The IoT-enabled Smart Grid uses IoT smart devices to collect the private electricity data of consumers and send it to service providers over the public network, which leads to some new security problems. To ensure the communication security in a smart grid, many researches are focusing on using authentication and key agreement protocols to protect against cyber attacks. Unfortunately, most of them are vulnerable to various attacks. In this paper, we analyze the security of an existent protocol by introducing an insider attacker, and show that their scheme cannot guarantee the claimed security requirements under their adversary model. Then, we present an improved lightweight authentication and key agreement protocol, which aims to enhance the security of IoT-enabled smart grid systems. Furthermore, we proved the security of the scheme under the real-or-random oracle model. The result shown that the improved scheme is secure in the presence of both internal attackers and external attackers. Compared with the original protocol, the new protocol is more secure, while keeping the same computation efficiency. Both of them are 0.0552 ms. The communication of the new protocol is 236 bytes, which is acceptable in smart grids. In other words, with similar communication and computation cost, we proposed a more secure protocol for smart grids.

No abstract

Three-factor multiserver authentication protocols become a prevalence in recent years. Among these protocols, almost all of them do not involve the registration center into the authentication process. To improve the protocol’s efficiency, a common secret key is shared among all severs, which leads to a serious weakness; i.e., we find that these protocols cannot resist the passive attack from the honest-but-curious servers. This paper takes Wang et al.’s protocol as an example, to exhibit how an honest-but-curious server attacks their protocol. To remedy this weakness, a novel three-factor multiserver authentication protocol is presented. By introducing the registration center into the authentication process, the new protocol can resist the passive attack from the honest-but-curious servers. Security analyses including formal and informal analyses are given, demonstrating the correctness and validity of the new protocol. Compared with related protocols, the new protocol possesses more secure properties and more practical functionalities than others at a relatively low computation cost and communication cost.