Privacy-Preserving Data Falsification Detection in
Smart Grids using Elliptic Curve Cryptography and
Homomorphic Encryption
Sanskruti Joshi†, Ruixiao Li†, Shameek Bhattacharjee‡, Sajal K. Das$, and Hayato Yamana††Department of Computer Science and Computer Engineering, Waseda University, Tokyo, Japan‡Department of Computer Science, Western Michigan University, Kalamazoo, USA$Department of Computer Science, Missouri University of Science and Technology, Rolla, USA
E-mail: sanskrutijoshi@fuji.waseda.jp, {liruixiao, yamana}@yama.info.waseda.ac.jp,
shameek.bhattacharjee@wmich.edu, sdas@mst.edu
anomaly detection for power grids by adopting local
differential privacy (LDP) and a deep learning model. Keshk
et al. [5] used blockchain technology to verify the data
integrity and deep learning technology to perform anomaly
detection. Though the methods above protect the security andprivacy of the consumers’ data, the computational overheadof previous works [3-5] still has been an issue.
Therefore, this paper proposes an elliptic curve cryptography(ECC) based HE scheme, which needs smaller memory spaceand shorter computation time than the HE schemes like
CKKS, while ensuring the privacy of the data. Moreover, ECC
supports bilinear pairing over encrypted data, detecting
computation manipulations over meter readings. Whereas,homomorphic operations can be performed on encrypted data,
which safeguards the secret information from unauthorizedaccess.

Abstract— In an advanced metering infrastructure (AMI),
the electric utility collects power consumption data from smart
meters to improve energy optimization and provides detailed
information on power consumption to electric utility customers.
However, AMI is vulnerable to data falsification attacks, whichorganized adversaries can launch. Such attacks can be detectedby analyzing customers’ fine-grained power consumption data;
however, analyzing customers’ private data violates thecustomers’ privacy. Although homomorphic encryption-based
schemes have been proposed to tackle the problem, thedisadvantage is a long execution time. This paper proposes a
new privacy-preserving data falsification detection scheme toshorten the execution time. We adopt elliptic curve
cryptography (ECC) based on homomorphic encryption (HE)without revealing customer power consumption data. HE is aform of encryption that permits users to perform computations
on the encrypted data without decryption. Through ECC, we
can achieve light computation. Our experimental evaluation
showed that our proposed scheme successfully achieved 18 times
faster than the CKKS scheme, a common HE scheme.
Keywords—Elliptic
Curve
Cryptography,
Encryption, smart grids, bilinear pairing

Contributions: Our contributions are as follows.
i) We first propose an ECC-based HE scheme for privacypreserving data falsification detection in smart grids,
enabling faster computation than the previous CKKS-based
schemes.
ii) We perform validation checking for encrypted data using
pairing operations over encrypted data, which can detectmaliciously encrypted data. That is, maliciously encrypted
meter readings can be detected not to send to the utility. The
solution uses the bilinear pairing property of ECC, which is
not possible for other encryption schemes.
iii) For a fair comparison, our proposed scheme and the
CKKS-based scheme are implemented on the same platform
to compare the performance.

Homomorphic

I. INTRODUCTION
Advanced Metering Infrastructure (AMI) refers to the entire
infrastructure, from smart meters to two-way communication
networks, controlling electric appliances and transferring
energy usage data. AMI enables two-way communication
with customers and serves as the smart grid's backbone. A
smart grid allows bidirectional energy flow and integrates
two-way communication and control capabilities, offering
several new features and applications [1].
At the same time, customer data from smart meters raises
privacy concerns and confidentiality issues [2]. The major
concern is that it is vulnerable to cyber-attacks. As the energy
consumption data collected from smart meters are sensitive
consumer information, providing data privacy is a key
concern. Hence, the data must be protected from malicious
parties that attack the system to generate falsified data to
manipulate the customer’s power consumption data.
Ishimaki et al. [3] proposed a privacy-preserving anomalybased attack detection scheme, which adopts the CKKS
scheme for privacy-preserving anomaly detection. Note that
the CKKS scheme is one of the homomorphic encryption(HE) schemes enabling the calculation over encrypted data.
Other approaches include differential privacy andblockchain. Wen et al. [4] performed privacy-preserving

The rest of the paper is organized as follows. Section II
describes related work, followed by Section III describing
preliminary knowledge. The system architecture is explainedin Section IV. Section V proposes our ECC-based HE
scheme. The experimental evaluation is performed in Section
VI. Finally, we conclude our work in Section VII.
II. RELATED WORKThe existing privacy-preserving techniques and privacypreserving anomaly detection schemes are summarized.
A. Privacy-Preserving Techniques
The literature includes three privacy-preserving techniques,differential privacy (DP), secure multiparty computation(SMC), and homomorphic encryption (HE).
1

