# Privacy-Preserving Electricity Trading for Connected Microgrids
## 6 Privacy and Security Analysis
### Security Analysis  
Our system model assumes a message authentication mechanism preventing the injection of disturbing messages from outsiders. Regarding the parties composing the microgrid, the substation is assumed to be honest while meters may misbehave by trying to obtain free-of-charge e-coins. This section proves the security against this possibility by means of three lemmas and a conclusion theorem.  
**Lemma 4**: _Illicit e-coins cannot be obtained while a wallet is being loaded._  
When the \"withdrawal\" procedure is being run as part of a wallet loading operation (Section 5.4.1), the procedure is run between a meter and the substation through an authenticated secure communication channel. Hence, no third party can gain any advantage from observing the encrypted communication.  
Regarding the meter whose wallet is being loaded, it is required to authenticate itself, and the substation participates in the issuance of exactly as many blind signatures as the number of e-coins requested by the meter. That is the exact quantity of e-coins the requesting meter obtains.  
**Lemma 5**: _Illicit e-coins cannot be obtained while depositing e-coins._  
The \"deposit\" protocol, run at the end of a billing period (Section 5.4.4), is always executed through an authenticated secure channel. Hence, no third party can gain any advantage from observing the exchanged ciphertexts.  
Each time an e-coin is deposited, that e-coin is recorded so that the substation rejects any attempt to deposit it again. Since e-coins cannot be forged, a meter can only deposit the exact quantity of e-coins it is in possession of.  
**Lemma 6**: _Illicit e-coins cannot be obtained from an execution of the \"pairing and payment\" procedure._  
During the execution of the \"pairing and payment\" procedure, the requesting meter transmits an e-coin to the offering one. That e-coin is then sent to the substation for checking. At that moment, the e-coin is recorded as already spent. In this way, the requesting meter cannot fraudulently use it as part of any other payment.  
Next, the payee is allowed to anonymously withdraw a new e-coin. The payee meter is not required to identify itself, but the blind signature request has to include a digital signature verifiable under an ephemeral public key sent by the payee as part of the message asking for the verification of the e-coin received from the payee. This mechanism ensures that only the meter who checked the validity of the coin received as payment is able to withdraw a new e-coin.  
Both the datagram in which the e-coin is transmitted from the payee to the payee and the datagram in which the e-coin is sent to the substation for validity checking are encrypted. In this way, third parties have no access to the e-coin and cannot try to use it for their own benefit. As for the newly minted e-coin, as stated before, only the payee can request it. The messages involved in this withdrawal operation do not need to be encrypted because the blinding factor (Section 4.4) required to obtain the digital signature over the new e-coin is only known to the payee.  
**Theorem 2**: _E-coins cannot be forged nor stolen among the meters._  
Lemmas 4-6 prove that e-coins cannot be fraudulently obtained while loading e-coins to a wallet, while depositing them, nor while making a payment as a result of a pairing between an energy offer and a request, respectively. These are the only procedures involving e-coins.