LiSA: A Lightweight and Secure Authentication Mechanism for Smart Metering Infrastructure

TL;DR

LiSA is a lightweight, ECC-based authentication protocol designed to secure smart metering infrastructure in smart grids, offering strong security features with minimal computational and communication overhead.

Contribution

This paper introduces LiSA, a novel ECC-based authentication scheme that enhances security for smart meters while maintaining low resource consumption.

Findings

LiSA achieves mutual authentication and anonymity.

LiSA incurs only 11.826 ms and 0.992 ms for smart meter and service provider passes.

LiSA requires 544 bits of message transmission per session.

Abstract

Smart metering infrastructure (SMI) is the core component of the smart grid (SG) which enables two-way communication between consumers and utility companies to control, monitor, and manage the energy consumption data. Despite their salient features, SMIs equipped with information and communication technology are associated with new threats due to their dependency on public communication networks. Therefore, the security of SMI communications raises the need for robust authentication and key agreement primitives that can satisfy the security requirements of the SG. Thus, in order to realize the aforementioned issues, this paper introduces a lightweight and secure authentication protocol, "LiSA", primarily to secure SMIs in SG setups. The protocol employs Elliptic Curve Cryptography at its core to provide various security features such as mutual authentication, anonymity, replay protection, session key security, and resistance against various attacks. Precisely, LiSA exploits the hardness of the Elliptic Curve Qu Vanstone (EVQV) certificate mechanism along with Elliptic Curve Diffie Hellman Problem (ECDHP) and Elliptic Curve Discrete Logarithm Problem (ECDLP). Additionally, LiSA is designed to provide the highest level of security relative to the existing schemes with least computational and communicational overheads. For instance, LiSA incurred barely 11.826 ms and 0.992 ms for executing different passes across the smart meter and the service providers. Further, it required a total of 544 bits for message transmission during each session.

Tables

Table 1. TABLE I: Analysis of security features.

Protocol	[23]	[24]	[19]	[20]	Proposed
$𝔖{𝔉}_1$	$✓$	$✓$	$✓$	$\times$	$✓$
$𝔖{𝔉}_2$	$✓$	$✓$	$✓$	$✓$	$✓$
$𝔖{𝔉}_3$	$✓$	$✓$	$✓$	$✓$	$✓$
$𝔖{𝔉}_4$	$✓$	$✓$	$✓$	$✓$	$✓$
$𝔖{𝔉}_5$	$✓$	$✓$	$✓$	$✓$	$✓$
$𝔖{𝔉}_6$	$\times$	$\times$	$\times$	$✓$	$✓$
$𝔖{𝔉}_7$	$\times$	$\times$	$\times$	$✓$	$✓$
$𝔖{𝔉}_8$	$\times$	$\times$	$\times$	$\times$	$✓$

Table 2. TABLE II: Execution time of different cryptographic functions.

Entity	${𝕋}_b$	${𝕋}_m$	${𝕋}_a$	${𝕋}_h$	${𝕋}_e$	${𝕋}_s$
SP	17.01	0.986	0.004	0.001	0.874	0.033
SM	9.23	5.9	0.004	0.026	7.86	0.079

Table 3. TABLE III: An illustration of computational complexity analysis.

Protocol	At SM	At SP
Odelu et al.[23]	$3{𝕋}_m+{𝕋}_a+{𝕋}_e+6{𝕋}_h\approx 25.72$	$2{𝕋}_m+{𝕋}_a+2{𝕋}_b+{𝕋}_e+6{𝕋}_h\approx 37.28$
Chen et al.[24]	$2{𝕋}_m+{𝕋}_e+5{𝕋}_h\approx 19.79$	$3{𝕋}_m+{𝕋}_b+{𝕋}_e+5{𝕋}_h\approx 21.26$
Abbasinezhad-Mood [19]	$4{𝕋}_m+{𝕋}_a+5{𝕋}_h\approx 23.80$	$4{𝕋}_m+{𝕋}_a+5{𝕋}_h\approx 3.98$
Braeken et al.[20]	$4{𝕋}_m+{𝕋}_a+{𝕋}_s+5{𝕋}_h\approx 23.81$	$4{𝕋}_m+2{𝕋}_a+{𝕋}_s+5{𝕋}_h\approx 3.99$
Proposed	$2{𝕋}_m+{𝕋}_h\approx 11.826$	${𝕋}_m+{𝕋}_a+2{𝕋}_h\approx 0.992$

Table 4. TABLE IV: An illustration of communicational complexity analysis.

