# Group Authentication Scheme for Neighbourhood Area Networks (NANs) in Smart Grids
## 3 The Smart Grid Network Model
### Case Two--Multi-Hop (Mesh)
#### 3.5.2 Authentication of the Smart Meters, \(SM_{ng}\)  
When \(SM_{new}\) requests to join a group, it needs to be authenticated by \(GW_{g}\). There are some SMs that have no direct link to \(GW_{g}\). Therefore, the authentication method shown in Figure 5 is not suitable, and we propose a two-step authentication scheme. The new SM, \(SM_{new}\), will be authenticated through another, already authenticated, \(SM_{ng}\), which is referred to as proxy \(SM_{ng}\). Initially, the new \(SM_{new}\) sends an authentication request to the proxy \(SM_{ng}\) (Figure 7). This message includes the following information:  
1. Mi, the serial number of \(SM_{new}\) and SNNSM, encrypted using \(K_{new,NOC}\),
2. Identity number of new \(SM_{ng}\), \(\text{IDSM}_{ng}\),
3. Timestamp TS. The proxy \(SM_{ng}\) encrypts Mi along with its identity and TS using the shared key between proxy \(SM_{ng}\) and \(GW_{g}\). After \(GW_{g}\) receives and decrypts the message, \(GW_{g}\) re-encrypts Mi using the key \(K_{GW_{g}}\). NOC will decrypt Mi using \(K_{g,noc}\), check the serial number of new \(SM_{new}\), SNNSM, and validate \(SM_{new}\). The NOC sends an authentication response, addressed to the new SM. The message, Xi consists of the encrypted master key of \(GW_{g},MK_{GW}\) using \(K_{sm,noc}\). When the new \(SM_{new}\) receives \(MK_{GW}\), it sends an encrypted acknowledgement to \(GW_{g}\), using \(MK_{GW}\). \(GW_{g}\) generates a random number R and multicasts the encrypted random number R, as a message, using the shared key \(K_{GW,SM}\), thereby refreshing the keys of the group when the new SM, \(SM_{new}\), is authenticated. When all SMs receive the encrypted message they decrypt the message using \(K_{GW,SM}\) to obtain the random number R. Then, each SM applies a one-way hash function on the random number R to generate the authentication value AVi. This authentication value is used by the gateway to authenticate nodes within the group. For example, for a group of SM with numbers between 10 to 20, the GW will multicast the key to all SM within a time duration of 5 s (timeout value) when using a wireless mesh network such as ZigBee or Wi-Fi. Figure 6 illustrates the following steps in a ladder diagram. 1. SM sends an authentication request. 2. NOC validates data and sends an authentication response. 3. Authentication response contains \(MK_{GW}\). 4. GW sends R to the new SM. 5. New SM sends an ACK to GW. 6. GW multicasts R to the group. Following the authentication, the SM sends data to the NOC. The steps involved in communication are listed below. Notice the authenticated forwarding in steps 4 and 5. The intermediate nodes use a MAC to check the integrity and source of the packet that arrived. Additionally, note that the source node will ascertain that its data is delivered only when it receives an acknowledgement from the NOC. The details of the communication phase are out of the scope of this discussion. 1. SM decides the neighbour to forward to, for a packet destined to the NOC. SM generates its encryption key \(K_{\mathit{forw}}\), \(\mathcal{F}^{\prime}\) (\(R\mid SM_{n,g}\)) where \(\mathcal{F}^{\prime}\) is the one-way-hash function. 3. SM generates a MAC for the message using \(K_{\mathit{forw}}\). 4. The neighbour receives the message with MAC and validates it. Knowing what node id it came from, it generates the forwarding key of the source. 5. If successful, it generates a MAC and forwards it to a neighbour (to the GW, if it is the neighbour). If the MAC fails, the packet is simply dropped. Our scheme is scalable for the requirements of a SG. In our scheme, each gateway and its group transact individually with the NOC and have no interdependency on other gateways or groups, except for forwarding data to the NOC. When the devices are scaled, an appropriate number of gateways are included to match the number of groups formed. Each gateway and its group need access to keys for their own group, the gateway and the NOC.