Availability of the charging infrastructure is critical for a smooth rollout of wide-scale electric vehicle (EV) adoption. Safe integration of the charging infrastructure with the power grid heavily relies on an intelligent platform to support demand-side management and a secure information and communication system to coordinate events. However, security has been identified as an area falling short of the desired expectation in the smart grid, possibly introducing considerable risk to the reliability and stability of the power grid. In addition, a concrete demand-side management system that is compatible with state-of-the-art EVs is also lacking. This paper fills the gap by proposing a scalable defence-in-depth cybersecurity architecture for the charging infrastructure and a demand response scheme for smart EV charging. The feasibility of the system is demonstrated by implementation and testing on a real vehicle.

Entity authentication and related key management is an active research topic in smart grid security. However, existing works seem to have overlooked the significance that the smart grid is a cyber-physical system, which entails more considerations in the integration of its cyber and physical domains. Ignoring this could possibly undermine security since the effects of cyber authorization in the smart grid are usually extended into the physical domain. The substitution attack, a kind of the man-in-the-middle attack, has been demonstrated using this gap. This paper proposes a two-factor cyber-physical device authentication protocol to defend against coordinated cyber-physical attacks in the smart grid. The idea is to combine a novel contextual factor based on physical connectivity in the power grid with the conventional authentication factor in the challenge-response protocol, widely used in cybersecurity. The resulting protocol provides assurance on not only the digital identity of a device but also the device's controllability in the physical domain. While the design is for the electric vehicle ecosystem, the framework could be readily extended to other smart grid subsystems.

A formal treatment to the security of Concealed Data Aggregation (CDA) and the more general Private Data Aggregation (PDA) is given. While there exist a handful of constructions, rigorous security models and analyses for CDA or PDA are still lacking. Standard security notions for public key encryption, including semantic security and indistinguishability against chosen ciphertext attacks, are refined to cover the multisender nature and aggregation functionality of CDA and PDA in the security model. The proposed security model is sufficiently general to cover most application scenarios and constructions of privacy-preserving data aggregation. An impossibility result on achieving security against adaptive chosen ciphertext attacks in CDA/PDA is shown. A generic CDA construction based on public key homomorphic encryption is given, along with a proof of its security in the proposed model. The security of a number of existing schemes is analyzed in the proposed model.

The difficulty of processing data in encrypted form has long been the barrier to the widespread use of encryption in data storage applications; improved security or privacy would always imply a sacrifice of functionality. Many applications, such as ASP, requiring a significant amount of processing at the data storage servers are hence precluded from using encryption to protect data privacy. To address this problem, this paper works on privacy homomorphism which allows encrypted data to be operated on. Two additive homomorphic schemes, namely iterated hill cipher (IHC) and modified rivest scheme (MRS), are given. They are secure to ciphertext-only attacks and have the nice property that the same data may have different representations in the encrypted domain.

Finding an optimal key assignment (subject to given constraints) for a key predistribution scheme in wireless sensor networks is a difficult task. Hence, most of the practical schemes are based on probabilistic key assignment, which leads to sub-optimal schemes requiring key storage linear in the total number of nodes. A graph theoretic framework is introduced to study the fundamental tradeoffs between key storage, average key path length (directly related to the battery consumption) and resilience (to compromised nodes) of key predistribution schemes for wireless sensor networks. Based on the proposed framework, a lower bound on key storage is derived for a given average key path length. An upper bound on the compromising probability is also given. This framework also leads to the design of key assignment schemes with a storage complexity of the same order as the lower bound.

Wireless sensor networks (WSNs) are composed of tiny devices with limited computation and battery capacities. For such resource-constrained devices, data transmission is a very energy-consuming operation. To maximize WSN lifetime, it is essential to minimize the number of bits sent and received by each device. One natural approach is to aggregate sensor data along the path from sensors to the sink. Aggregation is especially challenging if end-to-end privacy between sensors and the sink (or aggregate integrity) is required. In this article, we propose a simple and provably secure encryption scheme that allows efficient additive aggregation of encrypted data. Only one modular addition is necessary for ciphertext aggregation. The security of the scheme is based on the indistinguishability property of a pseudorandom function (PRF), a standard cryptographic primitive. We show that aggregation based on this scheme can be used to efficiently compute statistical values, such as mean, variance, and standard deviation of sensed data, while achieving significant bandwidth savings. To protect the integrity of the aggregated data, we construct an end-to-end aggregate authentication scheme that is secure against outsider-only attacks, also based on the indistinguishability property of PRFs.

