# Efficient and Privacy-Aware Power Injection over AMI and Smart Grid Slice in Future 5G Networks

Authors: Yinghui Zhang; Jiangfan Zhao; Dong Zheng
Journal: Mobile Information Systems
 (2017)

---

## Abstract

Smart grid is critical to the success of next generation of power grid, which is expected to be characterized by efficiency, cleanliness, security, and privacy. In this paper, aiming to tackle the security and privacy issues of power injection, we propose an efficient and privacy-aware power injection (EPPI) scheme suitable for advanced metering infrastructure and 5G smart grid network slice. In EPPI, each power storage unit first blinds its power injection bid and then gives the blinded bid together with a signature to the local gateway. The gateway removes a partial blind factor from each blinded bid and then sends to the utility company aggregated bid and signature by using a novel aggregation technique called hash-then-addition. The utility company can get the total amount of collected power at each time slot by removing a blind factor from the aggregated bid. Throughout the EPPI system, both the gateway and the utility company cannot know individual bids and hence user privacy is preserved. In particular, EPPI allows the utility company to check the integrity and authenticity of the collected data. Finally, extensive evaluations indicate that EPPI is secure and privacy-aware and it is efficient in terms of computation and communication cost.


---

## Body

## 1. Introduction

The fifth generation of mobile technology (5G) is positioned to provide a holistic end-to-end infrastructure that will include all aspects of the network. To be specific, the future 5G network is envisioned to provide higher data rates, enhanced end-user experience, and much lower latency and energy consumption. In particular, security and privacy preservation mechanisms are expected to be achieved besides the enhanced performance in 5G networks. Because wireless data services have witnessed an explosive growth driven by mobile Internet and smart devices, the new 5G mobile networks are expected to be deployed around 2020. The 5G architecture should include modular network functions that could be deployed and scaled on demand, to accommodate different use cases in a cost efficient and flexible manner.As the next generation of power grid, smart grid belongs to a representative use case suggested in the Next Generation Mobile Network (NGMN) association’s white paper [1]. Smart grid combines traditional grid with communication and information control technologies. It is expected to be characterized by efficiency, cleanliness, consumer involvement, security, privacy, and so forth. Indeed, as one of the main objectives of smart grid, the reduction of greenhouse gas emissions is greatly meaningful for the lives of the people [2]. This objective can be realized by widely deploying renewable energy generators and adaptively balancing the power demand and supply. Therefore, smart grid should have a large number of power storage units to store the excess power in certain cases, such as strong wind. Then, they inject the excess power to the grid when the utility company begins to collect energy at the period of reduced production. Both the utility company and the power storage units benefit from this process, where the utility company should be able to communicate with the power storage units. As important components of smart grid, smart meters (SMs) are two-way communication devices which are used to record power consumption periodically and collect real-time information on grid operations. The power storage units can be connected to the network of SMs through the existing network infrastructure Advanced Metering Infrastructure (AMI). SMs can communicate with local gateways based on AMI networks and the communication between the gateways and the utility company could be realized through the 5G smart grid network slice.Considering the issues of user privacy, communication efficiency, and so forth, it is meaningful for the gateways to aggregate the received requests before sending them to the utility company. Since transactions will be involved during power injection, data security and user privacy are of great importance. For one thing, all the data transmitted in the grid should be authenticated and be secure against unauthorized reading and malicious modifications. For another, user privacy related information must be protected against various attackers. For instance, during the communication process of power injection, individual power injection bids are sensitive and must be hidden. If some power storage units know that the other units do not inject power, they can deny selling power to force the utility company to offer a higher price. Furthermore, computation cost and communication overheads must be taken into account during power injection in smart grid. Therefore, the aggregation technique is important for addressing the above issues. As far as the authors’ knowledge, however, most existing solutions cannot tackle the security issues of power injection in smart grid.To solve the above problems, in this paper, we propose an Efficient and Privacy-aware Power Injection (EPPI) scheme suitable for AMI and 5G smart grid network slice. In EPPI, a novel data aggregation technique, namedhash-then-addition, is proposed. Specifically, each power storage unit can generate two secret keys based on bilinear pairings and use the hash values of the keys to blind its power injection bid. Based on AMI networks, each power storage unit sends its blinded power bid and the corresponding signature to the local gateway. It also generates a message authentication code based on exponentiation operations and sends the result to the gateway. Upon receiving packets from all the units, the gateway first removes a partial blind factor from each blinded bid. Then it aggregates the bids and signatures to get an aggregated bid and an aggregated signature. The gateway also aggregates all the message authentication codes to achieve an aggregated code. All the aggregated values are sent by the gateway to the utility company through the 5G smart grid network slice. Upon receiving the packet, the utility company can generate some secret keys and get the total amount of injected power at each time slot by removing the sum of the secret keys from the aggregated bid. In the proposed EPPI system, only the utility company can know the total amount of injected power at each time slot, and it is able to ensure the integrity and authenticity of the data. In particular, individual power bids are hidden during the communications in AMI networks and the 5G smart grid network slice. Through extensive evaluations we show that EPPI is secure and privacy-aware under the discrete logarithm assumption and it is efficient in terms of computation and communication cost.


### 1.1. Related Work

The 5G system deployed initially in 2020 is expected to provide approximately 1000 times higher wireless area capacity compared with the current 4G system [3]. The advanced cloud radio access network (C-RAN) has been presented as a potential 5G solution. C-RAN has attracted intense research interest from both academia and industry [4]. Combined with cloud computing technologies, the 5G network will extend its capability to provide various cloud services, which provides the user a full smart life experience. Cloud computing security has been well studied [5–8] and various cloud services are provided [9–11]. The air interface and spectrum of the 5G system should be combined with the long term evolution (LTE) and WiFi to achieve seamless and consistent user experience across time and space [12]. Nikaein et al. [13] presented a slice-based 5G architecture that efficiently manages network slices. NGMN anticipates countless emerging use cases with a high variety of applications will be supported in 5G. As an important use case, smart grid has attracted many scholars’ interest. In smart grid, in order to reduce communication overhead, it is essential to aggregate individual users’ data at local intermediate nodes. The trivial method of decrypt-aggregate-encrypt is computationally expensive and is risky when intermediate nodes are not trusted. Castelluccia et al. [14] enabled efficient encrypted data aggregation based on homomorphic encryption techniques. Westhoff et al. [15] proposed a key predistribution scheme that is suitable for the end-to-end encryption in sensor networks. A symmetric homomorphic encryption can be used together with [15] to improve the efficiency and flexibility of data aggregation. In smart grid, each user has energy consumption data of multiple dimensions and each dimensional data is small in size. If homomorphic encryption techniques are used directly on each dimensional data, the communication overhead will be unaffordable. Lin et al. [16] proposed a multidimensional privacy-preserving data aggregation scheme for saving energy consumption in wireless sensor networks by integrating the super-increasing sequence and perturbation techniques into compressed data aggregation. Lu et al. [17] designed a compressed data aggregation scheme under the public key infrastructure to improve efficiency and achieve high reliability. To improve the performance of the power grid, several schemes have been proposed to coordinate power charging [18, 19].In AMI networks, smart meters periodically send fine-grained power consumption data to the utility company. This data has a relation to the users’ activities and hence is sensitive. Tonyali et al. [20] developed a meter data obfuscation scheme to protect consumer privacy from eavesdroppers and the utility company. In order to tackle the scalability of AMI networks, Rabieh et al. [21] divided the AMI network into clusters of SMs and proposed two certificate revocation schemes to identify and nullify the false positives when using bloom filters to reduce the size of the certificate revocation lists. Besides, privacy-aware schemes with various security characteristics have been investigated for different network environment and applications [22–27]. Note that these schemes are not focusing on the security and privacy issues in power injection. Recently, Mahmoud et al. [28] have proposed a power injection querying scheme over AMI and LTE cellular networks. In [28], two aggregation techniques, point addition aggregation and homomorphic encryption based aggregation, are adopted to enable the local gateway to aggregate individuals’ power bids, where the homomorphic encryption [29] is used. However, we found that the scheme [28] fails to achieve privacy protection in that it cannot preserve the power storage unit’s bid. In fact, in [28], the utility company recovers the total amount of power by exhaustively computing jQ at different values of j∈Zq∗ until jQ=∑i=1n‍biQ, where Q is a bilinear group element and bi is an individual power injection bid. Obviously, this computation contradicts with the discrete logarithm assumption. In order to enable the utility company to get ∑i=1n‍bi, the authors assume that ∑i=1n‍bi is a small number. Unfortunately, if ∑i=1n‍bi is a small number, then each bi is a small number. In this case, any attacker can get bi and hence violates the bid privacy in that Bi=biQ is publicly sent by the power storage unit. More details can be found in [28]. The proposed EPPI realizes privacy preservation by using hash-then-addition aggregation technique and it does not constrain the power amount in any way.


