Authentication and authorization (A & A) mechanisms are critical to the security of Internet of Things (IoT) applications. Smart grid system processing and exchanging data without human intervention, known as smart grids, are well-known as IoT scenarios. Entities in such smart grid systems need to identify and validate one another and ensure the integrity of data exchange mechanisms. However, at present, most commonly used A & A protocols are centralized, resulting in security risks such as information leaks, illegal access, and identity theft. In this study, we propose a new distributed A & A protocol for smart grid networks based on blockchain technology to address with these risks. The proposed protocol integrates the decentralized authentication and immutable ledger characteristics of blockchain architectures suitable for power systems with a novel blockchain technique to realize both identity authentication and resource authorization for smart grid systems. We discuss the security of and threat models for prior A & A protocols and demonstrate how our protocol protects against these threats. We further demonstrate an approach to a real deployment of our A & A protocol using the FISCO consortium platform, applying algorithms from smart contract systems. Finally, we present the results of experimental simulations showing the efficacy and efficiency of our proposed protocol.
Enabled by recent advances in monitoring, sensing, control, and communication technologies as well as the recently increasing popularity of renewable energy and distributed power resources, conventional power grids are presently developing along a path of becoming power information and communication networks, realizing a vision of self-healing and self-restoration capabilities and improved sustainability and efficiency, which have been commonly referred to as the smart grid (SG) [
Thus, distributed authentication and authorization protocols present a potential solution to these problems. Authentication protocols define processes to validate user identities, whereas authorization protocols define processes determining what operations and functions users are permitted to perform once they are successfully authenticated. For example, in a smart grid, the identity of electricity users may be verified by providing a correct username/password in a power information management system. Once a user has been authenticated, the power service provider can further authorize them to perform various functions if the system defines access policies describing user permissions. These issues are not unique to electrical power grid systems; further examples of authentication and authorization include many other methods, such as the OpenID Connect [
In contrast to centralized models, blockchain technology has developed rapidly since the emergence of Bitcoin in 2008 [
In summary, three major challenges remaining to be solved in blockchain-based A & A protocols are described below:
Security solutions to address potential threats in a smart grid system still require further development. On this basis, we review the current security and threat models and aim to develop a protocol addressing the implications of these models Protocols improving the flexibility of A & A processes in smart grid-related applications still need to be developed, and protocols that can be relatively easily deployed in mature platforms may be required Methods for improving the efficiency of blockchain-based protocols are also needed. This may require the development of blockchain-based protocols able to process more transactions in a given time (commonly quantified in transactions per second). For example, Ethereum 1.0-based blockchain applications support only 25-30 transactions per second at most, while some may be limited to roughly 15, which are all considered to be slow, whereas the speed of E-transaction in the conventional banking system is over 5000 transactions per second
This study addresses the above challenges by proposing a new A & A protocol based on a consortium blockchain.
To summarize, the main contributions of the study are threefold:
First, we propose a blockchain-based decentralized authentication and authorization protocol. We note that few works have considered authorization using blockchain techniques. To address security and common threats in smart grid systems, we discuss the security and threat models applicable to blockchain systems and analyze our proposed protocol approaches to the prevention of various attacks or exploits described in these models. In addition, to enrich the present work, we also discuss methods to enhance the security of blockchain implementations Our protocol is the first A & A protocol constructed using a consortium blockchain technique, as far as we know. We highlight that our protocol is expected to be easy to deploy on mature platforms such as the Hyperledger [ Lastly, we demonstrate an approach to real deployment of our A & A protocol using the FISCO platform, by patching algorithms used to maintain and record smart contracts. We then give the results of experiments to show the efficiency of our proposed protocol
The remainder of this paper is organized as follows. In Section
Blockchain technology is usually divided into public, private, and consortium chains according to the access mechanism [
Smart contracts refer to computer programs that a network of mutually distrusting nodes can execute without the assistance of any trusted authority [
To ensure the sustainability and scalability of automated grid ecosystems, an A & A protocol must fulfill numerous security requirements [
Motivated by the related work [
Alternatively, Sybil attacks on the network refer to a malicious node weakening or destroying the redundant backup mechanism by simulating or controlling multiple nodes. Under this attack, multiple data backups may be stored on the Sybil nodes and thus potentially corrupted or compromised.
