Elliptic Curve Cryptography-Based Authentication with Identity Protection for Smart Grids.

In a smart grid, the power service provider enables the expected power generation amount to be measured according to current power consumption, thus stabilizing the power system. However, the data transmitted over smart grids are not protected, and then suffer from several types of security threats and attacks. Thus, a robust and efficient authentication protocol should be provided to strength the security of smart grid networks. As the Supervisory Control and Data Acquisition system provides the security protection between the control center and substations in most smart grid environments, we focus on how to secure the communications between the substations and smart appliances. Existing security approaches fail to address the performance-security balance. In this study, we suggest a mitigation authentication protocol based on Elliptic Curve Cryptography with privacy protection by using a tamper-resistant device at the smart appliance side to achieve a delicate balance between performance and security of smart grids. The proposed protocol provides some attractive features such as identity protection, mutual authentication and key agreement. Finally, we demonstrate the completeness of the proposed protocol using the Gong-Needham-Yahalom logic.

Introduction

Compared with traditional power networks, smart grid networks can avoid excess electricity generation by adjusting the amount of electricity based on the customer’s real-time requirements. In general, the smart grid network can be divided into three levels: control center, substations and smart appliances [1]. In a smart grid network, smart appliances communicate with substations by using smart meters. The smart meters send user’s requirements to the substations, and then the substations transmit the requirements to the control center. Next, according to the received requirements, the control center can allocate adequate power supplies to customers. The Supervisory Control and Data Acquisition system is used to protect the communications between the control center and the substations [2], but the security problems between other two levels remain unsolved. Although the security mechanisms between substations and smart appliances have been researched in recent years, existing security protocols are not robust enough to resist several types of attacks. Therefore, a determined effort should be made to address the security issues associated with the communications between the substations and the smart appliances [3].

As smart meters are used to transmit the real-time electricity demands from customers, the data transmission process could easily suffer from several types of security threats and attacks. To protect the transmitted data, an efficient authentication scheme should be provided. Compared with the authentication protocols designed for other scenarios such as VoIP and Ad Hoc networks, it is more challenging to provide a suitable authentication protocol for smart grids due to its complicated architecture and diverse security requirements. On one hand, the authentication protocols should secure against various types of possible attacks and provide several security features to satisfy the secure requirements of smart grids. For example, the user privacy should be fully considered especially the user’s identity protection, to prevent the adversary from obtaining the information about user’s daily patterns, which may not be important in other application environments. On the other hand, smart grid communications are more sensitive to transmission latency, and so existing security approaches with intensive computation are impractical in smart grid networks.

Recently, several authentication protocols have been proposed [4-19] to protect the data transmission between communication entities. In an attempt to prevent the adversary from obtaining the daily habit of the customer through analyzing the electricity usage pattern, T.W. Chim et al. [4] designed an authentication protocol by using a tamper-resistant device at the smart appliance and a pseudo identity for the smart grid network to protect the privacy of the customer. However the proposed protocol was suffered from impersonation attacks. Since only substations could authenticate smart appliances, the adversary could easily impersonate the substations to cheat the smart appliances. Besides, their protocol failed to provide a key agreement function capable of protecting the communication between substations and smart appliances. Furthermore, since a timestamp was used in the signing module of their protocol, the clock synchronization problem could not be avoided. In order to reduce the computational cost, Mostafa et al. [5] proposed a message authentication mechanism by using the Computational Diffie-Hellman assumption for smart grids. In their protocol, mutual authentication and key agreement were realized by using Diffie-Hellman exchange protocol between the smart meters distributed at different hierarchical networks of the smart grid system, and the subsequent messages could be authenticated by using a shared session key established previously and the hash-based authentication code technique. However, the computational costs of both protocols were still very high due to the usage of expansive exponential operations. In the same year, Qing et al. [6] designed a multicast authentication protocol for smart grids by using one-time signature to reduce the storage cost and the signature size. Because the one-time signature-based multicast authentication could provide short authentication delay and low computation cost, their protocol achieved a good performance. However their work only focused on designing a light-weight authentication protocol, remained the key agreement issue unsolved.