### 1.2. Organization

The remaining of this work is organized as follows. We first review some preliminaries in Section2. In Section 3, we present the system architecture and adversary models. We propose an efficient and privacy-aware power injection scheme over AMI and smart grid slice in 5G networks in Section 4. The security analysis and performance evaluations are described in Sections 5 and 6, respectively. Finally, we draw our conclusions in Section 7.


## 1.1. Related Work

The 5G system deployed initially in 2020 is expected to provide approximately 1000 times higher wireless area capacity compared with the current 4G system [3]. The advanced cloud radio access network (C-RAN) has been presented as a potential 5G solution. C-RAN has attracted intense research interest from both academia and industry [4]. Combined with cloud computing technologies, the 5G network will extend its capability to provide various cloud services, which provides the user a full smart life experience. Cloud computing security has been well studied [5–8] and various cloud services are provided [9–11]. The air interface and spectrum of the 5G system should be combined with the long term evolution (LTE) and WiFi to achieve seamless and consistent user experience across time and space [12]. Nikaein et al. [13] presented a slice-based 5G architecture that efficiently manages network slices. NGMN anticipates countless emerging use cases with a high variety of applications will be supported in 5G. As an important use case, smart grid has attracted many scholars’ interest. In smart grid, in order to reduce communication overhead, it is essential to aggregate individual users’ data at local intermediate nodes. The trivial method of decrypt-aggregate-encrypt is computationally expensive and is risky when intermediate nodes are not trusted. Castelluccia et al. [14] enabled efficient encrypted data aggregation based on homomorphic encryption techniques. Westhoff et al. [15] proposed a key predistribution scheme that is suitable for the end-to-end encryption in sensor networks. A symmetric homomorphic encryption can be used together with [15] to improve the efficiency and flexibility of data aggregation. In smart grid, each user has energy consumption data of multiple dimensions and each dimensional data is small in size. If homomorphic encryption techniques are used directly on each dimensional data, the communication overhead will be unaffordable. Lin et al. [16] proposed a multidimensional privacy-preserving data aggregation scheme for saving energy consumption in wireless sensor networks by integrating the super-increasing sequence and perturbation techniques into compressed data aggregation. Lu et al. [17] designed a compressed data aggregation scheme under the public key infrastructure to improve efficiency and achieve high reliability. To improve the performance of the power grid, several schemes have been proposed to coordinate power charging [18, 19].In AMI networks, smart meters periodically send fine-grained power consumption data to the utility company. This data has a relation to the users’ activities and hence is sensitive. Tonyali et al. [20] developed a meter data obfuscation scheme to protect consumer privacy from eavesdroppers and the utility company. In order to tackle the scalability of AMI networks, Rabieh et al. [21] divided the AMI network into clusters of SMs and proposed two certificate revocation schemes to identify and nullify the false positives when using bloom filters to reduce the size of the certificate revocation lists. Besides, privacy-aware schemes with various security characteristics have been investigated for different network environment and applications [22–27]. Note that these schemes are not focusing on the security and privacy issues in power injection. Recently, Mahmoud et al. [28] have proposed a power injection querying scheme over AMI and LTE cellular networks. In [28], two aggregation techniques, point addition aggregation and homomorphic encryption based aggregation, are adopted to enable the local gateway to aggregate individuals’ power bids, where the homomorphic encryption [29] is used. However, we found that the scheme [28] fails to achieve privacy protection in that it cannot preserve the power storage unit’s bid. In fact, in [28], the utility company recovers the total amount of power by exhaustively computing jQ at different values of j∈Zq∗ until jQ=∑i=1n‍biQ, where Q is a bilinear group element and bi is an individual power injection bid. Obviously, this computation contradicts with the discrete logarithm assumption. In order to enable the utility company to get ∑i=1n‍bi, the authors assume that ∑i=1n‍bi is a small number. Unfortunately, if ∑i=1n‍bi is a small number, then each bi is a small number. In this case, any attacker can get bi and hence violates the bid privacy in that Bi=biQ is publicly sent by the power storage unit. More details can be found in [28]. The proposed EPPI realizes privacy preservation by using hash-then-addition aggregation technique and it does not constrain the power amount in any way.


## 1.2. Organization

The remaining of this work is organized as follows. We first review some preliminaries in Section2. In Section 3, we present the system architecture and adversary models. We propose an efficient and privacy-aware power injection scheme over AMI and smart grid slice in 5G networks in Section 4. The security analysis and performance evaluations are described in Sections 5 and 6, respectively. Finally, we draw our conclusions in Section 7.


## 2. Preliminaries

In this section, we give a brief review on some cryptographic backgrounds.


### 2.1. Cryptographic Background

Definition 1 (bilinear pairings).
LetG, GT be cyclic multiplicative groups of prime order q. Let P∈G be a generator. We call e^ a bilinear pairing if e^:G×G→GT is a map with the following properties [30]:(1)
bilinear:e^aP,bP=e^(P,P)ab for all a,b∈Zq∗,(2)
nondegenerate: there existsP,Q∈G such that e^P,Q≠1,(3)
computable: there is an efficient algorithm to computee^P,Q for all P,Q∈G.We define that Gλ outputs q,P,G,GT,e^ where λ is a security parameter.


### 2.2. Discrete Logarithm Assumption

Definition 2 (discrete logarithm problem [31]).
LetG be a group of prime order q, given two elements P and Q, to find an integer x∈Zq∗, such that Q=xP whenever such an integer exists.Definition 3 (discrete logarithm assumption [31]).
In groupG, it is computationally infeasible to determine x from P and Q=xP.


## 2.1. Cryptographic Background

Definition 1 (bilinear pairings).
LetG, GT be cyclic multiplicative groups of prime order q. Let P∈G be a generator. We call e^ a bilinear pairing if e^:G×G→GT is a map with the following properties [30]:(1)
bilinear:e^aP,bP=e^(P,P)ab for all a,b∈Zq∗,(2)
nondegenerate: there existsP,Q∈G such that e^P,Q≠1,(3)
computable: there is an efficient algorithm to computee^P,Q for all P,Q∈G.We define that Gλ outputs q,P,G,GT,e^ where λ is a security parameter.


## 2.2. Discrete Logarithm Assumption

Definition 2 (discrete logarithm problem [31]).
LetG be a group of prime order q, given two elements P and Q, to find an integer x∈Zq∗, such that Q=xP whenever such an integer exists.Definition 3 (discrete logarithm assumption [31]).
In groupG, it is computationally infeasible to determine x from P and Q=xP.


