# A Privacy-Aware Electricity Consumption Data Collection Model Based on Group Blind Signature

Authors: Fengyin Li; Xiao Li; Peiyu Liu; Xueqing Sun; Siqi Yu; Junrong Ge
Journal: Security and Communication Networks
 (2022)

---

## Abstract

Blockchain gives a new method for distributed data ledgering. The smart grid obtains efficient two-way data transmission and information control. It effectively monitors and regulates the grid by collecting real-time electricity consumption data of users. However, online data collection brings privacy leakage. To solve the problem of privacy leakage in the electricity data collection in the smart grid, a privacy-aware electricity data collection model is proposed. Firstly, we propose a new group blind signature scheme by introducing the blind feature into the identity-based encryption method. Secondly, by applying the proposed group blind signature scheme to the electricity data collection process, we propose a privacy-aware electricity data collection model. The proposed model ensures the conditional anonymity and traceability of user identity and the privacy protection and unforgeability of electricity consumption data.


---

## Body

## 1. Introduction

Blockchain technology originated from Satoshi Nakamoto’s paper published in 2008. Blockchain, as a distributed shared ledger and database, in which records are copied and shared among its members, has the characteristics of decentralization, immutability, whole-process traces, openness, and transparency. Blockchain can store large decentralized data with better performance, availability, and scalability. Information leakage and low efficiency of blockchain are key issues that need to be addressed. A smart grid [1] is a new type of grid that combines traditional power grids with communication and information control technologies. It implements the two-way flow of the management information and power between the users and the power service provider. The architecture is shown in Figure 1. The smart grid is composed of four entities: power plant (PP), control center (CC), smart substation (SS), and smart meter (SM). There is a control center, several smart substations, and smart meters in a certain area, and the number of SSs is far less than SMs. Each SS is responsible for delivering power to users in a user area and collecting user electricity consumption data. The SM submits the user’s electricity consumption data to CC by SS. CC analyses users’ electricity consumption data and arranges PP to generate power. The power arrives at SS in the form of high voltage through the high voltage transmission line. SS transforms high voltage power into low voltage power. Then, SS transmits power to a certain user area through the power distribution line.Figure 1
Architecture of smart grid.Privacy protection issues are crucial in various systems, which are related to the reliability and security of the system. Chen et al. [2] proposed a visible routing approach PSSPR to achieve the source location privacy protection in WSNs. Li et al. [3] proposed a strong forward secure ring signature scheme based on RSA and introduced the ring signature into the privacy-aware PKI model, which achieves the privacy protection and user anonymity. Chen et al. [4] proposed a dynamic multi-key FHE scheme based on the LWE assumption in the public key setting. Otherwise, as a new biometric authentication technology, gait recognition [5–7] has attracted more and more researchers’ attention in recent years. Some cloud computing-related works [8, 9] also help with privacy protection and data storage work greatly. In the smart grid, frequent information exchanges between SS and SM bring privacy leakages [10, 11]. The adversary knows the user’s daily schedule by eavesdropping on the electricity consumption data between SS and SM. Therefore, privacy protection in the smart grid receives more attention [12–15]. Zhao et al. [16] proposed a smart and practical privacy-preserving data aggregation scheme with smart pricing and packing method. Zhang et al. [17] proposed a blind signature-aided privacy-preserving power request scheme for a smart grid. The scheme protects the user’s daily schedule. However, when the signature is invalid, CC cannot obtain the identity of the signer. The fine-grained requirements of the CC for electricity consumption data cannot be met. Some data aggregation schemes [18, 19] have been proposed in recent years. It is necessary to propose a method to implement user conditional anonymity and signer’s traceability. In addition, CC obtains fine-grained electricity consumption data and verifies the integrity of the data.Group blind signature technology provides a new way for us to achieve conditional anonymity and privacy protection for users in the smart grid. Group blind signature integrates the characteristics of group signature and blind signature at the same time. It allows the legal group member to anonymously generate signatures on behalf of the group. After the signing activity, the signer uses the group public key to verify the validity of the signature like others. However, he cannot know the signed time and who signed the signature. Due to the high anonymity and the traceability of the group blind signature, more and more new practical schemes [20–22] have been proposed by domestic and foreign scholars. The group signature is applied in the electronic voting system [23], electronic cash system [24], intelligent transportation [25], and other fields to ensure system security. In recent years, the research of combining the group blind signature with quantum cryptography and lattice cryptography is also very popular [26–31].In this study, we apply a new identity-based group blind signature to the privacy-aware electricity consumption data collection model. The model achieves user conditional anonymity and privacy protection. The contributions of this study are listed as follows:(1)
By modifying the member-managing method, a new identity-based group blind signature scheme is proposed. The proposed group blind signature need not save the public keys of group members, which reduce the storage pressure of the system. The scheme effectively revokes the group members without updating the key of group manager and other group members.(2)
Based on the proposed group blind signature scheme, a privacy-aware electricity consumption data collection model is proposed. Group blind signature assures the privacy of the electricity consumption data. In addition, we implement the user’s anonymous authentication and homomorphic verification tags, which ensure the privacy protection of user identity and the integrity of consumption data.The organization of this study is as follows. Section2 shows the preliminaries of this study. In Section 3, we propose a new group blind signature scheme and give its unforgeability proof. Then, we propose a privacy-aware electricity consumption data collection model based on group blind signature in Section 4. Section 5 shows the security and performance analysis of the data collection model. We conclude this study in Section 6.