In order to strengthen the security of smart grid communications, Soohyun Oh et al. [7] suggested a mutual authentication and key establishment mechanism based on public key certificates for smart grid. In their protocol, the data concentration unit’s public key certificate and pre-shared long-term key were used to realize the mutual authentication between the data concentration unit and the intelligent devices. But the problem of distributing the shared long-term key limited this protocol’s scalability and applicability. Biometric technique such as fingerprint was also adopted to achieve strong authentication for smart grids [10]. But these protocols are very complex due to the use of biometrics. In 2013, Binod Vaidya et al. proposed an authentication and authorization mechanism for smart grid networks [13]. They realized multi-factor authentication and attribute-based authorization in a smart grid environment by using public key certificates, zero-knowledge and access control technologies. But the heavy computational load could not be avoided since the implement of the public key certificates management and public key cryptography calculation. In the same year, Nicanfar et al. presented a password authenticated group key agreement protocol for smart grid [15]. Although the proposed protocol provided forward and backward secrecy and enhanced the security of communications among the devices, the usage of expansive exponential operations decreased the practical application of the protocol. To reduce the computational cost, a password authenticated key exchange based on Elliptic Curve Cryptography (ECC) was proposed [17]. Compared with previous studies, this protocol was more efficient due to the usage of ECC, but a primitive password should be preloaded between an appliance and the Home Area Network controller, which made this solution hard to scale and might arouse an intractable problem of password table maintenance. Recently, Li et al. proposed fault-diagnosable authentication architecture for advanced metering infrastructure in smart grid [19]. Since this work only focused on authentication, key negotiation was not considered in the proposed authentication mechanism.

According to above analysis, protocol [4] was suffered from impersonate attacks and protocols [5, 19] were vulnerable to eavesdropping since these protocols could not provide key agreement to protect the further communications. Moreover, protocol [17] faced some attacks associated with password. Although some of these protocols achieved good performance, they could not provide security at an acceptable level. Furthermore, other protocols such as [13, 15] were secure against several attacks, but the use of expansive exponential operations, the signature generation, and the verification lead to high computational overhead and communication delay. Therefore, these protocols are not suitable for smart grid. In general, the existing authentication protocols for smart grids mentioned above are insecure against some cryptographic attacks or impractical due to high computational costs. In addition, all the protocols discussed above could not provide privacy protection which is very important in smart grids. Based on these motivations, we proposed a robust and efficient authenticate protocol based on Elliptic Curve Cryptography (ECC) with identity protection for smart grids by using tamper-resistant attractive security properties. As ECC can achieve the same level security with a smaller key size, it offers better performance compared with other public key cryptosystems such as RSA or D-H. Thus, we adopted ECC to realize a mitigation authentication device at the smart appliance without involving time-consuming operations.

Compared with other security approaches, public key cryptosystems can resist most of possible attacks and provide more security properties to achieve a good balance between performance and security. By using ECC, the proposed protocol can achieve the authenticated key agreement with privacy protection at a lower computational cost. Furthermore, according to the characteristics of the smart grid, the control center can be considered fully trustable since it is managed by the government administrators; the substations that have higher computational power are difficult to be compromised than smart appliances; the smart appliances with limited power are more vulnerable to various attacks, and it can be combined with a tamper-resist device to protect the stored information. Taking advantage of above features, in the proposed protocol, a tamper-resist device was used to store secret information to help providing privacy protection through the authentication process. In addition, the control center and the substations can cooperate to complete the initialization process of the authenticated key agreement protocol.

In the proposed protocol, the smart meters are used to transmit the real-time electricity demands from customers intelligently. In order to protect the transmitted data, mutual authentication and a shared key should be provide to protect the further communication between the substation and the smart appliances. In the proposed protocol, the smart meters could control when the authentication protocol begins and which appliances need to be authenticated. Furthermore, the shared key updating could be realized by restarting the authentication process and the smart meter could also control the period of key updating during the communication. Therefore, the smart meter could manage the smart devices intelligently during the authentication process. In this paper, our study focused on the design of the authentication protocol with privacy protection, so the intelligent management of smart meters is beyond the scope of our work.