## 3. System Architecture and Adversary Models

### 3.1. System Architecture

As shown in Figure1, the system architecture of power injection over AMI and smart grid slice in 5G networks involves a number of communities and a utility company, and they are connected through a smart grid 5G network slice. In a community, there are many power storage units that are connected to AMI. Each AMI network connects to an access node and eventually to the utility company through a smart grid 5G network slice. The details are given as below.Figure 1
System architecture of power injection in future 5G networks.(i) Power Storage Units. The power storage units can be home batteries or charging stations. They store power energy from the smart grid or other renewable energy sources. Each storage unit can buy power from the grid at a low-price period and inject excess power energy to the grid at a high-price period. Note that a storage unit communicates with a SM based on the IEEE 802.11s protocol.(ii) AMI Network. The AMI network is an architecture for automated, two-way communication between SMs and a utility company. The goal of an AMI is to provides utility companies with real-time data about power consumption and allow users to make informed choices about energy usage based on the price at the time of use. In this paper, for the sake of efficiency, cleanliness, security, and privacy, smart meters communicate indirectly with the utility company by the gateway. The AMI network corresponding to a community comprises a group of SMs and a gateway. Similar to the work [28], two different AMI network topologies are considered: single hop AMI networks and multihop AMI networks. As shown in Figure 1, the SMs in the multihop AMI network are connected through a multihop wireless mesh topology, where each SM plays a role of relaying packets from other SMs. In the single-hop AMI network, the gateway can directly collect power injection related data from corresponding SMs, and then it aggregates the data and sends the result to the utility company. This process is performed periodically, for example, every 15 minutes. It can also receive the latest power data from the utility company and broadcast it to the SMs in the corresponding AMI network. Note that, similar to [28], the AMI network routes are created using the IEEE 802.11s mesh standard.(iii) Smart Grid Slice in 5G Networks. A 5G network slice supports the communication service of a particular connection type with a specific way of handling the C- and U-plane for this service [1]. For this purpose, a 5G slice consists of a series of 5G network functions and specific radio access technology (RAT) settings that are combined together for the particular use case. Therefore, a 5G slice can span all domains of the network. Not all slices contain the same functions, and some functions that seem important for a mobile network might even be missing in other slices. After network function virtualization, the radio access network and the core network are called edge cloud and central cloud (or core cloud), respectively. The front haul between the access node and the edge cloud is based on software-define networking (SDN). The backhaul between the edge cloud and the core cloud is also based on SDN. For a 5G slice supporting smart grid use case, security, privacy, reliability, and latency are of paramount importance. As shown in Figure 1, to tailor the network functions to suit the smart gird slice, all the necessary functions are instantiated at the cloud edge node.(iv) Utility Company. If the power energy demand from communities is more than the supply, the utility company should contact electricity vendors or power storage units to buy power. Note that the utility company communicates with the power storage units via the AMI and 5G smart grid slice networks. It connects to the 5G slice through an access node.


### 3.2. Adversary Models

It is assumed that all the entities are “honest-but-curious.” More precisely, they will honestly execute the tasks assigned by legitimate parties but try to find out as much private information as possible. Each power storage unit is curious to know the other units’ bids to judge whether it is more profitable to inject power now. We assume that each power storage unit can only send packets in the corresponding community. The AMI network attackers, the smart grid 5G slice attackers, and outsiders are also interested in other’s sensitive information, such as the amount and time of the power injection of each power storage unit. Similarly, the utility company does not disrupt the communication, but it tries to get private information on the owners of the power storage units and any other information that can help gain economic benefits. Note that the utility company does not collude with the power storage units in that they have conflicting interests. The utility wants to buy power at low prices but the storage units want to increase revenues. The power storage units will inject the amount of power as committed in their bids because this is more profitable.


### 3.3. Security Requirements and Design Goals

Considering the practical application environment, security and privacy are significant for the success of a power injection system. In order to prevent aforementioned adversaries from learning power storage units’ individual bid and to detect the adversaries’ malicious behaviors, the following security requirements should be satisfied in a secure power injection system.(i) Confidentiality and Privacy Protection. Even if an adversary eavesdrops the communication on the AMI and smart grid slice networks, it fails to achieve the total amount of power injected from the community. The utility cannot know the contents of individual power storage unit’s bid. In our scheme, aggregation at gateways is adopted to achieve these goals.(ii) Authentication and Integrity. The utility company is able to authenticate the received packets to ensure that the packets are really from legal power storage units and have not been altered during the transmission; that is, if the adversary forges and/or modifies a packet, the malicious behavior should be detected. Besides, the adversary should not impersonate the utility company, the gateway, or the storage units.In general, under the proposed system architecture and security requirements, our design goal is to design an efficient and privacy-aware power injection scheme based on AMI and smart grid slice in 5G networks. To be specific, the following two objectives should be achieved. Firstly, the security requirements should be guaranteed in the proposed scheme. For one thing, a desirable scheme should provide robust security against various types of attacks including passive eavesdropping, impersonation attack, replay attack, and man-in-the-middle attack. For another, a desirable power injection scheme should enjoy some significant security benefits such as the assurance of session key freshness which enables the forward and backward secrecy. Secondly, the performance-related issue should be taken into consideration. The proposed power injection scheme should enjoy desirable efficiency in terms of the computation cost and the communication overhead.


## 3.1. System Architecture

As shown in Figure1, the system architecture of power injection over AMI and smart grid slice in 5G networks involves a number of communities and a utility company, and they are connected through a smart grid 5G network slice. In a community, there are many power storage units that are connected to AMI. Each AMI network connects to an access node and eventually to the utility company through a smart grid 5G network slice. The details are given as below.Figure 1
System architecture of power injection in future 5G networks.(i) Power Storage Units. The power storage units can be home batteries or charging stations. They store power energy from the smart grid or other renewable energy sources. Each storage unit can buy power from the grid at a low-price period and inject excess power energy to the grid at a high-price period. Note that a storage unit communicates with a SM based on the IEEE 802.11s protocol.(ii) AMI Network. The AMI network is an architecture for automated, two-way communication between SMs and a utility company. The goal of an AMI is to provides utility companies with real-time data about power consumption and allow users to make informed choices about energy usage based on the price at the time of use. In this paper, for the sake of efficiency, cleanliness, security, and privacy, smart meters communicate indirectly with the utility company by the gateway. The AMI network corresponding to a community comprises a group of SMs and a gateway. Similar to the work [28], two different AMI network topologies are considered: single hop AMI networks and multihop AMI networks. As shown in Figure 1, the SMs in the multihop AMI network are connected through a multihop wireless mesh topology, where each SM plays a role of relaying packets from other SMs. In the single-hop AMI network, the gateway can directly collect power injection related data from corresponding SMs, and then it aggregates the data and sends the result to the utility company. This process is performed periodically, for example, every 15 minutes. It can also receive the latest power data from the utility company and broadcast it to the SMs in the corresponding AMI network. Note that, similar to [28], the AMI network routes are created using the IEEE 802.11s mesh standard.(iii) Smart Grid Slice in 5G Networks. A 5G network slice supports the communication service of a particular connection type with a specific way of handling the C- and U-plane for this service [1]. For this purpose, a 5G slice consists of a series of 5G network functions and specific radio access technology (RAT) settings that are combined together for the particular use case. Therefore, a 5G slice can span all domains of the network. Not all slices contain the same functions, and some functions that seem important for a mobile network might even be missing in other slices. After network function virtualization, the radio access network and the core network are called edge cloud and central cloud (or core cloud), respectively. The front haul between the access node and the edge cloud is based on software-define networking (SDN). The backhaul between the edge cloud and the core cloud is also based on SDN. For a 5G slice supporting smart grid use case, security, privacy, reliability, and latency are of paramount importance. As shown in Figure 1, to tailor the network functions to suit the smart gird slice, all the necessary functions are instantiated at the cloud edge node.(iv) Utility Company. If the power energy demand from communities is more than the supply, the utility company should contact electricity vendors or power storage units to buy power. Note that the utility company communicates with the power storage units via the AMI and 5G smart grid slice networks. It connects to the 5G slice through an access node.


## 3.2. Adversary Models

It is assumed that all the entities are “honest-but-curious.” More precisely, they will honestly execute the tasks assigned by legitimate parties but try to find out as much private information as possible. Each power storage unit is curious to know the other units’ bids to judge whether it is more profitable to inject power now. We assume that each power storage unit can only send packets in the corresponding community. The AMI network attackers, the smart grid 5G slice attackers, and outsiders are also interested in other’s sensitive information, such as the amount and time of the power injection of each power storage unit. Similarly, the utility company does not disrupt the communication, but it tries to get private information on the owners of the power storage units and any other information that can help gain economic benefits. Note that the utility company does not collude with the power storage units in that they have conflicting interests. The utility wants to buy power at low prices but the storage units want to increase revenues. The power storage units will inject the amount of power as committed in their bids because this is more profitable.


