💻 computer science

Secure Group Key Agreement on Cyber-Physical System Buses

This paper addresses the limitations of existing Group Key Agreement protocols for constrained Cyber-Physical System buses by systematizing requirements and designing a custom, authenticated, fully distributed protocol based on TreeKEM that accommodates broadcast-only links, dynamic membership, and strong adversarial threats.

Original authors: Sebastian N. Peters, Lukas Lautenschlager, David Emeis, Jason Lochert

Published 2026-01-30

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Sebastian N. Peters, Lukas Lautenschlager, David Emeis, Jason Lochert

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a busy factory floor or a long train where dozens of machines, sensors, and computers need to talk to each other constantly. They don't use Wi-Fi or the internet; they are all plugged into a single, shared "wire" called a bus (like a CAN bus in a car or a PROFIBUS in a factory).

The problem is that this wire is like a public town square: anyone plugged in can hear everything. If a hacker plugs in, they can listen to secrets or pretend to be a machine to cause chaos. To stop this, all the machines need a secret handshake code (a group key) that they use to lock their messages so only the real machines can read them.

The paper introduces a new way for these machines to agree on that secret code without needing a boss, without using too much battery power, and without getting confused when machines are added or removed.

Here is the breakdown of their solution, GRACYBUS, using simple analogies:

1. The Problem: The "Old Way" Doesn't Fit

Usually, when computers talk securely (like when you visit a bank website), they use a "handshake" between two people. But on a factory bus, you might have 100+ machines.

The Old Way: If every machine tried to shake hands with every other machine individually, it would be like 100 people trying to have private conversations in a crowded room at the same time. It would get too loud (too much data) and too slow.
The Constraint: These machines are "resource-constrained." Think of them as tiny, cheap calculators, not powerful laptops. They have very little memory and battery. They also live on "half-duplex" wires, meaning they can only talk or listen, not both at once, like a walkie-talkie.

2. The Solution: The "Tree House" Strategy

The authors designed a protocol called GRACYBUS. Instead of everyone talking to everyone, they organize the machines into a digital tree.

The Tree Structure: Imagine a family tree.
- The Leaves at the bottom are the individual machines.
- The Branches going up are shared secrets.
- The Root at the very top is the main group secret code.
How it works: When a machine wants to change the secret code (like rotating a password), it only has to whisper up its own branch to the top. It doesn't need to shout to the whole group. This keeps the "noise" low and the speed high, even if the group grows to 100+ machines.

3. Handling the Chaos: Joining and Leaving

In a factory, machines get unplugged, replaced, or break unexpectedly.

Joining: When a new machine arrives, it doesn't just walk in. It has to show an ID card (a digital certificate) to a "sponsor" (an existing machine). The sponsor then adds the new machine to the tree and updates the secret code so the new machine can hear the future, but the old code remains safe.
Leaving: If a machine leaves (or is kicked out), the group needs to change the code so the leaver can't listen anymore.
- The Twist: Sometimes a machine just vanishes without saying goodbye (like a power outage). GRACYBUS is smart enough to notice the silence, assume the machine is gone, and update the tree without waiting for a "goodbye" message.

4. Security Features: The "Magic Shield"

The paper claims this system is very tough against hackers, even if the hacker is sitting right next to the wire (the "Dolev-Yao" attacker).

No Single Point of Failure: There is no central server. If one machine breaks, the others keep talking. They are all equal.
Forward Secrecy: If a hacker steals a machine's secret code today, they still can't read the messages the machines sent yesterday. The old codes are thrown away immediately after use.
Post-Compromise Security: If a hacker does get in and steal a code, the system can "heal" itself. Once the machines perform one more update, the hacker is locked out of all future messages.
Future-Proof: The system is built to swap out its math tools easily. If a super-computer (quantum computer) comes along that can break today's math, the machines can switch to new math without needing a software update from a central boss.

5. The Trade-Off

The paper admits one limitation: If a hacker is powerful enough to cut the wire in the middle (splitting the group into two isolated islands), the two islands might end up with different secret codes. The system can't stop a hacker from physically cutting the line, but it ensures that as long as the line is connected, the code is secure.