## 2. Preliminaries

### 2.1. Elliptic Curve Discrete Logarithm Problem

The elliptic curve discrete logarithm problem (ECDLP) is that considering a pointQ of prime order q on the elliptic curve E, if P is a possible point on E. It is difficult to find an s∈Zq∗, which satisfied the equation P=s⋅Q.


### 2.2. Group Blind Signature

A. Lysyanskaya and Z. Ramzan combined group signature and blind signature for the first time in 1998 to design the first group blind signature scheme-Lys98 scheme [32]. They used this scheme to construct an online and anonymous electronic cash system. The entities in the scheme usually contain the group manager, the group member, and the external user.


### 2.3. Homomorphic Tag

Homomorphism refers to mapping from one algebraic structure to another algebraic structure, and the anterior and posterior structure remains unchanged. The homomorphic tag is the tag with the property of homomorphism. Therefore, the tag of any two blocks of data can be computed from the sum of the tags of these two blocks. At the same time, when using the homomorphism tag to verify the integrity of the data, the verification can be completed only by verifying a part of the data block.


## 2.1. Elliptic Curve Discrete Logarithm Problem

The elliptic curve discrete logarithm problem (ECDLP) is that considering a pointQ of prime order q on the elliptic curve E, if P is a possible point on E. It is difficult to find an s∈Zq∗, which satisfied the equation P=s⋅Q.


## 2.2. Group Blind Signature

A. Lysyanskaya and Z. Ramzan combined group signature and blind signature for the first time in 1998 to design the first group blind signature scheme-Lys98 scheme [32]. They used this scheme to construct an online and anonymous electronic cash system. The entities in the scheme usually contain the group manager, the group member, and the external user.


## 2.3. Homomorphic Tag

Homomorphism refers to mapping from one algebraic structure to another algebraic structure, and the anterior and posterior structure remains unchanged. The homomorphic tag is the tag with the property of homomorphism. Therefore, the tag of any two blocks of data can be computed from the sum of the tags of these two blocks. At the same time, when using the homomorphism tag to verify the integrity of the data, the verification can be completed only by verifying a part of the data block.


## 3. New Group Blind Signature Scheme

By introducing the blind feature into identity-based digital signature [33], this study proposes a new group blind signature scheme using the bilinear pairing mapping on the elliptic curve. The identity-based feature of the proposed scheme ensures that the signature system does not need to store the public key of group members. This feature reduces the storage overload of the system. In the new scheme, group members are effectively revoked without changing the key of the group manager and other group members. Security analysis indicates that the new scheme is reliable.


