# Smart Grid Security: A PUF-Based Authentication and Key Agreement Protocol
## 5 Security Analysis of PPSG
### Heuristic Security Evaluation  
In the PPSG protocol, the secret key of the smart meter, denoted as \(d_{SM}\), is protected through the process of masking with the \(\mathit{PUF}(.)\) function. As a result, if an adversary manages to compromise the smart meter, they are unable to directly extract the original secret key \(d_{SM}\). Instead, the adversary can only obtain a modified version of the secret key, denoted as \(sd_{SM}\), which is computed as the XOR operation between \(d_{SM}\) and the output of the \(\mathit{PUF}(.)\) function applied to a unique identifier \(I_{SM}\) associated with the smart meter. Mathematically, this can be expressed as \(sd_{SM}=d_{SM}\oplus\mathit{PUF}(I_{SM})\). Assuming that the employed \(\mathit{PUF}(.)\) function is secure enough, the adversary faces significant difficulties in extracting the actual secret key \(d_{SM}\) or conducting related attacks, such as impersonation. The security of the PPSG protocol relies on the assumption that the \(\mathit{PUF}(.)\) function effectively masks the secret key and prevents its direct extraction. By leveraging the security properties of the \(\mathit{PUF}(.)\) function, the protocol ensures that even if the adversary compromises the smart meter, they cannot obtain the original secret key and are limited to accessing the modified version \(sd_{SM}\).  
Additionally, the session key used in the PPSG protocol is randomized using a combination of parameters: \(r_{NAN}\), \(r_{SM}\), \(d_{SM}\), \(d_{NAN}\), and \(P\). The adversary, however, only has access to \(r_{NAN}\cdot Q_{NAN}\) and \(r_{SM}\cdot Q_{SM}\), where \(Q_{NAN}\) and \(Q_{SM}\) are the public keys corresponding to \(d_{NAN}\) and \(d_{SM}\), respectively. This means that even if the adversary possesses knowledge of \(d_{NAN}\) and \(d_{SM}\), they are unable to extract the session key without solving the elliptic curve discrete logarithm problem (ECDLP) or the elliptic curve computational Diffie-Hellman problem (EC-CDHP). Therefore, the proposed PPSG protocol provides forward secrecy, ensuring that even with compromised long-term secret keys, the adversary cannot retroactively derive the session key. In the proposed protocol, the integrity of the messages is guaranteed by the following equations:  
\[Auth1_{SM} = H(R2_{SM},I_{SM},T_{SM})\] \[Auth_{NAN} = H(R2_{NAN},I_{NAN}\oplus I_{SM},T_{SM}\oplus T_{NAN})\] \[Auth2_{SM} = H(SK\|T_{SM}^{\ell})\]  
where \(SK=H(I_{NAN}\|I_{SM}\|R2_{NAN}^{*}\|I_{SM}^{\ell}\|T_{NAN})\). Given that the timestamp has been used in all messages, the adversary cannot use these messages in a later session to apply a replay attack, thus demonstrating the security of PPSA against this attack.  
In conclusion, the PPSG protocol strengthens the security of the smart grid system by masking the secret key using the \(\mathit{PUF}(\cdot)\) function, preventing direct extraction. Furthermore, the randomized session key construction and the computational hardness of the ECDLP or EC-CDHP problems ensure forward secrecy, protecting the confidentiality of past sessions even in the presence of compromised long-term secret keys.