Summary

GRACYBUS is a new rulebook for how machines on industrial wires can agree on a secret password. It uses a tree structure to keep things fast and light, works without a central boss, handles machines coming and going automatically, and protects past and future secrets even if a machine is compromised. It's designed specifically for the tiny, tough, and long-lasting machines found in cars, trains, and factories.

Technical Summary: Secure Group Key Agreement on Cyber-Physical System Buses

1. Problem Statement

Modern Cyber-Physical Systems (CPS), such as industrial machinery, trains, and automotive networks, rely heavily on broadcast bus architectures (e.g., CAN, PROFIBUS, Industrial Ethernet) to interconnect embedded devices. Ensuring message integrity and authenticity on these buses typically requires Message Authentication Codes (MACs) derived from a shared group key. However, establishing this key securely presents significant challenges:

Insecure Defaults: Current deployments often rely on insecure fixed pre-shared keys or "trust-on-first-use" concepts, which lack dynamic adaptability.
Scalability Issues: Conventional pairwise protocols (e.g., TLS handshakes) do not scale to group settings, resulting in exponential state and message complexity that conflicts with broadcast-oriented communication.
CPS Constraints: Existing Group Key Agreement (GKA) protocols from IT or IoT contexts fail to address specific CPS bus constraints, including:
- Resource Limitations: Devices have strict budgets for computation, memory, and bandwidth (e.g., CAN payloads limited to 64 bytes).
- Communication Constraints: Links are often broadcast-only or half-duplex.
- Dynamic Membership: Devices may join or leave abruptly (e.g., power-cycling, hot-swapping) without warning, and unannounced leaves must be handled without disrupting the protocol.
- Long Lifecycles: Systems require cryptographic agility to adapt to future vulnerabilities and Post-Quantum Cryptography (PQC).
- Adversarial Model: A strong Dolev–Yao adversary capable of reading, modifying, replaying, injecting, dropping, and reordering messages, including the ability to partition the bus.

The core problem is the lack of an authenticated, fully distributed GKA protocol that satisfies these specific industrial constraints while providing strong security guarantees like Forward Secrecy (FS) and Post-Compromise Security (PCS).

2. Methodology

The authors employ a systematic approach to derive requirements, analyze existing solutions, and design a custom protocol.

System Model and Requirements Derivation

The authors define a generalized bus system model where multiple devices communicate over a broadcast channel. They assume a Dolev–Yao adversary model and derive 12 concrete requirements (R01–R12) for a secure GKA on CPS buses:

Authenticity (R01): Only authenticated participants can send valid messages.
Fully Distributed (R02) & Independence (R03): No central leader or external service; any node can perform operations.
Bus-Agnostic (R04): Independent of specific bus addressing or ordering features.
Dynamic (R05): Supports runtime joins and leaves, including removal of inactive nodes.
Scalable (R06): Efficient for groups of 100+ devices.
Robustness (R07): Resilient against Dolev–Yao attacks.
Security Guarantees (R08–R10): Post-Compromise Security (PCS), Forward Secrecy (FS), and Cryptographic Agility.
Resource Constraints (R11): Minimal overhead in computation, memory, and bandwidth.
Merge/Split (R12): Ability to merge and split subgroups (noted as a future goal).

Protocol Analysis

The authors systematize existing GKA protocols (referencing taxonomies by Prandtl et al. and Xiong et al.) and evaluate them against the derived requirements.

Exclusions: Centralized, decentralized, imbalanced, and cluster-based protocols are excluded due to conflicts with the "Fully Distributed" requirement. Protocols generating asymmetric shared keys are excluded due to resource constraints.
Selection: Among dynamic protocols, TreeKEM (the core protocol of Messaging Layer Security, MLS) is identified as the most suitable foundation due to its optimal computational and message overhead ( $O(\log_2 n)$ ).
Gap Analysis: Direct use of MLS is impossible because it requires centralized Authentication and Delivery Services, violating the distributed and independent requirements of CPS buses. Furthermore, the standard TreeKEM specification lacks explicit authenticity guarantees and detailed message formats for broadcast environments.

