DYNAMO

A hundred thousand devices with economic identities, each one revocable in under half a second.

Open the live chamber in the app
The animated flow, the attack replays and the deep architecture run there; this page is the reference text.

Who this serves

• Distribution system operator. A hundred thousand meters, each one revocable in half a second.
• Battery and VPP operator. Sell the evening peak per reading, per device, per shift.
• EV charging network. Roaming settlement between operators without a clearing house.
• Factory microgrid. Machines buying power from the roof next door, inside declared ceilings.

The problem

A distributed grid has hundreds of thousands of devices that need to transact in fractions of a cent and be individually revocable within seconds. TLS gives you a channel. It does not give you an identity with an economic ceiling and a kill switch.

The system

DYNAMO is a distribution operator running 118,000 inverters, meters and batteries as economic actors. Every device is a workload with a SPIFFE identity and a short-lived certificate that renews itself. A rooftop battery in Aarhus sells 3.1 kWh into the evening peak and is paid per reading, in fractions of a cent, with the fee carved by the rail that moves the money. The site operator’s agents hold capability tokens scoped to one substation for one shift, so the blast radius of any single compromise is a data structure, not a hope.

At 17:42 a meter starts reporting impossible numbers. The operator revokes it. The revocation travels over the event stream and the device’s identity is dead in under half a second: its next reading has no one to be. The same action suspends its account and blocklists cross-frame receipt, so the value it holds is frozen in place. Every reading it ever signed is still on the ledger, which is how the forensics team finds the firmware bug by Thursday.

The cast and their ceilings

The flow, step by step

1. 17:41. A reading arrives, signed by the device’s own identity.
2. Settlement in fractions of a cent, fee carved in-rail.
3. The reading is on the ledger forever.
4. 17:42. Impossible numbers. The operator acts once.
5. Revocation rides the event stream. Under half a second.

Each need, mapped to a live primitive

The attack this chamber refuses: The compromised meter, one second later

The attack. The revoked meter, still running hostile firmware, submits its next reading.

Why it fails. IRONHAND revocation propagated over the event stream and the SVID is dead. The reading arrives with no identity to be, and clamping the issuer has already emptied every capability token the site desk issued through it.

What actually happens. Nothing settles, nothing emits, and the frozen balance waits for forensics. The ledger keeps every reading the device ever signed.

Deep architecture

DYNAMO at deployment scale: your grid frame holds the identity fabric, the per-reading settlement and the kill switch; a neighbouring operator runs its own frame for roaming; the fabric between them settles corridors without a clearing house. The field devices live below, enrolled upward. The trace replays one evening peak, readings to revocation.

The deployment, traced

1. A reading arrives from the field, signed by the device’s own short-lived identity.
2. The substation desk holds a capability token scoped to one substation, one shift. Blast radius is a data structure.
3. The identity fabric admits the reading: a live SVID, inside its scope. Settlement follows in fractions of a cent.
4. Every reading and its fee land on the ledger, append-only.
5. The site desk bids the evening peak into the market. A bid is not a settlement.
6. Roaming exists because two operators exchanged signed cards and licenses, not API keys.
7. A roaming session settles across frames with an idempotency key. A retry can never double it.
8. The neighbour frame credits exactly once. No clearing house sits between them.
9. Their roaming desk confirms the session.
10. Their ledger writes the same settlement. Two operators, one truth.
11. 17:42. A meter reports impossible numbers. The operator acts once.
12. Revocation rides the event stream. The identity is dead in under half a second, the balance freezes, and cross-frame receipt is blocked by the same action.

Adoption, phase by phase

Discover: No device changes yet.

• Runs. Nothing in your estate. One meter’s history and a workstation.
• Agents. None. Your grid team reads a live ledger and walks the identity model on paper.
• Integrates. Nothing. Metering heads, the market interface and SCADA stay exactly as they are.
• Deliberately not yet. No device holds an identity. No money moves.
• Proof that gates the next phase. One meter’s month re-told as per-reading settlements, and the sum matches the billing system to the cent.

Pilot: One substation, fifty devices, a working kill switch.

• Runs. One hosted registry seat, or a single-VM frame if policy requires your walls. Fifty devices enroll through the identity fabric.
• Agents. substation-ops under an L4 shift token; grid-settlement paying per reading; the site operator holds the kill switch.
• Integrates. Metering heads feed readings in. The market interface stays read-only.
• Deliberately not yet. Pocket ceilings. No roaming. Revocation drills run against pilot devices only.
• Proof that gates the next phase. A revocation drill kills a live pilot device in under half a second, measured at the gate, and its next reading settles nothing.

Production: A region’s fleet, enrolled, settling, revocable.

• Runs. One sovereign frame per operator region: registry, TEG, EventStore, identity fabric. About nine containers each.
• Agents. The full cast. The fleet enrolls itself through the fabric; nobody hand-provisions a hundred thousand certificates.
• Integrates. Metering heads and the market operator interface. SCADA stays out of scope, deliberately and in writing.
• Deliberately not yet. No cross-operator roaming. The federation license is held but dark.
• Proof that gates the next phase. A full region settles per reading for a month with the supply delta at zero and every settlement attributable to a live SVID.

Federation: Roaming corridors without a clearing house.

• Runs. Unchanged infrastructure. Peer operators.
• Agents. Unchanged cast; per-corridor spend policies bound what each roaming partner can reach.
• Integrates. Each roaming partner is a signed card and a license, not a settlement bureau.
• Deliberately not yet. Nothing on this path requires new software.
• Proof that gates the next phase. Two operators settle a roaming corridor for a quarter with zero reconciliation calls between their back offices.

Sizing

One reading, and the revocation that outruns the next one

sequenceDiagram
  participant Dev as inverter-7741
  participant Fab as identity fabric
  participant TEG as your TEG
  participant ES as event ledger
  participant Op as site operator
  Dev->>Fab: signed reading (SVID, short TTL)
  Fab->>TEG: A2A authorize + settle per reading
  TEG-->>ES: reading + fee, append-only
  Op->>Fab: revoke device (one action)
  Note over Fab: revocation over the event stream, under 500ms
  Dev->>Fab: next reading
  Fab-->>Dev: no identity to be
  Fab-->>ES: refusal recorded, balance frozen in place

Topology, as declared

flowchart LR
  DEV["device workload<br/>SPIFFE SVID, short TTL"] -->|"signed reading"| REG["registry identity gate"]
  REG -->|"A2A payment authorize"| TEG["TEG settle per reading"]
  TEG --> ES[("event store")]
  OP["site operator"] -->|"coordinated suspension"| REV["IRONHAND revoke<br/>WS, under 500ms"]
  REV -.->|"SVID dead, tokens emptied"| REG

Standing it up

• Infrastructure. One registry per operator region. Free licence, 9 containers each.
• Agents. 3 to 4 roles; the device fleet enrolls through the identity fabric, not hand-provisioning.
• Integration. Metering heads and the market operator interface. The long pole is device firmware, not the network.

What this does not claim

• DYNAMO carries identity, authority and settlement. It is not SCADA and controls no safety-instrumented function.
• No assertion of IEC 62443 conformance.