An RLWE-Based Privacy-Preserving Key Agreement Method for Offshore Wind Farms

Abstract

Offshore wind farms are representative unmanned energy systems whose operation relies heavily on remote information exchange between offshore substations and onshore centralized control centers. However, the cross-sea communication link is vulnerable to cyberattacks, including impersonation and message tampering, and these threats persist in the quantum computing era, potentially compromising operational decision-making and control. To address this problem, this paper proposes a privacy-preserving key agreement method based on the Ring Learning With Errors (RLWE) problem. First, identity privacy protection is integrated with post-quantum cryptography. An identity commitment function conceals the true identities of the communicating entities, while a pre-shared authentication factor and fresh random parameters enable mutual authentication and session key establishment. This design prevents identity disclosure and secures information exchange in offshore wind farms against quantum-capable adversaries. Second, confidentiality and unforgeability are formally established under the decisional and search RLWE assumptions. Finally, experiments validate the effectiveness of the proposed method. Compared with existing schemes, it reduces communication overhead by up to 43.75%, making it particularly suitable for resource-constrained offshore wind farm environments.

1. Introduction

With the global transition toward a low-carbon economy and China’s carbon-peaking and carbon neutrality goals, wind energy is developing rapidly as a clean and sustainable energy source [1]. Owing to their autonomous, intelligent, and remotely operated characteristics, unmanned systems have become essential to offshore energy development, data acquisition, and operation and maintenance; offshore wind farms are a representative application in which remote monitoring and centralized dispatch are implemented through such systems. Compared to onshore wind power, offshore wind power offers substantial advantages in resource availability and stability, annual utilization hours, and conditions for large-scale development, and has therefore become a major source of growth in the wind industry [2]. As offshore wind farms continue to expand in scale and adopt clustered deployment, centralized modeling, monitoring, and operational management have become increasingly important [3]. In practical deployments, turbine-side data are aggregated at the offshore substation and ultimately transmitted to the onshore centralized control center, which serves as a core node of the monitoring and management platform. The cross-sea link between the offshore substation and the onshore centralized control center is a critical channel for telemetry upload and control-command delivery [4]. Securing this link is therefore a central challenge in offshore wind farm communications and is essential to safe and stable system operation.

Compared with onshore wind farms, offshore wind farms face more challenging security requirements due to their geographically dispersed deployment and cross-sea communication characteristics [5]. Long-distance transmission between offshore substations and onshore control centers increases the exposure of communication links to potential cyber threats, while the limited accessibility of offshore facilities makes security maintenance more difficult [6]. Therefore, ensuring reliable identity authentication, data integrity, and secure key establishment is essential for protecting offshore wind farm communications.

Research on secure data transmission over cross-sea links in offshore wind farms is progressing from conventional engineering protection toward active defense. To establish a logical security boundary, researchers have increasingly introduced cryptographic mechanisms. Shang et al. [7] and Amiya et al. [8] designed lightweight authentication protocols for Internet of Things healthcare networks using elliptic-curve cryptography (ECC) and identity-based cryptography combined with hashing, respectively. Abbasinezhad-Mood et al. [9] proposed an anonymous self-certified key-distribution scheme for smart grids based on ECC. Zhang et al. [10] developed an ECC-based lightweight authentication protocol for unmanned aerial vehicles that provides backward security for session keys while improving protocol flexibility. To address the wireless communication security requirements of offshore wind power collection lines, Chen et al. [11] designed a secure encryption scheme suitable for relay protection services, thereby ensuring the confidentiality of data transmission for multi-terminal wireless differential protection in complex marine environments. Arjun et al. [12] proposed an ECC-based lightweight authentication scheme for resource-constrained devices in energy and power systems.

With rapid advances in quantum computing and quantum algorithms, authentication methods based on conventional cryptography may be efficiently compromised by quantum adversaries [13]. Post-quantum cryptography has therefore emerged as a means of resisting quantum attacks [14]. Schemes based on the Ring Learning With Errors (RLWE) problem [15] have become a major research focus in lattice-based cryptography because they combine strong security with high computational efficiency. Zhao et al. [16] enhanced core security properties by achieving forward security in an RLWE-based identity-based protocol. Shen et al. [17] designed an RLWE-based two-factor three-party authentication protocol. Ni et al. [18] proposed an anonymous authenticated key agreement protocol for smart healthcare. Hong et al. [19] presented a parameter analysis method for an RLWE-based group key exchange protocol. Although recent studies have strengthened the core security properties of RLWE protocols and extended them to selected critical infrastructures, existing schemes have paid limited attention to the privacy and security requirements of offshore wind farms. Moreover, they generally lack comprehensive formal security arguments covering key operational threats such as tampering, man-in-the-middle attacks, and impersonation [8,9,11,12,19].

The key security challenge in offshore wind farms is to protect long-distance, geographically distributed, and remotely operated communication between offshore substations and onshore centralized control centers, which places stringent requirements on identity authentication, message integrity, secure key establishment, and communication efficiency. RLWE is not inherently specific to offshore communication; rather, its suitability in this work arises from its post-quantum security foundation and efficient polynomial-ring arithmetic [20]. These characteristics enable the proposed method to support mutual authentication and secure key establishment while satisfying the security and efficiency requirements of offshore wind farm communication systems. Compared with MLWE, which relies on module-based vector and matrix operations [21], RLWE enables a simpler single-ring construction. Therefore, RLWE is adopted to support a lightweight key agreement design in this work.

To address these limitations, this paper proposes an RLWE-based privacy-preserving key agreement method for offshore wind farms. Its main contributions are as follows: (1) an RLWE-based identity privacy and secure-authentication mechanism is designed to ensure the integrity and trustworthiness of cross-sea information transmission between the offshore substation and the onshore centralized control center in a quantum computing environment; and (2) the confidentiality and unforgeability of the proposed method are established under the hardness assumptions of RLWE, thereby providing a theoretical security foundation.

