20022 Financial Payloads

The Autonomous Revenue Distribution Protocol (ARDP) delivers banking-grade ACID assurance properties — Atomicity, Consistency, Isolation, and Durability. All financial payloads (Top-ups, Settlements, Tariffs) follow the ISO 20022 financial messaging standard (Camt.053 for credit syncs, Pacs.008 for revenue splits).

The Cryptographic Signing Chain

Every value-bearing transaction is constructed, normalised, and signed by hardware before transmission — establishing mathematical, non-repudiable proof of origin from a specific physical UMS device:

1. Payload Generation: MKRE constructs the XML payload — Instruction ID, Amount, Currency, Creditor Account.
2. Canonicalisation: XML normalised via C14N for byte-for-byte consistency across receiving systems.
3. Hardware Signing: The cryptographic hash of the canonicalised payload is routed to the TPM secure element.
4. Signature Execution: TPM signs the hash using the non-exportable Identity Private Key (PrK_ID). The key never leaves silicon.
5. Final Output: The bundle — raw ISO 20022 XML plus detached RSA-PSS-SHA256 signature — is transmitted upstream for settlement.

4.3 Non-Repudiation & Double-Spend Protection

• Mathematical Non-Repudiation: The Upstream Banking Node validates against the device's Public Key (PuK_ID). Because the private key cannot leave the TPM silicon, a valid signature is absolute proof that the specific physical meter generated the transaction.
• Strict Nonce Enforcement: Every financial packet includes a UUIDv4 Global Transaction ID (GTID). MKRE maintains a persistent atomic SQLite ledger of processed GTIDs — duplicates are instantly rejected.
• Atomic Commits: Ledger write and Credit Balance update occur in a single database transaction. If power fails mid-transaction, the journal automatically rolls back — preventing phantom credit generation.

4.4 The Offline "Air-Gap" Protocol (MAGP)

When WAN/4G is unavailable, the UMS allows localised UMA app interaction over Wi-Fi or BLE. This Air-Gap interface is secured via the Mezura Air-Gap Protocol (MAGP):

1. The Challenge: UMA App requests connection over WPA3-Encrypted Wi-Fi. The UMS generates a 32-byte nonce via TPM TRNG and sends it to the App. Valid for 60 seconds.
2. The Envelope: App retrieves the previously-signed Credit Token, signs it alongside the Meter Nonce to create a Transfer Envelope, and transmits to the UMS.
3. The Verification: UMS verifies the nonce matches the one in RAM (Proof of Liveness) and verifies the Bank's Root CA signature on the token (Proof of Value). Credit loaded; nonce immediately invalidated.

The local web interface operates behind a hardened Nginx Reverse Proxy — limits requests to 5/sec to prevent fuzzing, strips version headers to prevent fingerprinting, and strictly whitelists the /api/v1/public/* endpoint. All admin/logic-engine paths return 403 Forbidden at the proxy level.

Active mesh defense.

Deployed in highly uncontrolled, hostile environments, the UMS treats its physical enclosure as the frontline cyber-defense layer — implementing an Active Mesh Defense strategy.

5.1 Active Kinetic Defense & Sensor Fusion

• Chassis Intrusion Loops: Multi-modal active-low GPIO circuits routed through enclosure mechanical seams. Any physical separation triggers an immediate, unmaskable hardware interrupt (IRQ_TAMPER).
• Inertial Measurement Unit: ST LIS2DTW12 MEMS Accelerometer continuously monitors vibration signatures. MKRE differentiates ambient environmental noise from continuous high-frequency vibrations (drilling, sawing, prying).
• Supply Chain Integrity: Anti-Interdiction — enclosures sealed with serialised holographic labels. On first boot, the UMS verifies serial numbers of critical peripherals (4G Modem, LoRa) against the "As-Built" manifest at the National Audit Node.

5.2 The "Scorched Earth" Response Logic

Upon definitive validation of a physical breach event while powered, the system executes an automated, multi-stage defensive routine within 200 milliseconds:

1. Load Shed · Safety: Internal latching relays driven to OPEN (Disconnected) state — preventing unsafe bypass wiring while live.
2. Cryptographic Erasure · Data: MKRE issues a critical TPM2_Clear command to the Infineon SLB 9672 — permanently evicting the Identity Private Key (PrK_ID) and Wallet Storage Key (SRK), and resetting the TPM ownership hierarchy. The device is cryptographically bricked.
3. Distress Beacon · Network: Utilising residual capacitor energy, a "Last Gasp" high-priority alarm packet broadcasts via LoRaWAN — alerting the Regional Utility Node to the precise GPS coordinates and tamper event nature.