## 3.3. Security Requirements and Design Goals

Considering the practical application environment, security and privacy are significant for the success of a power injection system. In order to prevent aforementioned adversaries from learning power storage units’ individual bid and to detect the adversaries’ malicious behaviors, the following security requirements should be satisfied in a secure power injection system.(i) Confidentiality and Privacy Protection. Even if an adversary eavesdrops the communication on the AMI and smart grid slice networks, it fails to achieve the total amount of power injected from the community. The utility cannot know the contents of individual power storage unit’s bid. In our scheme, aggregation at gateways is adopted to achieve these goals.(ii) Authentication and Integrity. The utility company is able to authenticate the received packets to ensure that the packets are really from legal power storage units and have not been altered during the transmission; that is, if the adversary forges and/or modifies a packet, the malicious behavior should be detected. Besides, the adversary should not impersonate the utility company, the gateway, or the storage units.In general, under the proposed system architecture and security requirements, our design goal is to design an efficient and privacy-aware power injection scheme based on AMI and smart grid slice in 5G networks. To be specific, the following two objectives should be achieved. Firstly, the security requirements should be guaranteed in the proposed scheme. For one thing, a desirable scheme should provide robust security against various types of attacks including passive eavesdropping, impersonation attack, replay attack, and man-in-the-middle attack. For another, a desirable power injection scheme should enjoy some significant security benefits such as the assurance of session key freshness which enables the forward and backward secrecy. Secondly, the performance-related issue should be taken into consideration. The proposed power injection scheme should enjoy desirable efficiency in terms of the computation cost and the communication overhead.


## 4. Proposed EPPI Scheme

In this section, we propose an efficient and privacy-aware power injection scheme over AMI and smart grid slice in 5G networks, which comprises the following six phases: system initialization, registration, power collection request, privacy-aware bid generation, privacy-aware bid aggregation, and privacy-aware aggregated bid reading. Figure2 presents the process of the proposed EPPI system. The details are given in the following.Figure 2
Six phases of the proposed EPPI system.


### 4.1. System Initialization

The proposed EPPI system is initialized by the utility company. Specifically, in the system initialization phase, given the security parameterλ, the utility company first generates q,P0,G,GT,e^ by running Gλ. It computes Y=e^P0,P0 and chooses two random elements U,V∈G and four secure cryptographic hash functions H,H1,H2, and H3, where H:{0,1}∗→Zq∗, H1:0,1∗→G, H2:GT→Zq∗, and H3:GT→{0,1}∗. Then, the utility company chooses a random element sku∈Zq∗ as its secret key and calculates PKu=skuP0 as its public key. Finally, the utility company keeps sku secret and publishes the global public parameters(1)GPK=G,GT,e^,q,P0,U,V,PKu,H,H1,H2,H3,Y.


### 4.2. Registration

In order to join the EPPI system, each gateway chooses a random elementskg∈Zq∗ as its secret key and calculates PKg=skgP0 as its public key. A power storage unit with identity IDi chooses a random element ski∈Zq∗ as its secret key and calculates PKi=skiP0 as its public key. Similar to [28], in the proposed EPPI system, all the gateways and power storage units should contact the utility company to receive corresponding certificates for public keys. Note that the existing public key infrastructure (PKI) can be used to generate certificates. Besides PKI, in the proposed scheme, the aggregated message authentication code and the aggregated signatures are necessary to ensure the authenticity and integrity of transaction data, which are shown in the privacy-aware bid aggregation phase.


### 4.3. Power Collection Request

During the peak hours, the utility company can collect power from related communities. To be specific, the utility company sends power collection request (Power_Req) packets to corresponding gateways. Upon receiving the packet, each gateway verifies the freshness and validity of the packet. Then the gateway broadcasts the valid packet in its community.Suppose the utility company wants to collect power in the community corresponding to the gatewayIDg. As shown in Figure 2, the packet contains the identities of the utility company and the gateway, that is, IDu and IDg. It also has the power collection information of price per unit in each time slot, that is, Infop=p1,p2,…,pk, where k is the number of time slots. Then the utility company randomly chooses ru∈Zq∗, computes ruP0, and attaches ruP0 in the packet Power_Req. Note that ruP0 is used by each power storage unit covered by the gateway IDg in establishing a one-time key shared with the utility company. Besides, the packet contains a timestamp TS and a signature σu, where(2)σu=skuH1IDu∥IDg∥Infop∥ruP0∥TS.Both TS and σu will be used by the gateway in verification of the packet.In fact, after receiving the packetPower_Req, the gateway IDg first checks the freshness of Power_Req according to the difference between the current time and the timestamp TS. Then, it verifies the signature by checking if e^σu,P0=e^H1IDu∥IDg∥Infop∥ruP0∥TS,PKu holds. If and only if the equation holds, the gateway IDg randomly chooses rg∈Zq∗, computes rgP0, and attaches rgP0 in the packet Power_Req. Note that rgP0 is used by each power storage unit covered by the gateway IDg in establishing a one-time key shared with the gateway. Then, the gateway broadcasts the packet in its community.


### 4.4. Privacy-Aware Bid Generation

Upon receiving the power collection request, each power storage unit should prepare a bid with the amount of power it can inject in each time slot. Then, it sends a power request responsePower_Res packet to the corresponding gateway or its upstream smart meter. The bid format of the power storage unit IDi is bi=bi,1,bi,2,…,bi,k, where bi,x represents the number of power units the power storage unit IDi can inject in the x-th time slot at price px for 1≤x≤k. As shown in Figure 2, the packet Power_Res contains the identities of the gateway and the utility company, that is, IDg and IDu. The power storage unit IDi randomly chooses ri∈Zq∗, computes riP0, and attaches riP0 in the packet Power_Res. Note that riP0 is used by IDu in establishing a shared one-time key between IDi and IDu. The power storage unit IDi computes two shared keys as k^i=H2e^PKg,skirirgP0 and ki=H2e^PKu,skiriruP0, which will be used to mask IDi’s bid and ki can enable the utility company to ensure the authenticity and integrity of the aggregated bids without needing to read the individual bid.It is noted that we propose a novel bib aggregation method calledhash-then-addition in the aggregation phase. Corresponding to this method, the power storage unit IDi computes its masked bid as Bi=Bi,1,Bi,2,…,Bi,k, where Bi,x=bi,x+Hx∥k^i+Hx∥ki for 1≤x≤k. It then calculates a signature σi=skiH1Hki∥IDg∥IDu∥riP0∥TS and a message authentication code MACBi=Y∑1≤x≤k‍bi,x. Note that the masked bid can realize privacy protection in the sense of hiding individual bids.


