Unified BSI-TR-compliant security infrastructure for everything

A central cryptographic module for every application

One solution for everything! MTG CryptoController – comprehensive encryption & communication (BSI TR-03109) (© MTG)

The MTG CryptoController (MCC) is a cryptographic middleware specifically designed for the secure operation of smart metering infrastructures. Serving as the central cryptographic module for all applications—gateway administration (GWA), metering data reception as pEMT, and smart grid management and control as aEMT—the MCC ensures smooth and secure communication with smart meter gateways (SMGW) and between market participants. This applies whether communication occurs via AS4-based market communication (MAKO) or the BDEW Web API, for example during supplier changes (LFW 24) or the transmission of switching commands.

In addition to the reliable encryption and decryption of content data, the MCC handles validation, signing, and secure data transmission via TLS (Transport Layer Security) to communication partners. It also manages the connection to the root CA and sub-CAs of the SM-PKI and oversees all SM-PKI certificates for communication partners. By providing a centralized cryptographic infrastructure, the MCC enables you to meet all legal requirements of the Smart Meter PKI and operate all relevant applications manufacturer-independently and in full compliance with BSI TR-03109.

MTG CryptoController for AS4 based MAKO and BDEW-Web API

Any given application—whether AS4-based MAKO, BDEW Web API-driven supplier changes (LFW24), or switching communication between grid operators and MSBs—can be seamlessly linked to the necessary cryptography and Smart Meter PKI using the MCC API. The system is multi-tenant, fully scalable both horizontally and vertically, and built for high availability.

EMT applications are quickly integrated with the right interfaces (© MTG)

These tasks are performed by the MTG CryptoController:

• Special modules for AS4-based MAKO, BDEW-Web API for 24 h supplier changeover (LFW24) and for switching communication
• Certificate management (triples per participant)
• Renewal of certificates
• Own certificates (via connected sub-CA, e.g. DARZ.CA)
• Third-party certificates are obtained from other sub-CAs (LDAPs)
• Revocation lists and checking certificates of SM-PKI participants (GWA, EMT, Root & Sub CAs)
• 4-eyes principle: Certificate application & certificate renewal (Web Service Sub-CA)
• Management of access data and certificates of third-party sub-CAs
• BDEW Directory Service & Directory Service Query
• HSM connection

MTG CryptoController for use with the active EMT

The MTG Mehrwert-Konnektor is a specialized version of the MTG CryptoController, specifically developed for CLS management. It enables secure communication over the CLS channel and serves as a central security and communication hub for energy suppliers acting as active EMTs (aEMTs), allowing them to control end devices in a grid-friendly manner and deliver value-added services. When combined with the MTG CLS Stack, CLS devices can be quickly and easily connected to the SMGW infrastructure via TCP/IP, regardless of protocol, ensuring fast, flexible integration.

Detailed information is available here.

The MTG Mehrwert-Konnektor is a specific version of the MTG CryptoController, for efficient CLS Management (© MTG)

MTG CryptoController (MCC) – designed for SMGW manufacturers

Manufacturers of smart meter gateways can quickly and flexibly equip their hardware with the required quality seal certificates using the DARZ.CA and MTG CryptoController.

Leading SMGW manufacturers trust the MTG CryptoController in production (© MTG)