DP preserves privacy by adding a controlled amount ofrandomness (noise) to the raw data. Since the randomness iscontrolled, the resulting data is still accurate. However, DP
adds much noise when the data has large diversity, which
results in reducing the data utility. Moreover, balancing thebest trade-off is an open problem [6].
Secure multiparty computation (SMPC) is a cryptographic
approach that allows two or more parties to jointly computewithout revealing any information to one another indecentralized scenarios. Though smart meters can outsource
the desired computation to a set of servers, it is assumed that
non-colluding servers are controlled by distinct third parties[7-8]. One of the disadvantages of SMPC is communication
overhead among parties.
To perform data aggregation [9] and billing [10]computations in smart grids, additive HE (AHE), which canperform addition and constant multiplication, is sufficient.
However, identifying anomalous behavior requires complex
calculations such as division and logarithms, which prevents
HE implementation.

A. Elliptic Curves and ElGamal Encryption
Elliptic curve cryptography is based on the properties ofalgebraic curves over fields [11]. To keep thecomprehensiveness of this paper, the Elliptic curves andElGamal encryption is described by quoting the explanation
by Deepak et al. [11]. Mathematically, an elliptic curve isrepresented by an equation of the form: y2 = x3 + ax + b witha constraint that the discriminant ∆ = −16(4a3+27b2) is nonzero. The security of elliptic curve cryptography is based on
the ECDLP [12]. In other words, given two points, P and Q,
on the curve such that one is a scalar multiple of the other,i.e., P = x.Q (here ‘.’ (dot) represents scalar multiplication),
it is computationally difficult to find x. The ElGamal
encryption scheme with additive homomorphism can be
implemented using elliptic curve cryptography.
B. Elliptic Curve Discrete Logarithm Problem (ECDLP)The ECDLP [12] is the fundamental assumption for
elliptic-curve-based protocols. Computing the discrete
logarithm of a random elliptic curve element concerning apublicly known base-point is infeasible. The inability tocompute the multiplicand given the original and productpoints is required for elliptic curve encryption. To be secure,the inability of the potential to compute an elliptic curve
scalar multiplication is also required. The difficulty of the
problem is determined by the size of the elliptic curve, as
measured by the total number of discrete integer pairs
satisfying the curve equation.
Consider an elliptic curve E defined over a finite field 𝐹𝑝 .
Let A be a point of order n on the elliptic curve, where A ∈E (𝐹𝑝 ). The ECDLP is based on identifying integer z, where0 ≤ 𝑧 ≤ n − 1. For a given point B on the elliptic curve, B ∈⟨A⟩ and B is a scalar multiplication of the integer z and thepoint on elliptic curve A, such that B = z∙A. Here ‘∙’ is thescalar multiplication. The property of bilinear pairing is
supported by ECC. In this paper, we adopt bilinear pairing todetect malicious meter readings over encrypted data.

B. Privacy-Preserving Anomaly Detection
A framework for privacy-preserving anomaly-based attack
detection was proposed by Ishimaki et al. [3]. The CKKS
scheme, one of the popular HE schemes, was adopted for
privacy-preserving anomaly detection with the harmonic to
the arithmetic mean (HM-AM) metric. However, the HMAM ratio involves various HE-incompatible operations,
resulting in computational overhead in execution time.
Wen et al. [4] tackled the issue of energy theft detection insmart grids with a novel privacy-preserving federated
learning framework, FedDetect. The local differential
privacy (LDP) scheme is adopted to preserve consumers’ data
privacy. Besides, a deep learning model called the temporalconvolutional network (TCN) is used to detect energy thefts
in smart grids. However, LDP adds noise to the original data,
resulting in degradation of the detection accuracy. Moreover,noise-added data cannot be used for billing calculations.
Keshk et al. [5] proposed a privacy-preserving framework
to protect data and find anomalous behavior in smart power
networks. The framework uses blockchain technology toverify the integrity of the data and a deep learning techniquefor anomaly detection. For privacy-preserving, they adopt avariational autoencoder to transform raw data into an encoded
format before inputting it into the deep learning model.
However, the raw data might be revealed before transforming
the raw data to an encoded format.
In this paper, we tackle the heavy computation load of HE
by adopting an ECC-based HE scheme as ECC provides thesame security as a 3,072-bit RSA key with a 256-bit ECC key
and supports the property of bilinear pairing. Then, we ensure
the integrity of the data and detect data falsification overencrypted data. In the experiment, we compare our proposed
scheme with Ishimaki’s scheme [3].