In this section, we review related works on both authentication and authorization using blockchain techniques.
Fromknecht et al. [
Based on this, Axon and Goldsmith [
In contrast to the above blockchain-based distributed PKI system, Matsumoto and Reischuk [
For distributed PKI blockchain architectures, Hari and Lakshman [
Some scholars have studied the authorization of cryptocurrency based on blockchain technology. Blockchain architectures have good anonymity, which can help users hide their real identity and effectively protect users’ privacy information in public chains. However, in the fields of digital currency and private chain/alliance chains, it is necessary to ensure the authenticity of the node’s identities in the blockchain network, because excessively strong anonymity may be expected to shelter illegal activities such as money laundering, drug trafficking, and malicious attacks within an organization. Based on this, Thomas and Pentland [
In this subsection, we present our proposed general authentication protocol to build validated connections in a secure and decentralized manner via blockchain technology. As shown in Figure Registration. In the registration process of our authentication protocol, we first initialize a user’s cryptographic public key
Decentralized authentication.
Identity transaction.
Information | Description |
---|---|
TransactionType | Identity |
User | An organization, an application, or a person |
Identity | Identity card, passport, driver’s license |
PK | e.g., fcf4a1f566d1e0aa06436098c09d35d9762bf240 |
UserName | Alice001 |
Timestamp | The time the transaction occurs, i.e., 177131cee76 |
Signature | e.g., 0xc3373d3bd1d4edc089001fd330920c303e |
95c51b131c22bc91b2f9f9f56e0de9 |
LogIn. After registration, a user logs in to the smart grid system to use a service by running the “LogIn” process. The process flow is shown in Figure To log in, the user first commits the identity information and imports their secret key into the service application. In this case, the secret key can be imported by typing it manually or scanning by a QR code, etc. A user who needs to log in then sends a login request to the service provider of the smart grid network. Note that the login request is signed with the secret key The service provider parses the login request, extracts the hash, queries the blockchain, obtains identity information as Upon finishing the above process, an authentication request is sent back by the service provider. The authentication request contains a timestamp (to prevent a replay attack), the user’s UserName, and their The user generates a signature with five parameters, including timestamp, UserName, and The service provider verifies the received information, and if it is valid, the authentication succeeds; otherwise, the authentication fails, and the service provider denies the user login
After the LogIn process, the service provider obtains further personal information from the user to build their profile, which will then be used in the authorization mechanism.
Smart contract design. Here, we describe our proposed smart contract algorithms to further show how to realize our protocol. First, we need two key functions, namely “QueryData” and “SendTransaction.” The smart contract algorithms are as follows.
As shown in Algorithm
1: Table 2: Entries 3: 4: 5: else 6: 7:
As shown in Algorithm
1: 2: 3: 4: 5: Table 6: Entry 7: 8: 9: 10: 11: 12: 13:
{ 0d9a1f483c1f9b7f7db66d7a783fd, 0692ba94609af70a700cd9e7 56849f5f2dad811f6953d127 861002d640100000000026401000000009004565b }
Note that we do not give the entire transaction of the input due to space limitations. According to the transaction, we may observe the deployment process. In our proposed approach, when a smart contract is deployed, the code, written in Solidity, is compiled into a binary string. Later, the binary string is encoded with the recursive length prefix (RLP) encoding and constructed as the input of the transaction. The address in the “from” field is the public key of the user who deployed the smart contract. They then sign the transaction with their private key. Finally, the transaction is sent to the blockchain.
Thereafter, to achieve decentralized authentication, we must solve two types of tasks. One involves calling the abovementioned smart contract to access the blockchain system, while the other involves handling interactions between users and service providers. The decentralized authentication mechanism consists of “Registration” and “Login” algorithms.