Burrows-Abadi-Needham (BAN) Logic [20] is the first belief logic widely used to formally analyze the completeness of a cryptographic protocol, but it has some limitations [21]. Gong-Needham-Yahalom (GNY) logic [22] is one of the famous extensions to overcome the inherent limitations of BAN; and it has successfully disclosed redundancies or found defects in several protocols. Today, GNY has been used to demonstrate the completeness of several protocols successfully [23]. Therefore, we used the GNY logic to evaluate the security of the proposed protocol in this study.

The rest of this paper is organized as follows. Section 2 briefly describes the Elliptic Curve Cryptosystem. Our newly designed authentication protocol is detailed in Section 3. In Section 4, the completeness of the proposed protocol is proved through Gong-Needham-Yahalom logic. The performance of the proposed protocol is evaluated in Section 5, and the paper is concluded in Section 6.

Preliminaries

In this section we briefly introduce the basic concepts of the elliptic curve cryptosystem and the corresponding problems associated with it. We also explain the reason for adopting the elliptic curve cryptography.

ECC has been formally applied to public key cryptosystems since 1986. In an elliptic curve cryptosystem, the elliptic curve equation is defined as the form E(a,b): y2 = x3 + ax + b(mod p) over a prime finite field F, where p>3, a,b ∈ F and 4a3 + 27b2 ≠ 0(mod p). Given an integer and a point P ∈ E(a,b), the scalar multiplication tP over E(a,b) can be defined as tP = P + P + … + P(t times) [24]. And the corresponding problems associated with ECC are shown as follows:

Definition 1. Given two points P and Q over E(a,b), the elliptic curve discrete logarithm problem (ECDLP) is to find an integer such that Q = tP.

Definition 2. Given three points P, sP and tP over E(a,b) for , the computational Diffie-Hellman problem (CDHP) is to find the point stP over E(a,b).

Definition 3. Given two points P and Q = sP + tP over E(a,b) for , the elliptic curve factorization problem (ECFP) is to find two points sP and tP over E(a,b).

We assume that the three problems above are intractable. That is, there is no polynomial time algorithm that can solve these problems with non-negligible probability.

Next, we explain why we adopted ECC to design the authentication protocol for smart grid networks.

1) More complex: Since ECC can be implemented in different ways rather than a single encryption algorithm; it is more complex than RSA. Moreover, the elliptic curve discrete logarithm problem is more difficult to break than the factorization and discrete logarithm problem. Although many researchers have tried to attack ECC, it is still infeasible to break ECC with existing computational resources. Therefore, the security strength of ECC is much stronger than other public key cryptosystems such as RSA or Diffie-Hellman (D-H).

2) Smaller key size: as shown in Table 1, compared with RSA, ECC offers equivalent security with smaller key sizes which implies lower power, bandwidth, and computational requirements. These advantages are very important when public-key cryptography is implemented for low power environments.

Table 1

Comparison of the key length between RSA and ECC on the same security level.

Key length of ECC (bits)	Key length of an RSA (bits)	Key length ratio
160	1024	1:6
256	3072	1:12
384	7680	1:20
512	15,360	1:12

3) Computational efficiency: ECC is much more efficient than RSA and D-H public protocols in terms of computation, since implementing scalar multiplication in software and hardware is much more feasible than performing multiplications or exponentiations in them.

According to above attractive properties of ECC, we chose it to design the proposed robust and efficient authentication protocol for smart grids.

Our Proposed Authentication Scheme

This section details our newly designed authentication protocol based on elliptic curve cryptography for smart grids. Considering the efficiency, ECC version for El-Gamal has been adopted for asymmetric encryption in the proposed protocol where the cycle group used in El-Gamal is taken from elliptic-curve. For the details, please see [24]. There were two phases in the proposed protocol: initialization phase and authentication phase. The procedure of our protocol is described in detail as follows:

Initialization phase

In this phase, several security parameters used for authentication and key agreement are calculated by the control center and the substations.

