# Smart Grid Security: A PUF-Based Authentication and Key Agreement Protocol
## 4 Proposed Protocol (PPSG)  
To overcome the security pitfalls of existing protocols, following our system model, we propose a secure protocol that is named PUF-based protocol for the smart grid--in the shortened form, PPSG. In the initialization phase, the CA selects and discloses the protocol's parameters publicly in the smart metering infrastructure (SMI). We take into consideration that each smart meter is outfitted with a \(PUF(.)\). As a result, during this stage, the certificate authority (CA) discloses the system parameters, i.e., \(\{q,P,h(. ),E_{q}(c,d)\}\), and they are stored in the SMI. The registration phase of the protocol is used for the \(SM\)s and the \(NAN\) gateways enrollment to the CA over a secure channel. In this phase, to register a \(SM\), it generates an identity \(I_{SM}\) for itself and transmits it to the CA. It will be accepted by the CA if it is unique, i.e., has not been used by another \(SM\) already. When \(SM\) chooses a unique identity \(I_{SM}\), the CA assigns it to the \(SM\) and generates a pair \((d_{SM},Q_{SM}=d_{SM}.P\,)\) as the \(SM\)'s private and public keys, respectively. The CA then sends the token \(<d_{SM}\), \(Q_{SM}=d_{SM}.P>\) to the \(SM\) through a secure channel and deletes \(d_{SM}\) from its database. Once the message is received, the \(SM\) stores \((I_{SM},sd_{SM}=PUF(I_{SM})\oplus d_{SM},Q_{SM})\) in its memory. To register a \(NAN\) gateway, the same process will be run, and it chooses its unique identifier \(I_{NAN}\) and the CA computes \(<d_{NAN}\), \(Q_{NAN}=d_{NAN}.P>\) as its private and public keys, respectively, and shares with the \(NAN\). The set \(I_{SM},Q_{SM}\) is also stored in the smart metering infrastructure (SMI), similarly \((I_{NAN},Q_{NAN})\). Assume that the \(i\)th \(SM\), which is denoted by \(SM_{i}\), wants to communicate with a nearby \(j\)th \(NAN\) gateway, which is denoted by \(NAN_{j}\). The mutual authentication and key agreement phase of the protocol process is as follows, as also depicted in Figure 2:  
1. The \(SM_{i}\) obtains \(I_{NAN}\) and \(Q_{NAN}\) from SMI, generates a random number \(r_{SM}\in Z_{q}^{*}\) and the timestamp \(T_{SM}\), computes \(R1_{SM}=r_{SM}.Q_{SM}\), \(R2_{SM}=r_{SM}. (PUF(I_{SM})\oplus sd_{SM}).Q_{NAN}\), and \(Auth1_{SM}=H(R2_{SM},I_{SM},T_{SM})\) and sends the message \(M_{1}=<(I_{SM},Auth1_{SM})\oplus R2_{SM},R1_{SM},T_{SM}>\) to the \(NAN\). 2. Once the \(NAN_{j}\) received \(M_{1}\), it validates \(T_{SM}\), calculates \(R2_{SM}^{*}=d_{NAN}.R1_{SM}\), and extracts \(I_{SM}^{*}\) and \(Auth1_{SM}^{*}\). Next, it verifies whether \(Auth1_{SM}^{*}\stackrel{{? }}{{=}}H(R2_{SM}^{*},I_{SM}^{*},T_{SM})\) to accept the login request. Assuming the request has been accepted, using \(I_{SM}^{*},NAN_{j}\) obtains \(Q_{SM}^{*}\) from SMI, generates a random number \(r_{NAN}\in Z_{q}^{*}\) and its timestamp \(T_{NAN}\) and computes \(R1_{NAN}=r_{NAN}.Q_{NAN}\), \(R2_{NAN}=r_{NAN}.R2_{SM}^{*}\) and \(Auth_{NAN}=H(R2_{NAN},I_{NAN}\oplus\ I_{SM},T_{SM}\oplus\ I_{NAN})\), and sends the message \(M_{2}=<Auth_{NAN},R1_{NAN},T_{NAN}>\) to the \(SM_{i}\). 3. Once the \(SM_{i}\) receives \(M_{2}\), it validates \(T_{NAN}\), calculates \(R2_{NAN}^{*}=(PUF(I_{SM})\oplus sd_{SM}).r_{sm}.R1_{NAN}\), and verifies whether \(Auth_{NAN}\stackrel{{? }}{{=}}H(R2_{NAN}^{*},I_{NAN}\oplus I_{ SM},T_{SM}\oplus T_{NAN})\) to authenticate the \(NAN_{j}\). Next, it extracts its current timestamp \(T_{SM}^{*}\) and computes the shared key \(SK=H(I_{NAN}\|I_{SM}\|R2_{NAN}^{*}\|T_{SM}^{\prime}\|T_{NAN})\) and \(Auth2_{SM}=H(SK\|T_{SM}^{\prime})\) and sends \(M_{3}=<Auth2_{SM},T_{SM}^{\prime}>\) to the \(NAN_{j}\). 4. Once the \(NAN_{j}\) receives \(M_{3}\), it verifies \(T_{SM}^{\prime}\), calculates \(SK^{*}=H(I_{NAN}\|I_{SM}^{*}\|R2_{NAN}\|T_{SM}^{\prime}\|T_{NAN})\), and verifies whether \(Auth2_{SM}\stackrel{{? }}{{=}}H(SK^{*}\|T_{SM}^{\prime})\) to authenticate the \(SM_{i}\). 5.