Protocol	Number of Rounds	No. of bits
Odelu et al.[23]	3	1920
Chen et al.[24]	3	1632
Abbasinezhad-Mood [19]	3	832
Braeken et al.[20]	3	832
Proposed	2	544

Full text

I Introduction

Smart Grid (SG) is the next-generation power system that greatly enhances the reliability, efficiency and sustainability of the legacy power systems with renewable energy sources, distributed intelligence, and improved demand response features [1, 2]. As opposed to the traditional grid, SG allows a bi-directional flow of energy and information in order to enable new functionalities among the consumers and utilities. The smart metering infrastructure (SMI) is one of the crucial application domains of SGs that helps in evaluating the status of a power grid along with the management of the distributed resources [3, 4]. In SGs, the smart meters (SMs) connect power consumers to the utility company in order to exchange, manage and control the energy consumption. They rely on advanced information and communication technologies to support the intelligent power supply and enhance the efficiency of legacy power systems[5, 6]. However, due to the lack of inherent and effective security mechanisms, interactions between legal entities are susceptible to cyber-attacks [7, 8]. Nevertheless, the complex nature of the SG and its diverse security requirements pose challenges to its widespread adoption. Thus, it is necessary to provide secure and reliable authentication systems for SMs that not only maintain trust between the legitimate entities but also satisfy other security services like mutual authentication, integrity, and anonymity [9, 10].

In order to address the privacy issues of SMs, several authentication schemes have recently been proposed. For example, Diao et al. [11] introduced a privacy preserving smart metering protocol that employs Camenisch–Lysyanskaya signature scheme for providing a secure and reliable authentication system. This scheme constructs linkable anonymous credential in order to provide message authentication and traceability of faulty SMs. In a similar context, Yu et al. [12] designed an information centric networking (ICN) based approach; wherein a novel key management scheme was employed in order to ensure the security in SMI. Similarly, Abbasinezhad-Mood and Nikooghadam [13] devised a lightweight communication scheme for SMs which employs the hash and exclusive-OR operations in order to provide confidentiality, real-time authentication along with the ability to cope with one-minute or even less time intervals of data transmission. Likewise, the authors in [14] employed an identity-based non-interactive key distribution scheme to develop a secure and scalable key distribution framework for neighboring SMs. In order to provide compression and authentication of smart meter readings in SMIs, Lee et al. [15] introduced a unified approach based on the notion of compressive sensing in a multicarrier system. Here, the residual error of a received signal was used to determine whether the signal is legitimate or not.

In 2018, Mustapa et al. [16] proposed an authentication scheme for SMI; wherein ring oscillator physically unclonable functions (ROPUF) were employed for deriving and storing the cryptographic keys. In [17], Mohammadali et al. utilized Elliptic Curve Cryptography (ECC) to propose an identity-based key establishment protocol for SMIs. Likewise, Kumar et al. [18] presented a lightweight authentication and key agreement scheme in order to maintain the privacy in SMIs. In an another work, Abbasinezhad-Mood and Nikooghadam [19] developed an anonymous ECC-based self-certified key distribution scheme for SGs in order to solve the issues of public key infrastructure (PKI) maintenance and the key escrow problem. Similarly, Braeken et al. [20] also presented a key agreement model for smart metering communications which aims to provide session key security under the widely accepted Canetti-Krawczyk security model. The authors asserted that their scheme provides identity-based mutual authentication, credential privacy, and session key security, along with the resistance against the well-known attacks such as replay, man-in-the-middle, and impersonation. Although several authentication and key exchange protocols exist in the literature to provide security in SGs, most of them not only fail to provide SM anonymity but also require high communicational and computational costs. Thus, in this paper a Lightweight and Secure Authentication (LiSA) protocol is designed for securing SMIs.

