## 2 Related Work  
Local storage protection has been actively studied in academia. Most issues relating to the encryption of local data have been addressed using a key that is derived from a user password [3]. [PERSON] et al. [4] proposed an approach for limiting offline dictionary attacks by additionally requiring the user to solve a puzzle, such as CAPTCHA during the process of deriving a key from the user password. [PERSON] et al. [5] proposed a secret key sharing scheme in which a user's master key is reconstructed with two partial secrets that are stored and managed, respectively, in two separate devices. At first glance, this approach seems similar to ours in the sense that a user's master key has to be obtained only through the cooperation of multiple devices. However, the proposed system requires a centralized administration entity's persistent intervention and management, whereas in our approach the centralized administration entity is only needed for initial access policy configurations for industrial controllers. In addition, they presented the design of a system only without the actual implementation of their system while we implemented a fully working system and evaluated its performance under various conditions. [PERSON] et al. [6] proposed a secure storage architecture based on the TrustZone technology [7] in mobile devices to protect sensitive files from unauthorized access. However, the proposed technique can only be used with TrustZone enabled devices. One of our design goals is to provide a secure certificate-based user authentication scheme without relying on additional special hardware components such as TrustZone. To achieve this goal, we develop a secure user authentication scheme and evaluate its efficiency and security through experiments under various conditions. Unlike previous studies, we formally verified the security of our system. The National Institute of Standards and Technology (NIST) published a document for securing Industrial Control Systems (ICS) [8]. This document analyzes potential threats and vulnerabilities to ICS and recommends suitable countermeasures against the identified threats. In particular, with respect to user authentication, this document discusses five methods that could be applied to ICS environments and their pros and cons: password, challenge/response, physical token, smart card, and biometric authentication. This document also discusses specific considerations of ICS when applying each of these authentication methods. [PERSON] et al. [9] proposed a user authentication scheme based on QR codes and one-time passwords for industrial control systems, and [PERSON] et al. [10] further improved the scheme in [9] by taking advantage of the TLS channel binding technique [11]. [PERSON] et al. [1] proposed generic system architecture for user authentication and access control to industrial controllers in distributed industrial control systems. In their proposed architecture, a centralized authentication server and a centralized policy management server are employed for more efficient and flexible access control. Despite many benefits provided by such architectures with centralized servers, centralized identity management systems can be attractive targets for attackers, becoming a single point of failure. [PERSON] et al. [12] and [PERSON] et al. [13], respectively, proposed collaborative authentication protocols based on threshold cryptography, where multiple user devices jointly perform user authentication to remote verifiers. These approaches commonly use a secret sharing technique to split a secret key for user authentication into multiple shares and distribute them over multiple user devices. Due to the nature of the secret sharing technique in these approaches, the security of the collaborative user authentication process can be improved as the number of user devices sharing the secret key increases.