# Privacy-Preserving Electricity Trading for Connected Microgrids
## 6 Privacy and Security Analysis
### Privacy Analysis  
The proposed system aims to prevent the substation from tracing the consumption habits of the households composing the microgrid. This is achieved by guaranteeing that the identity of the participants in each transaction remains unrevealed. The following lemmas and theorem prove it.  
**Lemma 1**.: _After an execution of the \"e-coin withdrawal\" protocol, the substation gets no information about the generated e-coin._  
Proof.: When an e-coin is withdrawn, its payload is generated at random by the meter. Next, this payload is blindly signed by the substation. A blind signature protocol (Section 4.4) guarantees that the signer gets no information about the signed data nor about the resulting signature. Hence, the substation remains oblivious to the newly generated e-coin.  
**Lemma 2**.: _An \"offer\" message cannot be related to the meter which transmitted it._  
Proof.: An \"offer\" message just includes a random serial number, a timestamp, and a randomly created public key. None of these parameters can be related to the transmitting meter nor to previous offers generated by the same meter.  
**Lemma 3**.: _A \"request\" message cannot be related to the meter which transmitted it._  
Proof.: A \"request\" message only includes a random serial number which is unrelated to the transmitting meter.  
**Theorem 1**: _An execution of the \"energy matching and payment\" protocol does not reveal the identity of the involved meters._  
The mentioned protocol is run after the substation decides to pair an \"offer\" and a \"request\" message. As stated in Lemmas 2 and 3, none of these messages reveals the identity of the involved meters.  
After the pairing has been announced by the substation, the requesting meter sends the \"payment\" message which includes an e-coin and a random piece of data (the \"receipt\"). From Lemma 1, we know that e-coins cannot be linked to the moment they were generated. Hence, this spent e-coin does not reveal the identity of the requesting meter. No additional action is performed by the requesting meter.  
The offering meter checks the validity of the received coin against the substation by means of an anonymous message including the e-coin and an ephemeral public key generated at random. This way, the identity of the offering meter is not revealed as a result of this checking. Finally, the offering meter is allowed to withdraw a new e-coin. This operation is authenticated by including a digital signature verifiable under the previous ephemeral public key. Hence, its identity is not revealed at this step either.  
The last message transmitted during the pairing procedure only includes the random _receipt_ bitstring which keeps no relation with none of the involved meters.  
Lemmas 2 and 3 together with Theorem 1 ensure the fulfilment of Design Objective 1 (Section 3.4), which states that electricity should be traded in an anonymous and unlinkable manner.  
Regarding Objective 2, when a meter loads its wallet, the meter is required to identify itself so that the substation can record the quantity of withdrawn e-coins. Also, at the end of a billing period, each meter identifies itself and deposits all the unspent e-coins available in its wallet. In this way, the substation can compute the amount to be charged or paid to each household from the difference between the withdrawn and deposited e-coins. For Objective 2 to be met, it has to be proven that the underlying e-coin system is secure in the sense that e-coins cannot be maliciously forged nor stolen among the meters. This security aspect is discussed next.