### 4.5. Privacy-Aware Bid Aggregation

Upon receiving all the power request response packets, the gatewayIDg aggregates these packets and sends an aggregated response packet to the utility company IDu. The aggregated packet enjoys the following benefits. Firstly, the power storage unit’s bid privacy is preserved, which is very important in practical applications. For example, it can prevent the utility company from manipulating the power collection price. In fact, what the utility company needs is not the power storage units’ individual power injection data, but the total power amount that can be collected from the community in each time slot. Secondly, the aggregated packet has smaller packet size and hence reduces the required bandwidth for transmitting the data to the utility company. Thirdly, instead of sending one message for each bid, all the bids in different time slots can be collected in one message. In the following, we show how to aggregate the packets considering two different scenarios: a single-hop AMI network and a multihop AMI network.In the case of a single-hop AMI network, upon receiving all thePower_Res packets, IDg computes a secret key k^i=H2e^PKi,skgrgriP0 shared with the power storage unit IDi for 1≤i≤n. We note that k^i=H2e^PKg,skirirgP0=H2e^PKi,skgrgriP0. Then, IDg aggregates the signatures, masked bids, and message authentication codes to generate an aggregated signature σ, an aggregated masked bid B, and an aggregated message authentication code MACB. The aggregated signature is σ=∑1≤i≤n‍σi. The aggregated bid is B=B1,B2,…,Bk, where Bx=∑1≤i≤n‍Bi,x-Hx∥k^i for 1≤x≤k. The aggregated message authentication code is MACB=∏1≤i≤n‍MACBi. Additionally, the gateway IDg randomly chooses R∈Zq∗ and calculates the final message authentication code MACf=MAC1,MAC2, where MAC1=B∥R⊕H3MACB and MAC2=UHBVH(R). MACf will be used by the utility company IDu to ensure that the aggregated bid in each time slot stems from the intended power storage units and it has not been modified in transit. Note that during the verification process, IDu does not need to access the individual bid and hence the power storage unit’s privacy is preserved.In the case of a multihop AMI network, the aggregation process of the signatures and masked bids are done by the SMs in a bottom-up way, as shown in Figure3. Once a SM receives Power_Res packets from its downstream SMs, it first aggregates them with its own data and then sends the aggregated packet to its upstream SM. For example, as shown in Figure 3, SM2 and SM3 send their Power_Res packets to their upstream smart meter SM4. After receiving packets from SM2 and SM3, SM4 aggregates its signature to the received signatures of SM2 and SM3 to generate aggregated signature σ2-4=σ2+σ3+σ4. Then, SM4 aggregates its masked bid to the received masked bids of SM2 and SM3 to generate aggregated masked bid B2-4=B2-4,1,B2-4,2,…,B2-4,k, where B2-4,x=B2,x+B3,x+B4,x for 1≤x≤k. SM4 also aggregates its message authentication code to the received message authentication codes of SM2 and SM3 to generate an aggregated message authentication code MAC(B2-4)=MAC(B2)·MAC(B3)·MAC(B4). Similarly, SM5 generates σ1-5=σ1+σ2-4+σ5, B1-5=(B1-5,1,B1-5,2,…,B1-5,k), where B1-5,x=B1,x+B2-4,x+B5,x for 1≤x≤k, and MAC(B1-5)=MAC(B1)·MAC(B2-4)·MAC(B5). SM8 generates σ6-8=σ6+σ7+σ8, B6-8=(B6-8,1,B6-8,2,…,B6-8,k), where B6-8,x=B6,x+B7,x+B8,x for 1≤x≤k, and MAC(B6-8)=MAC(B6)·MAC(B7)·MAC(B8). Upon receiving response packets from SM5 and SM8, the gateway IDg computes k^i=H2e^PKi,skgrgriP0 for 1≤i≤8, σ=σ1-8=σ1-5+σ6-8, B1-8=(B1-8,1,B1-8,2,…,B1-8,k), where B1-8,x=B1-5,x+B6-8,x for 1≤x≤k, B=B1,B2,…,Bk, where B(x)=B1-8,x-∑1≤i≤8‍H(x∥k^i) for 1≤x≤k, and MAC(B)=MAC(B1-5)·MAC(B6-8). Additionally, the gateway IDg randomly chooses R∈Zq∗ and calculates the final message authentication code MACf=(MAC1,MAC2), where MAC1=B∥R⊕H3MACB and MAC2=UH(B)VH(R).Figure 3
The aggregation way in multihop AMI networks.In any cases, the gatewayIDg attaches {riP0}1≤i≤n to the aggregated response packet, where n is the number of power storage units covered by IDg. Finally, the aggregated response packet is sent to the utility company. Note that only the final message authentication code MACf is sent to the utility company by the gateway.


### 4.6. Privacy-Aware Aggregated Bid Reading

After receiving the power request response packet from the gatewayIDg, the utility company computes a secret key ki=H2e^PKi,skururiP0 shared with the power storage unit IDi for 1≤i≤n. We note that ki=H2e^PKi,skururiP0=H2e^PKu,skiriruP0. For 1≤x≤k, the utility company computes b(x)=B(x)-∑1≤i≤n‍Hx∥ki=∑1≤i≤n‍bi,x, which is the power amount the utility company can collect from the community of IDg in the x-th time slot at price px. Then, the utility company ensures the authenticity and integrity of the recovered data by checking if e^σ,P0=∏1≤i≤n‍e^H1Hki∥IDg∥IDu∥riP0∥TS,PKi. Finally, in order to ensure that the recovered aggregated bids stem from the intended power storage units and they have not been modified in transition, the utility company computes B′∥R′=MAC1⊕H3Y∑1≤x≤k‍bx and checks whether MAC2=UH(B′)VH(R′).


## 4.1. System Initialization

The proposed EPPI system is initialized by the utility company. Specifically, in the system initialization phase, given the security parameterλ, the utility company first generates q,P0,G,GT,e^ by running Gλ. It computes Y=e^P0,P0 and chooses two random elements U,V∈G and four secure cryptographic hash functions H,H1,H2, and H3, where H:{0,1}∗→Zq∗, H1:0,1∗→G, H2:GT→Zq∗, and H3:GT→{0,1}∗. Then, the utility company chooses a random element sku∈Zq∗ as its secret key and calculates PKu=skuP0 as its public key. Finally, the utility company keeps sku secret and publishes the global public parameters(1)GPK=G,GT,e^,q,P0,U,V,PKu,H,H1,H2,H3,Y.


## 4.2. Registration

In order to join the EPPI system, each gateway chooses a random elementskg∈Zq∗ as its secret key and calculates PKg=skgP0 as its public key. A power storage unit with identity IDi chooses a random element ski∈Zq∗ as its secret key and calculates PKi=skiP0 as its public key. Similar to [28], in the proposed EPPI system, all the gateways and power storage units should contact the utility company to receive corresponding certificates for public keys. Note that the existing public key infrastructure (PKI) can be used to generate certificates. Besides PKI, in the proposed scheme, the aggregated message authentication code and the aggregated signatures are necessary to ensure the authenticity and integrity of transaction data, which are shown in the privacy-aware bid aggregation phase.


## 4.3. Power Collection Request

During the peak hours, the utility company can collect power from related communities. To be specific, the utility company sends power collection request (Power_Req) packets to corresponding gateways. Upon receiving the packet, each gateway verifies the freshness and validity of the packet. Then the gateway broadcasts the valid packet in its community.Suppose the utility company wants to collect power in the community corresponding to the gatewayIDg. As shown in Figure 2, the packet contains the identities of the utility company and the gateway, that is, IDu and IDg. It also has the power collection information of price per unit in each time slot, that is, Infop=p1,p2,…,pk, where k is the number of time slots. Then the utility company randomly chooses ru∈Zq∗, computes ruP0, and attaches ruP0 in the packet Power_Req. Note that ruP0 is used by each power storage unit covered by the gateway IDg in establishing a one-time key shared with the utility company. Besides, the packet contains a timestamp TS and a signature σu, where(2)σu=skuH1IDu∥IDg∥Infop∥ruP0∥TS.Both TS and σu will be used by the gateway in verification of the packet.In fact, after receiving the packetPower_Req, the gateway IDg first checks the freshness of Power_Req according to the difference between the current time and the timestamp TS. Then, it verifies the signature by checking if e^σu,P0=e^H1IDu∥IDg∥Infop∥ruP0∥TS,PKu holds. If and only if the equation holds, the gateway IDg randomly chooses rg∈Zq∗, computes rgP0, and attaches rgP0 in the packet Power_Req. Note that rgP0 is used by each power storage unit covered by the gateway IDg in establishing a one-time key shared with the gateway. Then, the gateway broadcasts the packet in its community.


## 4.4. Privacy-Aware Bid Generation

Upon receiving the power collection request, each power storage unit should prepare a bid with the amount of power it can inject in each time slot. Then, it sends a power request responsePower_Res packet to the corresponding gateway or its upstream smart meter. The bid format of the power storage unit IDi is bi=bi,1,bi,2,…,bi,k, where bi,x represents the number of power units the power storage unit IDi can inject in the x-th time slot at price px for 1≤x≤k. As shown in Figure 2, the packet Power_Res contains the identities of the gateway and the utility company, that is, IDg and IDu. The power storage unit IDi randomly chooses ri∈Zq∗, computes riP0, and attaches riP0 in the packet Power_Res. Note that riP0 is used by IDu in establishing a shared one-time key between IDi and IDu. The power storage unit IDi computes two shared keys as k^i=H2e^PKg,skirirgP0 and ki=H2e^PKu,skiriruP0, which will be used to mask IDi’s bid and ki can enable the utility company to ensure the authenticity and integrity of the aggregated bids without needing to read the individual bid.It is noted that we propose a novel bib aggregation method calledhash-then-addition in the aggregation phase. Corresponding to this method, the power storage unit IDi computes its masked bid as Bi=Bi,1,Bi,2,…,Bi,k, where Bi,x=bi,x+Hx∥k^i+Hx∥ki for 1≤x≤k. It then calculates a signature σi=skiH1Hki∥IDg∥IDu∥riP0∥TS and a message authentication code MACBi=Y∑1≤x≤k‍bi,x. Note that the masked bid can realize privacy protection in the sense of hiding individual bids.