I-A Contributions

The key contributions of this paper are illustrated below:

• •

We propose a provably secure mutual authentication and key agreement protocol named LiSA, specifically for SMIs employed in SG environments. The designed protocol leverages the hardness of the Elliptic Curve Qu Vanstone (EVQV) certificate mechanism, Elliptic Curve Diffie Hellman Problem (ECDHP), and Elliptic Curve Discrete Logarithm Problem (ECDLP) in its design to prevent various security attacks.

• •

Additionally, we provide a detailed informal security evaluation of the proposed protocol. The evaluation reveals that LiSA supports mutual authentication, anonymity, replay protection, session key security, and resists various other attacks.

• •

The proposed protocol is a perfect mix of security features and lightweight cryptographic functions that make it apt for deployment in SG ecosystems. Thus, in order to validate it efficacy it has been extensively evaluated against the current state-of-the-art in terms of security features, computational complexity, and communicational complexity.

I-B Organization

The present manuscript is structured according to the following sequence. The proposed system model is sketched in Section II and the designed protocol is presented in Section III. Following this, detailed security analysis and performance assessment of the proposed scheme are demonstrated in Sections IV and V, respectively. Lastly, the conclusions are drawn in Section VI.

II System Model

A typical schematic diagram of the proposed LiSA protocol is depicted in Fig. 1. The setup comprises primarily of three entities, *i.e., *SMs, Service Providers (SPs), and Trusted Third Party (TTP). SMs are resource constrained electronic devices deployed across customers’ premises to record energy consumption on a periodic basis. Additionally, SMs are also responsible for collecting and transmitting the energy consumption data to the utility. On the other hand, SPs are utilities that provide services to the end-users. Above all, TTP is the trusted entity that initializes the system parameters and aids in registration of SMs and SPs. Following this, mutual authentication and key exchange is executed between the SMs and SPs. The execution details of LiSA are elaborated in the upcoming segment.

III LiSA: A Mutual Authentication and Key Exchange Strategy for SMI

In the proposed scheme, the concepts of ECQV, ECDLP, and ECDHP are exploited to establish trust and authenticity between the SMs and SPs to resist different attack vectors. The overall execution strategy has been segregated into the following broad phases: i) Setup Phase, ii) Registration Phase, and iii) Authentication and Key Exchange Phase [21, 22]. In summary, the by-product of the protocol is equivalent to “mutual authentication”, while the end-product is the “exchange of a secure session key”. The detailed information is given below:

III-A Phase I: Setup Phase

During this phase, the SMI is prepared for the subsequent phases and incorporates the following course of actions:

Step 1: It begins with the selection of an elliptic curve $E$ by the TTP. The $E$ is further associated with a generator $P$ and order $q$.

Step 2: Following this, the TTP computes its private ($d_{T}$) and public key ($Q_{T}$) pairs. This is done in accordance with the following equations: $d_{T}\in Z^{*}_{q}$ and $Q_{T}=d_{T}.P$.

Step 3: Next, a one-way hash function, *i.e., *($H_{0}()$) is selected.

Step 4: Finally, the above mentioned parameters including $<E,P,q,H_{0}(),Q_{T}>$ are made public.

III-B Phase II: Registration Phase

During this phase, the SMs and the SPs get themselves registered with the TTP. The process of registration for both the entities is exactly alike and is based on the ECQV certificate scheme [20]. Thus, it is discussed in the case of SMs only, but is extendable to the SPs as well. The execution steps of the registration process are detailed in Fig. 2 and discussed as under:

Step 1: The $A^{th}$ SM starts its registration process by choosing an identity ($ID_{A}$) for its itself. Next, it selects a random number ($r_{A}$) and computes $R_{A}$. Finally, the SM transmits $<ID_{u},~{}R_{A}>$ to the TTP using the secure channel.

Step 2: Upon receiving $<ID_{u},~{}R_{A}>$, the TTP selects a random number $r_{T}$ and computes $R_{T}$. It then computes a certificate for the $A^{th}$ SM using the following operation: $Cert_{A}=R_{A}+R_{T}$. Following this, the TTP calculates the value of variable $r$ using $H_{0}()$, concatenation, and ECC point addition operations.

