System and method for enabling a scalable public-key infrastructure on a smart grid network

A non-transitory computer-readable medium (CRM) storing a plurality of instructions for enabling a scalable public-key infrastructure (PKI), the plurality of instructions comprising functionality to:

• receive a message for a device;
• identify an association ID for the device;
• retrieve, using the association ID, a plurality of encrypted association keys stored on a server for communicating with the device, wherein the plurality of encrypted association keys are encrypted using a wrapping key stored on a Hardware Security Module (HSM);
• send the message and the plurality of encrypted association keys to the HSM;
• unwrap, by the HSM and using the wrapping key, the plurality of encrypted association keys to create unwrapped association keys;
• cryptographically process, by the HSM using the unwrapped association keys, the message to generate a processed message;
• delete the unwrapped association keys;
• send the processed message to the device;
• and
• wherein the plurality of instructions are invoked concurrently by a first application and a second application.

A system for enabling a scalable Public-Key Infrastructure (PKI), comprising:

• a device, configured to receive a processed message;
• and
• an application server configured to:
• receive a message for the device,
• identify an association ID for the device,
• retrieve, using the association ID, a plurality of encrypted association keys stored on the application server for communicating with the device, wherein the plurality of encrypted association keys are encrypted using a wrapping key stored on a Hardware Security Module (HSM),
• send the message and the plurality of encrypted association keys to the HSM,
• receive the processed message from the HSM, and
• send the processed message to the device,
• wherein the HSM is configured to:
• unwrap, using the wrapping key, the plurality of encrypted association keys to create unwrapped association keys,
• cryptographically process, using the unwrapped association keys, the message to generate the processed message,
• delete the unwrapped association keys, and
• send, to the application server, the processed message
• wherein the system is invoked concurrently by a first application and a second application.