As shown in Algorithm
1: Get cryptographic key pair 2: String 3: String 4: Get cryptographic suite 5: String 6: String 7: 8: 9: 10: 11: 12: 13: 14:
As shown in Algorithm
1: 2: 3: 4: 5: Verify the validity of the account data on the blockchain 6: String 7: String 8: String 9: Get cryptographic suite 10: String 11: String 12: Boolean 13: 14: Generate a token to be signed by the user 15: Long 16: 17: 18: Verify the validity of token data 19: 20: 21: 22: 23: 24: 25: 26: 27: 28:
As is shown in Figure Resource registration. In this process, a user registers basic information on the blockchain of their resource. Suppose that a user on the smart grid requests a resource of the resource server, and the user needs to submit a resource transaction to the blockchain through the blockchain client. This resource transaction should include at least the following information. Resource granting. In this process, the user implementation requests the resource of the resource owner and obtains authorization. Suppose that a user requests access to a resource owned by a resource owner, and the resource owner decides whether to grant access issuing a public-key cryptographic signature. This process is illustrated in Figure In the beginning, the resource owner first records their resource on the blockchain using the smart contract algorithm “RegisterResource” described below. Then, the requesting user sends an authorization request to the resource owner with parameters including the user’s UserName and its Upon receiving the request, the resource owner then verifies the validity of the request by checking the validity of the signature and decides whether the user who made the request may access the resources they own. This process is performed using the smart contract algorithm “GrantResource,” which is described below. If the verification passes, indicating that the resource owner decided to grant authorization, they release an access token based on the user’s previous request. The access token is in fact a new signature with a timestamp, UserName, user’s Upon receiving the access token, the requesting user further sends the actual resource access request to the resource server. Because the access token is available, the resource server can establish that the resource owner has already granted the requesting user’s access request and proceeds to the step below Upon receiving the parameters from the previous request, the resource server parses and verifies the validity of the request’s signature. If it is verified successfully, the resource server queries the owner’s information by checking the resource list on the blockchain and then checks the validity of the access token. If this also passes, the resource server sends the requested protected resource to the user Smart contract design. Similarly, we designed smart contract algorithms to achieve decentralized authorization. The application also needs to call the smart contract to access the blockchain system, and the communication among the resource owner, requester, and resource server is ignored. The proposed decentralized authorization protocol consists of “RegisterResource” and “GrantResource” algorithms
{ User’s profile, Resource address: “ipfs://QmUgmeDNfbP61hynZAQjvy81sGo. QmLQRzEaG51knUS9rjk” UserPK:148947262ec5e21739fe3a931c29e8b84ee34a0f b60b7b13d6a79f1ae5174 UserName:Bob001 Signature:0340a609475afa1f9a784cad0db5d5ba7dbaab 2147a5d7b9bbde4d1334a0e40a5 }
Note that the resource management in our design is also a decentralized storage network using the InterPlanetary File System (IPFS) technique [
Decentralized authorization.
As shown in Algorithm
1: String 2: Get ECDSA signature result 3: 4: 5: 6: 7: 8: 9:
1: Generate an access token with the owner’s signature. 2: Long 3: String 4: Get ECDSA signature result 5: The user sends the signed token to the server. 6: Resource server queries the owner’s information on the blockchain. 7: 8: 9: Query the owner’s information on the blockchain. 10: 11: 12: 13: String 14: String 15: String 16: Verify the validity of the access token 17: 18: Get cryptographic suite 19: 20: Boolean 21: String 22: String 23: Boolean 24: 25: Verify the validity of the resource data 26: String 27: 28: 29: 30: 31: 32: 33: 34: 35: 36:
As is shown in Algorithm
We describe below the reasons that our protocol satisfies the security requirements mentioned in Section
Then, for Sybil attacks on the network side, in the designed protocol, each entity can have only one public key as its identity, and accordingly, it can have only one secret key associated with the public key. We can see that each message in our protocol is signed by the secret key to ensure integrity. Moreover, the public key that binds to a UserName can be verified by the system, so that any attacker cannot use a forged public key, thus directly preventing the abovementioned Sybil attacks.