C. Bilinear Pairing
Let G1 be an additively written group of order n with identity∞, and let GT be a multiplicatively written group of order nwith identity 1. A bilinear pairing on (G1, GT) is a map ê: G1
× G1 → GT that satisfies the following conditions [13].
i) (bilinearity) For all R, S, T ∈ G1, ê (R + S, T) = ê (R, T),ê(S, T). This is equivalent to ê (aS, bT) = ê (S, T)abii) (non-degeneracy) ê (P, P) ≠ 1iii) (computability) ê can be efficiently computed.
D. Anomaly Detection Metric
The harmonic to arithmetic mean (HM-AM) ratio is anefficient standard for identifying anomalous behavior insmart grid data [3]. Hence, the HM-AM ratio is adopted foranomaly-based attack detection in the proposed scheme
because i) it deals with additive, deductive, and camouflage
attacks, and ii) it can detect the minute changes in data that
occurred due to data falsification attacks.
Here, N is denoted as the total number of smart meters in
an AMI located in a neighborhood area network, and eachtimeslot is denoted as t. A set of timeslots t is represented byT, where (∀𝑡∈𝑇). The power consumption of the 𝑖-th smart

III. PRELIMINARIESThis section explains the fundamental concepts required forour proposed scheme, including preliminaries of ECC,
Elliptic Curve Discrete Logarithm Problem (ECDLP),
bilinear pairing, and anomaly detection ratio metric.

2

(𝑖)

They obey the protocol; however, they try to collect theconsumers’ data while communicating the data from thesmart meters to the utility through the computational server.
Another assumption is that the computational server does notcollude with the utility that has the secret key. Note that if theserver and a subset of smart meters collude, only the meterreadings of those smart meters are revealed, whereas readings
from other smart meters are protected. Thus, we do not
restrict the collusion among smart meters and between smart
meters and the computational server.
Data integrity threat, where an adversary attacks the smart
meters to falsify the meter readings, is assumed to occur
before encrypting the power consumption data in smart
meters.

(𝑖)meter is represented as 𝑝𝑡 , where 𝑝𝑡 ∈ 𝑅 + . The 𝑖-th smart(𝑖)meter performs natural logarithm transformation (𝑃𝑡 ) on(𝑖)each power consumption 𝑝𝑡 and computes its inverse
′(𝑖)

(𝑖)

′(𝑖)

(𝑖)

(𝑖)

( 𝑃𝑡
) as follows: 𝑃𝑡 = 𝑙𝑜𝑔(𝑝𝑡 + 2) , 𝑃𝑡
= 1/𝑃𝑡 .
Finally, the HM-AM ratio 𝑄𝑑 for the 𝑑-th date is computed.
∑

𝑄𝑑 = ∑𝑡∈ 𝑇

𝐻𝑀𝑡𝑡∈ 𝑇 𝐴𝑀𝑡

where 𝐴𝑀𝑡 =(𝑖)∑𝑁𝑖=1(𝑃𝑡 )𝑁,and 𝐻𝑀𝑡 =

(1)
𝑁
1

∑𝑁
𝑖=1( (𝑖) )

(2)

𝑃𝑡

IV. SYSTEM ARCHITECTURE
The system architecture is shown in Figure 1 which
consists of three main components: the utility, acomputational server (operated by a third party), and N smart
meters, which is the same as the model used by Ishimaki etal. [3]. In Figure 1 𝑆𝑀𝑖 is the i-th smart meter, HAN is Home
Area Network, and NAN is Neighborhood Area Network.

V. PROPOSED SCHEME
We propose a novel privacy-preserving data falsification
detection scheme with ECC-based HE to encrypt data andperform HM-AM ratio calculations over the encrypted data.
ECC-based encryption is additively homomorphic, whichuses smaller keys to improve performance end-to-end andsupports bilinear pairing. Moreover, the bilinear pairing
function over the elliptic curve group allows us to validate
the encrypted data without decryption.
The proposed scheme consists of four phases, as shown in
Figure 2: 1) system initialization by the utility, 2) meter report
generation by smart meters, 3) HM-AM computation overencrypted data by the computational server, and 4) anomalyattack detection by the utility. Table I shows the variables
used in this paper.
TABLE I.
Variable
P
Q
G1
T
t
𝑟𝑡

Figure 1: System Architecture

The function of each component is as follows:
Utility:• The utility performs the system initialization step of
key generation (public and secret keys).
• The utility sends the public key (only known to thesmart meters) to the smart meters to perform
encryption operations and keeps the secret key.
• The utility computes the HM-AM ratio (Equation 1)
and performs the anomaly detection.
Smart meters:• The smart meters use the public key provided by theutility to encrypt the power consumption data tosend to the computational server.
Computational server:• The computational server receives the encrypted
power consumption data from the smart meters andcomputes the summation of AM (Equation 2) andthe summation of HM (Equation 3).
• The computed summations are then sent to theutility to perform anomaly detection.
The details of the scheme are provided in Section 4.

