# Anonymous and Efficient Message Authentication Scheme for Smart Grid

Authors: Libing Wu; Jing Wang; Sherali Zeadally; Debiao He
Journal: Security and Communication Networks
 (2019)

---

## Abstract

Smart grid has emerged as the next-generation electricity grid with power flow optimization and high power quality. Smart grid technologies have attracted the attention of industry and academia in the last few years. However, the tradeoff between security and efficiency remains a challenge in the practical deployment of the smart grid. Most recently, Li et al. proposed a lightweight message authentication scheme with user anonymity and claimed that their scheme is provably secure. But we found that their scheme fails to achieve mutual authentication and mitigate some typical attacks (e.g., impersonation attack, denial of service attack) in the smart grid environment. To address these drawbacks, we present a new message authentication scheme with reasonable efficiency. Security and performance analysis results show that the proposed scheme can satisfy the security and lightweight requirements of practical implementations and deployments of the smart grid.


---

## Body

## 1. Introduction

The explosive growth in mobile data services has paved the way for wireless communications to be achieved with lower energy consumption, higher throughout, and better quality of service [1]. The smart grid is one of the most significant technologies for developing smart homes and, as a result, we have witnessed an increase in interest among researchers and engineers in these technologies. Besides the one-way information flow communication as in the traditional power grid, the smart grid incorporates two-way communications to provide reliability, efficiency, and security for the electric system, where there are many machines (i.e., smart meters, sensing devices, control systems, and other household applications) involved to enable these two-way communications [2, 3].Generally, network communication forms the core of the electric system automation applications of the smart grid. The deployment of one-way information flow communication networks is similar to that in the traditional smart grid. As for the two-way information flow communication network, it involves a neighborhood gateway which collects the electricity consumption records from corresponding consumers via wireless network connections [4]. Next, the neighborhood gateway sends its collected data to the control center for detailed consumption analysis via a wired network connection. Finally, the control center responds with real-time pricing information to the smart grid consumers or sends the electric control information to relieve the burden of electricity demand peak. At the consumer’s side, the device communicating with the neighborhood gateway is the smart meter which is resource-constrained and is responsible for collecting the electricity consumption reports through its connection with various household appliances. Figure 1 depicts the communication architecture for smart grid (and the entities concluded in a home area network (HAN) are some household appliances).Figure 1
Simplified communication architecture of smart grid (updated from [4]).To enable network communications in the above architecture, it is desirable to choose the Internet Protocol-based communication technologies for the smart grid. Inevitably, such networks are prone to a number of external attacks, such as impersonation attack, tracking attack, and denied of service (DoS) attack [6]. Additionally, a large volume of sensitive data that directly impact user privacy is transmitted over these networks. Consequently, it is crucial to ensure that unauthorized entities cannot access such transmitted information or communicate with the information technologies elements in the smart grid communication systems.Authentication and key agreement protocols are key technologies that can ensure the security of an information system. Together, they ensure the legitimacy and authenticity of a user’s identity and provide an agreed session key for secure communication between entities in a network. According to recent researches [7–10], several authentication schemes for smart grid were proposed over the last several years. We identify two major limitations of many of these recently proposed authentications for smart grid:(i)
The computation cost of these schemes is not practical for smart grid environment:in a smart grid, most of smart things and applications connected to the Internet are constrained to computation capabilities. However, the smart devices (e.g., smart meters) in these authentication schemes are expected to perform some compute-intensive operations, such as the map-to-point hash and bilinear pairing operations.(ii)
Important security properties or functions are not provided by these schemes:these schemes have various vulnerabilities that can be exploited in different types of attacks to the smart grid networks, such as the impersonation attack and denial of service attack. Some of these schemes cannot provide secure mutual authentication, key agreement, and user anonymity. These limitations seriously hinder their practical deployment and implementation in the smart grid environment.Most recently, Li et al. [5] proposed an anonymous and lightweight message authentication scheme for smart grids. They only used some very lightweight cryptographic operations in their scheme, e.g., bitwise XOR operation and one-way hash functions. They also claimed that their scheme is provably secure and provides many necessary functions and security properties. However, we demonstrate that their scheme cannot provide secure mutual authentication and resistance against DoS attacks, which can seriously affect the availability of network communication systems. Since the message transmitted over the grid communication networks is delay-sensitive, these networks of smart grids are much more focused on the message delay than the data throughout when compared with the general Internet. Thus, Li et al.’s scheme is not practical in the deployment of smart grids. To address these weaknesses, we then propose an improved scheme and show that it is provably secure in Section 6.The remainder of this paper is organized as follows. In the next two sections, we briefly review related works and relevant preliminaries, respectively. In Section4, we review Li et al.’s scheme and identify the design weaknesses of their scheme. In Section 5, we describe our improved message authentication scheme for the smart grid. In Sections 6 and 7, we analyze the security and evaluate the performance of our proposed scheme respectively. Finally, we make some concluding remarks in the last section.


## 2. Related Work

In the last decade, several cryptographic protocols including digital signature [11], encryption [12, 13], data aggregation [14, 15], secure data storage [16–18], and authentication schemes [9, 19] have been proposed as solutions to secure the smart grid by academia and industry [20]. The authentication scheme is the first line of defense to protect data security and enforce privacy protection for smart grids, and it is an important requirement in the deployment of smart grids.Tsai and Lo [8] proposed an anonymous key distribution scheme to provide secure communications for smart grids by integrating identity-based signature and identity-based encryption. In their scheme, it is fairly easy for smart meters to authenticate each other, while some bilinear pairing operations are introduced. Later, Odelu et al. [21] pointed out that Tsai and Lo’s scheme fails to support SK-security and credential privacy of smart meters and then proposed a new authentication key agreement scheme for the smart grid environment to solve the vulnerabilities in [8].Chim et al. proposed a gateway-assisted authentication for power usage information with privacy preservation for smart grids, which allowed the smart meters to aggregate power usage information [22]. Chan and Zhou proposed a two-factor cyberphysical device authentication scheme to resist coordinated cyberphysical attacks in a smart grid (SG) environment by combining a novel contextual factor and conventional authentication factor [23]. Then, Wazid et al. proposed a secure three-factor authentication scheme for renewable-energy-based smart grid environment, which can provide password and biometric update and smart meter anonymity [19]. Li et al. [24] also proposed a three-factor authentication scheme for smart grid and solved the shortcomings (i.e., wrong password detection mechanism, vulnerability in DoS attacks) in [25].Li et al. claimed that many of the existing authentication schemes for wireless sensor networks more or less suffer from various weaknesses, so that they proposed a new secure authentication scheme with privacy preservation based on elliptic curve cryptography (ECC) for industrial Internet of things [26]. Mahmood et al. also proposed an ECC-based privacy-preserving authentication for smart grid communications with high efficiency by reducing some complex cryptographic operations [27]. Koo et al. also investigated both security and privacy into smart grid systems; they proposed a provably secure scheme with privacy-preserving aggregation and multisource smart meters authentication [28]. Before this, He et al. had proposed two related data aggregation schemes that are resistant against insider attacks in smart grid systems [14, 29].Shen et al. designed two lightweight authentication protocols and a group key establishment algorithm between sensor nodes and personal digital assistants for wireless body area networks [30, 31]. Their proposed protocols were aimed at resource-constrained devices and therefore they can be applied to smart grid systems. Ennahbaoui and Idrissi [32] designed a zero-knowledge authentication and intrusion detection system for secure smart grids. In [33], Aujla et al. argued that traditional TCP/IP-based networks are not suitable for most smart applications, so they proposed an SDN-enabled multiattribute secure communication model for smart grids. Most recently, Li et al. [5] proposed a provably secure message authentication scheme with high efficiency for smart grids. However, in this work, we will demonstrate the scheme fails to provide mutual authentication and cannot mitigate the impersonation attacks and DoS attacks.


