# Privacy-Preserving Overgrid: Secure Data Collection for the Smart Grid
## 4 Privacy-Preserving Overgrid
### Architecture Extension  
The idea of using virtual nodes inside each physical node belonging to the Overgrid allows for easily extending the distributed DR scheme, without changing the messages and the steps of the scheme. The only difference from the original version is related to the execution of additional computations at each node, related to the presence of the internal sub-nodes. This additional complexity is negligible, with each step of the flow updating algorithm being based on simple sums. Moreover, the number of real messages transmitted over the network does not change if we build a topology in which, at each node \(i\), only one sub-node is connected to each neighbor node, as shown in Figure 4.  
Similarly to the topology considered in the Multi-party algorithm presented in [29; 30], sub-nodes are sequentially connected in a ring topology inside each real node. This design choice makes the internal steps easy to be implemented and guarantees that the overlay network is not partitioned. Different design choices avoiding network partitions can also be considered.  
Obviously, if a node is isolated from the rest of the network, the Flow Updating scheme executed by the sub-nodes on the internal ring converges to the actual consumption value of the physical node. Conversely, if the sub-nodes are connected with other sub-nodes of neighboring nodes, then the algorithm mixes such information with the consumption of the other nodes, averaging the shares of the nodes with the shares of the neighbors. Thus, in order to preserve the users's privacy, in PP-Overgrid, the internal execution of the Flow Updating algorithm on virtual sub-nodes is triggered only after  
Figure 4: PP-Overgrid logical topology showing the internal ring within the physical node.  
the reception of messages by all the neighboring nodes. This guarantees that, even if a tagged node is isolated for a while, the execution of internal averaging operations is suspended too and will not reveal the power demand of the node one the external connection is re-established.  
It is easy to see that the privacy level of the proposed scheme depends on the number of node's neighbors, also called node degree. Indeed, sub-nodes communicate some of the power demand shares to other neighboring nodes. If all of the neighboring nodes of a target node collude with each other, i.e., exchange the messages received by the sub-nodes belonging to the target node, then they can retrieve the secret power demand of the node. In more detail, the SSC scheme guarantees that no information is disclosed until the shares of the sub-nodes are kept separated (i.e., not summed together). To converge, the Flow Updating algorithm indirectly \"mixes\" and sums the shares of all the sub-nodes in the network, revealing the average value of all nodes together. However, the consumption of a target node can still be revealed if _all_ its neighbors collude to compute the sum of the flows towards the target node. Indeed, if the Flow Updating has converged, the colluding node's estimate will be the same of the target node's estimate which, according to Equation 1, is equal to the node's (secret) value minus the sum of the flows. Otherwise, no information is revealed, as explained in [29].