(𝑖)

𝑝𝑡

Description
Independent point on the elliptic curve
Independent point on the elliptic curve
Elliptic curve group
A set of timeslots in a day
A timeslot
A random value generated at timeslot 𝑡
Power consumption of 𝑖-th smart meter at timeslot𝑡, where 1 ≤ 𝑖 ≤ N.

𝑃𝑡

(𝑖)

Natural log transformation of 𝑝𝑡 (𝑙𝑜𝑔(𝑝𝑡 + 2))

′(𝑖)

(𝑖)
(𝑖)
Inverse of 𝑃𝑡 (1/𝑙𝑜𝑔(𝑝𝑡 + 2))

𝑃𝑡
SHA-256
ê
𝑡
𝐴𝑀𝑠𝑢𝑚
𝑡
𝐻𝑀𝑠𝑢𝑚

Threat Model The proposed scheme attempts to protect theconsumer’s private data from both the computational server
and the utility if the following conditions hold.
The utility, the computational server, and the smart meters
are assumed to be semi-honest, i.e., honest but curious [3].

DESCRIPTION OF VARIABLES(𝑖)

A cryptographic hash function that outputs a 256-bit
long value
Bilinear map(𝑖)Summation of Enc (𝑃𝑡 ) at timeslot t (1 ≤ 𝑖 ≤ N)′(𝑖)

N

Summation of Enc (𝑃𝑡 ) at timeslot t (1 ≤ 𝑖 ≤ N)
Total number of smart meters

𝑄𝑑

HM-AM ratio for a day

Figure 2: Proposed Scheme

3(𝑖)A. System Initialization
The utility performs the initial setup. First, the utility
chooses an appropriate elliptic curve group G1 and two
independent points on the elliptic curve, P, Q ∈ G1 of ordern. Second, the utility generates two keys (key1 and key2) thatare shared between the smart meters and the utility only. Boththe keys are kept secret from the computational server.

Note that since 𝑚 × 𝑚′ = 1, we have the following
equation.
ˆ (m𝑟𝑡 P, m′𝑟𝑡 ′ Q) = ê (𝑃, Q)𝑚𝑟𝑡 𝑚′𝑟𝑡 ′ = ê (𝑃, Q)𝑟𝑡𝑟𝑡 ′= ê (𝑟𝑡 P, 𝑟𝑡 ′Q)(9)(𝑖)
The HM-AM ratio involves log(𝑝𝑡 + 2) and its inverses thatare not HE-friendly operations. Therefore, we first need to
(𝑖)
(𝑖)
′(𝑖)
(𝑖)
compute 𝑃𝑡 = log(𝑝𝑡 + 2) and 𝑃𝑡= 1/𝑃𝑡 for 𝑖 -thsmart meter. Log-transformation results in decimal places;
however, we can perform encryption over integers only.
(𝑖)′(𝑖)
Thus, we first round both 𝑃𝑡 and 𝑃𝑡
up to four decimal
places and then remove decimal points to make it an integer.
First, every smart meter computes a random value 𝑟𝑡 using
the shared key1 and corresponding timeslot t. Note that for
timeslot t, every smart meter uses the same random value 𝑟𝑡 .
𝑟𝑡 = SHA256(key1||t)If and only if the above equation does not hold for each(𝑖)′(𝑖)reading set of Enc (𝑃𝑡 ) and Enc (𝑃𝑡), where 1 ≤ 𝑖 ≤ N,
the reading set has been manipulated, which results indiscarding the data set to detect the malicious meter readings.
After confirming the above equation holds, the computational𝑡𝑡server computes 𝐴𝑀𝑠𝑢𝑚and 𝐻𝑀𝑠𝑢𝑚for each timeslot t as
shown below, where N is the total number of smart meters.
N(4)

Enc (𝑃𝑡 )

(10)