The remainder of this paper is organized as follows. Section 2 introduces the relevant preliminaries. Section 3 analyzes the vulnerabilities and security requirements of the cross-sea communication link in offshore wind farms. Section 4 presents the RLWE-based mutual-authentication key agreement method. Section 5 provides a theoretical security analysis. Section 6 reports the experimental evaluation. Finally, Section 7 concludes the paper and outlines directions for future work. The parameters used throughout the paper are summarized in Table 1.

Table 1. Notation, system parameters, and variable visibility.

Parameter	Description	Visibility
q	Modulus of the RLWE problem	Public
n	Lattice dimension; n is a power of 2	Public
${\psi }_a$	Discrete Gaussian distribution over the ring	Public
$x\leftarrow {\psi }_a$	Random sampling from distribution ${\psi }_a$	–
$R_q$	Polynomial ring	Public
g	Public parameter shared by the two communicating devices	Public
G	Group of order q	Public
N	Generator of group G	Public
$SI{D}_{\mathrm{KGC}}$	Identity of the key generation center	Public identifier
$SI{D}_O,SI{D}_L$	Identity of an entity device	Protected during authentication
$\zeta$	Pre-shared authentication factor between $SI{D}_O$ and $SI{D}_L$	Private
$(p{k}_L,s{k}_L)$	Public and private keys of device $SI{D}_L$	Public/Private
$H(·)$	One-way hash function	Public
$\mathrm{com}(·)$	Commitment function	Public
$a,s,e$	Public polynomial, master secret, and error polynomial	Public/Private/Private
$(p{k}_O,s{k}_O)$	Public and private keys of device $SI{D}_O$	Public/Private
$P,Q$	Ephemeral session public values	Public
$K_{\mathrm{sess}}^O,K_{\mathrm{sess}}^L$	Session keys of $SI{D}_O$ and $SI{D}_L$	Private
$r_O$	Private random polynomial generated by $SI{D}_O$	Private to $SI{D}_O$
$e_O$	Error polynomial generated by $SI{D}_O$	Private to $SI{D}_O$
$R_O$	Blinded public value	Public
$y_O$	Random polynomial generated by KGC	Private to KGC
$e_{y_O}$	Error polynomial generated by KGC	Private to KGC
$Y_O$	Public value generated by KGC	Public
$d_O$	Partial private key of $SI{D}_O$	Private to KGC and $SI{D}_O$

2. Preliminaries

2.1. Lattices and Related Hard Problems

A lattice is a discrete additive subgroup generated by linearly independent vectors in a real vector space. Let $b_1,b_2,\dots ,b_n\in {\mathbb{R}}^m$ (where m is the dimension of the real vector space ${\mathbb{R}}^m$) denote n linearly independent vectors, and let the basis matrix be $B=[b_1,b_2,\dots ,b_n]\in {\mathbb{R}}^{m\times n}$ [22]. The lattice generated by B is defined as

$$L\left(B\right)=\left\{{\displaystyle \sum _{i=1}^n}{x}_i{b}_i|x_i\in \mathbb{Z},i=1,2,\dots ,n\right\}.$$

(1)

where $[b_1,b_2,\dots ,b_n]$ is a basis of lattice $L\left(B\right)$. Every element of the lattice can be expressed as an integer linear combination of these basis vectors.

2.2. System Entities and Roles

The proposed RLWE-based privacy-preserving key agreement method involves three main entities: the key generation center (KGC), the offshore substation SDH device $SI{D}_O$, and the onshore centralized control center SDH device $SI{D}_L$. The KGC is responsible for system initialization and long-term key generation. The offshore substation SDH device $SI{D}_O$ and the onshore centralized control center SDH device $SI{D}_L$ are the two communicating entities responsible for mutual authentication and session key establishment.

In the identity commitment mechanism, the committer and verifier are functional roles assumed by the two communicating entities rather than additional system entities. Depending on the direction of authentication, $SI{D}_O$ and $SI{D}_L$ may act as the committer or the verifier, respectively. The KGC is responsible for key-related initialization and does not serve as a committer or verifier in the identity commitment process.

2.3. Class-C Commitment Scheme

Let G be a cyclic group of order q, where q is prime and N is a generator of group G. For any element $a\in {\mathbb{Z}}_q=\{0,1,2,\dots ,q-1\}$ in the message space, define the Class-C commitment function as $\mathrm{com}\left(a\right)=N^a$. The scheme comprises a commitment phase and a verification phase. During commitment, the committer applies the scheme to the message a to be concealed, computes commitment $\mathrm{com}\left(a\right)$, and sends it to the verifier. During verification, the committer reveals message a, and the verifier checks whether the received commitment satisfies $\mathrm{com}\left(a\right)=N^a$. Verification succeeds if the equality holds; otherwise, it fails.

2.4. Sig and Extr Functions

To enable the communicating parties to recover identical shared bits in the presence of small errors, we introduce the signal function $Sig(·)$ and the extraction function $Extr(·)$. Let q be a prime greater than 2. Define

$$Z_q=\{-2q-1,\dots ,2q-1\}.$$

(2)

$$E=\{-4q,\dots ,4q\}.$$

(3)

Definition 1 

(Sig function [23]). The signal function, $Sig\left(x\right)$, is defined as

$$\mathrm{Sig}\left(x\right)=\left\{\begin{array}{cc}0,\hfill & x\in E,\hfill \\ 1,\hfill & x\notin E.\hfill \end{array}\right.$$

(4)

This function generates auxiliary bit information according to the interval containing input x.

Definition 2 

(Extr function). When q is an odd integer greater than 8, the extraction function $Extr(x,\delta )$ is defined as

$$\left\{\begin{array}{c}Extr(x,\delta )=(x+\delta \frac{q-1}{2}\mathrm{mod}q)\mathrm{mod}2,\hfill \\ \delta =Sig\left(x\right).\hfill \end{array}\right.$$

(5)

where δ is the auxiliary bit output by $\mathrm{Sig}\left(x\right)$. The function extracts shared binary information from elements in the space modulo q. For any $x,y\in Z_q$ satisfying $x-y=2\epsilon$, $\left|2\epsilon \right|\le 4q-2$, where ε is the small error term in the computed difference, the $Sig$ and $Extr$ functions extract the same bit value from x and y. Thus, the two communicating parties can recover identical shared information in the presence of bounded errors.