## 4.5. Privacy-Aware Bid Aggregation

Upon receiving all the power request response packets, the gatewayIDg aggregates these packets and sends an aggregated response packet to the utility company IDu. The aggregated packet enjoys the following benefits. Firstly, the power storage unit’s bid privacy is preserved, which is very important in practical applications. For example, it can prevent the utility company from manipulating the power collection price. In fact, what the utility company needs is not the power storage units’ individual power injection data, but the total power amount that can be collected from the community in each time slot. Secondly, the aggregated packet has smaller packet size and hence reduces the required bandwidth for transmitting the data to the utility company. Thirdly, instead of sending one message for each bid, all the bids in different time slots can be collected in one message. In the following, we show how to aggregate the packets considering two different scenarios: a single-hop AMI network and a multihop AMI network.In the case of a single-hop AMI network, upon receiving all thePower_Res packets, IDg computes a secret key k^i=H2e^PKi,skgrgriP0 shared with the power storage unit IDi for 1≤i≤n. We note that k^i=H2e^PKg,skirirgP0=H2e^PKi,skgrgriP0. Then, IDg aggregates the signatures, masked bids, and message authentication codes to generate an aggregated signature σ, an aggregated masked bid B, and an aggregated message authentication code MACB. The aggregated signature is σ=∑1≤i≤n‍σi. The aggregated bid is B=B1,B2,…,Bk, where Bx=∑1≤i≤n‍Bi,x-Hx∥k^i for 1≤x≤k. The aggregated message authentication code is MACB=∏1≤i≤n‍MACBi. Additionally, the gateway IDg randomly chooses R∈Zq∗ and calculates the final message authentication code MACf=MAC1,MAC2, where MAC1=B∥R⊕H3MACB and MAC2=UHBVH(R). MACf will be used by the utility company IDu to ensure that the aggregated bid in each time slot stems from the intended power storage units and it has not been modified in transit. Note that during the verification process, IDu does not need to access the individual bid and hence the power storage unit’s privacy is preserved.In the case of a multihop AMI network, the aggregation process of the signatures and masked bids are done by the SMs in a bottom-up way, as shown in Figure3. Once a SM receives Power_Res packets from its downstream SMs, it first aggregates them with its own data and then sends the aggregated packet to its upstream SM. For example, as shown in Figure 3, SM2 and SM3 send their Power_Res packets to their upstream smart meter SM4. After receiving packets from SM2 and SM3, SM4 aggregates its signature to the received signatures of SM2 and SM3 to generate aggregated signature σ2-4=σ2+σ3+σ4. Then, SM4 aggregates its masked bid to the received masked bids of SM2 and SM3 to generate aggregated masked bid B2-4=B2-4,1,B2-4,2,…,B2-4,k, where B2-4,x=B2,x+B3,x+B4,x for 1≤x≤k. SM4 also aggregates its message authentication code to the received message authentication codes of SM2 and SM3 to generate an aggregated message authentication code MAC(B2-4)=MAC(B2)·MAC(B3)·MAC(B4). Similarly, SM5 generates σ1-5=σ1+σ2-4+σ5, B1-5=(B1-5,1,B1-5,2,…,B1-5,k), where B1-5,x=B1,x+B2-4,x+B5,x for 1≤x≤k, and MAC(B1-5)=MAC(B1)·MAC(B2-4)·MAC(B5). SM8 generates σ6-8=σ6+σ7+σ8, B6-8=(B6-8,1,B6-8,2,…,B6-8,k), where B6-8,x=B6,x+B7,x+B8,x for 1≤x≤k, and MAC(B6-8)=MAC(B6)·MAC(B7)·MAC(B8). Upon receiving response packets from SM5 and SM8, the gateway IDg computes k^i=H2e^PKi,skgrgriP0 for 1≤i≤8, σ=σ1-8=σ1-5+σ6-8, B1-8=(B1-8,1,B1-8,2,…,B1-8,k), where B1-8,x=B1-5,x+B6-8,x for 1≤x≤k, B=B1,B2,…,Bk, where B(x)=B1-8,x-∑1≤i≤8‍H(x∥k^i) for 1≤x≤k, and MAC(B)=MAC(B1-5)·MAC(B6-8). Additionally, the gateway IDg randomly chooses R∈Zq∗ and calculates the final message authentication code MACf=(MAC1,MAC2), where MAC1=B∥R⊕H3MACB and MAC2=UH(B)VH(R).Figure 3
The aggregation way in multihop AMI networks.In any cases, the gatewayIDg attaches {riP0}1≤i≤n to the aggregated response packet, where n is the number of power storage units covered by IDg. Finally, the aggregated response packet is sent to the utility company. Note that only the final message authentication code MACf is sent to the utility company by the gateway.


## 4.6. Privacy-Aware Aggregated Bid Reading

After receiving the power request response packet from the gatewayIDg, the utility company computes a secret key ki=H2e^PKi,skururiP0 shared with the power storage unit IDi for 1≤i≤n. We note that ki=H2e^PKi,skururiP0=H2e^PKu,skiriruP0. For 1≤x≤k, the utility company computes b(x)=B(x)-∑1≤i≤n‍Hx∥ki=∑1≤i≤n‍bi,x, which is the power amount the utility company can collect from the community of IDg in the x-th time slot at price px. Then, the utility company ensures the authenticity and integrity of the recovered data by checking if e^σ,P0=∏1≤i≤n‍e^H1Hki∥IDg∥IDu∥riP0∥TS,PKi. Finally, in order to ensure that the recovered aggregated bids stem from the intended power storage units and they have not been modified in transition, the utility company computes B′∥R′=MAC1⊕H3Y∑1≤x≤k‍bx and checks whether MAC2=UH(B′)VH(R′).


## 5. Security and Privacy Analysis

In this section, we show EPPI can achieve the expected security and privacy goals.


### 5.1. Confidentiality

In the privacy-aware aggregated bid reading phase, for1≤x≤k, the utility company computes b(x)=B(x)-∑1≤i≤n‍Hx∥ki=∑1≤i≤n‍bi,x, which is the power amount the utility company can collect from the community of IDg in the x-th time slot at price px. Then the utility company can know the total amount of power ∑1≤x≤k‍bx injected from the community of IDg. Obviously, the secret keys {ki}1≤i≤n are necessary for the computation of the total amount of power. Therefore, adversaries cannot know the total amount of power. On the other hand, based on the discrete logarithm assumption, it is infeasible for attackers to compute ∑1≤x≤k‍bi,x from MACBi=Y∑1≤x≤k‍bi,x. Also, the gateway fails to recover ∑1≤x≤k‍b(x) from MAC(B)=Y∑1≤x≤k‍b(x).


### 5.2. Privacy Protection

In the privacy-aware bid generation phase, the power storage unitIDi computes its masked bid as Bi=Bi,1,Bi,2,…,Bi,k, where Bi,x=bi,x+Hx∥k^i+Hx∥ki for 1≤x≤k. Because the secret keys k^i and ki are involved in the computation of Bi, any adversaries without knowing k^i or ki cannot know the original bid bi,x even if Bi is given. Although the utility company has the value ki, it fails to recover bi,x in that Hx∥k^i cannot be removed from Bi,x. On the other hand, because the utility company only has the aggregated value B(x)=∑1≤i≤n‍Bi,x-Hx∥k^i, it just gets the sum ∑1≤i≤n‍bi,x by computing b(x)=B(x)-∑1≤i≤n‍Hx∥ki. In this case, the individual bid privacy is still preserved.Furthermore, The use of one-time keysk^i and ki in hash-then-addition aggregation can boost the privacy protection because when the power storage units send the same bids in different cases, the masked bids are completely different and the attacker cannot distinguish the bids. In particular, the time slot parameter x is used in the generation of Bi,x, which makes it impossible for the attacker to calculate the difference between related bids.


### 5.3. Authentication and Integrity

The utility company ensures the authenticity and integrity of the recovered data by checking ife^(σ,P0)=∏1≤i≤n‍e^H1Hki∥IDg∥IDu∥riP0∥TS,PKi. Any modification to a packet content, such as power price, will result in the failure of the signature verification. Signatures can also be used to resist impersonation attacks and external attacks such as denial of service by sending false packets. The attackers cannot impersonate the utility, gateway, or the power storage units because the generation of a valid signature needs a secret key. Based on the discrete logarithm assumption, it is infeasible to compute the secret key ski from the corresponding public key PKi=skiP0 and the signature σi=skiH1(H(ki)∥IDg∥IDu∥riP0∥TS). Besides, we developed a message authentication code based on signature techniques. The gateway IDg randomly chooses R∈Zq∗ and calculates the final message authentication code MACf=(MAC1,MAC2), where MAC1=(B∥R)⊕H3(MAC(B)) and MAC2=UH(B)VH(R). MACf can be used by the utility company IDu to ensure that the aggregated bid in each time slot stems from the intended power storage units and it has not been modified in transit.