3. Key Contributions: The GRACYBUS Protocol

The paper presents GRACYBUS (GRoup key Agreement on Cyber-phYsical system BUSes), a custom protocol designed to adapt TreeKEM for CPS buses.

Design Features

Tree Structure: Organizes members in a perfect binary tree. Each leaf represents a device. Non-leaf secrets are derived via hashing of child secrets.
Key Schedule: Uses an epoch-based key schedule. The group traffic key is derived via a Key Derivation Function (KDF) from the current root secret and the previous epoch key. Past keys are erased to ensure Forward Secrecy.
Operations:
- UPDATE: A member rotates its leaf secret, propagates hashed secrets up the path, and broadcasts updated public keys. Subtree secrets are encrypted to co-path public keys.
- JOIN: An authenticated handshake (using PKI signatures) between a joiner and a sponsor. The sponsor inserts the leaf, computes secrets, and distributes the new epoch key.
- LEAVE: Executed by another member. New secrets are set on the leaver's path and encrypted only to keys the leaver cannot decrypt. Unannounced leaves are detected via an update window.
Messaging: Messages are structured for broadcast. Secrets are encrypted with subtree public keys (allowing multiple recipients to decrypt a single broadcast), while public keys are shared as plaintext (integrity-protected). All state-changing messages are MAC-protected with the current epoch key.
Authenticity: Relies on a common trust anchor (Industrial PKI) for initial bootstrapping. Within the group, integrity is maintained via MACs derived from the epoch key.

Implementation Details

Storage: Requires $O(\log n)$ private keys and $O(n)$ public keys (for redundancy to handle unannounced leaves).
Complexity: Computational and message overhead scales logarithmically with the group size ( $O(\log_2 n)$ ).
Agility: All cryptographic interfaces (hash, KDF, MAC, signature, encryption) are algorithm-agnostic, facilitating future PQC adoption.

4. Results and Evaluation

The paper evaluates GRACYBUS against the 12 derived requirements:

Performance: The protocol achieves $O(\log_2 n)$ complexity for group operations, fitting within the resource constraints of devices like those on CAN buses. Storage requirements are lightweight for private keys, with a trade-off of $O(n)$ public key storage for robustness.
Security Guarantees:
- Authenticity & Integrity: Achieved via PKI signatures for joins and MACs for group updates.
- Forward Secrecy (FS) & Post-Compromise Security (PCS): Achieved through the epoch key schedule and the overwriting of path keys. If a node is compromised, the system "heals" after a successful update without the adversary's interference.
- Cryptographic Agility: The design allows for the replacement of cryptographic primitives to address future vulnerabilities or quantum threats.
Limitations: The protocol does not fully satisfy the requirement for robustness against a Dolev–Yao adversary who partitions the bus. If the adversary drops messages to split the network, different partitions may derive different key trees, compromising overall availability. However, the authors note this is an inherent limitation of any key agreement protocol under such an adversary model.

5. Significance and Claims

The paper claims that GRACYBUS demonstrates the feasibility of designing key-establishment mechanisms specifically tailored to bus-oriented CPS settings without weakening security guarantees.

Bridging the Gap: It successfully integrates contemporary security principles (FS, PCS, PQC readiness) into resource-restricted, multi-party systems where such features are traditionally difficult to realize.
Bus-Centric Approach: By removing the need for centralized services and adapting TreeKEM for broadcast/half-duplex constraints, the protocol offers a practical solution for industrial deployments with long lifecycles.
Future-Proofing: The protocol provides a foundation for protecting CPS communication via encryption and integrity protection, aligning with modern security standards while respecting the physical and operational constraints of fieldbuses.

The authors conclude that while the protocol is robust, future work is needed to address group merge/split operations (R12), optimize tree truncation to avoid linear complexity in worst-case scenarios, and explore parallelized operations to improve efficiency.