### 2.1. Our Contributions

In this subsection, we summarize the main contributions of this work as follows:(i)
First, we propose a new anonymous message authentication scheme for smart grid. The proposed scheme addresses the weaknesses in Li et al.’s scheme with desire efficiency.(ii)
Second, we make an in-depth security analysis to demonstrate out proposed scheme is provably secure and can fulfill those security requirements of the smart grid environment.(iii)
Finally, we evaluate the performance of our proposed scheme and compare it with that in Li et al.’s scheme. The comparison results show that our scheme is more suitable for the practical deployment of the smart grid.


## 2.1. Our Contributions

In this subsection, we summarize the main contributions of this work as follows:(i)
First, we propose a new anonymous message authentication scheme for smart grid. The proposed scheme addresses the weaknesses in Li et al.’s scheme with desire efficiency.(ii)
Second, we make an in-depth security analysis to demonstrate out proposed scheme is provably secure and can fulfill those security requirements of the smart grid environment.(iii)
Finally, we evaluate the performance of our proposed scheme and compare it with that in Li et al.’s scheme. The comparison results show that our scheme is more suitable for the practical deployment of the smart grid.


## 3. Preliminaries

Next, we present the threat models, some notations, and two mathematical problems used in this paper.


### 3.1. Notations

We use the following notations in this paper:(i)
HANGWi: the i-th smart meter gateway of the home area network (HAN).(ii)
NANGWj: the j-th smart meter gateway of the neighborhood area network (NAN).(iii)
G: a cyclic multiplication group.(iv)
q: a strong prime integer as the order of G.(v)
g: the generator of G.(vi)
h: the secure hash function, where h:{0,1}∗→Zq.(vii)
h′: the secure hash function, where h′:{0,1}∗→{0,1}log2q+|ID|.(viii)
IDi: the real identity of HANGWi, where IDi∈{0,1}∗.(ix)
IDj: the real identity of NANGWj, where IDj∈{0,1}∗.(x)
⊕: the exclusive-OR operation.(xi)
Δt: the uplimited time interval.(xii)
Pr[E]: the probability of event E.


### 3.2. Mathematical Problems

LetG be a cyclic multiplication group with generator g and a strong prime integer q as its order, so that p=2×q+1 is also a large prime integer. For any number a∈Zq∗, ga mod p is included in G. For clarity, we omit the expression“modp” in this paper. The following two mathematical problems are the security foundation of the proposed scheme in Section 5.(1)
Discrete Logarithm (DL) Problem. Given two elements (g,ga)∈G, the goal is to compute the value of a∈Zq∗, which is hard for a polynomial function with in polynomial time.(2)
Computational Diffie-Hellman (CDH) Problem. Given three elements (g,ga,gb)∈G, where a,b∈Zq∗ are kept secret, the goal is to compute the value of gab∈G, which is hard for a polynomial function within polynomial time.


### 3.3. Network Model

In our network model, we focus on the communication security between the neighborhood gateway and the smart meter. As shown in Figure2, we assume that a neighborhood area network (NAN) covers a number of home area networks (HANs, e.g., HAN1,HAN2,HAN3), where the smart meter is a communication center. We also assume the smart meter as a gateway in the HAN.Figure 2
A simplified communication network model (updated from [1]).(i)
Registration center (RC): the RC represents a trusted third party that is responsible for generating all system parameter, and secret values (i.e., private key) for each communication party in the system. (ii)
Neighborhood gateway (NAN-GW): the NAN-GW represents a gateway deployed in the NAN. It is in charge of receiving the consumption reports from each HAN-GW and then sends them to the control center. The main function of the NAN-GW is to detect the replay attack, impersonation attack, and other malicious attacks. (iii)
Home gateway (HAN-GW): the HAN-GW represents a gateway deployed in the HAH. It is equipped with a smart meter in order to collect the consumption reports and then transmits them to the NAN-GW. The HAN-GW is resource-constrained and vulnerable to many network attacks.


## 3.1. Notations

We use the following notations in this paper:(i)
HANGWi: the i-th smart meter gateway of the home area network (HAN).(ii)
NANGWj: the j-th smart meter gateway of the neighborhood area network (NAN).(iii)
G: a cyclic multiplication group.(iv)
q: a strong prime integer as the order of G.(v)
g: the generator of G.(vi)
h: the secure hash function, where h:{0,1}∗→Zq.(vii)
h′: the secure hash function, where h′:{0,1}∗→{0,1}log2q+|ID|.(viii)
IDi: the real identity of HANGWi, where IDi∈{0,1}∗.(ix)
IDj: the real identity of NANGWj, where IDj∈{0,1}∗.(x)
⊕: the exclusive-OR operation.(xi)
Δt: the uplimited time interval.(xii)
Pr[E]: the probability of event E.


## 3.2. Mathematical Problems

LetG be a cyclic multiplication group with generator g and a strong prime integer q as its order, so that p=2×q+1 is also a large prime integer. For any number a∈Zq∗, ga mod p is included in G. For clarity, we omit the expression“modp” in this paper. The following two mathematical problems are the security foundation of the proposed scheme in Section 5.(1)
Discrete Logarithm (DL) Problem. Given two elements (g,ga)∈G, the goal is to compute the value of a∈Zq∗, which is hard for a polynomial function with in polynomial time.(2)
Computational Diffie-Hellman (CDH) Problem. Given three elements (g,ga,gb)∈G, where a,b∈Zq∗ are kept secret, the goal is to compute the value of gab∈G, which is hard for a polynomial function within polynomial time.


## 3.3. Network Model

In our network model, we focus on the communication security between the neighborhood gateway and the smart meter. As shown in Figure2, we assume that a neighborhood area network (NAN) covers a number of home area networks (HANs, e.g., HAN1,HAN2,HAN3), where the smart meter is a communication center. We also assume the smart meter as a gateway in the HAN.Figure 2
A simplified communication network model (updated from [1]).(i)
Registration center (RC): the RC represents a trusted third party that is responsible for generating all system parameter, and secret values (i.e., private key) for each communication party in the system. (ii)
Neighborhood gateway (NAN-GW): the NAN-GW represents a gateway deployed in the NAN. It is in charge of receiving the consumption reports from each HAN-GW and then sends them to the control center. The main function of the NAN-GW is to detect the replay attack, impersonation attack, and other malicious attacks. (iii)
Home gateway (HAN-GW): the HAN-GW represents a gateway deployed in the HAH. It is equipped with a smart meter in order to collect the consumption reports and then transmits them to the NAN-GW. The HAN-GW is resource-constrained and vulnerable to many network attacks.


## 4. Cryptanalysis of Li et al.’s Scheme

In this section, we briefly review the provably secure message authentication scheme proposed by Li et al. For more details, readers can refer to [5]. Focusing on the authentication phase, we demonstrate that this phase is vulnerable to the impersonation attack and the DoS attack.


