The increasing complexity of the smart grid raises significant concerns regarding the security of smart grid communication. As a countermeasure, authentication and key agreement (AKA) protocol ensures the secure transmission of sensitive information between legitimate entities by achieving mutual authentication and establishing session keys. One of the most urgent and critical security threats in AKA protocol concerns ephemeral secret leakage (ESL) attack, due to its threat to session key secrecy. However, there remains a lack of systematic understanding of how to resist ESL attacks in smart grid environment. Therefore, we categorize the ESL attack into three different types, then conduct an in-depth analysis of their root causes and propose corresponding recommendations to mitigate it. To further illustrate the effectiveness of the recommendations, we design a secure and efficient AKA protocol based on elliptic curve cryptography accordingly. The proposed protocol is proven secure through rigorous security proof under the random oracle model and formally verified by AVISPA tool. Performance comparisons indicate that the proposed protocol outperforms other related protocols due to its lightweight nature and adherence to all fundamental security attributes, making it well-suited for deployment in resource-constrained smart grid environment.
The increasing complexity of the smart grid raises significant concerns regarding the security of smart grid communication. As a countermeasure, authentication and key agreement (AKA) protocol ensures the secure transmission of sensitive information between legitimate entities by achieving mutual authentication and establishing session keys. One of the most urgent and critical security threats in AKA protocol concerns ephemeral secret leakage (ESL) attack, due to its threat to session key secrecy. However, there remains a lack of systematic understanding of how to resist ESL attacks in smart grid environment. Therefore, we categorize the ESL attack into three different types, then conduct an in-depth analysis of their root causes and propose corresponding recommendations to mitigate it. To further illustrate the effectiveness of the recommendations, we design a secure and efficient AKA protocol based on elliptic curve cryptography accordingly. The proposed protocol is proven secure through rigorous security proof under the random oracle model and formally verified by AVISPA tool. Performance comparisons indicate that the proposed protocol outperforms other related protocols due to its lightweight nature and adherence to all fundamental security attributes, making it well-suited for deployment in resource-constrained smart grid environment.
Abstract Smart grid (SG) facilitates our lives by providing more reliable electricity and enabling better integration of renewable energy sources. Currently, numerous authentication and key agreement (AKA) protocols have been proposed to secure SG communication. However, these solutions often result in considerable cost, making them inappropriate for resource-constrained SG environment. In this paper, we propose a secure and resource-efficient AKA protocol by employing lightweight cryptography primitives including authenticated encryption with associated data (AEAD) primitive ASCON, hash function and XOR operation. The ASCON primitive simultaneously provides data confidentiality, integrity and authenticity with low computation cost, making it suitable for employing in resource-constrained SG environment. The secret intermediate values in the protocol are designed as hash values that incorporate both long-term and short-term secrets, thereby providing enhanced security while further reducing cost. Moreover, a dynamic indexing method is deployed in the protocol to resist de-synchronization attack. The designed protocol performs secure mutual authentication and session key establishment between entities without relying on a central trusted authority. The proposed protocol is proven secure through rigorous security proof under the real-or-random model and formally verified by AVISPA tool. Theoretical performance analysis and simulation results indicate that the proposed protocol outperforms other related protocols due to its lightweight nature and adherence to all fundamental security attributes, making it suitable for deployment in smart grid environment.
With the enablement of Internet of Things technology, the electrical grid is currently undergoing a drastic revolution, which is known as smart grid. Since massive sensitive data and control commands transmitted via public channels, the smart grid is challenged by various cyber threats. Authenticated key agreement protocols in smart grid effectively ensure the confidentiality and authentication of communication through mutual authentication and establishing session keys. In this article, we review the existing elliptic curve cryptography (ECC)-based authentication and key agreement protocols in smart gird and perform a security analysis of Hu et al.’s protocol. We exhibit that the protocol fails to resist key compromise impersonation (KCI) attack and cannot provide untraceability. Furthermore, we propose a security-enhanced authentication and key agreement protocol based on ECC, which performs registration, authentication, and key agreement phases over public channels to enable mutual authentication and to establish session keys. The protocol is also proved to be security-enhanced by formal proof and informal analysis. The performance analysis results demonstrate that the proposed protocol is comparable to other existing protocols while achieving enhanced security. Therefore, the protocol satisfies the deployment requirements for resource-constrained smart grid.