3. Problem Formulation

An offshore wind farm is a representative sea-land collaborative operating system [24]. Its communication network encompasses turbine-side data acquisition, service aggregation at the offshore substation, and monitoring and dispatch at the onshore centralized control center. The long communication span, geographically dispersed nodes, and prolonged operation in open or semi-open environments expose the system to cyber threats such as message tampering, man-in-the-middle attacks, and identity impersonation [25]. Figure 1 illustrates a typical offshore wind farm. Turbine-side measurements, including blade pitch angle, real-time wind speed, and rotor speed, are aggregated through tower-base switches and the internal aggregation switch of the offshore substation. The data are then transmitted through the submarine cable fiber link from the synchronous digital hierarchy (SDH) equipment at the offshore substation to the SDH equipment at the onshore centralized control center [3], after which they enter the onshore core data-switching network. In general, an offshore wind farm has one offshore substation and one onshore centralized control center. The offshore substation monitoring system is incorporated as a subsystem of the computerized monitoring system at the onshore center. The two sites exchange information over the transmission link network using TCP/IP. This link carries both telemetry uploads and remote control commands; it is therefore the core channel for sea–land information exchange and the most critical security boundary of the offshore wind farm.

Figure 1. Offshore wind farm communication architecture. This figure illustrates the turbine-side data acquisition, data aggregation at the offshore substation, cross-sea transmission to the onshore centralized control center, and potential attack links.

Although the physical layer of this link relies on SDH equipment and fiber-optic channels, the underlying TCP/IP suite prioritizes open interconnection and transmission efficiency and does not provide intrinsic protection tailored to critical infrastructure. Its limitations are twofold. First, the protocol layer cannot directly authenticate communication entities in the offshore wind farm, allowing an adversary to impersonate a legitimate node through session or address spoofing. Second, the protocol itself provides no end-to-end integrity protection for operational messages, which may therefore be intercepted, tampered with [26], or injected during cross-sea transmission. We consider a network-level adversary who does not require direct physical access to the submarine fiber-optic link. By compromising an intermediate network node, communication interface, or legitimate endpoint, the adversary may gain logical access to the communication process and subsequently modify, inject, or replay protocol messages, or impersonate a legitimate communicating entity. Such capabilities may enable message tampering, identity impersonation, and man-in-the-middle attacks during authentication and key establishment.

These limitations directly affect the security of information transmitted between the offshore substation and the onshore centralized control center. If an adversary attacks this link, the information received by the onshore center may no longer reflect the true operating state of offshore equipment, thereby compromising state assessment, monitoring analysis, and dispatch decisions. Conventional TCP/IP transmission mechanisms cannot satisfy the secure communication requirements of this critical offshore wind power link. A key agreement method supporting mutual authentication is therefore urgently needed for offshore wind farm environments.

4. Proposed Method

The proposed RLWE-based privacy-preserving key agreement method involves three types of entities: a key generation center (KGC), with identity $SI{D}_{\mathrm{KGC}}$; an SDH device at the offshore substation, with identity $SI{D}_O$; and an SDH device at the onshore centralized control center, with identity $SI{D}_L$. The method comprises system initialization, long-term key generation, and session key agreement, as described below.

4.1. System Initialization

The system first initializes the public parameters required for the offshore wind farm communication environment.The key generation center $SI{D}_{\mathrm{KGC}}$ first generates the system root key $KGC$. It uniformly samples a public polynomial $a\in R_q$ and independently samples the master secret polynomial $s\leftarrow {\psi }_{\alpha }$ and the error polynomial $e\leftarrow {\psi }_{\alpha }$ over $R_q$, where $R_q={\mathbb{Z}}_q\left[X\right]/(X^n+1)$. The coefficients of a, s, and e are defined modulo q. The system master public key is then computed as

$$p{k}_{\mathrm{KGC}}=a·s+e\left(\mathrm{mod}q\right).$$

(6)

It then distributes the system parameters

$$params=\{R_q,a,p{k}_{\mathrm{KCG}},H\}$$

(7)

Here, $R_q$ denotes the polynomial ring, a is the public polynomial, $p{k}_{\mathrm{KGC}}$ is the system master public key, and H denotes the one-way hash function, whose detailed definition is given in Equation (9). These system parameters are distributed to all entities. Additional parameters are generated according to the security requirements: n is the lattice dimension and a power of 2; q is a prime satisfying $q\mathrm{mod}2n=1$, The modulus q is selected as a prime of the form $q=2nt+1$, where t is a positive integer. This construction directly ensures $q\equiv 1\left(\mathrm{mod}2n\right)$. and G is a group of order q. The prime q satisfies the stated constraint. Moreover,

$$R_q={\mathbb{Z}}_q\left[X\right]/(X^n+1)$$

(8)

is a polynomial ring with modulus q, and ${\psi }_a$ is a discrete Gaussian distribution defined over $R_q$, with standard deviation $\alpha$ [27]. Parameter g is shared by the offshore substation and the onshore centralized control center.

Parameter g is shared by the offshore substation and the onshore centralized control center.

The pre-shared authentication factor $\zeta$ is securely provisioned to $SI{D}_O$ and $SI{D}_L$ during system initialization or device registration through a protected management channel. During long-term operation, $\zeta$ can be periodically refreshed according to the security policy. If compromise or suspected leakage is detected, the current factor is revoked and replaced with a newly generated value before authentication is resumed. The parties then select a hash function

$$H:{\{0,1\}}^{\ast }\to {\{0,1\}}^k.$$

(9)

SHA-256 is used in this work and outputs a 256-bit message digest. To protect the identities of both parties, the commitment function $\mathrm{com}$ is defined as

$$\mathrm{com}\left(SID\right)=N^{H\left(SID\right)}.$$

(10)

4.2. Long-Term Key Generation

This phase describes how $SI{D}_{\mathrm{KGC}}$ interacts with $KCG$, $SI{D}_O$, and $SI{D}_L$ to generate and distribute the long-term identity-based public/private key pairs of the entities. The key generation procedure for $SI{D}_O$ is used as an example. To avoid placing full control of the private key with $KCG$, the key is generated in the following three steps.