In the previous section, we presented a security analysis of our proposed protocol. Most of our security prevention is addressed by the potential security of the blockchain architecture itself; therefore, in this subsection, we discuss methods to enhance the security of the blockchain.
Our implementation consisted of three parts. One was the construction of a blockchain system on which we could run the proposed decentralized authentication and authorization. The other was to program smart contract algorithms based on blockchain. The smart contracts should at least implement the basic functions consisting of sending transactions and retrieving data on the blockchain. Finally, we should implement other functions that do not need to interact with the blockchain, such as the interactions between users, resource servers, and requesters. Fortunately, the blockchain we choose has provided the Java SDK, offering APIs for node status, blockchain system configuration modification, and nodes to send transactions. The Java SDK achieves this by calling the basic functions implemented by smart contracts. Therefore, we first used a smart contract to implement the functions referring to the blockchain and then wrote a Java application to complete the entire experiment we as required.
We deployed our blockchain system based on an open-source blockchain platform called FISCO BCOS. The code for our deployment is available in
In our deployment, we chose cryptography algorithms described in [
In our decentralized application, we focused on operations referring to access to the blockchain system and ignored other operations, such as communication between a user and the service provider. We ran 100 test cases for every application to obtain average results.
Registration in authentication.
Total time (MS) | Generate signature (MS) | Send transaction (MS) |
---|---|---|
445 | 15 | 430 |
Login in authentication.
Total time (MS) | Query account data (MS) | Verify account data (MS) | Generate token (MS) | Verify token (MS) |
---|---|---|---|---|
31 | 5 | 12 | 11 | 3 |
Furthermore, in order to see the impact of illegal access, we wrote a simulation program to show the average time for sending one transaction to the blockchain system for different numbers of test cases. The number of test cases refers to the number of users attempting to register. As is shown in Figure
Registration test on the authentication process.
Comparatively, we present simulation results for querying transactions on the blockchain system. Figure
The login test on the authentication process.
Register resource in authorization.
Size of the resources (MS) | Total time (MS) | Generate signature (MS) | Send transaction (MS) |
---|---|---|---|
50B | 500 | 14 | 486 |
100 B | 532 | 15 | 517 |
1 kB | 514 | 13 | 501 |
5 kB | 537 | 17 | 520 |
10 kB | 531 | 13 | 518 |
Grant resources in authorization.
Size of the resources (MS) | Total time (MS) | Generate token (MS) | Query resource (MS) | Verify the validity (MS) |
---|---|---|---|---|
50 B | 29 | 11 | 5 | 13 |
100 B | 26 | 11 | 4 | 11 |
1 kB | 26 | 11 | 3 | 12 |
5 kB | 30 | 11 | 5 | 14 |
10 kB | 70 | 11 | 46 | 13 |
As shown in Tables
In this study, we have proposed a distributed authentication and authorization protocol for smart grid networks based on blockchain technology. Our proposed protocol applies a novel blockchain technique to realize terminal identity authentication in a smart grid system as well as communication authorization functions of the resources. In addition, it can reduce the security risks associated with centralization. We show in detail our proposed method to construct a distributed protocol and analyze its security vulnerability prevention capabilities. Finally, the deployment and experiments conducted demonstrate the efficiency of the protocol.
In future work, we plan to realize other functions of a smart grid system using blockchain techniques, such as data statistics and resource counting; additionally, we plan to extend our decentralized authorization function to a role-based access control function, and finally, we plan to develop a data privacy protection protocol using secure multiparty computing technologies, homomorphic encryption technologies, and agency encryption technologies, among other associated approaches.
No data were used to support this study.
The authors declare that they have no conflicts of interest.