Cadenza US — Design for FERC Order 2222

Cadenza is a prototype that provides provable data integrity for critical energy infrastructure in the United States. It uses Ed25519 signatures, Merkle tree chaining, and RFC 3161 timestamping to ensure operational data is authentic and unchanged — even against the operator, and without a blockchain. The architecture implements security controls aligned with eight CISSP domains, and is designed to address requirements relevant to US energy regulators under FERC Order 2222.

FERC Order 2222

FERC Order 2222 is a landmark rule that opens the wholesale electric grid to distributed energy resources (DERs) — rooftop solar, battery storage, electric vehicles, and demand response — to compete alongside traditional power plants. It requires regional transmission organizations (RTOs) and independent system operators (ISOs) to remove barriers that exclude small, aggregated DERs from the wholesale market.

Distributed Energy Resources under Order 2222

The order mandates that DER aggregators can bid into wholesale markets just like traditional generators. For grid operators and DER aggregators, this means data integrity matters more than ever: every measurement, dispatch signal, and settlement record must be provably authentic, tamper-evident, and auditable.

Prototype capabilities relevant to Order 2222

• Ed25519-signed telemetry at the edge — the prototype signs every DER reading at the source before it enters any system of record.
• Merkle tree chaining — all records are bound together in the prototype; altering one changes the root fingerprint, making tampering detectable.
• RFC 3161 timestamping — the prototype anchors the root hash to an independent authority, providing a neutral witness that cannot be forged by any single party.
• Append-only storage in the core — the prototype Spring Boot layer verifies and stores records but never mints source signatures, enforcing a verify-only policy.

Energy-first restructuring

The US energy landscape is shifting from centralized generation to a distributed, market-driven model. FERC Order 2222, the Inflation Reduction Act, and state-level clean-energy mandates are reshaping how electricity is measured, traded, and settled.

Cadenza was designed for this transition. The provable data fabric works wherever energy is produced, measured, or settled — from rooftop solar to utility-scale batteries, from DER aggregators to RTO markets. Energy comes first: the architecture assumes that data integrity is a prerequisite for fair markets.

Patent pending

US provisional patent applications 64/145,616 and 64/145,617 have been filed. Cadenza's provable data integrity architecture — Ed25519 signing, Merkle chaining, and RFC 3161 anchoring — is protected by these pending applications.

CISSP Domain Mapping

Cadenza implements security controls aligned with eight CISSP domains:

1. Security and Compliance

• Tamper-evident audit trail for all operational readings
• RFC 3161 timestamping by independent authority ensures non-repudiation
• Designed to support evidence and incident duties relevant to FERC Order 2222 and NIS2/BSIG requirements

2. Access Control

• Ed25519 private keys never leave the edge device — cryptographic proof at the source
• Verify-only core: Spring Boot verifies signatures but never mints source signatures
• Append-only storage prevents unauthorized modification of verified records

3. Security Architecture

• Defense-in-depth: edge signing → Merkle chaining → external timestamping
• Merkle tree structure: altering any single record changes the root fingerprint
• No blockchain, token, or extra chain process required

4. Identity and Authentication

• Ed25519 elliptic-curve cryptography for device identity and data signing
• Each attestation tagged with Cadenza-Attestation-v1 for protocol clarity
• Private keys stored securely at the edge, never transmitted

5. Cryptography

• Ed25519: post-quantum-resistant elliptic-curve digital signature algorithm
• Merkle tree: collision-resistant hash function binds all records cryptographically

6. Data Security

• Data integrity verified at every layer: edge, transport, and storage
• Tamper demo proves that changing an EMS copy does not affect the signed leaf
• cadenzaUS.cissp6c

7. Software Security

• Go agent handles edge signing with minimal attack surface
• Spring Boot core enforces verify-only policy — no source signature minting

8. Security Operations

• Quellenkarte (source map) with GRUEN/GELB/ROT status for operational awareness
• Three-party room: Anlage, Vermarkter, VNB share verified Istwerte; ISB reads only
• cadenzaUS.cissp8c

What we do not claim

• Not NIS2-certified and not a KRITIS fulfilment statement
• Not a blockchain, token, or extra chain process

What we may say

• Designed to support evidence and incident duties relevant to the new BSIG (NIS2) and FERC Order 2222
• On-prem; no third-country model API is required
• Provable data origin and integrity for audit and regulatory compliance