### 5.4. Replay Attacks

In the proposed EPPI system, if attackers record valid packets and replay them in a different community or time slot, these replayed packets will be identified and dropped. For one thing, time stamps are used to protect against this replay attacks. For another, the verification ofMACf fails if an attacker replays packets associated with old secret keys. In EPPI, we adopt a key management procedure to enable the utility company to share keys with power storage units. The attackers cannot calculate the keys because the secret number ri is used, which is selected by each power storage unit. It is infeasible to retrieve ri from riP0. Particularly, even if the gateway and some power storage units collude, they cannot achieve the shared secret key between the utility company and a victim because the secret key computation is controlled jointly by the power storage unit and the utility company.


### 5.5. Man-in-the-Middle Attacks

In the proposed EPPI system, suppose an attacker resides between a power storage unit and the utility company. It tries to establish two secret keys to fool the power storage unit and the utility company to believe that they communicate directly, where one key is shared with the utility company and the other is shared with the power storage unit. The secret key agreement procedure is resilient to this attack becauseriP0 and ruP0 are signed by the power storage unit and the utility company, respectively.


### 5.6. Session Key Freshness

It is a very desirable practice to periodically refresh the shared secret keys. In the proposed EPPI system, the secret key management procedure can achieve both forward and backward secrecy, where the attacker cannot derive the previously used session keys nor the future session keys even if the current key is exposed. This is because each time the utility company requests power injection, a new key is computed using one-time random numbersru and ri. Therefore, if an attacker could get one key, this does not help him to know the old or new ones.


## 5.1. Confidentiality

In the privacy-aware aggregated bid reading phase, for1≤x≤k, the utility company computes b(x)=B(x)-∑1≤i≤n‍Hx∥ki=∑1≤i≤n‍bi,x, which is the power amount the utility company can collect from the community of IDg in the x-th time slot at price px. Then the utility company can know the total amount of power ∑1≤x≤k‍bx injected from the community of IDg. Obviously, the secret keys {ki}1≤i≤n are necessary for the computation of the total amount of power. Therefore, adversaries cannot know the total amount of power. On the other hand, based on the discrete logarithm assumption, it is infeasible for attackers to compute ∑1≤x≤k‍bi,x from MACBi=Y∑1≤x≤k‍bi,x. Also, the gateway fails to recover ∑1≤x≤k‍b(x) from MAC(B)=Y∑1≤x≤k‍b(x).


## 5.2. Privacy Protection

In the privacy-aware bid generation phase, the power storage unitIDi computes its masked bid as Bi=Bi,1,Bi,2,…,Bi,k, where Bi,x=bi,x+Hx∥k^i+Hx∥ki for 1≤x≤k. Because the secret keys k^i and ki are involved in the computation of Bi, any adversaries without knowing k^i or ki cannot know the original bid bi,x even if Bi is given. Although the utility company has the value ki, it fails to recover bi,x in that Hx∥k^i cannot be removed from Bi,x. On the other hand, because the utility company only has the aggregated value B(x)=∑1≤i≤n‍Bi,x-Hx∥k^i, it just gets the sum ∑1≤i≤n‍bi,x by computing b(x)=B(x)-∑1≤i≤n‍Hx∥ki. In this case, the individual bid privacy is still preserved.Furthermore, The use of one-time keysk^i and ki in hash-then-addition aggregation can boost the privacy protection because when the power storage units send the same bids in different cases, the masked bids are completely different and the attacker cannot distinguish the bids. In particular, the time slot parameter x is used in the generation of Bi,x, which makes it impossible for the attacker to calculate the difference between related bids.


## 5.3. Authentication and Integrity

The utility company ensures the authenticity and integrity of the recovered data by checking ife^(σ,P0)=∏1≤i≤n‍e^H1Hki∥IDg∥IDu∥riP0∥TS,PKi. Any modification to a packet content, such as power price, will result in the failure of the signature verification. Signatures can also be used to resist impersonation attacks and external attacks such as denial of service by sending false packets. The attackers cannot impersonate the utility, gateway, or the power storage units because the generation of a valid signature needs a secret key. Based on the discrete logarithm assumption, it is infeasible to compute the secret key ski from the corresponding public key PKi=skiP0 and the signature σi=skiH1(H(ki)∥IDg∥IDu∥riP0∥TS). Besides, we developed a message authentication code based on signature techniques. The gateway IDg randomly chooses R∈Zq∗ and calculates the final message authentication code MACf=(MAC1,MAC2), where MAC1=(B∥R)⊕H3(MAC(B)) and MAC2=UH(B)VH(R). MACf can be used by the utility company IDu to ensure that the aggregated bid in each time slot stems from the intended power storage units and it has not been modified in transit.


## 5.4. Replay Attacks

In the proposed EPPI system, if attackers record valid packets and replay them in a different community or time slot, these replayed packets will be identified and dropped. For one thing, time stamps are used to protect against this replay attacks. For another, the verification ofMACf fails if an attacker replays packets associated with old secret keys. In EPPI, we adopt a key management procedure to enable the utility company to share keys with power storage units. The attackers cannot calculate the keys because the secret number ri is used, which is selected by each power storage unit. It is infeasible to retrieve ri from riP0. Particularly, even if the gateway and some power storage units collude, they cannot achieve the shared secret key between the utility company and a victim because the secret key computation is controlled jointly by the power storage unit and the utility company.


## 5.5. Man-in-the-Middle Attacks

In the proposed EPPI system, suppose an attacker resides between a power storage unit and the utility company. It tries to establish two secret keys to fool the power storage unit and the utility company to believe that they communicate directly, where one key is shared with the utility company and the other is shared with the power storage unit. The secret key agreement procedure is resilient to this attack becauseriP0 and ruP0 are signed by the power storage unit and the utility company, respectively.


## 5.6. Session Key Freshness

It is a very desirable practice to periodically refresh the shared secret keys. In the proposed EPPI system, the secret key management procedure can achieve both forward and backward secrecy, where the attacker cannot derive the previously used session keys nor the future session keys even if the current key is exposed. This is because each time the utility company requests power injection, a new key is computed using one-time random numbersru and ri. Therefore, if an attacker could get one key, this does not help him to know the old or new ones.


## 6. Performance Evaluation

In this section, we evaluate the performance of the proposed EPPI scheme in terms of the computation complexity and the communication overhead.


### 6.1. Computation Complexity

As for computation complexity, we will focus on measuring the time required for performing the cryptographic operations in EPPI. Denote the computational costs of a bilinear pairing operation, an exponentiation operation inG, an exponentiation operation in GT, a multiplication operation in G, a multiplication operation in GT, and an addition operation in G by Cp, Ce, Cet, Cm, Cmt, and Ca, respectively.In the proposed EPPI scheme, in order to generate a power collection requestPower_Req=IDu∥IDg∥Infop∥ruP0∥TS∥σu, the utility company needs 2Ce computation cost. In the privacy-aware aggregated bid reading phase, the computation cost for the utility company is (2n+1)Cp+(n+2)Ce+Cet+Cm. In fact, the computation of the secret key ki=H2e^PKi,skururiP0 shared with the power storage unit IDi involves one Cp and one Ce. The authenticity and integrity of the recovered data based on e^(σ,P0)=∏1≤i≤n‍e^(H1(H(ki)∥IDg∥IDu∥riP0∥TS),PKi) involves (n+1)Cp. To compute B′∥R′=MAC1⊕H3Y∑1≤x≤k‍bx, one Cet is needed. The verification based on MAC2=UH(B′)VH(R′) involves 2Ce and Cm. After receiving the packet Power_Req, the gateway verifies the signature by checking if e^(σu,P0)=e^(H1(IDu∥IDg∥Infop∥ruP0∥TS),PKu) holds. Then it computes rgP0. The computation cost in this process is 2Cp+Ce. In the privacy-aware bid aggregation phase, the computation cost for the gateway is nCp+(n+2)Ce+Cm+(n-1)Cmt+(n-1)Ca. Specifically, the aggregated signature is σ=∑1≤i≤n‍σi and it needs (n-1)Ca. The computation of the secret key k^i=H2(e^(PKg,skirirgP0)) involves one Cp and one Ce. The aggregated message authentication code is MAC(B)=∏1≤i≤n‍MAC(Bi) and it needs (n-1)Cmt. The final message authentication code MACf needs 2Ce and Cm. In EPPI, the computation cost for each power storage units is 2Cp+4Ce+Cet. We present the computation cost in Table 1, where UC, GW, and PSU represent the utility company, the gateway, and a power storage unit, respectively.Table 1
Computation complexity of EPPI.
Computation complexity UC ( 2 n + 1 ) C p + ( n + 4 ) C e + C e t + C m GW ( n + 2 ) C p + ( n + 3 ) C e + C m + ( n - 1 ) C m t + ( n - 1 ) C a PSU 2 C p + 4 C e + C e t