1) First, an elliptic curve equation E(a,b): y2 = x3 + ax + b(mod p) over a prime finite field F is selected by the control center. Here a,b ∈ F and 4a3 + 27b2 ≠ 0(mod p). Next the control center chooses a base point P over E(a, b) and writes P to the tamper-resistant device of U as well as the substations.

2) The control center allocates an identity ID for each smart appliance U and preloads ID into the memory of the corresponding tamper-resistant devices. Then the identity ID of smart appliance U is written in an ID table by the control center. Next, the control center submits the identity table to the substation over a secure channel and assigns an identity SID for each substation S. The substation S stores the identity SID in its memory securely. Finally, a one-way hash function h(∙): {0,1}* → {0,1} is selected by the control center. And the substations as well as the tamper-resistant devices store the hash function in their memories.

3) The substation chooses a random integer as a secret key for symmetric encryption/decryption. And then it generates a random integer sktamper-resistant device.

If a new smart appliance U wants to incorporate into the smart grid, the control center and the substation should cooperate to complete the initialization of the new appliance. First, the control center allocates a new identity ID for U and records it in the ID table. Then it sends the identity of the new smart appliance to the corresponding substation over a secure channel. Having received the message, the substation records the identity in its ID table and then computes a secret (C1, C2) for the new smart appliance. Finally, the substation writes the point P, the one-way hash function, the identity ID, the public key pk and the pair secret (C1, C2) into the tamper-resistant device of U to achieve the initialization of the new smart appliance.

Authentication phase

During the authentication process, the substation and the smart appliance U perform the following four steps to realize mutual authentication and key agreement.

1) First, the tamper-resistant device of U selects an integer randomly to compute C3 = e(ID‖C1‖r1), where e(•) denotes the public key encryption function using the substation S’s public key pk and C1 = E(ID) is a secret stored in the tamper-resistant device of U. Then, the smart appliance U sends C3 = e(ID‖C1‖r1) to the substation S.

2) In this step, the substation S obtains ID, C1 and r1 by decrypting the receiving message C3 via its private key sk. Then, it checks whether ID is valid by matching it in the ID table. If not valid, the authentication process stops. Otherwise, the substation S uses the system key s to decrypt C1 and then gets the ID. Next, it compares the value of ID in C3 with that of ID in decrypted message C1. If they are not equivalent, the substation terminates the authentication process; otherwise, the substation chooses two random integers and to calculate the shared session key SK = h(r1‖r2) and authentication message , where denotes the secure symmetric encryption algorithm with the secret key r1. Finally, the substation S submits the message (C4, r3) to U.

Here the random integer r3 needs not be encrypted because it is used to check the freshness of the message only and is not connected with the final session key in any way. Even if the adversary obtained the random integer r3, the shared key could not be compromised. Thus, the random integer r3 is transmitted in plaintext, and this method has been widely used in authentication protocols to check the freshness of the message.

3) After receiving the message (C4, r3), the smart appliance U adopts r1 to decrypt C4 and then obtains r2 and SID. Then it calculates SIDP and checks whether the following equation holds . If the equation holds, the smart appliance U calculates the shared session key SK' = h(r1‖r2) and the authentication message C5 = h(SK'‖(r3 + 1)). And then U submits the authentication message C5 to the substation S. Otherwise, the smart appliance U rejects the message and terminates the authentication process.

4) Upon receiving the message C5, the substation S checks whether the value of the received C5 equals to the value of the computed h(SK‖(r3 + 1)). If true, the substation S sets SK as the shared session key with the smart appliance U; otherwise, it terminates the authentication process.