### 3.1. Group Blind Signature Scheme

Bilinear pairing is used to implement the identity-based group blind signature scheme.G1 is an elliptic curve additive cyclic group whose order is a prime number q, and G2 is a multiplicative cyclic group whose order is q. Meanwhile, a bilinear mapping is e:G1×G1⟶G2. In the effective time, the discrete logarithm problem cannot be calculated whether in G1 or G2.


#### 3.1.1. System Initialization

The group manager selects generatorP∈G1 and three one-way hash functions: H1:0,1∗⟶G1,H2:0,1∗⟶Zq∗, and H3:G1⟶Zq∗. He chooses a random number s∈Zq∗ as the private key and calculates PG=s⋅P as his public key. Then, he initializes the group bulletin board E=1 and the corresponding time T. The group manager releases system public parameters G1,G2,P,PG,H1,H2,H3 and announces the product of H2ASIDi on the group bulletin board, denoted as E=∏iH2ASIDi.


#### 3.1.2. Group Member Joining

A new memberUi joins this group. He first submits his real identity SIDi to the group manager. After the group manager verifies the validity of the identity, an anonymous identity code ASIDi is generated. The member’s public key QASIDi and private key DASIDi are as follows:(1)QAIDi=H1ASIDi,DASIDi=s⋅QASIDi.The group manager savesSIDi,ASIDi in his database. Then, he sends the group member’s private key DASIDi and anonymous identity code ASIDi to Ui. At the same time, the group manager updates E=H2ASIDi⋅E=H2ASIDi⋅∏iH2ASIDi. in the group bulletin board.


#### 3.1.3. Group Member Revocation

The group manager updates the timeT and E to revoke the member Uj. CC calculates E:E=H2ASIDj−1⋅E=H2ASIDj−1⋅∏iH2ASIDi, where j∈0,i. At the same time, the group manager updates T to the present time. In this way, the group manager performs a multiplication operation to update E without changing the group public key and the group member key.


#### 3.1.4. Group Blind Signature

For a received message, the group member signs it on behalf of the group. For instance, the signature steps of the group memberASIDi are as follows:(1)
A requester wants to acquire the signature of messagem. He first chooses a random number t1∈Zq∗ and calculates m′=t1H2m. Then, he transmits m′ to ASIDi.(2)
After receivingm′, ASIDi chooses a random number k∈Zq∗ and calculates R1=kP, S1=k−1m′P, and S2=k−1DASIDi. Then, he sends the blind signature σ′=R1,S1,S2,t to requester, where t is the signature time.(3)
requester chooses a random numbert2∈Zq∗ and calculates the signature σ=R,S,t of message m as follows:(2)R=t2R1=t2kP,S=t2−1t1−1S1+H3RS2,=t2−1t1−1k−1m′P+H3Rk−1DASIDi,=t2−1t1−1k−1t1H2mP+H3Rk−1DASIDi,=t2−1k−1H2mP+H3RDASIDi.


#### 3.1.5. Signature Verification

The validity verification of the signatureσ=R,S,t is divided into two steps. Firstly, the verifier selects the corresponding E based on the comparison between time t and T and verifies whether H2ASIDi is divisible by E. If H2ASIDi is not divisible, the signature is invalid. Otherwise, the signer is a member of the group. Then, the verifier uses the group public key PG by comparing eR,S with eP,PH2m⋅ePG,QASIDiH3R to verify the validity of the signature. If the equation holds, σ is a validity signature. Otherwise, σ is invalid.The verification process is as follows:(3)eR,S=et2kP,t2−1k−1H2mP+H3RDASIDi,=eP,H2mP+H3RDASIDi,=eP,PH2m⋅eP,DASIDiH3R,=eP,PH2m⋅eP,s⋅QASIDiH3R,=eP,PH2m⋅ePG,QASIDiH3R.


### 3.2. Security Analysis

The group blind signature scheme proposed in this study satisfies unforgeability, anonymity, traceability, and revocability.