Step 3: Finally, the computed value of $Cert_{A}$ and $r$ are sent to the $A^{th}$ SM over the secure channel.

Step 4: Using the received values, the SM computes its private key ($d_{A}$) followed by its public key $Q_{A}$.

III-C Phase III: Authentication & Key Exchange Phase

This is the most crucial phase of LiSA and incorporates mutual authentication and session key exchange between the SMs and SPs. The series of execution steps are reflected in Fig. 3 and explained as follows.

Step 1: The process is initiated by the $A^{th}$ SM by generating its current time stamp ($T_{SM}$) and a random number ($r_{SM}$). Next, it computes $R_{SM}$ and $R_{SM}^{{}^{\prime}}$ using ECC point multiplication.

Step 2: Following this, the $A^{th}$ SM computes an intermediate token ($\mathbb{T}o_{SM}$) using its $Cert_{A}$ and $ID_{A}$. It also calculates an authorization token ($\mathbb{A}uth_{SM}$) for the SP to verify using the following operation: $\mathbb{A}uth_{SM}=R_{SM}^{{}^{\prime}}\oplus\mathbb{T}o_{SM}\oplus T_{SM}$.

Step 3: Next, $<T_{SM},~{}R_{SM},~{}\mathbb{A}uth_{SM}>$ are transmitted to $SP_{B}$ over the open channel. It is worth noting here that the SM’s ID is never transmitted over the channel in clear text format which prevents tracking of SM by the adversary $\mathcal{A}$.

Step 4: Once $<T_{SM},~{}R_{SM},~{}\mathbb{A}uth_{SM}>$ are received by the SP, it validates the time stamp $T_{SM}$. If found valid, the SP proceeds; else the connection is terminated immediately. Next, the SP computes $R_{SM}^{{}^{\prime\prime}}=d_{B}.R_{SM}$; followed by the extraction of $(Cert_{A}||ID_{A})$ from the received $\mathbb{A}uth_{SM}$. Using the extracted values, the SP computes $SM_{A}$’s public key: $Q_{A}=H_{0}(Cert_{A}||ID_{A})Cert_{A}+Q_{T}$. If the computed key matches the publicly available $Q_{A}$, then the SP is sure about the authenticity of the SM. Otherwise, the connection is dropped by the SP.

Step 5: Next, the SP records its time stamp $T_{SP}$ and generates another authentication token ($\mathbb{A}uth_{SP}$) for the SM to verify. Simultaneously, the SP also computes a session key ($SK_{B-A}$) that is used only if the mutual authentication is established. $SK_{B-A}$ is computed using the following operation: $kdf(ID_{A}||Cert_{A}||R_{SM}^{{}^{\prime\prime}}||T_{SP}||T_{SM})$ where $kdf$ is a key derivative function.

Step 6: Finally, the parameters $<T_{SP},~{}\mathbb{A}uth_{SP}>$ are communicated to the SM for the next course of action.

Step 7: On receiving the above mentioned parameters, the validation of time stamp $T_{SP}$ is done. Next, the authentication token $\mathbb{A}uth_{SP}^{*}$ is computed for verifying it against the received token. A match indicates that the SP is a valid/authentic entity.

Step 8: Finally, the SM computes the shared session key as follows: $SK_{A-B}=kdf(ID_{A}||Cert_{A}||R_{SM}^{{}^{\prime}}||T_{SP}||T_{SM}$.

IV Security Analysis and Comparisons

In this section, detailed security analysis of the proposed LiSA protocol is illustrated. Along with this, the comparative security assessment against the existing schemes is also presented herewith.

IV-A Security Analysis

LiSA provides a number of security features and resists various attack vectors. The detailed information is illustrated below.

