Overview

eGauge meters include multiple security features designed to protect meter data, configuration settings, user access, and network communications.

Current EG4xxx eGauge Core and Pro meters support encrypted communications, configurable user permissions, secure remote access, authenticated API connections, and the ability to disable services that are not required.

Local Data Storage

Measurement data is stored directly on the eGauge meter rather than being stored on the eGauge proxy service.

The proxy service provides remote access to the meter but does not act as the meter's primary data storage location.

This means:

• The meter continues recording data if Internet connectivity is lost.
• Meter data can be accessed directly from the local network.
• The meter can operate without an active Internet connection.
• Remote Internet access can be disabled if required by the site's security policies.

Encrypted Communications

EG4xxx meters support encrypted network communication to help protect meter data, credentials, and configuration information while it is transmitted across a network.

Depending on the connection and service being used, eGauge supports TLS 1.2 and TLS 1.3 encryption.

Encrypted communication is available for features including:

• Remote access through the eGauge.io proxy service
• Local HTTPS access to the meter
• HTTPS-based API connections
• HTTPS Data Sharing and other supported outbound connections

For local connections, unencrypted HTTP access can also be disabled so the meter only accepts secure HTTPS web connections.

FIPS 140-3 Compliant Proxy Encryption

The eGauge.io proxy service is configured to use FIPS 140-3-compliant cryptography for encrypted communications between supported eGauge meters and the proxy infrastructure.

FIPS-compliant encryption is also available for communication between supported web browsers and the eGauge.io proxy service.

The proxy service supports secure AES-GCM cipher suites, including:

• AES-128-GCM with SHA-256
• AES-256-GCM with SHA-384

TLS 1.3 is preferred for browser communication when supported. TLS 1.2 connections may also be supported using FIPS-compliant cryptography.

Secure Meter Authentication

The eGauge.io service authenticates EG4xxx meters using public-key authentication.

Each supported meter contains a private authentication key stored in non-removable media within the meter. This allows the proxy infrastructure to verify the identity of the meter and helps prevent an unauthorized device from impersonating an eGauge.

The private authentication key is not exposed to the user or transmitted as part of normal authentication.

Usernames, Passwords, and Permissions

eGauge meters support multiple user accounts rather than requiring all users to share one set of credentials.

Each account can be assigned permissions based on the level of access the user requires. This allows an administrator to provide access to meter data without necessarily allowing that user to modify meter configuration.

Meters manufactured after January 2021 are shipped with a unique factory-generated password printed on the meter label rather than a shared default password.

Passwords and user permissions can be changed through the meter's Access Control settings.

Site-Wide Password Protection

A site-wide password can be enabled to require authentication before users can view meter data.

Without site-wide password protection, some meter data may be intentionally available without authentication.

Enabling site-wide authentication is recommended when meter data should only be available to authorized users.

LAN-Only Administration

Meter administration can be restricted so configuration changes are only permitted when the user is connected to the same local network as the meter.

When LAN-only administration is enabled, remote users may still be able to view the meter, but protected configuration changes cannot be saved through the remote proxy connection.

This can be useful for organizations that want remote monitoring while requiring sensitive configuration changes to be made from the installation network.

Remote administration permissions can be managed through eGuard by authorized users.

Secure Remote Access

Remote access through eGauge.io uses a connection initiated outbound by the meter.

Because the meter initiates the connection, most installations do not require an inbound firewall rule or port forwarding to expose the meter directly to the Internet.

When a remote user accesses an eGauge through eGauge.io, the user connects to the eGauge.io proxy infrastructure rather than directly to the meter's public IP address. The meter's originating IP address is not provided to the remote browser.

This provides remote access without requiring the eGauge web server itself to be directly exposed to the Internet.

Remote Access Can Be Disabled

Remote proxy access is optional.

If an installation does not require remote access, the eGauge.io proxy service can be disabled. The meter will continue measuring, recording, and storing data and can still be accessed from the local network.

Network Services Can Be Disabled

The eGauge supports several network protocols for integration with other systems. Services that are not required should remain disabled.

Examples include:

• SSH – Disabled by default and reserved for factory maintenance and advanced troubleshooting.
• BACnet/IP – Disabled by default and only needs to be enabled when integrating with a BACnet building automation system.
• Modbus TCP – Disabled by default and only needs to be enabled when another system requires Modbus access.

Keeping unused network services disabled reduces the number of services available to other devices on the network.

Local HTTPS Certificates

EG4xxx meters running supported firmware can use a custom HTTPS certificate for secure local web access.

This allows organizations to use their own trusted certificate infrastructure when accessing the meter directly through the local network.

Custom certificates affect local HTTPS access and are separate from certificates used by the eGauge.io remote proxy service.

Secure API Authentication

The EG4xxx JSON Web API requires authentication using JSON Web Tokens (JWT).

API clients must first authenticate and obtain a temporary token before accessing protected API functions. Tokens typically expire after a short period and must then be renewed.

eGauge recommends using digest-based authentication to obtain a token because this avoids directly transmitting the meter password.

API integrations should use a dedicated meter account with only the permissions required by the application.

Firmware Security

eGauge periodically releases firmware updates that include bug fixes, new functionality, and security updates.

Installing a firmware update requires valid meter credentials.

Firmware downloaded by the meter is provided as a signed firmware file, helping ensure that the meter installs authorized eGauge firmware.

Supported meters can also be updated offline when Internet access is restricted.

Keeping the meter firmware current is recommended to ensure the latest available security improvements are installed.

eGuard Access Permissions

Organizations managing multiple eGauge meters can use eGuard to control which users have access to devices and groups of devices.

eGuard includes different permission levels for users, managers, and administrators. These permissions can be used to control who can:

• View assigned meters
• Manage meter groups
• Assign meters to groups
• Manage other users and their access
• This allows organizations to manage access without sharing a single eGuard account between employees.

Recommended Security Practices

For installations where network security is a concern, eGauge recommends:

• Keep meter firmware current.
• Change or securely store the factory credentials.
• Use strong, unique passwords.
• Create separate accounts for individual users and integrations.
• Grant users only the permissions they require.
• Enable site-wide password protection when meter data should not be publicly accessible.
• Use HTTPS for meter access.
• Disable unencrypted HTTP access when it is not required.
• Leave SSH, BACnet, Modbus, and other unused network services disabled.
• Use LAN-only administration when remote configuration is not required.
• Avoid exposing the meter directly to the Internet through port forwarding.
• Disable the proxy service when remote access is prohibited by the site's security policy.
• Coordinate network and firewall changes with the site's network administrator.
  
  Organizations with specific cybersecurity, compliance, or regulatory requirements should review their requirements with their network administrator and contact eGauge Support if additional product security information is required.