#### 3.2.1. Unforgeability

Theorem 1.
If the ECDLP question is hard, under the existential unforgeability against chosen message attack (EU-CMA) model, the group blind signature scheme is existentially unforgeable.Proof.
We assume thatA is an adversary authorized by a malicious user and able to forge group blind signatures. C is a challenger who uses the adversary’s ability to solve the ECDLP. However, this is contrary to the assumption of ECDLP, so the group blind signature scheme is secure. The group blind signature algorithm is modelled as a signing oracle, and the game is depicted as follows:Setup: challengerC performs the setup algorithm to generate system parameter and transmits it to A. The system parameter includes G1,G2,P,PG,H1,H2,H3. C randomly chooses an integer i∗∈1,l, where l denotes the maximum times of private key queries. Then, C randomly chooses s′∈Zq∗ as the private key, where the private key s′ is equivalent to s. C computes the public key PG=s′⋅P.Hash Queries:A chooses the identity ASIDi and sends to C. C calculates the hash value QASIDi=H1ASIDi and sends it to A.Private Key Queries:A makes the sign private key queries in this stage. C maintains a list of legal signers. When A queries signer’s private key by sending the anonymous identity code ASIDi to C, C checks the list of legal signers. When i=i∗, abort. When i≠i∗, if i,ASIDi,QASIDi,DASIDi exists, C returns QASIDi,DASIDi directly to A. Otherwise, C returns QASIDi=H1ASIDi and DASIDi=s′⋅QASIDi to A and adds i,ASIDi,QASIDi,DASIDi to the list of legal signers.Sign Queries: adversary conducts signature queries at this stage.C prepares a signature list to record all queries and responses. The list is empty at the beginning, and the format is m,Ri,S1i,S2i.A selects the identity ASIDi and message m, requesting the blind signature from C. When A queries the signature of m,ASIDi,QASIDi, if i=i∗, abort. Otherwise, C randomly chooses k∈Zq∗ and returns σi′=Ri,S1i,S2i to A, where Ri=kP, S1i=k−1mP, and S2i=k−1DASIDi. Then, C adds m,Ri,S1i,S2i to the signature list.Outputs:A finally outputs a valid forged signature σ∗=Ri∗,S1i∗,S2i∗ of ASIDi∗ about the message m∗. In addition, A cannot solve the ECDLP problem, so A cannot get s′ from σi′=Ri,S1i,S2i. However, according to assumption A gets the signature σ∗ of message m∗. Therefore, C obtains the solution s′ of ECDLP according to the signature σ∗ and the question previously queried.
Finally,A solves the ECDLP assumption, but ECDLP is a difficult problem that cannot be calculated. Hence, under the difficulty assumption of ECDLP, the proposed group blind signature is existential unforgeability.


#### 3.2.2. Anonymity

The correspondenceSIDi,ASIDi between a group member’s real identity SIDi and his anonymous identity code ASIDi is only known by the group manager. Any other group members and external users cannot obtain it. The group member uses the anonymous identity to sign the message submitted by external users. No one obtains the real identity of the signer except the group manager, which implements the anonymity of the signer.


#### 3.2.3. Traceability

The group member must submit his real identitySIDi to the group manager during the stage of group member joining. Then, he receives the anonymous identity code ASIDi and the private key DASIDi. In this way, he becomes a legal group member and has the ability to sign messages. As long as the group member wants to correctly sign, he must use the anonymous identity code and private key distributed by the group manager. Therefore, the group manager has the ability to trace the real identity of the signer using SIDi,ASIDi stored in his database to achieve traceability.


#### 3.2.4. Revocability

If a group member signs invalidly multiple times, he is identified as a malicious member. In this case, he revoked the group membership by the member revocation algorithm. Then, he loses the ability to sign on behalf of the group. Therefore, the proposed scheme has the revocability of group members.


## 3.1. Group Blind Signature Scheme

Bilinear pairing is used to implement the identity-based group blind signature scheme.G1 is an elliptic curve additive cyclic group whose order is a prime number q, and G2 is a multiplicative cyclic group whose order is q. Meanwhile, a bilinear mapping is e:G1×G1⟶G2. In the effective time, the discrete logarithm problem cannot be calculated whether in G1 or G2.