𝑡
𝐻𝑀𝑠𝑢𝑚
=∑

Enc (𝑃𝑡′(𝑖)) (11)

i=1

The
computational
server
then
sends
𝑡
𝑡
{𝐴𝑀𝑠𝑢𝑚, 𝐻𝑀𝑠𝑢𝑚}∀𝑡∈𝑇 to the utility to calculate the HM-AM
ratio. The algorithm of server-side computation is shown
below.

value generated by Equation 4. The corresponding encryption(𝑖)of 𝑃𝑡 is shown s below.
(𝑖)

(𝑖)

𝑡
𝐴𝑀𝑠𝑢𝑚
=∑

i=1
N

(𝑖)
Second, we need to encode 𝑃𝑡 into a group element to(𝑖)apply ECC-based ElGamal encryption. We round 𝑃𝑡 to(𝑖)three decimal places and then convert 𝑃𝑡 into integer. After(𝑖)that, we encode it as (𝑃𝑡 − 1)𝑟𝑡 P, where 𝑟𝑡 is the random(𝑖))) using bilinear pairing as

ˆ (𝑟𝑡 P,𝑟𝑡 ′Q) = ê (m𝑟𝑡 P, m′𝑟𝑡 ′Q),
(8)
(𝑖)
′(𝑖)
where 𝑚 = 𝑃𝑡 and 𝑚′ = 𝑃𝑡

B. Meter Report Generation

Enc (𝑃𝑡 ) = (𝑟𝑡 𝑃, ((𝑃𝑡

′(𝑖)

(𝑖)

pair ( Enc (𝑃𝑡 ), Enc ( 𝑃𝑡
follows:

Algorithm 2 (Server-side computation for each timeslot)
Input:(𝑖)• {𝐸𝑛𝑐(𝑃𝑡 )}: A set of encrypted log power(𝑖)− 1)𝑟𝑡 𝑃 + 𝑟𝑡 𝑃 ) = (𝑟𝑡 𝑃, 𝑃𝑡 𝑟𝑡 ) (5)

1≤𝑖≤𝑁

′(𝑖)

Similarly, encryption of 𝑚′ = 𝑃𝑡

consumption data in an area

is shown below.
•

Enc (m′) = (𝑟𝑡 ′Q, m′𝑟𝑡 ′Q), (6)where 𝑟𝑡 ′ = SHA256(key2||t)(7)

power consumption data in an area

(𝑖)

(𝑖)

(𝑖)

1: 𝑐1 = 𝐸𝑛𝑐𝑝𝑘 (𝑝𝑡 ) ► Encryption using Elgamal public key

D. Anomaly Detection by the Utility(𝑖)2: Compute 𝑃𝑡 = 𝑙𝑜𝑔(𝑝𝑡 + 2)(𝑖)
3: 𝑐2 = 𝐸𝑛𝑐𝑝𝑘 (𝑃𝑡 )
′(𝑖)

)

4:
fracsumt ← fracsumt ⊞ 𝐸𝑛𝑐 (𝑃𝑡′ )5: end for
6: return sumt, fracsumt

Output: 𝐸𝑛𝑐(𝑝𝑡 ), 𝐸𝑛𝑐(𝑃𝑡 ), 𝐸𝑛𝑐 (𝑃𝑡′ )
(𝑖)

′(𝑖)

(𝑖)

𝑁
Output: 𝐸𝑛𝑐(∑𝑁
𝑖=1 𝑃𝑡 ), 𝐸𝑛𝑐 (∑𝑖=1 𝑃𝑡
1: fracsumt ← 0, sumt ← 0
2: for 𝑖 ← 1 to 𝑁 do(𝑖)3:sumt ← sumt ⊞ 𝐸𝑛𝑐(𝑃𝑡 )Algorithm 1 (Smart meter-side encryption)
Input:(𝑖)• 𝑝𝑡 : Power consumption data of 𝑖-th meter at time 𝑡• pk: Elgamal public key(𝑖): A set of encrypted inverse log

)}
1≤𝑖≤𝑁

The algorithm of smart meter-side encryption is shown below.