### 4.1. Review of Li et al.’s Scheme

Li et al.’s scheme consists of three phases (i.e., initialization phase, authentication phase, and message transmission phase) and two communication parties (i.e.,HANGWi and NANGWj). Since the initialization phase and message transmission phase are the same as described in Sections 5.1 and 5.3, we omit them in this subsection. We only present the authentication phase as depicted in Figure 3.Figure 3
Authentication phase of Li et al.’s scheme.Step A1. HANGWi randomly selects a number a∈Zq∗ and extracts the current timestamp ti to compute C1=ga, C2=Pjs⊕IDi and C3=a(xi+h(IDi∥ti))-1.Step A2. HANGWi sends M1={C1,C2,C3,ti} to NANGWj.Step A3. Upon receiving message M1, NANGWj extracts the current timestamp ti′, checking whether |ti′-ti|≤Δt holds. If so, it continues to compute IDi=C2⊕C1yj for verifying Pigh(IDi∥ti))C3=?C1. If the equation does not hold, it aborts the current authentication. Otherwise, it does the next step.Step A4. NANGWj randomly selects a number b∈Zq∗ and extracts the current timestamp tj to compute C4=gb, C5=h(C1yj∥IDi∥ti)⊕IDj, skN-H=h(C1∥C4∥C1b∥IDi∥IDj) and C6=h(IDi∥ti∥IDj∥tj∥C1∥C4∥skN-H).Step A5. NANGWj sends M2={C4,C5,C6,ti} to HANGWi.Step A6. Upon receiving message M2, HANGWj extracts the current timestamp tj′, checking whether |tj′-tj|≤Δt holds. If it holds, it computes IDj=C5⊕h(Pja∥IDi∥tj), skH-N=h(C1∥C4∥C4a∥IDi∥IDj). Then, it checks the correctness of C6=h(IDi∥ti∥IDj∥tj∥C1∥C4∥skH-N) to determine whether aborts this communication.


### 4.2. Design Weaknesses in Li et al.’s Scheme

With superior performance and desired properties over the related works, Li et al.’s scheme seems quite promising from the perspective of desirable features which their scheme supports. However, its potential threats in some realistic attack scenarios go beyond the provable security model, the security analysis of their scheme is insufficient. We will show that their scheme fails to achieve mutual authentication by verifying(Pigh(IDi∥ti))C3=C1 at the NANGWj’s side. Additionally, their scheme cannot resist impersonation attack where an attacker A forges a message M1 to impersonate HANGWi.Next we investigate the following new but realistic attacking scenario. Suppose the identityIDi is somehow known to an attacker A as in the case when A is familiar to the user and guesses the IDi via the user’s personal information. Since the authentication message M1={C1,C2,C3,ti} is transmitted over an open channel, it is easy for A to intercept M1 during any authentication process. Suppose A has obtained two messages M11={C11,C21,C31,ti1} and M12={C12,C22,C32,ti2}, where C11=ga1, C12=ga2 and a1,a2 are unknown to the attacker. A can impersonate HANGWi by forging any request message M1∗={C1∗,C2∗,C3∗,ti∗} with real-time ti∗ as shown by following steps.Step 1.
Computeh1=h(IDi∥ti1), h2=h(IDi∥ti2), h∗=h(IDi∥ti∗), and P1=C21⊕IDi, P2=C22⊕IDi.Step 2.
Select two variablesσ1,σ2 to construct equations (1)C3∗=σ1·C31+σ2·C32h∗·C3∗=σ1·h1·C31+σ2·h2·C32Step 3.
Compute one of solutions to above equations, such as(2)σ1=1σ2=h∗-h1C31h2-h∗C32Step 4.
ComputeC1∗=(C11)σ1·(C12)σ2, C2∗=((P1)σ1·(P2)σ2)⊕IDi, and C3∗=σ1·C31+σ2·C32.Step 5.
SendM1∗={C1∗,C2∗,C3∗,ti∗} to a valid NANGWj.Correctness. Upon receiving the message M1∗ from A, NANGWj first checks the freshness of ti∗. Then, it computes IDi∗=C2∗⊕(C1∗)yj. Since (3)C2∗=P1σ1·P2σ2⊕IDi=Pja1σ1·Pja2σ2⊕IDi=ga1σ1yj·ga2σ2yj⊕IDi=C11σ1·C12σ2yj⊕IDi=C1∗yj⊕IDiwe obtain IDi∗=C2∗⊕(C1∗)yj=IDi. Next, NANGWj checks whether (Pigh(IDi∥ti∗))C3∗=?C1∗. According to Step 2 above, we can get(4)PighIDi∥ti∗C3∗=PiC3∗·gh∗C3∗=Piσ1C31+σ2C32·gσ1h1C31+σ2h2C32=PiC31·gh1C31σ1·PiC32·gh1C32σ2=C11σ1·C12σ2=C1∗Therefore, an attackerA can pass NANGWj’s authentication without knowing a HANGWi’s private key. As a result, A manages to make NANGWj believe that he/she is a valid HANGWi and continuously execute authentication operations. Thus, an external attacker can break the security of mutual authentication and launch the DoS attack on the smart grid by impersonating a legal HANGWi gateway to connect with the corresponding NANGWj. As a consequence, the smart grid network system cannot reject the connection of a malicious IP address by detecting the invalid data packages received, and thus it is susceptible to DoS attacks, which will lead to an increase in message delay.Effectiveness. It is worth noting that the above attack is very effective because it only requires a passive eavesdropping attacker and involves a few lightweight cryptographic operations, such as addition, multiplication, exponentiation, and hash operations. For example, to get a solution in Step 3 and forge a successful authentication message M1, we only require three general hash operations, six multiplication operations, one division operation, four exponentiation operations, and three addition/subtraction operations. Given the running time of each operation referred in Li et al.’s scheme [5], the total time for A to successfully implement an attack is about 1.396ms.


## 4.1. Review of Li et al.’s Scheme

Li et al.’s scheme consists of three phases (i.e., initialization phase, authentication phase, and message transmission phase) and two communication parties (i.e.,HANGWi and NANGWj). Since the initialization phase and message transmission phase are the same as described in Sections 5.1 and 5.3, we omit them in this subsection. We only present the authentication phase as depicted in Figure 3.Figure 3
Authentication phase of Li et al.’s scheme.Step A1. HANGWi randomly selects a number a∈Zq∗ and extracts the current timestamp ti to compute C1=ga, C2=Pjs⊕IDi and C3=a(xi+h(IDi∥ti))-1.Step A2. HANGWi sends M1={C1,C2,C3,ti} to NANGWj.Step A3. Upon receiving message M1, NANGWj extracts the current timestamp ti′, checking whether |ti′-ti|≤Δt holds. If so, it continues to compute IDi=C2⊕C1yj for verifying Pigh(IDi∥ti))C3=?C1. If the equation does not hold, it aborts the current authentication. Otherwise, it does the next step.Step A4. NANGWj randomly selects a number b∈Zq∗ and extracts the current timestamp tj to compute C4=gb, C5=h(C1yj∥IDi∥ti)⊕IDj, skN-H=h(C1∥C4∥C1b∥IDi∥IDj) and C6=h(IDi∥ti∥IDj∥tj∥C1∥C4∥skN-H).Step A5. NANGWj sends M2={C4,C5,C6,ti} to HANGWi.Step A6. Upon receiving message M2, HANGWj extracts the current timestamp tj′, checking whether |tj′-tj|≤Δt holds. If it holds, it computes IDj=C5⊕h(Pja∥IDi∥tj), skH-N=h(C1∥C4∥C4a∥IDi∥IDj). Then, it checks the correctness of C6=h(IDi∥ti∥IDj∥tj∥C1∥C4∥skH-N) to determine whether aborts this communication.