### 3.1.1. System Initialization

The group manager selects generatorP∈G1 and three one-way hash functions: H1:0,1∗⟶G1,H2:0,1∗⟶Zq∗, and H3:G1⟶Zq∗. He chooses a random number s∈Zq∗ as the private key and calculates PG=s⋅P as his public key. Then, he initializes the group bulletin board E=1 and the corresponding time T. The group manager releases system public parameters G1,G2,P,PG,H1,H2,H3 and announces the product of H2ASIDi on the group bulletin board, denoted as E=∏iH2ASIDi.


### 3.1.2. Group Member Joining

A new memberUi joins this group. He first submits his real identity SIDi to the group manager. After the group manager verifies the validity of the identity, an anonymous identity code ASIDi is generated. The member’s public key QASIDi and private key DASIDi are as follows:(1)QAIDi=H1ASIDi,DASIDi=s⋅QASIDi.The group manager savesSIDi,ASIDi in his database. Then, he sends the group member’s private key DASIDi and anonymous identity code ASIDi to Ui. At the same time, the group manager updates E=H2ASIDi⋅E=H2ASIDi⋅∏iH2ASIDi. in the group bulletin board.


### 3.1.3. Group Member Revocation

The group manager updates the timeT and E to revoke the member Uj. CC calculates E:E=H2ASIDj−1⋅E=H2ASIDj−1⋅∏iH2ASIDi, where j∈0,i. At the same time, the group manager updates T to the present time. In this way, the group manager performs a multiplication operation to update E without changing the group public key and the group member key.


### 3.1.4. Group Blind Signature

For a received message, the group member signs it on behalf of the group. For instance, the signature steps of the group memberASIDi are as follows:(1)
A requester wants to acquire the signature of messagem. He first chooses a random number t1∈Zq∗ and calculates m′=t1H2m. Then, he transmits m′ to ASIDi.(2)
After receivingm′, ASIDi chooses a random number k∈Zq∗ and calculates R1=kP, S1=k−1m′P, and S2=k−1DASIDi. Then, he sends the blind signature σ′=R1,S1,S2,t to requester, where t is the signature time.(3)
requester chooses a random numbert2∈Zq∗ and calculates the signature σ=R,S,t of message m as follows:(2)R=t2R1=t2kP,S=t2−1t1−1S1+H3RS2,=t2−1t1−1k−1m′P+H3Rk−1DASIDi,=t2−1t1−1k−1t1H2mP+H3Rk−1DASIDi,=t2−1k−1H2mP+H3RDASIDi.


### 3.1.5. Signature Verification

The validity verification of the signatureσ=R,S,t is divided into two steps. Firstly, the verifier selects the corresponding E based on the comparison between time t and T and verifies whether H2ASIDi is divisible by E. If H2ASIDi is not divisible, the signature is invalid. Otherwise, the signer is a member of the group. Then, the verifier uses the group public key PG by comparing eR,S with eP,PH2m⋅ePG,QASIDiH3R to verify the validity of the signature. If the equation holds, σ is a validity signature. Otherwise, σ is invalid.The verification process is as follows:(3)eR,S=et2kP,t2−1k−1H2mP+H3RDASIDi,=eP,H2mP+H3RDASIDi,=eP,PH2m⋅eP,DASIDiH3R,=eP,PH2m⋅eP,s⋅QASIDiH3R,=eP,PH2m⋅ePG,QASIDiH3R.


## 3.1.1. System Initialization

The group manager selects generatorP∈G1 and three one-way hash functions: H1:0,1∗⟶G1,H2:0,1∗⟶Zq∗, and H3:G1⟶Zq∗. He chooses a random number s∈Zq∗ as the private key and calculates PG=s⋅P as his public key. Then, he initializes the group bulletin board E=1 and the corresponding time T. The group manager releases system public parameters G1,G2,P,PG,H1,H2,H3 and announces the product of H2ASIDi on the group bulletin board, denoted as E=∏iH2ASIDi.