(𝑖)

′(𝑖)

{𝐸𝑛𝑐 (𝑃𝑡𝑡𝑡
After
receiving {𝐴𝑀𝑠𝑢𝑚, 𝐻𝑀𝑠𝑢𝑚
}𝑡∈𝑇
from
the
computational server, the utility first decrypts them and thencomputes AMt and HMt as follows:(𝑖)

4: Compute 𝑃𝑡= 1/𝑃𝑡(𝑖)
5: 𝑐3 = 𝐸𝑛𝑐𝑝𝑘 (𝑃𝑡′ )6: return 𝑐1 , 𝑐2 , 𝑐3

𝐴𝑀𝑡 =C. HM-AM Computation over Encrypted Data𝑡
𝐷𝑒𝑐(𝐴𝑀𝑠𝑢𝑚)𝑁, 𝐻𝑀𝑡 =𝑁𝑡
𝐷𝑒𝑐( 𝐻𝑀𝑠𝑢𝑚
)

,

(12)

where N is the total number of smart meters.
Finally, the utility computes the HM-AM ratio as follows:

After receiving the encrypted data from each smart meter,
the computational server first checks for the validity of each4∑

𝑄𝑑 = ∑𝑡∈ 𝑇

𝐻𝑀𝑡𝑡∈ 𝑇 𝐴𝑀𝑡

A. Setup(13)

For all the experiments, we used a Windows 10 operating
system, 11th Gen Intel(R) Core (TM) i5 (2.4 GHz) processor,
8 GB RAM, SageMath 9.2 compiler, and Python 3.8.10.
The proposed scheme was implemented in Jupyter
Notebook and NumPy library in Python-based SageMath1.
The proposed scheme uses elliptic curve E: 𝑦 2 = 𝑥 3 − 4 overa finite field 𝐹𝑝 with prime of form p = 36𝑢4 + 36𝑢3 +24𝑢2 + 6𝑢 + 1, where 𝑢 =2114 +2101 − 214 −1, which is
the recommended setting to achieve 128-bit security forbilinear pairing and ECC-based encryption [15].
For the CKKS-based scheme, the HEAAN Python library2
and the Python wrapper3 for the HEAAN C++ library4 wereused. For division over ciphertext operation, an inbuilt cipher
inverse function of the HEAAN library is used. Parameters
are set as (n, log Q, p) = (215 , 491, 35), in which a fresh
ciphertext size is calculated as 2𝑛 ∙ 𝑙𝑜𝑔𝑄 bits. As 215 =
32,768, it supports 128-bit security [16].
We used the same dataset used in the paper [3], a smart griddataset collected from the Pecan Street Project. The dataset
includes the power consumption data of 200 households in
Texas, USA, over three years (2014–2016). The differencesin the implementation of the proposed scheme and the CKKS
scheme are listed in Table II.

Then, the utility adopts the residual under the curve (RUC)
metric proposed in [14] to detect the anomaly. The algorithmof utility-side computation is shown below.
Algorithm 3 (Utility-side computation)
Input:• {𝒔𝒖𝒎𝒕 }𝑡∈𝑇 : A set of the encrypted sum of log power
consumption data in an area• {𝒇𝒓𝒂𝒄𝒔𝒖𝒎𝒕 }𝑡∈𝑇 : A set of the encrypted sum of inverse
log power consumption data in an area
Output: Anomaly detection result
1: HM ← 0, AM ← 0
2: for 𝑡 ∈ 𝑇 do
𝐷𝑒𝑐(𝑠𝑢𝑚𝑡 )3:
AM ← AM +𝑁

4:

𝐻𝑀 ← HM +𝐻𝑀

𝑁

𝐷𝑒𝑐(𝑓𝑟𝑎𝑐𝑠𝑢𝑚𝑡 )5: Calculate𝐴𝑀
6: Apply the RUC metric [14] to detect the anomaly.
E. System Goals
The goal of our proposed scheme is as follows:• Perform anomaly-based attack detection in a securedmanner without disclosing each consumer’s power usage
details to the server and the utility.
• Verify the validity of the encrypted data to ensure thatthe consumers’ data are not manipulated to pass throughthe anomaly-based detection process.

TABLE II.

ECC-based HE (proposed)

F. Security Analysis

•
•

CKKS

Library

NumPy

HEAAN C++

Tool
Inversefunction
Linking

Python binding for C++ libraries
not supported over ciphertext

Python based SageMath
supported overciphertext
unsupported

HM-AM
ratio

The proposed scheme ensures the security of theconsumers’ data from both the computational server and theutility, as shown below.
•