## 4.2. Design Weaknesses in Li et al.’s Scheme

With superior performance and desired properties over the related works, Li et al.’s scheme seems quite promising from the perspective of desirable features which their scheme supports. However, its potential threats in some realistic attack scenarios go beyond the provable security model, the security analysis of their scheme is insufficient. We will show that their scheme fails to achieve mutual authentication by verifying(Pigh(IDi∥ti))C3=C1 at the NANGWj’s side. Additionally, their scheme cannot resist impersonation attack where an attacker A forges a message M1 to impersonate HANGWi.Next we investigate the following new but realistic attacking scenario. Suppose the identityIDi is somehow known to an attacker A as in the case when A is familiar to the user and guesses the IDi via the user’s personal information. Since the authentication message M1={C1,C2,C3,ti} is transmitted over an open channel, it is easy for A to intercept M1 during any authentication process. Suppose A has obtained two messages M11={C11,C21,C31,ti1} and M12={C12,C22,C32,ti2}, where C11=ga1, C12=ga2 and a1,a2 are unknown to the attacker. A can impersonate HANGWi by forging any request message M1∗={C1∗,C2∗,C3∗,ti∗} with real-time ti∗ as shown by following steps.Step 1.
Computeh1=h(IDi∥ti1), h2=h(IDi∥ti2), h∗=h(IDi∥ti∗), and P1=C21⊕IDi, P2=C22⊕IDi.Step 2.
Select two variablesσ1,σ2 to construct equations (1)C3∗=σ1·C31+σ2·C32h∗·C3∗=σ1·h1·C31+σ2·h2·C32Step 3.
Compute one of solutions to above equations, such as(2)σ1=1σ2=h∗-h1C31h2-h∗C32Step 4.
ComputeC1∗=(C11)σ1·(C12)σ2, C2∗=((P1)σ1·(P2)σ2)⊕IDi, and C3∗=σ1·C31+σ2·C32.Step 5.
SendM1∗={C1∗,C2∗,C3∗,ti∗} to a valid NANGWj.Correctness. Upon receiving the message M1∗ from A, NANGWj first checks the freshness of ti∗. Then, it computes IDi∗=C2∗⊕(C1∗)yj. Since (3)C2∗=P1σ1·P2σ2⊕IDi=Pja1σ1·Pja2σ2⊕IDi=ga1σ1yj·ga2σ2yj⊕IDi=C11σ1·C12σ2yj⊕IDi=C1∗yj⊕IDiwe obtain IDi∗=C2∗⊕(C1∗)yj=IDi. Next, NANGWj checks whether (Pigh(IDi∥ti∗))C3∗=?C1∗. According to Step 2 above, we can get(4)PighIDi∥ti∗C3∗=PiC3∗·gh∗C3∗=Piσ1C31+σ2C32·gσ1h1C31+σ2h2C32=PiC31·gh1C31σ1·PiC32·gh1C32σ2=C11σ1·C12σ2=C1∗Therefore, an attackerA can pass NANGWj’s authentication without knowing a HANGWi’s private key. As a result, A manages to make NANGWj believe that he/she is a valid HANGWi and continuously execute authentication operations. Thus, an external attacker can break the security of mutual authentication and launch the DoS attack on the smart grid by impersonating a legal HANGWi gateway to connect with the corresponding NANGWj. As a consequence, the smart grid network system cannot reject the connection of a malicious IP address by detecting the invalid data packages received, and thus it is susceptible to DoS attacks, which will lead to an increase in message delay.Effectiveness. It is worth noting that the above attack is very effective because it only requires a passive eavesdropping attacker and involves a few lightweight cryptographic operations, such as addition, multiplication, exponentiation, and hash operations. For example, to get a solution in Step 3 and forge a successful authentication message M1, we only require three general hash operations, six multiplication operations, one division operation, four exponentiation operations, and three addition/subtraction operations. Given the running time of each operation referred in Li et al.’s scheme [5], the total time for A to successfully implement an attack is about 1.396ms.


## 5. The Proposed Scheme

To overcome the weakness of Li et al.’s scheme, we propose an improved anonymous message authentication scheme for the smart grid. Similar to Li et al.’s scheme, our protocol also has three phases: the initialization phase, the authentication and key agreement phase, and the message transmission phase.


### 5.1. Initialization Phase

In this phase, the registration center (RC) generates the system parameters and private-public key pair for each registered entity (i.e.,HANGWi and NANGWj) as follows.Step I1. The RC chooses a multiplication cyclic group G with order q, and the generator is g. Next, the RC selects a secure one-way hash function h′(·):{0,1}∗→{0,1}log2q+|ID| and a secure hash function h(·):{0,1}∗→Zq∗.Step I2. For each registered entity, RC generates a distinct random number x as private key and computes gx as the corresponding public key. Here, let xi∈Zq∗ be the i-th HAN-GW’s private key, and Pi=gxi be i-th HAN-GW’s public key.Step I3. The RC sends the key pair (xi,Pi) to HANGWi (i.e., the i-th HAN-GW) via a secure channel, where Pi can be revealed to others.Similarly, thej-th NAN-GW can obtain its own key pair as (yj,Qj=gyj) from the RC as described inStep I3.


### 5.2. Authentication Phase

In this phase,HANGWi and NANGWj authenticate with each other. In addition, a temporary session key is created and used for encrypting subsequent transmitted messages. As depicted in Figure 4, the details are described as follows.Figure 4
Authentication phase of the proposed scheme.Step A1. HANGWi first chooses a random number a from group Zq∗ and assigns up the current timestamp ti. Then, HANGWi computes A=ga,C=Qja⊕(IDi∥S) and S=a-xih(IDi∥ti∥A).Step A2. HANGWi sends the plain message M1=(A,C,ti) to NANGWj via a public channel.Step A3. Upon receiving message M1 at time ti′, NANGWj first checks the freshness of the timestamp ti by equation |ti′-ti|≤Δt. If it holds, NANGWj computes IDi′=C⊕Ayj and further verifies the correctness of A=?gS·Pih(ID′∥ti∥A). If the final equation does not hold, NANGWj aborts the authentication process. Otherwise, it continues to the next step.Step A4. NANGWj selects a random number b from group Zq∗ and gets the current timestamp tj. Similarly, HANGWi computes B=gb and the temporary session key skN-H=h(A∥B∥Ab∥IDi′∥IDj. Finally, HANGWi computes v=h(IDi′∥IDj,skN-H),D=h′(Ayj∥IDi′∥tj)⊕(IDj∥v).Here, we assume thatHANGWi already knows the identity of NANGWj (i.e., IDj) because it is a control smart meter among several HANGWi in a specific neighborhood.Step A5. NANGWj sends the plain message M2=(B,D,tj) to HANGWi via a public channel.Step A6. Upon receiving message M2, HANGWi assigns the current timestamp tj′ and checks |tj′-tj|≤Δt. If it does not hold, HANGWi aborts this authentication. Otherwise, HANGWi first computes (IDj′∥v′)=h′(Qja∥IDi∥tj)⊕D,skH-N=h(A∥B∥Ba∥IDi∥IDj′). Then HANGWi verifies the correctness v′=?h(IDi∥IDj′∥skH-N). If it holds, HANGWi confirms that the temporary session key skH-N is associated with NANGWj. Otherwise, HANGWi aborts this authentication process.


### 5.3. Message Transmission Phase

In this phase, a secure symmetric encryption algorithm (i.e., Advanced Encryption Standard, AES) and a secure one-way hash function are used to guarantee the message’s confidentiality and integrity. The details are as follows.Step M1. HANGWi periodically collects user’s current electricity consumption report Mi and computes the value of Hi=h(Mi∥Ti), where Ti is the current timestamp. Then, HANGWi encrypts the message Mi as Ci=Enc(Mi∥Ti∥Hi) by using the above agreed session key skH-N, and sends Ci to NANGWj over a public channel.Step M2. After receiving Ci at time Ti′, NANGWj runs the decryption algorithm Dec to get the corresponding plaintext of Ci with session key skN-H. The plaintext is in the form of Mi∥ti∥Hi. NANGWj further verifies |Ti′-Ti|≤Δt and h(Mi∥Ti)=?Hi to confirm the freshness and integrity of the received message.