In the proposed protocol, if the substation D needs to be changed, it submits all the shared keys between itself and corresponding smart appliance to the control center over a secure channel and then deletes the ID table and the shared keys from its memory. Next the control center transforms ID table including all identities of the smart appliance associated with substation D and all the session keys submitted from D to the new substation D over a secure channel. In addition, the control center also chooses a secure one-way hash function and transforms it to the substation D. After the substation D finishes the initialization procedure, it adopts the corresponding shared key to encrypt the secret information including the pair secret (C1, C2), the public key pk and the hash function. Then the substation D can transmit the secret information securely to the corresponding smart appliance. Consequently, the tamper-resistant devices can update the secret information securely. And the new session key between the new substation D and the smart appliance can be achieved by running the proposed key agreement protocol to realize the secure and easy change of the substation.

In the proposed protocol, instead of preloading the shared key, the secret (C1,C2) as “material” is stored in the tamper-resistant device of the smart appliance to help realize mutual authentication and key agreement. The session key is constructed by two high-entropy random integers chosen by the substation and the smart appliance freely, and the session key varies in each authentication and key agreement process, that is, the secret (C1,C2) is not connected with the final computed session key. Thus, even the secret (C1, C2) stored in the tamper-resistant device was compromised, the session key would not be leaked and the adversary could not obtain the information transmitted between the smart appliance and the substation encrypted by the session key. Under this case, if the secret (C1, C2) was compromised, the message relayed between the smart appliance and the substation would not be exposed to the adversary. On the contrary, if the shared key was preloaded into a tamper-resistant device, the adversary could launch the capture attack to obtain the shared key, and then could use it to decrypt the message communicated between the smart appliance and the substation. In addition, the solution of preloading the shared key requires the substation storing the shared keys for each smart appliance. Once the substation was compromised by the adversary, all the shared keys would be revealed. Furthermore, the associated problems of shared key updating and maintaining make this security measure hard to scale up.

Security Analysis

Burrows-Abadi-Needham Logic [20] is the first belief logic which has been widely used to formally analyze the completeness of protocols. A great effort has been put into overcoming its limitations [21]. Gong-Needham-Yahalom (GNY) logic [22] is one of these extensions. And it has successfully disclosed redundancies or found defects in several protocols. Therefore, we adopted the GNY logic to evaluate the security of our proposed protocol.

In this section, some formulae and statements used in the GNY logic are introduced first; then the goals and the assumptions of the proposed protocol are set; finally the GNY logic is adopted to prove that the proposed protocol is valid and practical.

Formulae and statements

In the GNY logic, a formula is a name used to refer to a bit string, which has a particular value in a run [22]. In order to describe the GNY logic, first let symbols X and Y range over formulae. Then, some formulae used in our authentication proof are introduced and the complete list of all logical postulates is described in [22].

(X, Y): conjunction of two formulae X and Y.

{X} and : symmetrically encrypt and decrypt X with the key K.

{X}+K and {X}-K: asymmetrically encrypt and decrypt X with the public key +K and the private key -K.

h(X): a one-way function of X.

*X: X is not originated here.

A basic statement reflects some property of a formula. Let symbols P and Q be principals. The following are statements used in our authentication proof.

P◁X: P is told formula X.

P∍X: P possesses formula X.

P|∼X: P once conveyed formula X.

P|≡#(X): P believes that X is fresh.

P|≡ϕ(X): P believes that X is recognizable.

: P believes that S is a suitable secret for P and Q.

P|⇒X: P has jurisdiction over X.

P⊲*X: P is told that a formula X which did not convey previously in the current run.

Protocol descriptions and goals

In this subsection, some notations are changed to fit the GNY logic and the proposed protocol are transformed into the form of P→Q:(X). In addition, the server’s private key is denoted as–K and the corresponding public key is denoted as +K.

U → S: ({ID‖{ID}‖r1}+)

U → S: (h(h(r1‖r2)‖(r3 + 1)))

Next, our goals which consist of three aspects are described in detail.

(1) Message content authentication

Goal 1: S believes the message in the first run is recognizable.

Goal 2: U believes the message in the second run is recognizable.

Goal 3: S believes the message in the third run is recognizable.

(2) Message origin authentication

Goal 4: U believes S conveyed the message in the second run.

Goal 5: S believes U conveyed the message in the third run.

(3) Session key material establishment

Goal 6: U believes that S believes that SK is a secret shared between U and S.

