A Security-Enhanced Authentication and Key Agreement Protocol in Smart Grid

With the enablement of Internet of Things technology, the electrical grid is currently undergoing a drastic revolution, which is known as smart grid. Since massive sensitive data and control commands transmitted via public channels, the smart grid is challenged by various cyber threats. Authenticated key agreement protocols in smart grid effectively ensure the confidentiality and authentication of communication through mutual authentication and establishing session keys. In this article, we review the existing elliptic curve cryptography (ECC)-based authentication and key agreement protocols in smart gird and perform a security analysis of Hu et al.’s protocol. We exhibit that the protocol fails to resist key compromise impersonation (KCI) attack and cannot provide untraceability. Furthermore, we propose a security-enhanced authentication and key agreement protocol based on ECC, which performs registration, authentication, and key agreement phases over public channels to enable mutual authentication and to establish session keys. The protocol is also proved to be security-enhanced by formal proof and informal analysis. The performance analysis results demonstrate that the proposed protocol is comparable to other existing protocols while achieving enhanced security. Therefore, the protocol satisfies the deployment requirements for resource-constrained smart grid.

I. Introduction

The expeditious advancement of Internet of Things (IoT) has enabled smart grid (SG) to progressively become the next-generation power system by integrating advanced sensing, information technology, and control technology. The IoT-enabled SG is a cyber-physical system [1], which includes meter data management system, demand response (DR) system, and advance metering infrastructure (AMI) system, etc. With leveraging information and communication technology, the SG integrates diverse systems [3], technologies [2], and smart devices for secure and efficient information collection and transmission, user's privacy protection and other requirements. In particular, the AMI system showed in Fig. 1 implements two-way communication between users and service providers (SPs).