Step 1: $SI{D}_O$ randomly selects $r_O$ and $e_O$ and computes the blinded public key

$$R_O=a·r_O+e_O\left(\mathrm{mod}q\right).$$

(11)

It then sends $\{SI{D}_O,R_O\}$ to $KCG$.

Step 2: $KCG$ receives the request. Sample $y_O$ and $e_{y_O}$. Compute the public value

$$Y_O=a·y_O+e_{y_O}\left(\mathrm{mod}q\right).$$

(12)

With the master secret key s, obtain the partial private key

$$d_O=y_O+s·H_1(SI{D}_O,R_O,Y_O)\left(\mathrm{mod}q\right).$$

(13)

Step 3: Entity $SI{D}_O$ combines the value received from $KCG$, namely $d_O$, with its locally retained value $r_O$. Its final long-term private key is $s{k}_O=(r_O,d_O)$, and its long-term public key is $p{k}_O=(R_O,Y_O)$.

Entity $SI{D}_L$ analogously obtains the long-term private key $s{k}_L=(r_L,d_L)$ and public key $p{k}_L=(R_L,Y_L)$. For clarity, the main variables involved in the long-term key generation phase, together with their meanings and visibility, are summarized in Table 1.

4.3. Key Agreement

The key agreement procedure between the offshore substation SDH device $SI{D}_O$ and the onshore centralized control center SDH device $SI{D}_L$ is shown in Figure 2 and proceeds as follows.

Figure 2. Detailed key agreement procedure.

4.3.1. Offshore-Side Authentication Request

Before initiating an authentication request, $SI{D}_O$ conceals its identity by applying an identity commitment to identifier $SI{D}_O$, thereby obtaining commitment $C_O=\mathrm{com}\left(SI{D}_O\right)$. Entity $SI{D}_O$ then randomly selects $s_1\in \{1,2,\dots ,q\}$ and constructs the identity-hiding parameter $v_1=s_1+H\left(SI{D}_O\right)$. From the discrete Gaussian distribution ${\psi }_a$, it samples parameter $m_O,\theta ,\eta$, and uses $m_O,\theta$ to compute the offshore-side ephemeral session public key $P=g\theta +2m_O$. The commitment $C_O$, pre-shared authentication factor $\zeta$, and nonce $\eta$ are jointly hashed to obtain the offshore-side authentication digest $H_a=H(P\parallel C_O\parallel \zeta \parallel \eta )$. Entity $SI{D}_O$ then packs the authentication data into plaintext $m=H_a\parallel s_1\parallel \eta$, encodes it as polynomial $\mu =\mathrm{Encode}\left(m\right)\in R_q$, and encrypts it using the long-term public key of $SI{D}_L$, namely $p{k}_L=(R_L,Y_L)$. It randomly samples $r,e_1,e_2\leftarrow {\psi }_a$ and performs the computations $c_1=R_{L}r+e_1\left(\mathrm{mod}q\right)$, $c_2=Y_{L}r+e_2+\mu \left(\mathrm{mod}q\right)$, then sets the identity authentication ciphertext to $Aut{h}_O=(c_1,c_2)$. Finally, it constructs the first-round authentication request $H\left(SI{D}_O\right)\parallel P\parallel Aut{h}_O\parallel v_1$ and sends it to $SI{D}_L$.

4.3.2. Onshore-Side Authentication and Response

Entity $SI{D}_L$ receives the first-round authentication request sent by $SI{D}_O$ and first checks the integrity of the identity-related information.

(1) Entity $SI{D}_L$ uses the received $v_1$ and $H\left(SI{D}_O\right)$ to recover $s_1=v_1-H\left(SI{D}_O\right)$ and computes $C_O=\mathrm{com}\left(SI{D}_O\right)$. It then verifies whether $N^{v_1}=N^{s_1}{C}_O$ holds. If the equality holds, the offshore-side identity information has not been altered in transit and the message passes the integrity check. Otherwise, the request may have been tampered with or forged, and $SI{D}_L$ immediately terminates the protocol.

(2) After the first-round request passes the integrity check, $SI{D}_L$ uses its private key $s{k}_L$ to decrypt $Aut{h}_O$, thereby recovering the offshore-side authentication digest $H_a=H(P\parallel C_O\parallel \zeta \parallel \eta )$, $s_1$, and $\eta$. Entity $SI{D}_L$ then uses the received offshore-side ephemeral public key P, identity commitment $C_O$, pre-shared authentication factor $\zeta$, and nonce $\eta$ to reconstruct the local authentication digest $H_a^{\prime }=H(P\parallel C_O\parallel \zeta \parallel \eta )$. If $H_a^{\prime }=H_a$ holds, $SI{D}_L$ possesses the correct pre-shared authentication factor $\zeta$ in the current session, and its transmitted identity commitment, session nonce, and ephemeral public key are mutually consistent; thus, the identity of $SI{D}_O$ is authenticated. Otherwise, the received authentication data do not match the local computation, and $SI{D}_L$ terminates the protocol. Upon successful authentication, $SI{D}_L$ samples from the discrete Gaussian distribution ${\psi }_a$ to obtain parameter $m_L,\lambda ,z_L$, and computes the onshore-side ephemeral session public key $Q=g\lambda +2m_L$ and the key agreement intermediate $T_L=P\lambda +2z_L$. Functions $Sig$ and $Extr$ are then used to compute $w=Sig\left(T_L\right)$ and $k_L=Extr(T_L,w)$, respectively.