Goal 7: U believes that SK is a secret shared between U and S.

Goal 8: S believes that U possesses SK.

Goal 9: S believes that U believes that SK is a secret shared between U and S.

Assumption list

In this subsection, some assumptions are made as follows:

The secret key s is generated by S in the proposed protocol, so S possesses s. S also possesses the private key–K and the public key +K.

Since S keeps the identity table, S believes that ID is recognizable.

Since U stores C2 = SIDP secretly and holds the base point P. Then U can check the SID and believes that SID is recognizable.

The random integer r1 is generated by U in the protocol, so U possesses r1 and believes that r1 is fresh. U ∍ r1,U|≡#(r1)

The random integer r1 is generated by U as part of the temporal session key in the current run. So, we assume that U believes r1 is a suitable secret for himself and S.

The random integer r2 and r3 are generated by S in the protocol, so S possesses r2 and r3, and believes that r3 is recognizable and r2 is fresh.

The SK generated by S is a temporal session key in the current run. So we assume that S believes that SK is a suitable secret between itself and U.

U believes that the server S is an authority on generating a suitable session key material SK shared between U and S.

Authentication proof using GNY logic

In this subsection, we adopt the GNY logic to analyze our protocol. A complete list of all logical postulates and the index in the list is provided [22], such as (T1, P1), to show how to achieve the goals.

(1) The first run:

If S believes that ID is recognizable and S possesses the key s, then S is entitled to believe that the encryption of ID with the key s is recognizable and then the formula {ID‖{ID}‖r1} is also recognizable.

If S believes (ID‖{ID}‖r1) is recognizable and S possesses a public key +K, then it believes that the encryption {ID‖{ID}‖r1}+ is recognizable. Therefore, in the proposed protocol, the server S can recognize the message {ID‖{ID}‖r1}+ in the first run. (Goal 1)

(2) The second run:

If U believes that SID is recognizable, then U is entitled to believe that the formula (SID‖r2) of which SID is a component, is recognizable. Since U possesses r1, it also believes that the encryption is recognizable.

If S believes is recognizable, then it is entitled to believe that , of which is a component, is recognizable. So, we can conclude that in the proposed protocol, U can recognize the message in the second run. (Goal 2)

If the following five conditions hold: 1) U receives the formula (SID‖r2) encrypted with the key r1 and marked with a not-originated-here mark; 2) U possesses r1; 3) U believes that r1 is a suitable secret for himself and S; 4) U believes that the formula (SID‖r2) is recognizable; and 5) U believes that r1 is fresh. Then U is entitled to believe that 1) S once conveyed (SID‖r2) encrypted with r1 and 2) U believes that the S possesses r1. (Goal 4)

According to the GNY logic, we assume that U|≡S|⇒S|≡*, that is, U believes that S is honest and competent, and then we can deduce the following statement:

If U believes that S is honest and competent; and U receives a message , which it believes S conveyed, then U ought to believe that S really believes . Therefore, U believes that S believes that SK is a suitable secret between U and S. (Goal 6)

If U believes that S is an authority on the statement and S believe in , then U ought to believe in as well. So, U believes that SK is a suitable secret between U and S. (Goal 7)

(3) The third flow:

If S is told a formula (ID‖{ID}‖r1) encrypted with the public key +K and it possesses the corresponding private key–K, then it is considered to have been told the decrypted contents of that encrypted formula. And it has also been told r1 as the formula’s components.

If S is told r1, it is capable of possessing r1. And if S also possesses r2, it is capable of possessing (r1‖r2) and h(r1‖r2). For the same reason, if S possesses r3 then it possesses (r3+1).

If S possesses h(r1‖r2) and (r3+1), then it possesses (h(r1‖r2)‖(r3 + 1)) as well.

If S believes that r3 is recognizable, then S believes that (r3+1) is recognizable and (h(r1‖r2)‖(r3 + 1)), of which (r3+1) is a component, is also recognizable.