IV-A1 Mutual authentication

LiSA supports the concept of mutual authentication between the communication parties, *i.e., *SMs and SPs. The process of mutual authentication helps to establish the authenticity of one party to the other. In the designed protocol, it is realised using two different intermediate authentication tokens namely $\mathbb{A}uth_{SM}$ and $\mathbb{A}uth_{SP}$. The hardness of these tokens can be attributed to ECQV and ECDHP [20]. In detail, these tokens cannot be computed without the knowledge of $Cert_{A},ID_{A},$ and $d_{B}$; which are specifically private to the legitimate entities and are not shareable.

IV-A2 Replay protection

Resistance against replay attacks enable the protocol to deny any previous message to retransmitted between the legitimate parties. In the proposed LiSA protocol, replay protection has been provided using the concept of time stamps and pseudo random numbers. These time stamps and numbers enable new values to the intermediate tokens in every session. Further, during every session, the time stamps are verified for their validity. In case of violation, the ongoing communications are terminated to avoid replay attacks.

IV-A3 Resistance against impersonation attacks

The proposed protocol also resists impersonation attacks. This implies that an adversary $\mathbb{A}$ cannot impersonate a valid SM to form a legitimate session with the SP. This can be credited to the strength of the ECQV certificate mechanism and the $ID$ masking mechanism that prevents an $\mathbb{A}$ to track SMs and spoof their identities. Further, extraction of a SM’s certificate and identity from $\mathbb{A}uth_{SM}$ is an intractable process for an $\mathbb{A}$. This is because, these values can only be extracted by a valid SP (say $SP_{B}$ with which the SM is trying to connect) with its respective private key $d_{B}$.

IV-A4 Resistance against man-in-the-middle (MITM) attacks

The MITM attack allows an $\mathbb{A}$ to intercept a legitimate session and spoof the identity of an entity. Following this, $\mathbb{A}$ alters the relayed messages to illegitimately develop a session with the SM/SP. However, as explained earlier, LiSA resists impersonation and replay attacks. Further, the alteration of $\mathbb{A}uth_{SM}$ and $\mathbb{A}uth_{SP}$ tokens is also not possible in the proposed scheme. Thus, LiSA prevents MITM attacks.

IV-A5 Supports anonymity

LiSA also support perfect anonymity for the participating SMs. This is achieved by masking the SM’s identity and certificate information while trying to develop a session with the SPs. Precisely, the SM’s confidential information such as $Cert_{A}$ and $ID_{A}$ are never relayed in clear text format. Further, their extraction from the intermediate tokens by an illegitimate party is an intractable process. This can be attributed to the hardness of ECDLP [20].

IV-A6 Session key security

The session keys ($SK_{A-B}$ and $SK_{B-A}$) derived by the SMs and SPs in LiSA are completely secure. The session keys can only be computed by the valid and authentic parties post successful mutual authentication as discussed in Section III-C.

IV-A7 Resistance against Denial of Service (DoS) attacks

In LiSA, the process of mutual authentication is essentially initiated by the SM by relaying the following message: $\textless T_{SM},~{}R_{SM},~{}\mathbb{A}uth_{SM}\textgreater$. Post receiving this message, the SP makes checks i) the validity of the received time stamp $T_{SM}$ followed by ii) the authenticity of the SM using $\mathbb{A}uth_{SM}$. In the course of this process, if any validation check fails, then the SP knows that the other party is illegitimate. Thus, the connection is immediately dropped to prevent DoS attacks.

IV-B Security Comparison

This sections presents the detailed comparison between the proposed LiSA protocol and the existing schemes [23, 24, 19, 20]. The comparison is carried out on the basis of following features: mutual authentication ($\mathfrak{SF}_{1}$), replay protection ($\mathfrak{SF}_{2}$), resistance against impersonation attacks ($\mathfrak{SF}_{3}$), resistance against MITM attacks ($\mathfrak{SF}_{4}$), anonymity ($\mathfrak{SF}_{5}$), session key security ($\mathfrak{SF}_{6}$), resistance against DoS attacks ($\mathfrak{SF}_{7}$), and lightweight ($\mathfrak{SF}_{8}$).