(3) The identity of $SI{D}_L$ is mapped by the commitment function to the onshore-side identity commitment $C_L=\mathrm{com}\left(SI{D}_L\right)$. A fresh value $s_2\in \{1,2,\dots ,q\}$ is sampled to construct the identity-hiding parameter $v_2=s_2+H\left(SI{D}_L\right)$. Based on the onshore-side ephemeral public key Q, identity commitment $C_L$, pre-shared authentication factor $\zeta$, reconciliation hint w, and nonce $\eta$, entity $SI{D}_L$ computes the authentication value $Aut{h}_L=H(Q\parallel C_L\parallel \zeta \parallel w\parallel \eta +1)$. It then constructs the second-round response $H\left(SI{D}_L\right)\parallel Q\parallel Aut{h}_L\parallel v_2\parallel w$ and sends it to $SI{D}_O$. Meanwhile, it derives the shared session key $K_{\mathrm{sess}}^L=H(C_O\parallel C_L\parallel P\parallel Q\parallel w\parallel \eta \parallel k_L)$ from its local extraction result.

4.3.3. Offshore-Side Verification and Key Establishment

After $SI{D}_O$ receives the second-round response returned by $SI{D}_L$, it performs the following operations.

(1) Entity $SI{D}_O$ uses the received $v_2$ and $H\left(SI{D}_L\right)$ to recover the integrity nonce $s_2=v_2-H\left(SI{D}_L\right)$ and computes $C_L=\mathrm{com}\left(SI{D}_L\right)$. It then verifies whether $N^{v_2}=N^{s_2}{C}_L$ holds. If it does, the onshore-side identity information has not been altered in transit and the response passes the integrity check. Otherwise, verification fails and $SI{D}_O$ immediately aborts the protocol.

(2) After the integrity check succeeds, $SI{D}_O$ uses the received onshore-side session value $Q\parallel C_L\parallel \zeta$ and substitutes $\eta +1$ into the computation to reconstruct authentication value $Aut{h}_L^{\prime }=H(Q\parallel C_L\parallel \zeta \parallel w\parallel \eta +1)$. If $Aut{h}_L^{\prime }=Aut{h}_L$ holds, the onshore-side entity is authenticated; otherwise, $SI{D}_O$ aborts the protocol. Following successful authentication, $SI{D}_O$ enters the local key-recovery phase. From distribution ${\psi }_a$, it samples parameter $z_O$ and combines its ephemeral private parameter $\theta$ with the received onshore-side ephemeral public key Q to compute the offshore-side key agreement intermediate $T_O=Q\theta +2z_O$. Function $Extr$ then yields $k_O=Extr(T_O,w)$. The shared session key $K_{\mathrm{sess}}^O=H(C_O\parallel C_L\parallel P\parallel Q\parallel w\parallel \eta \parallel k_O)$ is computed from the local extraction result. By the key-reconciliation mechanism, the parties’ extraction results satisfy $k_O=k_L$, namely, $K_{\mathrm{sess}}^O=K_{\mathrm{sess}}^L$. Consequently, $SI{D}_O$ and $SI{D}_L$ achieve mutual authentication and establish a common session key without revealing their device identities.

Remark 1. 

Representative studies have demonstrated that post-quantum security mechanisms can be integrated into existing industrial communication systems through protocol security layers, security proxies, or plug-and-play security modules [28,29,30]. Following these deployment patterns, the proposed method does not alter the existing communication architecture or industrial communication protocols of offshore wind farms. Instead, the RLWE-based mutual authentication and key agreement procedure is introduced before operational data transmission over the existing TCP/IP link. After successful authentication and session key establishment, the established key can be used to protect the subsequent data transmission, while the original communication protocol and application-layer message format remain unchanged.

5. Security Analysis

5.1. Security Model

The security model considers the same three entities introduced in Section 2.1: the key generation center (KGC), the offshore substation SDH device $SI{D}_O$, and the onshore centralized control center SDH device $SI{D}_L$.

With appropriate security parameters, a malicious adversary cannot solve the search RLWE or decisional RLWE problem in polynomial time. The security of the proposed method is therefore founded on the hardness of RLWE. The relevant definitions are given below.

Definition 3 

(Search RLWE problem). Let $R_q={\mathbb{Z}}_q\left[x\right]/(x^n+1)$, where n is a power of 2 and modulus q satisfies $q\equiv 1\left(\mathrm{mod}2n\right)$. Given secret polynomial $s\in R_q$, choose $a\in R_q$ uniformly at random, and, from error distribution ${\psi }_a$, sample $e\in R_q$. The resulting sample pair $(a,b=as+e(\mathrm{mod}q\left)\right)$ follows the RLWE distribution, denoted by $A_{s,\chi }$. Given multiple independent samples $(a,b)\in R_q\times R_q$ drawn from RLWE distribution $A_{s,\chi }$, the search problem is to recover the corresponding secret polynomial s. If no probabilistic polynomial-time algorithm can recover s with non-negligible probability, the search RLWE problem is said to be hard.

Definition 4 

(Decisional RLWE problem). Under the conditions above, given multiple independent samples $(a,b)\in R_q\times R_q$, determine whether they were drawn from the RLWE distribution $A_{s,\chi }$ or from the uniform distribution over $(a,b)\in R_q\times R_q$. If no probabilistic polynomial-time algorithm can distinguish the two distributions with non-negligible advantage, the decisional RLWE problem is said to be hard.

5.2. Security Proofs

5.2.1. Adversary Models

The proposed method considers the following two types of potential adversaries.

• Type-${\mathcal{A}}_I$ Adversary. This adversary does not know the system master key $pk=(a,b)$ but can replace the public key of any legitimate device and obtain ephemeral keys from the public channel.
• Type-${\mathcal{A}}_{II}$ Adversary. This adversary knows the system master key but cannot replace the public key of a legitimate device.

5.2.2. Security Properties

• Confidentiality.

Theorem 1. 

Given parameters $(n,q,{\psi }_a)$, the proposed authentication method is indistinguishable under chosen plaintext attack under the decisional ${\mathrm{RLWE}}_{n,q,{\psi }_a}$ assumption.