IMPLEMENTATION COMPARISON

supported through bilinear
pairingcomputed by the utility

computed by thecomputational server

B. Performance comparison
In this experiment, we compared the performance of useside encryption, server-side computation, utility-side
decryption, and the total execution time.
a) Performance of user-side encryption
Each smart meter performs three encryptions per timeslot,
(𝑖)
(𝑖)
′(𝑖)
i.e., Enc (𝑝𝑡 ), Enc (𝑃𝑡 ) and Enc (𝑃𝑡). Table III shows(𝑖)the runtime for three times encryption, including Enc (𝑝𝑡 ),The proposed scheme adopts the ECC-based El-Gamal
system, and its security depends on the discrete
logarithm (DL) problem [12] in the elliptic curve (EC)group. Therefore, the proposed scheme is as secure as the
DL in the EC group.
As the computational server evaluates encrypted data,
the privacy of the data is maintained, and consumers’
data is protected from leaking.
In the proposed scheme, 𝐴𝑀𝑡 and 𝐻𝑀𝑡 (the arithmetic
mean and the harmonic mean of power consumption dataat each time slot) will be visible to the utility; however,this does not leak individual readings of the meter;
thereby, the utility cannot find the reading of any meterfrom either 𝐴𝑀𝑡 or 𝐻𝑀𝑡 .

′(𝑖)

(𝑖)

Enc (𝑃𝑡 ) and Enc (𝑃𝑡
TABLE III.

RUNTIME COMPARISON OF USER-SIDE ENCRYPTION

Scheme
ECC-based HE (proposed)
CKKS (Enc(0) +m)
CKKS(Enc(m))

VI. EXPERIMENTAL EVALUATION
To confirm the effectiveness of our proposed scheme, we
compared our scheme with the CKKS scheme, which is oneof the popular HE schemes.

).

Runtime of user-side encryption
(sec)
0.074
0.016
2.112

When encrypting with the CKKS, direct encryption takes
longer than an addition with ciphertext; thereby, Enc(0) is
pre-computed, consuming 0.984 sec, followed by addition.

1

https://www.sagemath.org/download.html
https://awesomeopensource.com/project/Huelse/HEAAN-Python
3
https://github.com/Huelse/HEAAN-Python

4 https://github.com/snucrypto/HEAAN

2

5

Table III shows that the ECC-based HE scheme has a longer
encryption time than the CKKS with pre-computation;
however, the ECC-based HE is much faster than the CKKS
without pre-computation.

VII. CONCLUSION
We proposed the first implementation of ECC-based HEwith HM-AM ratio-based anomaly detection and confirmed
18 times speedup of the anomaly detection compared to thepreviously proposed CKKS scheme. Our proposed scheme is
as secure as the CKKS scheme and ensures that theconsumers’ private data is protected from the server and theutility.

b) Performance of server-side computation
Table IV shows the server-side computation runtime, which
confirms that the ECC-based HE scheme performs better withand without bilinear pairing operation than the CKKS
scheme. Our proposed scheme can adopt bilinear pairing on(𝑖)the server to check if the individual encryptions Enc (𝑃𝑡 )ACKNOWLEDGMENT
This work was supported by Japan-US Network Opportunity
2 by Commissioned Research of the National Institute ofInformation and Communications Technology (NICT),Japan, and NSF grants SATC-2030611, SATC-2030624,
DGE-1433659, CNS-1818942.

′(𝑖)and Enc (𝑃𝑡) are related to each other. In the CKKS
scheme, the computational server computes the HM-AM
ratio; thereby, the runtime without HM-AM ratio
computation is also shown in Table IV for a fair comparison.
Note that the ECC-based HE scheme omits the calculation of
the HM-AM ratio in the computational server to delegate itto the utility.
TABLE IV.