## 5.1. Initialization Phase

In this phase, the registration center (RC) generates the system parameters and private-public key pair for each registered entity (i.e.,HANGWi and NANGWj) as follows.Step I1. The RC chooses a multiplication cyclic group G with order q, and the generator is g. Next, the RC selects a secure one-way hash function h′(·):{0,1}∗→{0,1}log2q+|ID| and a secure hash function h(·):{0,1}∗→Zq∗.Step I2. For each registered entity, RC generates a distinct random number x as private key and computes gx as the corresponding public key. Here, let xi∈Zq∗ be the i-th HAN-GW’s private key, and Pi=gxi be i-th HAN-GW’s public key.Step I3. The RC sends the key pair (xi,Pi) to HANGWi (i.e., the i-th HAN-GW) via a secure channel, where Pi can be revealed to others.Similarly, thej-th NAN-GW can obtain its own key pair as (yj,Qj=gyj) from the RC as described inStep I3.


## 5.2. Authentication Phase

In this phase,HANGWi and NANGWj authenticate with each other. In addition, a temporary session key is created and used for encrypting subsequent transmitted messages. As depicted in Figure 4, the details are described as follows.Figure 4
Authentication phase of the proposed scheme.Step A1. HANGWi first chooses a random number a from group Zq∗ and assigns up the current timestamp ti. Then, HANGWi computes A=ga,C=Qja⊕(IDi∥S) and S=a-xih(IDi∥ti∥A).Step A2. HANGWi sends the plain message M1=(A,C,ti) to NANGWj via a public channel.Step A3. Upon receiving message M1 at time ti′, NANGWj first checks the freshness of the timestamp ti by equation |ti′-ti|≤Δt. If it holds, NANGWj computes IDi′=C⊕Ayj and further verifies the correctness of A=?gS·Pih(ID′∥ti∥A). If the final equation does not hold, NANGWj aborts the authentication process. Otherwise, it continues to the next step.Step A4. NANGWj selects a random number b from group Zq∗ and gets the current timestamp tj. Similarly, HANGWi computes B=gb and the temporary session key skN-H=h(A∥B∥Ab∥IDi′∥IDj. Finally, HANGWi computes v=h(IDi′∥IDj,skN-H),D=h′(Ayj∥IDi′∥tj)⊕(IDj∥v).Here, we assume thatHANGWi already knows the identity of NANGWj (i.e., IDj) because it is a control smart meter among several HANGWi in a specific neighborhood.Step A5. NANGWj sends the plain message M2=(B,D,tj) to HANGWi via a public channel.Step A6. Upon receiving message M2, HANGWi assigns the current timestamp tj′ and checks |tj′-tj|≤Δt. If it does not hold, HANGWi aborts this authentication. Otherwise, HANGWi first computes (IDj′∥v′)=h′(Qja∥IDi∥tj)⊕D,skH-N=h(A∥B∥Ba∥IDi∥IDj′). Then HANGWi verifies the correctness v′=?h(IDi∥IDj′∥skH-N). If it holds, HANGWi confirms that the temporary session key skH-N is associated with NANGWj. Otherwise, HANGWi aborts this authentication process.


## 5.3. Message Transmission Phase

In this phase, a secure symmetric encryption algorithm (i.e., Advanced Encryption Standard, AES) and a secure one-way hash function are used to guarantee the message’s confidentiality and integrity. The details are as follows.Step M1. HANGWi periodically collects user’s current electricity consumption report Mi and computes the value of Hi=h(Mi∥Ti), where Ti is the current timestamp. Then, HANGWi encrypts the message Mi as Ci=Enc(Mi∥Ti∥Hi) by using the above agreed session key skH-N, and sends Ci to NANGWj over a public channel.Step M2. After receiving Ci at time Ti′, NANGWj runs the decryption algorithm Dec to get the corresponding plaintext of Ci with session key skN-H. The plaintext is in the form of Mi∥ti∥Hi. NANGWj further verifies |Ti′-Ti|≤Δt and h(Mi∥Ti)=?Hi to confirm the freshness and integrity of the received message.


## 6. Security Analysis and Comparisons

In this section, we first apply the following security model to prove that the proposed scheme is provably secure. Secondly, we make a further discussion to demonstrate that it can resist various well-known attacks along with the security requirements for smart grid.


### 6.1. Security Model

We assume that there are two entitiesHANGWi and NANGWj in a message authentication scheme Π. Let HANGWil and NANGWjl denote the l-th instance of HANGWi and NANGWj respectively. If the two entities do not need to be distinguished, we denote the l-th instance of them as Il. All of them can have multiple instances and they are allowed to execute the scheme concurrently.Definition 1 (adversary abilities).
We use some oracles played between an adversaryA and a simulator C to prove the security of the proposed scheme. A is able to know all the public parameters of HANGWi and NANGWj and control the network. Moreover, A can execute the following queries and get corresponding answers as follows:(i)
h(mt): C maintains a table Lh (or Lh′) that is initialized to empty. Upon receiving the query, C checks if (mt,rt) is recorded in Lh, if so, C returns ri to A. Otherwise, C chooses a random number ri and outputs it to A and then records the generated entry (mi,ri) into Lh (or Lh′).(ii)
Execute(HANGWil,NANGWjl): this query simulates a passive attack. C honestly performs the authentication scheme that allows A to get access to the normal authentication process and outputs M1,M2 as the answer.(iii)
Send(Il,m): A executes the query with message m and C performs the message authentication scheme according to its specification and then returns the output result to A.(iv)
Reveal(Il): if the oracle IL has turned into theAccept state, A can get the current session key of this oracle.(v)
Corrupt(Il): this oracle is used in the forward secrecy model, where A can get the long-term secret key of Il from C’s answer.(vi)
Test(Il): this oracle tests the AKA security of the session key. As the l-th session, C selects a bit b∈{0,1}, if b=1, outputs the real session key as the answer. Otherwise, C outputs a random string with the same length as the real session key.Definition 2 (AKA-secure).
Let the probability thatA guesses the bit b involved in theTest query denote A’s advantage of breaking the scheme. More precisely, we denote the advantage as Pr[AdvΠaka(A)]=2Pr[b=b′]-1. We say a scheme Π is AKA-secure if Pr[AdvΠaka(A)] is negligible for any polynomial adversary A.Definition 3 (MA-secure).
We say a message authentication scheme for smart gridΠ is mutual authentication (MA) secure if the probability Pr[AdvΠma(A)] is negligible for any polynomial adversary A.