Any secured system can be modeled as a capability-based access control system in which each user is given a set of secret keys of the resources he is granted access to. In some systems which are sensitive to key storage cost, key derivation is commonly used. With a goal to minimize the maximum key storage per user, key compression based on key linking, that is, deriving one key from another without compromising security, is studied. A lower bound on key storage needed for a general access structure with key derivation is derived. This bound demonstrates the theoretic limit of any systems which do not trade off security and can be treated as a negative result to provide ground for designs with security tradeoff. A concrete, provably secure key linking scheme based on pseudorandom functions is given, along with an algorithm for finding optimal key linking patterns.

In data aggregation, multiple source nodes send their data to a sink along a concast tree with aggregation done en route so that the sink can obtain the aggregate (which could be the sum, average, etc.) of all these data. End-to-end privacy and aggregate integrity are the two main goals of secure data aggregation. While the privacy goal has been widely studied, providing end-to-end aggregate integrity in the presence of possibly compromised aggregating nodes remains largely an open problem. Message Authentication Codes (MAC) are commonly used to provide end-to-end data integrity in two party settings. Natural extensions of MAC for the data aggregation scenario are considered. It is shown that a straightforward and intuitive refinement of the MAC security model (for the data aggregation setting) is not achievable. A weaker security notion is proposed; whether this notion is achievable remains unclear.

We consider the problem of sending messages into the future, commonly known as timed release cryptography. Existing schemes for this task either solve the relative time problem with uncontrollable, coarse-grained release time (time-lock puzzle approach) or do not provide anonymity to senders and/or receivers and are not scalable (server-based approach). Using a bilinear pairing on any Gap Diffie-Hellman group, we solve this problem by giving scalable, server-passive and user-anonymous timed release public-key encryption schemes allowing precise absolute release time specifications. Unlike the existing server-based schemes, the trusted time server in our scheme is completely passive - no interaction between it and the sender or receiver is needed; it is even not aware of the existence of a user, thus assuring the privacy of a message and the anonymity of both its sender and receiver. Besides, our scheme also has a number of desirable properties including a single form of update for all users, self-authenticated time-bound key updates, and key insulation, making it a scalable and appealing solution. It could also be easily generalized to a more general policy lock mechanism

Key management is an essential cryptographic primitive upon which other security primitives are built. Among the solutions to the key management problem in ad hoc networks, key predistribution schemes (KPS) seem to be a practical option, tolerant to changing topology and broken links. However, relying on trusted dealers, although only needed in initialization, renders KPS inapplicable in many ad hoc network scenarios and lead to a single point of vulnerability. We present protocols for the distributed key predistribution scheme (DKPS) paradigm, which eliminates the need of a trusted dealer in KPS and realizes fully distributed and self-organized KPS without relying on any infrastructure support. We especially focus on the secure shared key discovery (SSD), a component of DKPS, and present two protocols to realize it.

Key management is an essential cryptographic primitive upon which other security primitives are built. However, none of the existing key management schemes are suitable for ad hoc networks. They are either too inefficient, not functional on an arbitrary or unknown network topology, or not tolerant to a changing network topology or link failures. Recent research on distributed sensor networks suggests that key pre-distribution schemes (KPS) are the only practical option for scenarios where the network topology is not known prior to deployment. However, all of the existing KPS schemes rely on trusted third parties (TTP) rendering them inapplicable in many ad hoc networking scenarios and thus restricting them from wide-spread use in ad hoc networks. To eliminate this reliance on TTP, we introduce distributed key pre-distribution scheme (DKPS) and construct the first DKPS prototype to realize fully distributed and self-organized key pre-distribution without relying on any infrastructure support. DKPS overcomes the main limitations of the previous schemes, namely the needs of TTP and an established routing infrastructure. It minimizes the requirements posed on the underlying networks and can be easily applied to the ad hoc networking scenarios where key pre-distribution schemes were previously inapplicable. Finally, DKPS is robust to changing topology and broken links and can work before any routing infrastructure has been established, thus facilitating the widespread deployment of secure ad hoc networks.

Message authentication is considered as a serious bottleneck to multicast security, particular for stream-type of traffic. The technique of hash chaining/signature amortization has been proposed in many schemes for stream authentication, with or without multicast settings. However, none of them is optimal. They either have a large packet overhead or are not robust to packet loss. Some even have a large receiver delay or require a large receiver buffer size. These schemes are constructed by trial-and-error methods. There lack tools to evaluate and compare their performances. There is no systematic way to construct these schemes either In this paper, we introduce the notion of dependence-graphs which links these hash-chained authentication schemes to the well-known graph theory, and provides an effective analytical tool. Many important metrics of a hash-chained authentication scheme can be readily and easily determined from its dependence-graph. As well, a dependence-graph demonstrates design tradeoff and provides insights into optimizing hash-chained schemes.