### 6.2. Communication Overhead

In the proposed EPPI system, the communications can be divided into four parts, that is, UC-to-GW communication, GW-to-PSU communication, PSU-to-GW communication, and GW-to-UC communication. We assign two bytes for each identity, four bits for each pricepi, five bytes for TS, 20 bytes for q, and 40 bytes for each group element in G and GT. We first consider the UC-to-GW communication, where the utility company generates a power collection request Power_Req and delivers the request to the gateway. The Power_Req packet is of the form IDu∥IDg∥Infop∥ruP0∥TS∥σu. Its size should be k/2+89 bytes if k time slots are adopted. In the GW-to-PSU communication, the Power_Req packet is of the form IDg∥IDu∥Infop∥rgP0∥ruP0∥TS∥σu and the size is k/2+129 bytes. In the PSU-to-GW communication, the power request response Power_Res packet is of the form IDg∥IDu∥riP0∥TS∥σi∥Bi∥MAC(Bi) for the i-th power storage unit. The packet size should be 20k+129 bytes. It is noted that, instead of sending n signatures with a total of 56n bytes, the aggregated signature needs only 56 bytes for any number of storage units. In the GW-to-UC communication, the response message is of the form IDu∥IDg∥{riP0}1≤i≤n∥TS∥σ∥B∥MACf and the size is 40n+40k+109 bytes where n represents the number of power storage units. We present the communication cost in Table 2. As shown in Figures 4 and 5, we plot the communication overhead in terms of the time slot number k and the power storage unit number n.Table 2
Communication overhead of EPPI.
Communication overhead (bytes) UC-to-GW 0.5 k + 89 GW-to-PSU 0.5 k + 129 PSU-to-GW 20 k + 129 GW-to-UC 40 n + 40 k + 109Figure 4
The UC-to-GW, GW-to-PSU, and PUS-to-GW communication overheads of EPPI.Figure 5
The GW-to-UC communication overhead of EPPI.In general, the proposed EPPI scheme is the first secure and privacy-aware power injection scheme and the above analysis indicates that EPPI is efficient in terms of computation and communication cost.


## 6.1. Computation Complexity

As for computation complexity, we will focus on measuring the time required for performing the cryptographic operations in EPPI. Denote the computational costs of a bilinear pairing operation, an exponentiation operation inG, an exponentiation operation in GT, a multiplication operation in G, a multiplication operation in GT, and an addition operation in G by Cp, Ce, Cet, Cm, Cmt, and Ca, respectively.In the proposed EPPI scheme, in order to generate a power collection requestPower_Req=IDu∥IDg∥Infop∥ruP0∥TS∥σu, the utility company needs 2Ce computation cost. In the privacy-aware aggregated bid reading phase, the computation cost for the utility company is (2n+1)Cp+(n+2)Ce+Cet+Cm. In fact, the computation of the secret key ki=H2e^PKi,skururiP0 shared with the power storage unit IDi involves one Cp and one Ce. The authenticity and integrity of the recovered data based on e^(σ,P0)=∏1≤i≤n‍e^(H1(H(ki)∥IDg∥IDu∥riP0∥TS),PKi) involves (n+1)Cp. To compute B′∥R′=MAC1⊕H3Y∑1≤x≤k‍bx, one Cet is needed. The verification based on MAC2=UH(B′)VH(R′) involves 2Ce and Cm. After receiving the packet Power_Req, the gateway verifies the signature by checking if e^(σu,P0)=e^(H1(IDu∥IDg∥Infop∥ruP0∥TS),PKu) holds. Then it computes rgP0. The computation cost in this process is 2Cp+Ce. In the privacy-aware bid aggregation phase, the computation cost for the gateway is nCp+(n+2)Ce+Cm+(n-1)Cmt+(n-1)Ca. Specifically, the aggregated signature is σ=∑1≤i≤n‍σi and it needs (n-1)Ca. The computation of the secret key k^i=H2(e^(PKg,skirirgP0)) involves one Cp and one Ce. The aggregated message authentication code is MAC(B)=∏1≤i≤n‍MAC(Bi) and it needs (n-1)Cmt. The final message authentication code MACf needs 2Ce and Cm. In EPPI, the computation cost for each power storage units is 2Cp+4Ce+Cet. We present the computation cost in Table 1, where UC, GW, and PSU represent the utility company, the gateway, and a power storage unit, respectively.Table 1
Computation complexity of EPPI.
Computation complexity UC ( 2 n + 1 ) C p + ( n + 4 ) C e + C e t + C m GW ( n + 2 ) C p + ( n + 3 ) C e + C m + ( n - 1 ) C m t + ( n - 1 ) C a PSU 2 C p + 4 C e + C e t


## 6.2. Communication Overhead

In the proposed EPPI system, the communications can be divided into four parts, that is, UC-to-GW communication, GW-to-PSU communication, PSU-to-GW communication, and GW-to-UC communication. We assign two bytes for each identity, four bits for each pricepi, five bytes for TS, 20 bytes for q, and 40 bytes for each group element in G and GT. We first consider the UC-to-GW communication, where the utility company generates a power collection request Power_Req and delivers the request to the gateway. The Power_Req packet is of the form IDu∥IDg∥Infop∥ruP0∥TS∥σu. Its size should be k/2+89 bytes if k time slots are adopted. In the GW-to-PSU communication, the Power_Req packet is of the form IDg∥IDu∥Infop∥rgP0∥ruP0∥TS∥σu and the size is k/2+129 bytes. In the PSU-to-GW communication, the power request response Power_Res packet is of the form IDg∥IDu∥riP0∥TS∥σi∥Bi∥MAC(Bi) for the i-th power storage unit. The packet size should be 20k+129 bytes. It is noted that, instead of sending n signatures with a total of 56n bytes, the aggregated signature needs only 56 bytes for any number of storage units. In the GW-to-UC communication, the response message is of the form IDu∥IDg∥{riP0}1≤i≤n∥TS∥σ∥B∥MACf and the size is 40n+40k+109 bytes where n represents the number of power storage units. We present the communication cost in Table 2. As shown in Figures 4 and 5, we plot the communication overhead in terms of the time slot number k and the power storage unit number n.Table 2
Communication overhead of EPPI.
Communication overhead (bytes) UC-to-GW 0.5 k + 89 GW-to-PSU 0.5 k + 129 PSU-to-GW 20 k + 129 GW-to-UC 40 n + 40 k + 109Figure 4
The UC-to-GW, GW-to-PSU, and PUS-to-GW communication overheads of EPPI.Figure 5
The GW-to-UC communication overhead of EPPI.In general, the proposed EPPI scheme is the first secure and privacy-aware power injection scheme and the above analysis indicates that EPPI is efficient in terms of computation and communication cost.


## 7. Conclusions

Aiming to tackle the security and privacy issues of power injection over AMI and 5G, we propose an efficient and privacy-aware power injection scheme based on 5G smart grid network slice. The proposed scheme allows the utility company to recover the total amount of collected power and resists any attacker to read individual power injection bid. Each power storage unit blinds its power injection bid, and all the bids will be aggregated by the local gateway based on a novel aggregation technique calledhash-then-addition. In particular, the utility company can ensure the integrity and authenticity of the collected data. Extensive evaluations indicate that our scheme is secure and privacy-aware and it is efficient in terms of computation and communication cost.



---

*Source: 3680671-2017-01-30.xml*