## 4 Proposed Key Management Infrastructure Design for IACS
### Key Establishment Phase
```
1:if New Field Device is added to the field level network then
2: CKMI server:
3: Considers one polynomial share (\(PS\)) \(\in\) polynomial pool, \(ID\) used for generating \(PS\) and \(FGK\). 4: CKMI server \(\xrightarrow{\{PS||ID||FGK\}_{E_{identity}}}\) New Field Device. 5: CKMI server broadcasts message to all field level devices about the addition of new device (encrypted using \(FGK\)). 6:else if New Control Device is added to the control level network then
7: CKMI server:
8: One extra column is added to the public matrix using a seed value (\(SD\)). 9: Performs matrix multiplication \(A\) = Symmetric matrix (\(S\)) \(\times\) public matrix (\(P\)) and transpose \(A^{T}\). 10: Considers the newly generated row (\(ER\)) in \(A^{T}\) and \(CGK\). 11: CKMI server \(\xrightarrow{\{ER||SD||CGK\}_{E_{identity}}}\) New Control Device. 12: CKMI server broadcasts message to all control level devices about the addition of new device (encrypted using \(CGK\)) and also updates the public matrix in the public key directory. 13:else if New Plant Device is added to the plant level network then
14: CKMI server:
15: CKMI server \(\xrightarrow{\{EDP||D||PGK\}_{E_{identity}}}\) New Plant Device. 16: CKMI server broadcasts message to all plant level devices about the addition of new device (encrypted using \(CGK\)) and also adds the public key of the new device in the public key directory. 17:endif
```
**Algorithm 4** Device addition. ```
1:if New Field Device is added to the field level network then
2: CKMI server:
3: Considers one polynomial share (\(PS\)) \(\in\) polynomial pool, \(ID\) used for generating \(PS\) and \(FGK\). 4: CKMI server \(\xrightarrow{\{PS||ID||FGK\}_{E_{identity}}}\) New Field Device. 5: CKMI server broadcasts message to all field level devices about the addition of new device (encrypted using \(FGK\)). 6:else if New Control Device is added to the control level network then
7: CKMI server:
8: One extra column is added to the public matrix using a seed value (\(SD\)). 9: Performs matrix multiplication \(A\) = Symmetric matrix (\(S\)) \(\times\) public matrix (\(P\)) and transpose \(A^{T}\). 10: Considers the newly generated row (\(ER\)) in \(A^{T}\) and \(CGK\). 11: CKMI server \(\xrightarrow{\{ER||SD||CGK\}_{E_{identity}}}\) New Control Device. 12: CKMI server broadcasts message to all control level devices about the addition of new device (encrypted using \(CGK\)) and also updates the public matrix in the public key directory. 13:else if New Plant Device is added to the plant level network then
14: CKMI server:
15: CKMI server \(\xrightarrow{\{EDP||D||PGK\}_{E_{identity}}}\) New Plant Device. 16: CKMI server broadcasts message to all plant level devices about the addition of new device (encrypted using \(CGK\)) and also adds the public key of the new device in the public key directory. 17:endif
```
**Algorithm 5** Device addition. * Field level devices: CKMI server installs one of the available polynomial shares using a combination of a polynomial from the polynomial pool, a polynomial share generation \(ID\) and a Field level group key. * CKMI server broadcasts a message to all field level devices (encrypted using \(FGK\)) about the addition of a new device. Once the new device is deployed in the field level network, it can securely communicate with other field devices using the polynomial share received from the CKMI server. * Control level devices: Control level devices will get stored with a secret row from matrix \(A\) and a seed value from public matrix \(P\). In the case when no rows are available in matrix \(A\), there is a need for generating additional rows in matrix \(A\), which can be done as follows:
* CKMI server adds one extra column to the matrix \(P\) by considering a new seed value. No modification is required in the matrix \(S\). * To generate a new secret row in matrix \(A\), the CKMI server performs the matrix multiplication operation for \(P\) and \(S\) matrices. Transpose operation \(A=(S\cdot P)^{T}\) is performed.