# A Secure and Efficient Group Key Management Scheme for Clusters of String Inverters
## 5 Performance Evaluation  
### Experiment Settings  
In order to demonstrate the feasibility of the proposed key management scheme, we built a prototype in the C++11 programming language and deployed it on a cluster composed of ten Power-One Italy S.p.A. inverters. The entire cluster is powered with the following voltages/currents: (a) +12 volts (1.5 ampere) and (b) +3.3 volts (0.5 ampere) by means of a 450-watt Allied switching power supply unit (model AL-B450E).  
Each smart string inverter in the cluster was equipped with 512 MB Double Data Rate 3 Low voltage (DDR3L) of Random Access Memory (RAM; at 400 megahertz), an Advanced Risk Machine (ARM) Cortex-A8 (model AM3354 BZCZA100) Central Processing Unit (CPU) @1.0 GHz, and 4 GBytes (GB) embedded MultiMediaCard (eMMC) flash storage. Cluster inverters run 32-bit Ubuntu 14.04.4, desktop version. Figure 4 shows the cluster.  
Cluster inverters are interconnected by an Ethernet-based LAN in the daisy chain topology. For this purpose, the key elements are the two Ethernet interfaces 10/100 BASE-T, namely Eth0 and Eth1. Specifically, interface Eth0 of one inverter is connected via an Ethernet cable to interface Eth1 of the next inverter and so on and so forth. Figure 5 shows the system setup's main connections.  
Due to Power-One Italy S.p.A. guidelines and recommendations, including the ones on cybersecurity, a minimum-security level of 112-bit should be considered. Effectively, we considered 112-bit and 128-bit security levels, in the event of future development. Therefore, we endowed each cluster inverter both with an RSA and Elliptic Curves (ECs) private-public key pair with 112-bit and 128-bit security level. Table 3 presents the mapping between the security level and corresponding type/length of endowed cryptographic keys.  
In other terms, the RSA keys length was 2048-bit and 3072-bit while EC named curves considered were _secp224r1_ (equivalent to 2048-bit RSA key) and _secp256k1_ (equivalent to 3072-bit RSA key). On the other hand, we always considered a 128-bit long (i.e., 16 bytes) symmetric group key. This was used with Advanced Encryption Standard in Galois Counter Mode (AES-GCM).  
Figure 4: Experimental system setup: cluster of ten Power-One Italy S.p.A. a member of the FIMER Group inverters. Interconnections between inverters are not present.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Security Level** & **RSA Keys Length** & **EC Named Curve** \\ \hline
112-bit & 2048 bits & secp224r1 \\
128-bit & 3072 bits & secp256k1 \\ \hline \hline \end{tabular}
\end{table}
Table 3: Mapping between the security level and corresponding type/length of endowed cryptographic keys.  
Figure 5: Main connections of the experimental system setup: 2 \(\times\) Ethernet 10/100 BASE-T.  
Each of the four public keys was certified by an (X509v.3) certificate. Each certificate was issued by an (offline) root Certification Authority (CA) that we created ad-hoc. Certificates were issued from the root CA upon processing associated CSRs. Finally, we also saved the (self-signed) root CA certificate and the CRL on each inverter. In other terms, we defined a one-tier Public Key Infrastructure (PKI) hierarchy chain, with the single CA acting as both root CA and issuing CA.  
The reason why we endowed each inverter with different types of keys of a different key length was to evaluate the performance of the scheme as a function of those. Particularly, we evaluated the performance of the prototype along two dimensions, namely: (i) latency for group key generation and distribution and (ii) memory overhead.