Secure Group Key Agreement on Cyber-Physical System Buses

TL;DR

Secure Group Key Agreement on Cyber-Physical System Buses addresses authentic, cooperative key establishment across constrained CPS bus networks without central authorities. The authors analyze existing GKAs, derive bus-specific requirements, and design GRACYBUS, a fully distributed GKA built on TreeKEM with a tree-structured key hierarchy, epoch-based key scheduling, and bus-aware messaging. The protocol supports dynamic joins/leaves, robustness under a Dolev-Yao adversary, and cryptographic agility, achieving $O(\log n)$ overhead in computation and messaging while maintaining scalable storage. Evaluation and discussion demonstrate practical feasibility for long-lived CPS deployments and outline future enhancements, including group merge/split operations and optimization of tree truncation, with post-quantum readiness in mind.

Abstract

Cyber-Physical Systems (CPSs) rely on distributed embedded devices that often must communicate securely over buses. Ensuring message integrity and authenticity on these buses typically requires group-shared keys for Message Authentication Codes (MACs). To avoid insecure fixed pre-shared keys and trust-on-first-use concepts, a Group Key Agreement (GKA) protocol is needed to dynamically agree on a key amongst the devices. Yet existing GKA protocols lack adaptability to constrained CPS buses. This paper targets authenticated, fully distributed GKA suitable for bus topologies under constraints of industrial and cyber-physical systems, including broadcast-only links, half-duplex operation, resource limits, dynamic membership (including unannounced leaves), a long device lifetime, and a strong Dolev-Yao adversary capable of partitioning the bus. We first systematise existing protocols, then derive the requirements necessary for an authenticated and fully distributed GKA on bus systems. Finally, we design, implement, and evaluate a custom GKA protocol based on TreeKEM.

Figures (1)

• Figure 1: System model: Bus system with connected devices A, B, and C. Device J is joining the bus. Device X is leaving the bus abruptly. The attacker T has physical access to the bus.