REFERENCES[1] NIST, Smart grid: A beginner’s guide, https://www.nist.gov/el/smartgrid/about-smart-grid/smart-grid-beginners-guide[2] M.R. Asghar and D. Miorandi, “A holistic view of security and privacy
issues in smart grids,” Proc. of Int’l Workshop on Smart Grid Security,
LNCS, Springer, vol. 7823 pp. 58-71, 2012.
[3] Y. Ishimaki, S. Bhattacharjee, H. Yamana, and S. K. Das, “Towards
Privacy-preserving Anomaly-based Attack Detection against Data
Falsification in Smart Grid,” Proc. of 2020 IEEE Int’l Conf. on
Communications, Control, and Computing Technologies for Smart Grids,
pp. 1-6, 2020.
[4] M. Wen, R. Xie, K. Lu, L. Wang, and K. Zhang, “FedDetect: A Novel
Privacy-Preserving Federated Learning Framework for Energy Theft
Detection in Smart Grid,” IEEE Internet of Things J., vol. 9, no. 8, pp. 60696080, 2022.
[5] M. Keshk, B. Turnbull, N. Moustafa, D. Vatsalan, and Kim-Kwang R.
Choo, “A privacy-preserving-framework-based blockchain and deeplearning for protecting smart power networks,” IEEE Trans. on Industrial
Informatics, vol. 16, no. 8, pp. 5110-5118, 2019.
[6] M. R. Asghar, G. Dán, D. Miorandi, and I. Chlamtac, “Smart Meter Data
Privacy: A Survey,” IEEE Comm. Surveys & Tutorials, vol. 19, no. 4, pp.
2820-2835, 2017.
[7] G. Danezis, C. Fournet, M. Kohlweiss, and S. Zanella-B´eguelin, “Smart
meter aggregation via secret-sharing,” Proc. of the First ACM Workshop on
Smart Energy Grid Security, pp. 75–80, 2013.
[8] M. A. Mustafa, S. Cleemput, A. Aly and A. Abidin, “A Secure andPrivacy-Preserving Protocol for Smart Metering Operational Data
Collection,” IEEE Trans. on Smart Grid, vol. 10, no. 6, pp. 6481-6490, 2019.
[9] F. Li, B. Luo, and P. Liu, “Secure Information Aggregation for Smart
Grids Using Homomorphic Encryption,” Proc. of First IEEE Int’l Conf. on
Smart Grid Communications, pp. 327-332, 2010.
[10] X. Liang, X. Li, R. Lu, X. Lin, and X. Shen, “UDP: Usage-Based
Dynamic Pricing with Privacy Preservation for Smart Grid,” IEEE Trans. on
Smart Grid, vol. 4, no. 1, pp. 141-150, 2013.
[11] K. Deepak and K. Chandrasekaran, “Investigating Elliptic Curve
Cryptography for Securing Smart Grid Environments,” Proc. of Third ISEA
Conf. on Security and Privacy (ISEA-ISAP), pp. 1-7, 2020.
[12] D. Hankerson and A. Menezes, “Elliptic Curve Discrete Logarithm
Problem,” Encyclopedia of Cryptography and Security, Springer, pp. 397400, 2011.
[13] PS. Barreto, HY. Kim, B. Lynn, and M. Scott, “Efficient algorithms forpairing-based cryptosystems,” Proc. of Ann. Int’l Cryptology Conf., pp. 354369, 2002.
[14] S. Bhattacharjee and S. K. Das, “Detection and Forensics against
Stealthy Data Falsification in Smart Metering Infrastructure,” IEEE Trans.
on Dependable and Secure Computing, vol. 18, no. 2, pp. 356-371, 2021.
[15] R. Barbulescu and S. Duquesne, “Updating Key Size Estimations for
Pairings,” J. of Cryptology, vol. 32, pp.1298–1336, 2018[16] M. Chase, H. Chen, J. Ding, S. Goldwasser, S. Gorbunov, J. Hoffstein,
K. Lauter, S. Lokam, D. Moody, T. Morrison, A. Sahai, and V.
Vaikuntanathan, “Security of Homomorphic Encryption,” Draft
Homomorphic Encryption Standard, HomomorphicEncryption.org,
Redmond WA, Tech. Rep, 2017

RUNTIME COMPARISON OF SERVER-SIDE COMPUTATION
SchemeRuntime of serverside computation
(sec)
0.051
112.457
191.590(63.962)

ECC-based HE w/o bilinear pairing (proposed)
ECC-based HE w/ bilinear pairing (proposed)
CKKS (w/ HM-AM ratio computation)(w/o HM-AM ratio computation)c) Performance of utility-side computation
Table V shows the runtime of utility-side computation,
which confirms that the CKKS scheme is faster than the
ECC-based HE scheme. The reason is that the ECC-based HE
scheme needs to compute the HM-AM ratio after thedecryption of HM and AM, while the CKKS scheme needs
only the decryption of the HM-AM ratio.
TABLE V.

RUNTIME COMPARISON OF UTILITY-SIDE COMPUTATION
SchemeRuntime of utility-side
computation(sec)
10.3770.273

ECC-based HE (proposed)
CKKSd) Total performance
The total execution time is compared in Table VI, which
confirms that the ECC-based HE scheme performs better withand without bilinear pairing operation than the CKKS
scheme. Especially without bilinear pairing, our proposed
ECC-based HE scheme performed 18 times faster than the
CKKS scheme. Furthermore, we still have 1.56 times
speedup even with bilinear pairing to check if the individual(𝑖)′(𝑖)
encryptions Enc (𝑃𝑡 ) and Enc (𝑃𝑡) are related to eachother to increase the security level.
TABLE VI.

TOTAL RUNTIME

Scheme
ECC-based HE w/o bilinear pairing(proposed)
ECC-based HE w/ bilinear pairing (proposed)
CKKS

Total runtime (sec)
10.502
122.908
191.8796