### 6.2. Formal Security Proof

In this subsection, we show that our improved scheme is provably secure for smart grid. LetE1 denote the event that A can break the authentication of HANGWi -to- NANGWj and E2 denote the event that A can break the authentication of NANGWj -to- HANGWi. Let E3 denote the event that A can break AKA security of the improved message authentication scheme. Let Pr[E1]=ε1 and Pr[E2]=ε2 be the advantage of the events that A can break the authentication of HANGWi to NANGWj and the authentication of NANGWj to HANGWi, respectively.Theorem 4.
The proposed scheme for the smart grid is MA-secure if bothPr[E1] and Pr[E2] are negligible.Proof.
Assume that the adversary has executed the above-mentioned oracles in the normal manner. In particular, we consider thatA executes the Send(NANGWjl,M1)-query, if the simulator succeeds to compute the value of A=gS·Pih(IDi∥ti∥A), it implies that the message M1={A,C,ti} is valid. If A can produce a valid M1, it can produce another valid message M1′={A,C′,ti′}, which means it can generate a valid S′. Then, C can get HANGWi’s private key xi=h(IDi∥ti′∥A)/S-S′ due to the following equations (5)A=gS·PihIDi∥ti∥Aand (6)A=gS′·PihIDi∥ti′∥A
Based the above two equations, we get(7)1=gS·PihIDi∥ti∥AgS′·PihIDi∥ti′∥A=gS+xihIDi∥ti∥A-S′+xihIDi∥ti′∥A
Thus,A can output xi=h(IDi∥ti′∥A)/S-S′ as a solution of the DL problem. It is similar to [5] that the probability of forging a correct pair (A,S) is 1/pq. Therefore, the probability that C can solve the DL problem is ε1/pq, which is contradicted with the hardness of DL problem. In other words, the probability of Pr[E1]=ε1 is negligible.
Similarly, considering the querysend(HANGWi,M2), if the message M2 can pass the verification of C, it implies that C can get a perfect hash recording including (Qja∥IDi∥tj) in Lh′, where Qj=gyj. Therefore, C can output Qja=gyja as the instance (g,gyj,ga) of the CDH problem with the probability of ε2/qh′, where qh is the bound times of hash queries. Since the CDH is hard, the probability Pr[E2]=ε2 is negligible.
To conclude, the improved scheme is MA-secure.Theorem 5.
The proposed scheme for smart grid is AKA-secure ifPr[E3] is negligible.Proof.
Assume that an adversaryA correctly guesses the value of b involved in theTest-query with a nonnegligible probability ε3. We then show that there exists a simulator C that can solve the CDH problem.
LetEsk denote the event that A obtains the correct session key, and let EHb, ENb denote the events that A guesses b in instance HANGWi and instance NANGWj respectively. From the Definition 2, the probability that A guess the correct b is at least 1/2, and thus we can get Pr[Esk]=ε3/2. Furthermore, we can get the following equations: (8)ε32≤PrEsk=PrEsk⋀EHb+PrEsk⋀ENb⋀E1+PrEsk⋀ENb⋀E⌝1=PrEsk⋀EHb+PrE1+PrEsk⋀ENb⋀E⌝1ε32-PrE1≤PrEsk⋀EHb+PrEsk⋀ENb⋀E⌝1≤PrEsk⋀EHb+PrEsk⋀EHb
Thus, we getPr[Esk⋀EHb]≥1/2(ε3/2-Pr[E1]).
According to Theorem4, Pr[E1] is negligible and, therefore, Pr[Esk] is nonnegligible. Since A can break the AKA security, A can output gab as the solution to the CDH problem of instance (g,ga,gb) with nonnegligible probability, which contradicts with the hardness of CDH problem. Therefore, the proposed message authentication scheme for smart grid is AKA-secure.


### 6.3. Other Discussions on Security Properties

We now demonstrate how our improved scheme achieves the mutual authentication, session key agreement, user anonymity, perfect forward secrecy, and resistance to several attacks [14, 34–37].Mutual Authentication. From the description of our proposed scheme, NANGWj verifies the identity of HANGWi via checking A=gS·Pih(IDi∥ti∥A), and HANGWi verifies the identity of NANGWj via checking v=h(IDi∥IDj∥skH-N). The formal security analysis has proved that nobody can impersonate one of the two parties to cheat the other one by generating a valid authenticated message M1 (or M2) during the authentication process. Thus, our improved scheme can support mutual authentication.Session Key Agreement. In the authentication and key agreement phase, NANGWj and HANGWi can independently compute the session key skN-H=h(A∥B∥Ab∥IDi′∥IDj) and skH-N=h(A∥B∥Ba∥IDi∥IDj′), which can be used to encrypt messages in subsequent communications. Furthermore, HANGWi can verify the correctness of the session key by recovering v (by computing Qja) and matching it with its own computed h(IDi∥IDj∥skH-N). Thus, our improved scheme can achieve session key agreement.User Anonymity. In our improved scheme, the real identity of HANGWi is hidden by C=Qja⊕IDi, where a is a random number chosen by HANGWi and it is unknown to others. So without knowing the value of a, the only way to reveal the identity of HANGWi is to compute C⊕Ayj, where C is transmitted over the public channel while yi is the private key known only to NANGWj. If the adversary intends to reveal HANGWi’s real identity, the adversary needs to get the value of Qja or Ayj given A,Qj, which means he/she has to solve the CDH problem. Else, the adversary cannot get HANGWi’s real identity. Thus, our improved scheme can provide user anonymity.Perfect Forward Secrecy. H A N G W i and NANGWj agree with a shared session key sk=h(A∥B∥Ab∥IDi∥IDj)=h(A∥B∥Bb∥IDi∥IDj) in the final step of the authentication and key agreement phase. If an attacker intends to compute the session key of a special communication, he/she has to obtain the real identity of HANGWi and NANGWj and compute gab from A=ga and B=gb as well. From the above analysis, he/she needs to solve the CDH problem or it cannot derive the correct session key even though he/she obtains long-term secret key. Thus, our improved scheme can provide perfect forward secrecy.Resistance to Several Attacks. Next, we show how the improved scheme can resist tracking attack, replay attacks, impersonation attack, man-in-the-middle attack, and DoS attack.(i) Resistance of Tracking Attack. The messages transmitted during each session phase are different and fresh as they are randomized by two random numbers {a,b}. This means an attacker cannot link any two sessions to the same user or track a user’s behaviors from some sessions. Thus, our improved scheme can mitigate the tracking attack.(ii) Resistance to Replay Attack. As every authenticated message (i.e., M1,M2) contains timestamps, which also includes in the computation of S and AIDj, an old/intercepted authenticated messages cannot pass the verification of the other party in the current time. Thus, our improved scheme can mitigate the replay attack.(iii) Resistance to Impersonation Attack. If an attacker intends to impersonate HANGWi, he/she has to create a legal request message M1 that he/she needs to compute a valid S. It means that he/she needs to know the private key xi of HANGWi. Similarly, impersonating NANGWj should correctly compute the value of h′(Ayj∥IDi∥tj); otherwise, it cannot pass the verification of HANGWi. If the attacker succeeds to impersonate NANGWj, he/she either gets the private key yj or solves the CDH problem with the instance {g,A=ga,Qj=gyj}. Thus, our improved scheme can mitigate the impersonation attack.(iv) Resistance to Mathematical Analytical Attack. We define the attack on Li et al.’s protocol to be a mathematical analytical attack, and we now prove that our proposed protocol can resist this attack. For the sake of fairness, we assume that the identity IDi is revealed to an attacker meaning that the attacker can get the information of IDi and many pairs of (A,C,ti). From the structure of C=Qja⊕(IDi∥S), the attacker cannot construct a system of linear equations because it has no knowledge of S. Next, we compute S=a-xih(IDi∥ti∥A) rather than S=a-xih(IDi∥ti), which further breaks the linear relations between equations. Thus, our proposed protocol can resist the mathematical analytical attack even if the attacker knows the user’s identity IDi.(v) Resistance to Man-in-the-Middle Attack. As we analyzed before, our improved scheme can provide mutual authentication, and no attacker is able to cheat HANGWi/NANGWj through impersonating the other party. Thus, our improved scheme can mitigate the man-in-the-middle attack.(vi) Resistance of DoS Attack. Assuming that an attacker intends to implement the DoS attack, he/she may flood the NANGWj with some messages. If the message can pass the verification of NANGWj, it will cause wastage of computation and communication resources of NANGWj when computing and transmitting the response message, which results in increased delay for data communications in the smart grid. In our improved scheme, an illegal message can be effectively detected by NANGWj and thus aborts the current communication thereby avoiding additional unnecessary computation and communication costs. Thus, our improved scheme can provide resistance of DoS attack to some extent.