Proof. 

Consider the given parameters $(n,q,{\psi }_a)$ and $bg\in \{0,1\}$. If $bg=0$, then a value is drawn uniformly from ${\left(R_q\right)}^2$ to obtain $(a,b)$. If $bg=1$, uniformly sample $s\leftarrow {\psi }_a$, $a\leftarrow R_q$, and $e\leftarrow {\psi }_a$, and compute $b=as+e$. Thus, given $(n,q,{\psi }_a)$ and $(a,b)$, solving the decisional RLWE instance amounts to guessing $bg$. □

Assume that, in the proposed authentication method, the indistinguishability of $Aut{h}_O=EN(m,pk)$ can be broken with non-negligible advantage ${ϵ}_I$ by a polynomial-time adversary ${\mathcal{A}}_I$. Then challenger ${\mathcal{S}}_I$ can solve the decisional RLWE problem with non-negligible advantage, using ${\mathcal{A}}_I$ as a subroutine of ${\mathcal{S}}_I$ and answering its queries ${\mathcal{S}}_I$.

Finally, ${\mathcal{A}}_I$ receives $ct$ and outputs $b{g}^{\prime }\in \{0,1\}$ as its guess for $b{g}^{\ast }$. If $b{g}^{\prime }=b{g}^{\ast }$, then ${\mathcal{S}}_I$ guesses $bg=1$. Clearly, when $bg=1$, $ct$ is a valid ciphertext, and the probability that adversary ${\mathcal{A}}_I$ correctly guesses $b{g}^{\ast }$ is ${\displaystyle \frac{2{\mathsf{\ell }}_I+1}{2}}$. Therefore,

$$\mathrm{Pr}[{\mathcal{S}}_I\mathrm{success}\mid bg=1]={\displaystyle \frac{2{\mathsf{\ell }}_I+1}{2}},$$

(14)

where ${\mathsf{\ell }}_I$ is a non-negligible advantage. When $bg=0$, because ${\left(R_q\right)}^2$ is sampled uniformly, $ct$ is independent of $b{g}^{\ast }$, and hence

$$\mathrm{Pr}[{\mathcal{S}}_I\mathrm{success}\mid bg=0]={\displaystyle \frac{1}{2}}.$$

(15)

Combining the two cases yields

$$\begin{array}{cc}\hfill \mathrm{Pr}\left[{\mathcal{S}}_I\mathrm{success}\right]& ={\displaystyle \frac{1}{2}}\ast {\displaystyle \frac{1}{2}}+{\displaystyle \frac{1}{2}}\ast \left({\displaystyle \frac{1}{2}}+{\mathsf{\ell }}_I\right)\hfill \\ & ={\displaystyle \frac{1}{2}}+{\displaystyle \frac{{\mathsf{\ell }}_I}{2}}.\hfill \end{array}$$

(16)

This result contradicts the decisional RLWE assumption. Therefore, by contradiction, the proposed authentication method is indistinguishable under chosen plaintext attack.

• Unforgeability.

Theorem 2. 

Given parameters $(n,q,{\psi }_a)$, if a malicious adversary ${\mathcal{A}}_{II}$ can break the proposed authentication algorithm with non-negligible advantage ${\mathsf{\ell }}_{II}$, then a probabilistic polynomial-time challenger ${\mathcal{S}}_{II}$ can solve the search RLWE problem with non-negligible advantage $\left({\displaystyle \frac{Q_s(Q_s-1)}{Q_h(Q_h-1)}}\right){\mathsf{\ell }}_{II}$.

Proof. 

Challenger ${\mathcal{S}}_{II}$ generates the system parameters $(n,q,{\psi }_a)$ according to the proposed algorithm. Assume that adversary ${\mathcal{A}}_{II}$, in a fresh session, can distinguish the session key from a random value with non-negligible advantage. The session key is computed as

$$K_{\mathrm{sess}}^L=H(C_O\parallel C_L\parallel P\parallel Q\parallel w\parallel \eta \parallel k_L),$$

(17)

where $k_L=\mathrm{Extr}(T_L,w)$. If ${\mathcal{A}}_{II}$ can correctly compute $k_L$, this is equivalent to solving the RLWE problem for the given parameters $(n,q,{\psi }_a)$. □

Suppose ${\mathcal{S}}_{II}$ simulates $Q_h$ protocol sessions in total, among which $Q_s$ are matching sessions $(Q_s\le Q_h)$. The probability that a successful forgery by adversary ${\mathcal{A}}_{II}$ occurs precisely in a matching session is

$$P_r={\displaystyle \frac{\left(\genfrac{}{}{0pt}{}{Q_s}{2}\right)}{\left(\genfrac{}{}{0pt}{}{Q_h}{2}\right)}}={\displaystyle \frac{Q_s(Q_s-1)}{Q_h(Q_h-1)}}.$$

(18)

If the forgery advantage of adversary ${\mathcal{A}}_{II}$ in an arbitrary session is ${\mathsf{\ell }}_{II}$, then its advantage in a matching session is at least $P_r·{\mathsf{\ell }}_{II}$. A successful forgery in a matching session implies that ${\mathcal{A}}_{II}$ has correctly computed $k_L$; consequently, ${\mathcal{S}}_{II}$ can recover the solution to the search RLWE instance from $k_L$. Therefore, the probability that ${\mathcal{S}}_{II}$ solves the search RLWE problem is

$${\mathrm{Adv}}_{\mathrm{RLWE}}\ge {\displaystyle \frac{Q_s(Q_s-1)}{Q_h(Q_h-1)}}{\mathsf{\ell }}_{II}.$$

(19)

Lattice-based cryptography theory indicates that the search RLWE problem remains hard against quantum computation; no probabilistic polynomial-time algorithm is known to solve it with non-negligible advantage. By contradiction, no polynomial-time adversary ${\mathcal{A}}_{II}$ can forge a valid authentication value with non-negligible advantage. Hence, the proposed method is unforgeable.

