# Privacy-Preserving Overgrid: Secure Data Collection for the Smart Grid
## 4 Privacy-Preserving Overgrid  
The distributed architecture of Overgrid avoids the presence of a central data-center, which in principle could easily collect consumption data to profile single user behaviors. Indeed, data on users' power demand can be very sensitive, revealing, for example, the presence (or the absence) of people at home or the number of people living in the same building. However, even using a decentralized P2P scheme like Flow Updating, neighbor nodes exchange information about their real consumption at the first iteration of the scheme for computing the average power demand of the Overgrid, or when a new node joins the Overgrid. Since neighbor nodes might not trust each other, this operation could represent a data breach.  
We propose an extension of the distributed DR scheme implemented in Overgrid, in order to mitigate the problem of data breaches between neighboring nodes. The scheme, called Privacy-Preserving Overgrid (PP-Overgrid), combines the original DR algorithm with a Secure Secret Sharing (SSS) scheme [28]. In particular, we use a Secure Sum Computation (SSC), to privately sum the secrets of \(n\) nodes, using a distributed implementation like the one shown in Figure 3. The algorithm works as follows: assume each node owns its secret \(s_{i}\), and that the sum, \(\sum_{i}^{n}s_{i}\), lies in the range \([0,q)\). The first node 1 adds a random value \(r\) to its secret \(s_{1}\) modulo \(q\), obtaining \(r_{1}=(r+s_{1})mod\ q\) and sends it to node 2. Then, node 2 adds its own secret to \(r_{1}\), obtaining \(r_{2}=(r_{1}+s_{2})mod\ q\) and sends it to node 3, and so on until the last node \(n\) sends \(r_{n}\) back to node 1. Finally, node 1 subtracts the initial random value \(r\) and determines the sum \(\sum_{i}^{n}s_{i}\).  
In PP-Overgrid, the idea is replacing each node with a set of \(n\) logical sub-nodes, each one with a specific power demand, whose sum corresponds to the real demand of the nodes. For each node \(i\)  
Figure 3: Secure Sum implementation example.  
the power demand \(sh_{ij}\) of a generic sub-node \(j\) with \(j\leq n-1\) is randomly generated as in the so-called trivial secret sharing scheme, while the last power demand \(sh_{in}\) is computed in order to guarantee that the total demand \(\sum_{j}^{n}sh_{ij}=p_{i}\) corresponds to the real demand \(p_{i}\) of node \(i\). The use of logical sub-nodes guarantees that information is not disclosed unless the \(n\) shares are summed together. If one share is missing, no information can be retrieved (i.e., results become random). This on-off privacy property descends from the homomorphic property of the SSS: when considering two (or more) secrets, the sum of the shares represents a share of the sum of the secrets. In PP-Overgrid, we have applied SSS (and its well-known privacy properties) to the Overgrid scenario to protect user's consumption data.  
For each sub-node, random values of power demand are extracted from uniform distribution in the range \([0,p_{max}]\), where \(p_{max}\) is the maximum power of the nodes, while negative values take into account the presence of power generators. Thus, to retrieve the real consumption data of node \(i\), it is necessary to know all the power demands of its sub-nodes. This can be easily avoided by opportunistically building the topology connecting sub-nodes to external nodes, i.e., by avoiding all the internal sub-nodes from being connected to the same external node. By executing the Flow Updating schemes between \(N\cdot n\) virtual nodes of the Overgrid, the average power demand of the whole Overgrid is equal to the value \(p/n\), from which \(p\) can be derived.