It is evident from the comparison shown in Table I that the proposed LiSA protocol is the most secure out of the existing schemes. For instance, Odelu et al.’s [23], Chen et al.’s [24], and Abbasinezhad-Mood & Nikooghadam’s schemes [19] fail to provide session key security and resistance against DoS attacks. Additionally, these protocols are not lightweight in comparison to the other protocols. Finally, Braeken et al.’s scheme [20] neither provides mutual authentication nor is lightweight.

V Performance Evaluation

In this section, the comparative analysis of the proposed LiSA protocol is carried out against the current state-of-the-art [23, 24, 19, 20]. The related comparisons have been performed on the basis of total computational and communicational complexities associated with these protocols. The detailed information about these assessments and the related simulation parameters are discussed herewith.

V-A Simulation Details

Braeken *et al.*in [20] adopted an efficient means to simulate the SG setup and evaluated different protocols on it. In the said setup, the authors employed a personal computer to mimic the computational capability of the SPs; while a constrained device was used to represent a SM. The configurations of SPs included Windows 7 running on 2.5 GHz CPU and 8 GB RAM. On the other hand, SMs had limited capabilities with a single core 798 MHz CPU and 256 MB RAM.

V-B Evaluation Parameters

For the evaluation of the proposed LiSA protocol in comparison to the existing protocols, the following metrics have been chosen:

V-B1 Computational Overhead Analysis

The computational time of the proposed and existing protocols have been computed by taking into consideration the number of computationally expensive cryptographic operations executed during the authentication and key exchange phases. Table II illustrates the computational time (in ms) required for executing different functions on the SMs and SPs, respectively. Here, $\mathbb{T}_{b},\mathbb{T}_{m},\mathbb{T}_{a},\mathbb{T}_{h}$, $\mathbb{T}_{e}$, and $\mathbb{T}_{s}$ refer to the execution time for performing bilinear pairing, point multiplication, point addition, hashing, modular exponentiation operation, and symmetric encryption/decryption operation, respectively.

In accordance with the values depicted in the above table, the computational complexities of different protocols have been computed. The related outcomes are shown Table III; wherein the overheads on the SMs and SPs are depicted separately. The proposed LiSA protocol requires 11.826 msec on the SM level and almost 0.992 msec on the SP level, for executing the authentication mechanism along with the key exchange. Additionally, the said execution time is the least in comparison with the other protocols as evidenced from the results shown in Table III.

V-B2 Communicational Overhead Analysis

In order to analyse the communicational complexity of the proposed and the existing protocols, the number of messages and bits transmitted between the SMs and SPs have been considered. For this analysis, the transmitted messages have been segregated into different tokens with variable lengths. For instance, the length of the hash function and random numbers is equivalent to 160 bits, while the length of the identity field and time stamps are set to 32 bits each. Further, the x-coordinate of an ECC point requires 60 bits. Likewise, the message length of other tokens can be found in the literature [20]. Consequently, the communicational overheads associated with the transmission of different tokens across the authentication and key exchange mechanism are summarized in Table IV. It is quite clear from the obtained results that LiSA requires the least number of rounds and number of bits to establish trust, authenticity and secure session key between the communicating parties. In detail, LiSA requires 2 rounds and 544 bits for transmission of messages between the SMs and SPs.

Thus, it can be summarized from the above discussion that LiSA is the most secure and lightweight authentication scheme for SMIs in SG setups.

VI Conclusion

In this paper, a provably secure mutual authentication and key agreement protocol named LiSA was devised, specifically for SMIs employed in SG environments. The proposed protocol is a perfect mix of security features and lightweight cryptographic functions that make it apt for deployment in SG ecosystems. In order to attain the above mentioned features, the designed protocol utilizes ECC, one-way hash functions, concatenation, and logical XOR operations. In terms of ECC, the protocol leverages the concept of ECQV, ECDLP, and ECDHP to generate the intermediate tokens including authentication tokens and session keys. Further, the detailed security assessment of the protocol reveals that it supports various security features namely mutual authentication, replay protection, anonymity, resistance against MITM, DoS, impersonation attacks, etc. Additionally, the computational and communicational overheads associated with the execution of the designed protocol in SG setups indicate that it is relatively lightweight in comparison with the current state-of-the-art.

Acknowledgment

This work was supported by the Tier 2 Canada Research Chair.