With the rise of the Internet of Things (IoT), maintaining data confidentiality and protecting user privacy have become increasingly challenging. End devices in the IoT are often deployed in unattended environments and connected to open networks, making them vulnerable to physical tampering and other security attacks. Different authentication key agreement (AKA) schemes have been used in practice; several of them do not cover the necessary security features or are incompatible with resource-constrained end devices. Their security proofs have been performed under the Random-Oracle model. We present an AKA protocol for end devices and servers. The proposal leverages the ECC-based key exchange mechanism and one-way hash function-based message authentication method to achieve mutual authentication, user anonymity, and forward security. A formal security proof of the proposed scheme is performed under the standard model and the eCK model with the elliptic curve encryption computational assumptions, and formal verification is performed with ProVerif. According to the performance comparison, it is revealed that the proposed scheme offers user anonymity, perfect forward security, and mutual authentication, and resists typical attacks such as ephemeral secret leakage attacks, impersonation attacks, man-in-the-middle attacks, and key compromise impersonation attacks. Moreover, the proposed scheme has the lowest computational and communication overhead compared to existing schemes.
Unlike traditional power networks, the smart grid power system has the ability to arrange the power supply in real time to the customer for active power consumption. Therefore, it can avoid excess electricity generation. In addition, based on the current power consumption, the power service providers can measure the expected power generation amount to stabilize the power system. Compared with traditional power networks, the characteristics of the smart grid power system make it easier to suffer from several types of security threats and attacks such as impersonation, eavesdropping and message modification etc. In order to strength the security of smart grid networks, a robust and efficient authentication protocol should provide to mutual authentication and session key agreement. Since the communications between the control center and the substation is protected by the Supervisory Control and Data Acquisition system, we focus on the secure communication between the substation and the smart appliances. In this paper, a robust and efficient authentication protocol based on elliptic curve cryptography is proposed to achieve mutual authentication and key agreement between the substation and the smart appliances. In addition, the proposed protocol not only resists replay attacks, impersonation attacks, and man-in-middle attacks, but also provides the session key security and the known-key security.
Based on users’ permanent private keys and ephemeral secret keys (randomness secret values), authenticated key agreement (AKA) protocols are used to construct a common session key between two session parties while authenticating each other. Recently, the design of leakage-resilient AKA (LR-AKA) resisting side-channel attacks has received significant attention from researchers. By side-channel attacks, an adversary is allowed to obtain fractional leakage information of private (secret) keys during the computation rounds of LR-AKA protocols. However, most LR-AKA protocols have a restriction, namely, the overall fractional leakage information must be bounded. In this paper, we propose an efficient LR-AKA protocol with overall unbounded leakage property in the continual leakage extended Canetti-Krawczyk model. Security analysis is given to demonstrate that our LR-AKA protocol is provably secure in the generic bilinear group model. By comparisons, our protocol is better than the previously proposed LR-AKA protocols in terms of computation cost, security model, and leakage properties.
Due to the openness of communication channels and the sensitivity of the data being collected and transmitted, securing data access and communication in IoT systems requires robust ECC-based authentication and key agreement (AKA) protocols. However, designing an AKA protocol for IoT presents significant challenges, as most IoT sensors are deployed in resource-constrained, unattended environments with limited computational power, connectivity, and storage. To achieve anonymous authentication, existing solutions typically rely on shared temporary public keys to mask device IDs or validate sender certificates, which increases the computational overhead. Furthermore, these protocols often fail to address crucial security concerns, such as nonresistance to ephemeral secret leakage (ESL) attacks and a lack of perfect forward security. To mitigate the computational burden, we propose a dynamic authenticated credentials (DACs) synchronization framework for anonymous authentication. Then, we introduce an ECC-based AKA scheme that employs DACs in place of temporary public keys or sender credentials, enabling efficient and secure anonymous authentication. The security of the proposed protocol was rigorously verified under the Real-or-Oracle model and validated using ProVerif. Performance comparisons demonstrate that our scheme offered significant improvements in security, with an over 37% reduction in communication cost and computational overhead.