## 4 Proposed Key Management Infrastructure Design for IACS
### Key Establishment Phase
This results
in one extra row in matrix \(A\), as shown in Figure 5. This extra row can be considered as the secret row for the new device. * Plant level devices: The CKMI server installs the elliptic curve domain parameters, a unique private key \(\in F_{p}\) and plant level group key for the new device. The CKMI server broadcasts a message to all plant level devices (encrypted using _PGK_) informing about the addition of a new device and also adds the public key of the new device to a public key directory. Once the new device is deployed in the plant level network, it can securely communicate with other plant devices using the elliptic curve parameters and the public and private keys received from the CKMI server. \[S=\begin{bmatrix}K_{11}&K_{12}&...&K_{1n}\\ K_{12}&K_{22}&...&K_{2n}\\ K_{13}&K_{23}&...&K_{3n}\\ \vdots&\vdots&\ddots&\vdots\\ K_{1n}



plant level device maintains a public key revocation list. In addition, the CKMI server removes the public key of the compromised device from the public key directory. For every communication, devices check the public key of the device in the revocation list. If the communication requesting device's public key is present in the revocation list, the device terminates the connection and informs the same to the CKMI server. ```
1:if Key revocation is for Field device then
2: CKMI server \(\frac{\{\mathit{Evicted\;deviceID}\}_{FGRK}}{\mathit{Field\;devices}}\)
3: Field Devices: Updates Device ID revocation list. 4:elseif Key revocation is for Control device then
5: CKMI server \(\frac{\{\mathit{Evicted\;device\;send\;value\}\}_{FGRK}}{\mathit{Control\;devices}}\)
6: Control Devices: Updates Seed value revocation list. 7: CKMI server: Updates the public matrix in public key directory by removing the column of the compromised device. 8:elseif Key revocation is for Plant device then
9: CKMI server \(\frac{\{\mathit{Evicted\;device\;public\;key\}\}_{FGRK}}{\mathit{Plant\;devices}}\)
10: Plant Devices: Updates public key revocation list. 11: CKMI server: Removes the public key of the compromised device from the public key directory. 12:endif
```
**Algorithm 5** Key revocation. ### Key Update

According to the security policies and requirements, the keying materials of the devices should be updated. The old parameters of the device are archived, and CKMI server is involved in updating new parameters for the devices. Algorithm 6 depicts the key update process for IACS devices. * Field level devices: If the CKMI server wants to update the keying materials of a specific device, Join key of the device is used to send the new polynomial share and the \(ID\) used for generating the polynomial share. If the CKMI server wants to modify all the security parameters of the device, it uses a commissioning device [36]. The commissioning device is a portable device used by the commissioning engineer to configure the security parameters of the devices in the industrial plant. For field level devices, the new parameters include new polynomial share with a new ID, Join key and \(FGK\). * Control level devices:
* If CKMI server needs to update the keying materials (secret row and seed value) of the specific control device, it changes the seed value of the corresponding device in the public matrix and performs matrix multiplication for secret symmetric matrix (\(S\)) and the updated public matrix (\(P\)). The matrix multiplication operation results in a change of only one secret row corresponding to the device, which requires a key update and remaining rows are not affected in the matrix \(A\). The Join key of the device is used to send the new secret row and the seed value for the device. The CKMI server updates the public matrix in the public key directory. * If CKMI server wants to modify all the security parameters of the device, it uses commissioning device. For control level devices, the new parameters include a new secret row from matrix \(A\), a seed value from the new public matrix \(P\), Join key and \(CGK\).