If S believes that (h(r1‖r2)‖(r3 + 1)) is recognizable and it also possesses (h(r1‖r2)‖(r3 + 1)), and then it is entitled to believe that h(h(r1‖r2)‖(r3 + 1)) is recognizable. So, we can say that S believes that the message h(h(r1‖r2)‖(r3 + 1)) in the third run is recognizable. (Goal 3)

If S believes r2 is fresh then it is entitled to believe that h(r1‖r2) is fresh. And then if S also possesses (r1‖r2), it is entitled to believe that h(r1‖r2) is fresh.

If all of the following conditions hold: 1) S receives a formula consisting of a one way function of (r3+1) and SK marked with a not-originated-here mark; 2) S possesses (r3+1) and SK; 3) S believes SK is a suitable secret for itself and U; 4) S believes that SK is fresh. Then S is entitled to believe that U once conveyed ((r3+1), SK) and h(h(r1‖r2)‖(r3 + 1)).Therefore, we can say that S believes that the message h(h(r1‖r2)‖(r3 + 1)) in the third run of the proposed protocol is conveyed from the U. (Goal 5)

If S believes that U once conveyed the formula ((r3+1), SK), then it is entitled to believe that U once conveyed SK. And if S also believes that SK is fresh, then it is entitled to believe that U possesses SK. Therefore, S believes that SK is possessed by U. (Goal 8)

According to the GNY logic, we assume that U|≡S|⇒S|≡*, that is, S believes that U is honest and competent, and then we can deduce the following statement:

If S believes that U is honest and competent, and S receives a message which it believes is conveyed by U, then S ought to believe that U really believes . So, we can conclude that in the proposed protocol, S believes that SK is a suitable secret between U and S. (Goal 9)

Complexity Analysis

In this section, we first summarize the functionalities of the proposed protocol, and then evaluate the computational cost of the protocol.

As an attractive feature, our protocol provides identity protection including the identities of the smart appliance and the substation. In the proposed protocol, the adversary cannot obtain the real identities of the smart appliance and the substation since the identities are transmitted in ciphertext. So even if the adversary compromises the secret (C1, C2) stored in the tamper-resistant device and intercepts all the messages transmitted between the smart appliance and the substation, she/he cannot obtain the real identities of the smart appliance and the substation. In addition, the proposed protocol also provides mutual authentication and key agreement to protect the communications between the smart appliance and the substation. Next, we compare the computational cost of the proposed protocol with other related protocols. Some notations are defined as follows:

T: the time for executing a modular exponentiation operation.

T: the time for executing a scalar multiplication operation of elliptic curve.

T: the time for executing a one-way hash function.

T: the time for executing a symmetric key encryption operation.

T: the time for executing a symmetric key decryption operation.

T: the time for executing an asymmetric key encryption operation.

T: the time for executing an asymmetric key decryption operation.

T: the time for executing a Hash-based Message Authentication Code (HMAC) operation

As shown in Table 2, in the proposed protocol, the computational cost at the substation S side is T+T during the initialization phase. One scalar multiplication operation T is used to compute the secret C2 = SIDP. And one symmetric key encryption operation T is used to generate another secret C1 = E(ID) through using the system key s. In the authentication phase, the computational cost at the substation S side is T +T +T+ T, and the computational cost at the smart appliance U side is T + T + T + T. The smart appliance U takes one asymmetric key encryption operation via the substation S’s public key pk to generate C3 = e(ID‖C1‖r1); takes one symmetric key decryption operation to get SID and r2; takes one scalar multiplication operation to compute SIDP; and takes a one-way hash function operation to calculate C5 = h(SK'‖(r3 + 1)). The substation S takes one asymmetric key decryption operation to get the smart appliance U’s identity ID, the random integer r1 and the authentication message C1; takes a one-way hash function operation to obtain h(SK‖(r3 + 1)); and takes one symmetric key decryption operation and one symmetric key encryption operation. So, the total computational cost of the proposed protocol is 2T+T+T +2T+2T+2T. The theoretical analysis and experimental results [25] show that the modular exponentiation operation T and the asymmetric key encryption/decryption operations T/T are much higher than that of the symmetric key encryption/decryption operations T/T and the scalar multiplication operation of elliptic curve T. In addition, compared with the asymmetric key encryption/decryption operations T/T and the modular exponentiation operation T, the computational cost of hash function operation T could be ignored. Close analysis of the data in Table 2, shows that our proposed protocol is more efficient than and Mostafa et al.’s protocol [5], because it eliminates the expansive modular exponentiation operations and reduces the numbers of asymmetric key encryption/decryption operations. In addition, compared with Chim et al.’s protocol [4], our protocol reduces the computational cost at the smart appliance side. Although Chim et al.’s protocol possesses better performance at the substation side in comparison with the proposed protocol, their protocol cannot support mutual authentication and fails to provide a key agreement.