6. Experimental Results and Analysis

The experimental evaluation emulates the three protocol entities in the offshore wind farm communication environment, namely $SI{D}_{KGC}$, $SI{D}_O$, and $SI{D}_L$. The experiments focus on evaluating the computational and communication overhead of the proposed key agreement protocol rather than simulating the physical operation of the offshore wind farm. To provide adequate computing resources and eliminate interference caused by hardware differences, the experiments were conducted on a computer equipped with an Intel Core i7-12650H CPU, 16 GB of RAM, and a 64-bit Windows 10 operating system. The algorithmic logic and communication procedure were implemented in Java. The performance of the proposed privacy-preserving key agreement method is evaluated quantitatively below in terms of computational and communication overhead.

6.1. Computational Overhead

Computational overhead analysis considers the costs of hashing, polynomial scalar multiplication, polynomial multiplication, polynomial addition, and exponentiation, denoted by $T_h$, $T_{sm}$, $T_{pm}$, $T_{pa}$, and $T_e$, respectively; the negligible cost of integer addition and subtraction is ignored. The execution costs of $SI{D}_O$ and $SI{D}_L$ are analyzed theoretically. The offshore side incurs a cost of $5T_h+2T_{sm}+4T_{pm}+5T_{pa}+2T_e$, the onshore side incurs a cost of $5T_h+2T_{sm}+3T_{pm}+3T_{pa}+2T_e$, and the total cost is $10T_h+4T_{sm}+7T_{pm}+8T_{pa}+4T_e$. For comparison, the theoretical computational costs of the schemes in [16,17,18] are $8T_h+10T_{pm}+8T_{pa}$, $20T_h+2T_{sm}+4T_{pm}+2T_{pa}$, and $12T_h+6T_{sm}+8T_{pm}+6T_{pa}$, respectively.

Implementation-based benchmark experiments were conducted to measure the execution time of the five basic cryptographic operations involved in the protocol, namely hashing, polynomial scalar multiplication, polynomial multiplication, polynomial addition, and exponentiation, as reported in Table 2. Based on these measured operation times and the corresponding operation counts required by each scheme, the overall computational overhead was calculated. Specifically, the total execution time is given by $T_{\mathrm{total}}=n_h{T}_h+n_{sm}{T}_{sm}+n_{pm}{T}_{pm}+n_{pa}{T}_{pa}+n_e{T}_e$, where $n_h$, $n_{sm}$, $n_{pm}$, $n_{pa}$, and $n_e$ denote the numbers of hashing, polynomial scalar multiplication, polynomial multiplication, polynomial addition, and exponentiation operations, respectively.

Table 2. Execution time of cryptographic operations.

Operation	Execution Time (μs)
$T_h$	427.46
$T_{sm}$	36.26
$T_{pm}$	203.04
$T_{pa}$	26.08
$T_e$	30.78

According to Table 2, the computational cost of the proposed method is $6.17268$ ms, whereas the costs of the schemes in [16,17,18] are $7.1279$ ms, $9.4860$ ms, and $5.65872$ ms, respectively, as summarized in Table 3. Compared with [16] and [17], the proposed method reduces the computational cost by approximately $13.40\%$ and $34.93\%$, respectively. Although the proposed method incurs approximately $9.08\%$ higher computational cost than [18], this moderate increase is acceptable considering its enhanced post-quantum security and functional completeness. Moreover, the proposed method requires only 10 hash operations, compared with 12 in [16] and 20 in [17], achieving a better balance between computational efficiency and security.

Table 3. Comparison of computational overhead.

Scheme	Computational Cost	Total Time (ms)
[16]	$12T_h+6T_{sm}+8T_{pm}+6T_{pa}$	7.13
[17]	$20T_h+2T_{sm}+4T_{pm}+2T_{pa}$	9.49
[18]	$8T_h+10T_{pm}+8T_{pa}$	5.66
Proposed method	$10T_h+4T_{sm}+7T_{pm}+8T_{pa}+4T_e$	6.17

6.2. Communication Overhead

In addition to computational overhead, the communication overhead of the proposed method is evaluated quantitatively and compared with the schemes in [16,17,18]. For a fair comparison, only the payload introduced by the security mechanisms is counted; the fixed headers of TCP/IP and the SDH bearer layer, such as IP/TCP headers, Ethernet headers, and SDH mapping overhead, are excluded. To establish a common metric, let ${\mathsf{\ell }}_{ID}$ denote the identity length (${\mathsf{\ell }}_{ID}=128$ bits); ${\mathsf{\ell }}_q$ denote the length of an element modulo q, where the bit length of the modulus q is set to ${\mathsf{\ell }}_q=256$ bits (${\mathsf{\ell }}_q=256$ bits); ${\mathsf{\ell }}_R$ denote the ring-output length, where n is set to 1024 (${\mathsf{\ell }}_R=1024$ bits); ${\mathsf{\ell }}_h$ denote the hash-output length, which is 256 bits (${\mathsf{\ell }}_h=256$ bits) for SHA-256; and ${\mathsf{\ell }}_{\omega }$ denote the auxiliary-parameter length (${\mathsf{\ell }}_{\omega }=1024$ bits). The total communication overhead is the sum of the bit lengths of all transmitted messages across all rounds, namely, $C_i={\sum }_{i=1}^r{C}_i$, where r is the number of protocol rounds and $C_i$ is the sum of the field lengths in the message sent during round i. The scheme in [16] uses three rounds and incurs total overhead $C_{total}=2{\mathsf{\ell }}_{ID}+2{\mathsf{\ell }}_R+3{\mathsf{\ell }}_{\omega }+3{\mathsf{\ell }}_h$; the scheme in [17] uses four rounds and incurs $C_{total}=4{\mathsf{\ell }}_{ID}+4{\mathsf{\ell }}_R+3{\mathsf{\ell }}_{\omega }+6{\mathsf{\ell }}_h$; and the scheme in [18] uses two rounds and incurs $C_{total}=3{\mathsf{\ell }}_h+2{\mathsf{\ell }}_R+2{\mathsf{\ell }}_{\omega }$. The proposed protocol uses two rounds: the first-round request from the offshore side incurs $C_1=2{\mathsf{\ell }}_h+2{\mathsf{\ell }}_q+{\mathsf{\ell }}_R$, and the second-round response from the onshore side incurs $C_2=2{\mathsf{\ell }}_h+{\mathsf{\ell }}_R+{\mathsf{\ell }}_q+{\mathsf{\ell }}_{\omega }$, yielding a total communication overhead of $C_{total}=4{\mathsf{\ell }}_h+2{\mathsf{\ell }}_R+2{\mathsf{\ell }}_q+{\mathsf{\ell }}_{\omega }$. Table 4 compares the resulting communication payloads in bits.