5.3 Business Continuity & Disaster Recovery (BCDR)

Classified as Critical National Infrastructure (CNI), the architecture survives catastrophic loss of the National Node, localised grid collapse, or individual device corruption.

• "Golden Key" Root CA: Root Certificate Authority private key never stored online — resides on a FIPS 140-2 Level 3 HSM in an air-gapped physical bank vault. Operational signing via Intermediate CAs with 90-day lifespans. National Node compromise revokes Intermediate CA only — Root of Trust unbreached.
• Firmware Resilience: Dual-Bank A/B Storage prevents OTA-bricking. Updates written to inactive partition and verified against Mezura Release Key. Bootloader toggles active flag only after successful verification. Missing heartbeat for 120s triggers Hardware Watchdog rollback.
• "Black Start" Protocol: On total grid/National Node communication collapse, devices default to "Local Standalone" — continuing to meter energy and accept offline UMA app tokens via MAGP without server connectivity. Logs buffered in encrypted database for up to 30 days and drained upon network restoration.

5.4 Regulatory Compliance & E-Waste Sanitisation

Decommissioning: When a meter is retired, an authorised technician issues a cryptographically signed Decommission_Token. MKRE executes a NIST 800-88 Clear: overwriting the SQLite database with random-data passes, issuing TPM2_Clear, and burning a Decommissioned fuse bit in the BCM2712 OTP — permanently preventing re-enrollment.

Structural physics, not reactive software.

Cyberattacks are no longer limited to static scripts. Dynamic, learning autonomous agents adapt to defenses in real-time. MEZURA mitigates AAI threats through structural physics — not reactive software patches.

6.1 The AAI Threat Landscape · Three Primary Vectors

6.2 Algorithmic Immunity · "Ghost Token" Defense

Legacy STS systems rely on symmetric encryption — uniquely susceptible to AI-driven cryptanalysis. An AI trained on valid tokens can mathematically infer the generation seed, enabling catastrophic revenue stream exploitation.

• Asymmetric via HRoT: MEZURA entirely eliminates the "Token Generation Algorithm". Value transfer relies strictly on ISO 20022 digital signatures generated by unique RSA-2048 or ECC-256 private keys locked within each device's TPM.
• Computational Infeasibility: An AI cannot guess a private key — there is no pattern to learn. To forge a signature, an AAI would need to solve the Integer Factorization Problem for a 2048-bit key — computationally infeasible for classical AI. The attack surface forcibly shifts from Pattern Recognition (an AI's strength) to Physical Theft (an AI's weakness).

6.3 Invisibility to Agentic Scanners & Side-Channel Defense

• "Black Hole" Topology: The SDP utilising WireGuard and Headscale explicitly drops all inbound packets lacking cryptographic authentication. To an Agentic Scanner, the UMS IP is completely unresponsive — an AI cannot launch an automated exploit against a target it cannot detect.
• Hardware Noise Injection: Against Deep Learning Side-Channel Analysis, the OPTIGA™ TPM SLB 9672 employs internal shield logic and randomised wait-states — artificially obfuscating power signatures and EM emissions during cryptographic operations, breaking the AI's inference models.

6.4 Cognitive Security & Supply Chain Poisoning Defense

Generative AI introduces severe Deepfake threats — capable of high-fidelity social engineering attacks against network administrators. Additionally, AI agents can autonomously inject vulnerabilities into open-source upstream dependencies.

• M-of-N Multi-Sig Governance: MEZURA defends against deepfakes by mathematically removing unilateral human trust. Critical infrastructure commands (Tariff changes, Firmware OTA, Root Key revocation) require a physical quorum of hardware signatures — e.g. 3 of 5 authorised HSM keys held by geographically separated security officers. AI may deceive a human via deepfake; it cannot deceive a multi-sig cryptographic quorum.
• Signed SBOM & Measured Boot: If an AI poisons an upstream software dependency, the MEZURA Build Pipeline intercepts the threat. Every dependency is pinned by hash in a strict Software Bill of Materials. Secure Boot inherently verifies kernel and MKRE signatures — unsigned or modified binaries fail the hardware signature check, halting the CPU before the malicious AI payload can execute.