## 6.1. Security Model

We assume that there are two entitiesHANGWi and NANGWj in a message authentication scheme Π. Let HANGWil and NANGWjl denote the l-th instance of HANGWi and NANGWj respectively. If the two entities do not need to be distinguished, we denote the l-th instance of them as Il. All of them can have multiple instances and they are allowed to execute the scheme concurrently.Definition 1 (adversary abilities).
We use some oracles played between an adversaryA and a simulator C to prove the security of the proposed scheme. A is able to know all the public parameters of HANGWi and NANGWj and control the network. Moreover, A can execute the following queries and get corresponding answers as follows:(i)
h(mt): C maintains a table Lh (or Lh′) that is initialized to empty. Upon receiving the query, C checks if (mt,rt) is recorded in Lh, if so, C returns ri to A. Otherwise, C chooses a random number ri and outputs it to A and then records the generated entry (mi,ri) into Lh (or Lh′).(ii)
Execute(HANGWil,NANGWjl): this query simulates a passive attack. C honestly performs the authentication scheme that allows A to get access to the normal authentication process and outputs M1,M2 as the answer.(iii)
Send(Il,m): A executes the query with message m and C performs the message authentication scheme according to its specification and then returns the output result to A.(iv)
Reveal(Il): if the oracle IL has turned into theAccept state, A can get the current session key of this oracle.(v)
Corrupt(Il): this oracle is used in the forward secrecy model, where A can get the long-term secret key of Il from C’s answer.(vi)
Test(Il): this oracle tests the AKA security of the session key. As the l-th session, C selects a bit b∈{0,1}, if b=1, outputs the real session key as the answer. Otherwise, C outputs a random string with the same length as the real session key.Definition 2 (AKA-secure).
Let the probability thatA guesses the bit b involved in theTest query denote A’s advantage of breaking the scheme. More precisely, we denote the advantage as Pr[AdvΠaka(A)]=2Pr[b=b′]-1. We say a scheme Π is AKA-secure if Pr[AdvΠaka(A)] is negligible for any polynomial adversary A.Definition 3 (MA-secure).
We say a message authentication scheme for smart gridΠ is mutual authentication (MA) secure if the probability Pr[AdvΠma(A)] is negligible for any polynomial adversary A.


## 6.2. Formal Security Proof

In this subsection, we show that our improved scheme is provably secure for smart grid. LetE1 denote the event that A can break the authentication of HANGWi -to- NANGWj and E2 denote the event that A can break the authentication of NANGWj -to- HANGWi. Let E3 denote the event that A can break AKA security of the improved message authentication scheme. Let Pr[E1]=ε1 and Pr[E2]=ε2 be the advantage of the events that A can break the authentication of HANGWi to NANGWj and the authentication of NANGWj to HANGWi, respectively.Theorem 4.
The proposed scheme for the smart grid is MA-secure if bothPr[E1] and Pr[E2] are negligible.Proof.
Assume that the adversary has executed the above-mentioned oracles in the normal manner. In particular, we consider thatA executes the Send(NANGWjl,M1)-query, if the simulator succeeds to compute the value of A=gS·Pih(IDi∥ti∥A), it implies that the message M1={A,C,ti} is valid. If A can produce a valid M1, it can produce another valid message M1′={A,C′,ti′}, which means it can generate a valid S′. Then, C can get HANGWi’s private key xi=h(IDi∥ti′∥A)/S-S′ due to the following equations (5)A=gS·PihIDi∥ti∥Aand (6)A=gS′·PihIDi∥ti′∥A
Based the above two equations, we get(7)1=gS·PihIDi∥ti∥AgS′·PihIDi∥ti′∥A=gS+xihIDi∥ti∥A-S′+xihIDi∥ti′∥A
Thus,A can output xi=h(IDi∥ti′∥A)/S-S′ as a solution of the DL problem. It is similar to [5] that the probability of forging a correct pair (A,S) is 1/pq. Therefore, the probability that C can solve the DL problem is ε1/pq, which is contradicted with the hardness of DL problem. In other words, the probability of Pr[E1]=ε1 is negligible.
Similarly, considering the querysend(HANGWi,M2), if the message M2 can pass the verification of C, it implies that C can get a perfect hash recording including (Qja∥IDi∥tj) in Lh′, where Qj=gyj. Therefore, C can output Qja=gyja as the instance (g,gyj,ga) of the CDH problem with the probability of ε2/qh′, where qh is the bound times of hash queries. Since the CDH is hard, the probability Pr[E2]=ε2 is negligible.
To conclude, the improved scheme is MA-secure.Theorem 5.
The proposed scheme for smart grid is AKA-secure ifPr[E3] is negligible.Proof.
Assume that an adversaryA correctly guesses the value of b involved in theTest-query with a nonnegligible probability ε3. We then show that there exists a simulator C that can solve the CDH problem.
LetEsk denote the event that A obtains the correct session key, and let EHb, ENb denote the events that A guesses b in instance HANGWi and instance NANGWj respectively. From the Definition 2, the probability that A guess the correct b is at least 1/2, and thus we can get Pr[Esk]=ε3/2. Furthermore, we can get the following equations: (8)ε32≤PrEsk=PrEsk⋀EHb+PrEsk⋀ENb⋀E1+PrEsk⋀ENb⋀E⌝1=PrEsk⋀EHb+PrE1+PrEsk⋀ENb⋀E⌝1ε32-PrE1≤PrEsk⋀EHb+PrEsk⋀ENb⋀E⌝1≤PrEsk⋀EHb+PrEsk⋀EHb
Thus, we getPr[Esk⋀EHb]≥1/2(ε3/2-Pr[E1]).
According to Theorem4, Pr[E1] is negligible and, therefore, Pr[Esk] is nonnegligible. Since A can break the AKA security, A can output gab as the solution to the CDH problem of instance (g,ga,gb) with nonnegligible probability, which contradicts with the hardness of CDH problem. Therefore, the proposed message authentication scheme for smart grid is AKA-secure.


