Threat Model
Status: DRAFT
Method: STRIDE + physical/device lifecycle threats.
| ID | Category | Threat | Existing control | Gap / action |
|---|---|---|---|---|
| T-001 | Spoofing | attacker impersonates another gateway | NATS JWT, VPN | VERIFY unique credentials per device |
| T-002 | Spoofing | cloned SD card reuses device credentials | backend serial binding | serial is not cryptographic proof; add credential binding/revocation |
| T-003 | Tampering | command modified in transit | VPN/NATS secure transport | document TLS configuration |
| T-004 | Tampering | attacker modifies filesystem on removed microSD | TODO | evaluate read-only rootfs / secure element / integrity controls |
| T-005 | Repudiation | operator denies changing inverter mode | TODO | add immutable/auditable command log |
| T-006 | Information disclosure | device key extracted from SD | file permissions | evaluate secure element and credential rotation |
| T-007 | DoS | command flood exhausts gateway | TODO | rate limits / queue limits / watchdog |
| T-008 | Elevation | remote actor gets unrestricted Modbus write | semantic command model | verify raw register API is impossible |
| T-009 | Supply chain | vulnerable dependency included in image | TODO | SBOM + CVE scan |
| T-010 | Update | malicious update package installed | TODO | signed OTA + verification |
| T-011 | Availability | VPN/NATS/backend unavailable | local operation | document fail-safe behavior |
| T-012 | Enrollment | attacker claims another device serial | e-mail + serial registration | add proof-of-possession / activation secret if not present |