# A Secure and Efficient Group Key Management Scheme for Clusters of String Inverters
## 3 System Model  
With reference to Figure 3, we considered a cluster of \(n\) inverters interconnected by a communication link, both wired (e.g., Ethernet) or wireless (e.g., WiFi). The cluster may be both Internet-connected or not. Inverter \(i\), \(1\leq i\leq n\), is identified by a unique identifier UID\({}_{i}\) and is configured with a pair of public-private cryptographic keys (\(privK_{i}\), \(pubK_{i}\)). Let \(\text{Cert}_{i}\) be the certificate released to inverter \(i\) by a Certification Authority (CA) trusted by all inverters in the cluster. Certificate \(\text{Cert}_{i}\) as well the root certificate \(\text{Cert}_{\text{CA}}\) of the Certification Authority CA are locally stored at any inverter \(i\). Furthermore, we assumed that each inverter maintains a Certificate Revocation List (CRL) whereby it stores revoked certificates. Every inverter is equipped with a hardware secure module (HSM) to store secret cryptographic material (e.g., the private key) and a Cryptographically Secure Pseudo Random Generator (CSPRG) [66]. We assumed that by exploiting the public key material, any pair of inverters could securely communicate in a unicast fashion. By secure we mean that the unicast channel guarantees data confidentiality, integrity and authenticity and inverters' mutual authentication. On the point-to-point channel, an inverter will abort any attempts of communication from other inverters whose certificates are present in its own CRL. This allows only authorized inverters to securely communicate in a unicast fashion with each other. To fix ideas, you may assume that a pair of inverters uses the Transport Layer Security (TLS) to establish a secure channel whereby mutual authentication (mTLS) has been activated. TLS connection establishment is aborted if the other inverter's certificate has been revoked. The security of the TLS protocol has been extensively scrutinized [67; 68; 69; 70; 71]. Protocol and implementation vulnerabilities afflicted different versions of TLS [72; 73; 74]. In this paper, we assumed an implementation of TLS, which did not suffer from any known vulnerability. Inverters of the cluster form an IP multicast group \(G\). To limit access to multicast information, group members share a secret cryptographic key, the group key, which they use to encrypt and decrypt messages that are transmitted and received, respectively, within the group. We denoted by  
Figure 3: System model: (**a**) Internet-connected PV plant and (**b**) Internet-disconnected PV plant. \(\mathrm{K_{G}}\) the group key of group \(G\). We employed the Galois Counter Encryption Mode (GCM) to meet the confidentiality, integrity and authenticity of group communication [75]. An inverter becomes a member of the group by explicitly joining it. We call this operation join. Upon joining the group, the new member receives the current group key. As a member of the group, an inverter may multicast messages to the other group members. Later, a member may leave the group. We call this operation leave. Leaving the group may be voluntary, e.g., when the inverter's mission is completed or when the inverter is sent to maintenance. Alternatively, an inverter may be forced to leave because compromised or suspected to be so. When an inverter leaves the group, the current group key is revoked and a new one is distributed. In addition, the group key is periodically renewed. We call this operation key refresh. The group of inverters is managed by a Group Controller (GC) that is composed of three main services: a Group Membership Service (GMS), a Key Management Service (KMS) and an Intrusion Detection Service (IDS). The GMS component maintains the membership of the group by keeping track of inverters that join and leave the group. Upon a membership change, GMS invokes the join or leave operation accordingly. The IDS probes/monitors the network activities to uncover compromised inverters. Upon detecting a compromised inverter, the IDS forces the inverter to leave the group by reporting the inverter's identifier to the GMS.