# A Blockchain-Based Cooperative Authentication Mechanism for Smart Grid
## 4 Our Proposed Mechanism
### Cross-Domain Authentication Algorithm  
Cross-domain authentication means that, if a smart device \(D_{i}\) in one domain wants to access a device \(D_{j}\) in another domain and read some information, the identity of \(D_{i}\) must be confirmed by authentication before accessing it. Key activities of the device, including device registration, device update, and device logout, are prerequisites for cross-domain authentication. The overall process of cross-domain authentication is described in detail below. Suppose device \(D_{i}\) from domain A wants to access device \(D_{j}\) from domain B. Before authentication, \(D_{i}\) must check whether its certificate has expired. If it has, \(D_{i}\) must perform the device update operation. If the certificate is not expired, the cross-domain authentication process can begin, which is shown in Figure 3. The cross-domain authentication algorithm is as follows:  
Figure 3: Cross-domain authentication flow chart. Step 1: Device \(D_{i}\) in domain A sends a connection request to device \(D_{j}\) in domain B. After receiving the request, device \(D_{j}\) forwards this request to the domain manager \(M_{B}\) in domain B. Step 2: After receiving the request, \(M_{B}\) checks whether the authentication information of device \(D_{i}\) is available in its local database; if so, it jumps to step 3; if not, it jumps to step 6. Step 3: \(M_{B}\) will send a request for querying device \(D_{i}\) to the blockchain proxy node \(P_{B}\) of domain B. After receiving the request, \(P_{B}\) queries the blockchain for information about \(D_{i}\) and gets \(\{T_{i},h_{0}(Cert_{i}),state\}\) and sends it to \(M_{B}\). Step 4: \(M_{B}\) determines whether the hash value of the authentication information in the local database is equal to \(h_{0}(Cert_{i})\); if it is equal then execute step 5; if not then skip to step 7. Step 5: \(M_{B}\) determines whether the certificate is expired, assuming \(NOW\) is the current timestamp; if \(T_{i}<NOW\) then the authentication information has expired; go to step 6; if it has not expired then the cross-domain authentication is successful. Step 6: \(M_{B}\) generates a random string \(RS\) and sends it to \(D_{i}\). Step 7: After receiving the random string \(RS\), \(D_{i}\) uses its private key to sign to get \(Sig(RS)_{sk_{i}}\). Afterwards \(D_{i}\) hashes his certificate to get \(h_{0}(Cert_{i})\), which prevents the certificate from being tampered with. Finally, \(D_{i}\) sends \(\{Cert_{i},h_{0}(Cert_{i}),Sig(RS)_{sk_{i}}\}\) to \(M_{B}\). Step 8: After \(M_{B}\) gets the public key \(pk_{i}\) of device \(D_{i}\) from the certificate, use its public key to verify the signature to get \(RS^{\prime}=Dsig(Sig(RS)_{sk_{i}})_{pk_{i}}\), then judge whether \(RS^{\prime}\) is equal to \(RS\); if it is equal then execute the next step, otherwise it means the cross-domain authentication fails so end the cross-domain authentication process. Step 9: \(M_{B}\) sends a request to \(B_{j}\) to query the device \(D_{i}\). \(B_{j}\) receives the request and queries the blockchain for information about \(D_{i}\) to get \(\{T_{i},h_{0}(Cert_{i}),state\}\) and sends it to \(M_{B}\). Step 10: \(M_{B}\) determines whether the certificate status is legal, whether the hash value of the certificate in the blockchain is equal to the hash value of the certificate sent from the device \(D_{i}\), and whether the certificate is expired. If all three conditions are satisfied, the next step is executed, otherwise it means that the cross-domain authentication fails so end the cross-domain authentication process. Step 11: \(M_{B}\) stores the certificate of device \(D_{i}\), then encrypts the certificate of device \(D_{j}\) with the public key of \(D_{i}\) to get \(Sig(Cert_{j})_{pk_{i}}\) and sends it to device \(D_{i}\). Step 12: \(D_{i}\) decrypts the certificate \(Cert_{j}=DSig(Sig(Cert_{j})_{pk_{i}})_{sk_{i}}\) of device \(D_{j}\) with its private key and sends it to the manager \(M_{A}\) of domain A.