## 6.3. Other Discussions on Security Properties

We now demonstrate how our improved scheme achieves the mutual authentication, session key agreement, user anonymity, perfect forward secrecy, and resistance to several attacks [14, 34–37].Mutual Authentication. From the description of our proposed scheme, NANGWj verifies the identity of HANGWi via checking A=gS·Pih(IDi∥ti∥A), and HANGWi verifies the identity of NANGWj via checking v=h(IDi∥IDj∥skH-N). The formal security analysis has proved that nobody can impersonate one of the two parties to cheat the other one by generating a valid authenticated message M1 (or M2) during the authentication process. Thus, our improved scheme can support mutual authentication.Session Key Agreement. In the authentication and key agreement phase, NANGWj and HANGWi can independently compute the session key skN-H=h(A∥B∥Ab∥IDi′∥IDj) and skH-N=h(A∥B∥Ba∥IDi∥IDj′), which can be used to encrypt messages in subsequent communications. Furthermore, HANGWi can verify the correctness of the session key by recovering v (by computing Qja) and matching it with its own computed h(IDi∥IDj∥skH-N). Thus, our improved scheme can achieve session key agreement.User Anonymity. In our improved scheme, the real identity of HANGWi is hidden by C=Qja⊕IDi, where a is a random number chosen by HANGWi and it is unknown to others. So without knowing the value of a, the only way to reveal the identity of HANGWi is to compute C⊕Ayj, where C is transmitted over the public channel while yi is the private key known only to NANGWj. If the adversary intends to reveal HANGWi’s real identity, the adversary needs to get the value of Qja or Ayj given A,Qj, which means he/she has to solve the CDH problem. Else, the adversary cannot get HANGWi’s real identity. Thus, our improved scheme can provide user anonymity.Perfect Forward Secrecy. H A N G W i and NANGWj agree with a shared session key sk=h(A∥B∥Ab∥IDi∥IDj)=h(A∥B∥Bb∥IDi∥IDj) in the final step of the authentication and key agreement phase. If an attacker intends to compute the session key of a special communication, he/she has to obtain the real identity of HANGWi and NANGWj and compute gab from A=ga and B=gb as well. From the above analysis, he/she needs to solve the CDH problem or it cannot derive the correct session key even though he/she obtains long-term secret key. Thus, our improved scheme can provide perfect forward secrecy.Resistance to Several Attacks. Next, we show how the improved scheme can resist tracking attack, replay attacks, impersonation attack, man-in-the-middle attack, and DoS attack.(i) Resistance of Tracking Attack. The messages transmitted during each session phase are different and fresh as they are randomized by two random numbers {a,b}. This means an attacker cannot link any two sessions to the same user or track a user’s behaviors from some sessions. Thus, our improved scheme can mitigate the tracking attack.(ii) Resistance to Replay Attack. As every authenticated message (i.e., M1,M2) contains timestamps, which also includes in the computation of S and AIDj, an old/intercepted authenticated messages cannot pass the verification of the other party in the current time. Thus, our improved scheme can mitigate the replay attack.(iii) Resistance to Impersonation Attack. If an attacker intends to impersonate HANGWi, he/she has to create a legal request message M1 that he/she needs to compute a valid S. It means that he/she needs to know the private key xi of HANGWi. Similarly, impersonating NANGWj should correctly compute the value of h′(Ayj∥IDi∥tj); otherwise, it cannot pass the verification of HANGWi. If the attacker succeeds to impersonate NANGWj, he/she either gets the private key yj or solves the CDH problem with the instance {g,A=ga,Qj=gyj}. Thus, our improved scheme can mitigate the impersonation attack.(iv) Resistance to Mathematical Analytical Attack. We define the attack on Li et al.’s protocol to be a mathematical analytical attack, and we now prove that our proposed protocol can resist this attack. For the sake of fairness, we assume that the identity IDi is revealed to an attacker meaning that the attacker can get the information of IDi and many pairs of (A,C,ti). From the structure of C=Qja⊕(IDi∥S), the attacker cannot construct a system of linear equations because it has no knowledge of S. Next, we compute S=a-xih(IDi∥ti∥A) rather than S=a-xih(IDi∥ti), which further breaks the linear relations between equations. Thus, our proposed protocol can resist the mathematical analytical attack even if the attacker knows the user’s identity IDi.(v) Resistance to Man-in-the-Middle Attack. As we analyzed before, our improved scheme can provide mutual authentication, and no attacker is able to cheat HANGWi/NANGWj through impersonating the other party. Thus, our improved scheme can mitigate the man-in-the-middle attack.(vi) Resistance of DoS Attack. Assuming that an attacker intends to implement the DoS attack, he/she may flood the NANGWj with some messages. If the message can pass the verification of NANGWj, it will cause wastage of computation and communication resources of NANGWj when computing and transmitting the response message, which results in increased delay for data communications in the smart grid. In our improved scheme, an illegal message can be effectively detected by NANGWj and thus aborts the current communication thereby avoiding additional unnecessary computation and communication costs. Thus, our improved scheme can provide resistance of DoS attack to some extent.


## 7. Performance Evaluation and Comparisons

In this section, we evaluate the performance of our improved scheme and compare it with Li et al.’s scheme [5]. For fair comparison, we use the experimental data referred in [5] to evaluate the performance of Li et al.’s scheme and our proposed scheme.Here, we briefly recall the experimental platform and the selected parameters used in Li et al.’s scheme. The executing platform for running related cryptographic operations is a personal computer with an Intel(R) Core TM i7-4710HQ 2.50GHz processor, 8GB memory, Win8 operating system. The related operations (e.g., modular exponentiation, bilinear pairing operation) are executed based on the MIRACL C/C++ library with Visual C++ 2010. To achieve the same security level for different schemes, Li et al. chose a multiplication cyclic group consisting of1024-bit integers.Let AES and 160-bit SHA1 algorithms be the symmetric encryption algorithm and hash function to handle messages in the schemes. Note that each block in AES is 128 bits. The following notations denote the average running times of related cryptographic operations and the corresponding results are presented in Table1. Here, we ignore the XOR, modular addition operations from the comparison because their running times are negligible.(i)
Tme: The running time of a modular exponentiation operation.(ii)
Tinv: The running time of a modular inversion operation.(iii)
Tmm: The running time of a modular multiplication operation.(iv)
TAES: The running time of a AES encryption/decryption operation.(v)
Th: The running time of a SHA1 hash operation.Table 1
Running times of related operations (millisecond).
Operations T m e T i n v T m m T A E S T h  Times 0.3308 0.0463 0.0038 0.0215 0.000033The authentication and key agreement phase of Li et al.’s scheme [5] requires a total of three modular exponentiation operations, one modular multiplication operation, one modular inversion operation, and four SHA1 hash operations at the HANGWi’s side to compute (C1,C2,C3,IDj,skH-N,C6). While at the NANGWj’s side, it requires five modular exponentiation operations, one modular multiplication operation, and four SHA1 hash operations to calculate (IDi,C1,C4,C5,C6,skN-H). Therefore, Li et al.’s scheme takes around 1.0426ms and 1.6579ms at HANGWi’s and NANGWj’s sides respectively during the authentication and key agreement phase.In our proposed scheme, the authentication and key agreement phase requires a total of three modular exponentiation operations, one modular multiplication operation, and four SHA1 hash operations at theHANGWi’s side to compute (A,C,S,skH-N,v). While at the NANGWj’s side, it also requires five modular exponentiation operations, one modular multiplication operation, and four SHA1 hash operations to calculate (A,B,IDi′,S,skN-H,v). Therefore, this phase only takes around 0.9963ms and 1.6578ms at HANGWi’s and NANGWj’s sides respectively.For the communication cost, we need to transmit two elements in the groupG (i.e., A,C) and only one element in the group Zq∗ (i.e., ti) at the HANGWi’s side, and there is one element in G (i.e., B), two elements in group Zq∗ (i.e., v,tj) to be transmitted at the NANGWi’s side. We assume that |G| denotes the length of element in group G and |h|,|h′| denote the length of element in group Zq∗ and (log2q+|ID|). Thus, the total communication cost of our proposed scheme is 3|G|+3|h|+|h′|=3776 bits (assume that the length of identity is 64 bits). Similarly, we note that there are three elements in G (i.e., C1,C2,C4) and five elements in the group Zq∗ (i.e., C3,C5,C6,ti,tj) to be transmitted over the network channel. Thus, the total communication cost of Li et a’.’s scheme is 3|G|+5|h|=3872 bits.As shown in Tables2 and 3, our proposed scheme addresses the security weakness of the authentication phase without increasing the computation and communication costs when it is compared to [5]. In particular, the computation cost at the HAN-GW’s side is even slightly lower than that of [5] because the proposed protocol removes the inversion operation. Therefore, our proposed protocol is more suitable for the practical deployment of the smart grid.Table 2
Running operations of related operations (millisecond).
Our proposed scheme Scheme [5]  THAN-GW 3 T m e + T m + 4 T h 3 T m e + T m + T i n v + 4 T h TNAN-GW 5 T m e + T m + 4 T h 5 T m e + T m + 4 T h communication cost 3 | G | + 3 | h | + | h ′ | 3 | G | + 5 | h |Table 3
Running times of related operations (millisecond).
T H A N - G W T N A N - G W Communication cost  Our proposed scheme 0.9963 ms 1.6578 ms 3776 bits Scheme [5] 1.0426 ms 1.6578 ms 3872 bits


## 8. Conclusion

Device authentication and secure message transmission are important processes in the practical deployment of the smart grid. Li et al. recently proposed a lightweight message authentication scheme for the smart grid with user anonymity and they claimed it is secure. However, we found that their scheme fails to achieve device mutual authentication, which results in possible network availability attacks that include DoS attacks. To address the weaknesses in Li et al.’s scheme, we proposed an improved message authentication scheme which does not incur additional computation and communication costs. A security analysis demonstrates that our proposed scheme can satisfy various security requirements for the smart grid. Our future work will focus on reducing the communication cost during the authentication process.



---

*Source: 4836016-2019-05-12.xml*