Table 2

Computational costs comparison between our protocol and others.

	Our protocol	Chim et al.’s protocol [4]	Mostafa et al.’s protocol [5]
Smart appliance	Te+Tae+Tsd+Th	2Tae+Thmac	——-
Substation	Te +Tad+2Tse+ Tsd+Th	Thmac	——-
Control center	——-	2Tad	——-
HAN	——-	——-	2Tm+Tae+Tad+Th+Thmac
BAN	——-	——-	2Tm+ Tae +Tad+Th
Total	Tae+Tad+2Th+2Te+2Tse+2Tsd	2Tae+2Tad+ 2Thmac	2Tae+2Tad+2Th+4Tm+Thmac

HAN: home area network; BAN: building area network

Then, we discuss the communication and storage overhead by comparing our proposed protocol with other protocols. Since Mostafa et al.’s protocol do not use tamper-resistant device, we only compared storage overhead with Chim et al.’s protocol at the smart appliance side. In our protocol, the smart appliance needs to store a hash function and the secure information (C1, C2, pk, P), where C1, C2, and P are 1024 bits, and pk is 128 bits. The total storage overhead needed at the tamper-resistant devices in our protocol is 3200 bits. In Chim et al.’s protocol, the tamper-resistant needs to store the public key Pub, the secret key S, a pair private and public key, the identity of smart appliance RID and HMAC function. Where Pub is 1024 bits, S is 128 bits, RID is 32 bits and a pair key is 2048 bits. Therefore, the total overhead at the tamper-resistant devices side in Chim et al.’s protocol is larger than 3232 bits. As shown in Table 3, Compared with Chim et al.’s protocol, our proposed protocol reduced the storage overhead at the tamper-resistant side.

Table 3

Communication costs and storage overhead comparison between our protocol and others.

	Our protocol	Chim et al.’s protocol [4]	Mostafa et al.’s protocol [5]
Storage overhead (tamper-resistance devise side)	3200 bits	3232 bits	——-
Communication cost	608 bits	4448 bits	3744 bits

We hereby present the communication overhead of the proposed protocol. In our experiments, the user’s ID was 32 bits, the timestamp was 32 bits, the random number was 64 bits, the signature was 160 bits, and a modular exponentiation was 512 bits. In addition, the output of a 256-bit AES was based on the input of the plaintext. We assume that RSA was adopted as public key encryption/decryption algorithm in protocols [4, 5].The communication cost comparisons between our protocol and others are shown in Table 3. In our proposed protocol, the average communication cost was 608 bits. Compared with the protocols in [4, 5], the proposed protocol scaled down the communication cost significantly.

Conclusion

An efficient authentication protocol with identity protection for smart grids has been proposed in this paper. In the proposed protocol, based on elliptic curve cryptography the substations and smart appliances realized mutual authentication and key agreement via a tamper-resistant device. In addition, the identities of the smart appliance and the substation are transmitted in ciphertext in the proposed protocol. So the adversary cannot obtain the real identities of the smart appliance and the substation. Furthermore, the completeness of the proposed protocol is demonstrated by Gong, Needham, and Yahalom (GNY) logic. And performance analysis shows that our proposed protocol increases efficiency in comparison with other related protocols. Therefore, the proposed protocol is more suitable for the smart grids.