Table 4. Communication overhead.

Scheme	Number of Rounds	Communication Overhead (Bits)
[16]	3 rounds	$2{\mathsf{\ell }}_{ID}+2{\mathsf{\ell }}_R+3{\mathsf{\ell }}_{\omega }+3{\mathsf{\ell }}_h=6144$
[17]	4 rounds	$4{\mathsf{\ell }}_{ID}+4{\mathsf{\ell }}_R+3{\mathsf{\ell }}_{\omega }+6{\mathsf{\ell }}_h=8192$
[18]	2 rounds	$3{\mathsf{\ell }}_h+2{\mathsf{\ell }}_R+2{\mathsf{\ell }}_{\omega }=4864$
Proposed method	2 rounds	$4{\mathsf{\ell }}_h+2{\mathsf{\ell }}_R+2{\mathsf{\ell }}_q+{\mathsf{\ell }}_{\omega }=4608$

Taken together, the results in Table 3 and Table 4 show that the proposed method does not optimize a single metric in isolation; rather, it achieves a more practical balance among security, functional completeness, and performance overhead. Its communication overhead is 4608 bits. Compared with the schemes in [17] (8192 bits) and [18] (4864 bits), this represents reductions of approximately $43.75\%$ and $5.26\%$, respectively. Compared with [16] (6144 bits), the proposed method incurs a modest increase in computation but reduces communication overhead by $25.00\%$. In bandwidth-constrained SDH bearer networks, this reduction can substantially decrease link occupancy and handshake latency. Trading a moderate amount of local computation for lower transmission overhead is therefore well aligned with practical network requirements. Overall, the proposed method combines post-quantum security with more compact message exchange and lower critical-operation overhead.

Remark 2. 

The performance results reported in this section correspond to the normal case in which mutual authentication is successfully completed. If an integrity check or authentication value verification fails, the corresponding entity immediately terminates the current protocol execution. In practical industrial communication systems, additional mechanisms can be employed to handle such failures. For example, an authentication-failure threshold can be introduced to restrict repeated invalid authentication attempts [31], while secure retransmission and data recovery mechanisms can be employed after anomaly detection [32]. These mechanisms may introduce additional recovery or re-authentication latency and communication overhead, which should be evaluated separately from the normal authentication delay in future work.

6.3. Cross-Paradigm Comparison of Post-Quantum Schemes

The above performance evaluation mainly compares the proposed method with existing lattice-based authentication and key agreement schemes. To further clarify the applicability of different post-quantum approaches to critical industrial infrastructure, this subsection provides a cross-paradigm comparison with representative code-based and hash-based schemes. Since these schemes are designed for different cryptographic functionalities, a direct comparison based solely on execution time is not always meaningful. Therefore, the comparison focuses on their main functionality, computational characteristics, communication and storage overhead, and suitability for industrial communication environments.

6.4. Cross-Paradigm Comparison with Post-Quantum Schemes

To further evaluate the suitability of different post-quantum paradigms for critical industrial communication, representative code-based, hash-based, and lattice-based schemes are compared with the proposed method. The comparison considers not only security functionality but also key/signature size, computational cost, and communication efficiency, thereby highlighting the different trade-offs of these post-quantum approaches.

As shown in Table 5, different post-quantum paradigms exhibit distinct trade-offs in terms of security functionality and implementation efficiency. Representative code-based schemes can provide post-quantum security but may involve relatively large key sizes, while hash-based schemes generally incur larger signature overhead and may require an additional mechanism for session key establishment. Lattice-based alternatives can provide both authentication and key-establishment capabilities, but their overall communication and computational overhead depends on the combination of cryptographic primitives adopted. In contrast, the proposed RLWE-based method integrates mutual authentication, identity privacy protection, and session key agreement within a unified protocol. Together with its low computational cost and high communication efficiency, the proposed method provides a favorable balance for offshore wind farm communication.

Table 5. Comparison of representative post-quantum schemes.

Works	PQC Type	Mutual Auth.	Key Agree.	Identity Privacy	Key/Signature Size	Comp. Cost	Comm. Efficiency
[33]	Code-based	×	✔	×	Large	Moderate	Moderate
[34]	Hash-based	×	×	×	Large signature	Low–Moderate	Low–Moderate
[35]	Lattice-based	△	✔	×	Moderate–Large	Moderate	Moderate
Proposed	RLWE-based	✔	✔	✔	Compact	Low	High

✔: supported; △: partially supported or requires an additional mechanism; ×: not supported.

7. Conclusions

This paper addressed the security requirements of the cross-sea communication link in offshore wind farms by proposing an RLWE-based privacy-preserving key agreement method. Theoretical analysis and experiments demonstrated its security as well as its computational and communication efficiency. The current method primarily targets point-to-point communication between an offshore substation and an onshore centralized control center. For multi-node or hierarchical offshore wind farm networks, the proposed two-round authentication mechanism can be extended through pairwise key agreement while maintaining the same handshake structure for each individual session; however, the overall authentication and key-management overhead will increase as the number of active communication relationships grows. Future work will therefore focus on hierarchical key management, group authentication, and dynamic session management to improve the scalability of the proposed method in large-scale offshore wind farm environments. Further work is required for key management in large-scale multi-node environments, practical deployment on devices with limited computing capacity, and data-privacy protection after the communication channel has been established.