## 3.1.2. Group Member Joining

A new memberUi joins this group. He first submits his real identity SIDi to the group manager. After the group manager verifies the validity of the identity, an anonymous identity code ASIDi is generated. The member’s public key QASIDi and private key DASIDi are as follows:(1)QAIDi=H1ASIDi,DASIDi=s⋅QASIDi.The group manager savesSIDi,ASIDi in his database. Then, he sends the group member’s private key DASIDi and anonymous identity code ASIDi to Ui. At the same time, the group manager updates E=H2ASIDi⋅E=H2ASIDi⋅∏iH2ASIDi. in the group bulletin board.


## 3.1.3. Group Member Revocation

The group manager updates the timeT and E to revoke the member Uj. CC calculates E:E=H2ASIDj−1⋅E=H2ASIDj−1⋅∏iH2ASIDi, where j∈0,i. At the same time, the group manager updates T to the present time. In this way, the group manager performs a multiplication operation to update E without changing the group public key and the group member key.


## 3.1.4. Group Blind Signature

For a received message, the group member signs it on behalf of the group. For instance, the signature steps of the group memberASIDi are as follows:(1)
A requester wants to acquire the signature of messagem. He first chooses a random number t1∈Zq∗ and calculates m′=t1H2m. Then, he transmits m′ to ASIDi.(2)
After receivingm′, ASIDi chooses a random number k∈Zq∗ and calculates R1=kP, S1=k−1m′P, and S2=k−1DASIDi. Then, he sends the blind signature σ′=R1,S1,S2,t to requester, where t is the signature time.(3)
requester chooses a random numbert2∈Zq∗ and calculates the signature σ=R,S,t of message m as follows:(2)R=t2R1=t2kP,S=t2−1t1−1S1+H3RS2,=t2−1t1−1k−1m′P+H3Rk−1DASIDi,=t2−1t1−1k−1t1H2mP+H3Rk−1DASIDi,=t2−1k−1H2mP+H3RDASIDi.


## 3.1.5. Signature Verification

The validity verification of the signatureσ=R,S,t is divided into two steps. Firstly, the verifier selects the corresponding E based on the comparison between time t and T and verifies whether H2ASIDi is divisible by E. If H2ASIDi is not divisible, the signature is invalid. Otherwise, the signer is a member of the group. Then, the verifier uses the group public key PG by comparing eR,S with eP,PH2m⋅ePG,QASIDiH3R to verify the validity of the signature. If the equation holds, σ is a validity signature. Otherwise, σ is invalid.The verification process is as follows:(3)eR,S=et2kP,t2−1k−1H2mP+H3RDASIDi,=eP,H2mP+H3RDASIDi,=eP,PH2m⋅eP,DASIDiH3R,=eP,PH2m⋅eP,s⋅QASIDiH3R,=eP,PH2m⋅ePG,QASIDiH3R.


## 3.2. Security Analysis

The group blind signature scheme proposed in this study satisfies unforgeability, anonymity, traceability, and revocability.


### 3.2.1. Unforgeability

Theorem 1.
If the ECDLP question is hard, under the existential unforgeability against chosen message attack (EU-CMA) model, the group blind signature scheme is existentially unforgeable.Proof.
We assume thatA is an adversary authorized by a malicious user and able to forge group blind signatures. C is a challenger who uses the adversary’s ability to solve the ECDLP. However, this is contrary to the assumption of ECDLP, so the group blind signature scheme is secure. The group blind signature algorithm is modelled as a signing oracle, and the game is depicted as follows:Setup: challengerC performs the setup algorithm to generate system parameter and transmits it to A. The system parameter includes G1,G2,P,PG,H1,H2,H3. C randomly chooses an integer i∗∈1,l, where l denotes the maximum times of private key queries. Then, C randomly chooses s′∈Zq∗ as the private key, where the private key s′ is equivalent to s. C computes the public key PG=s′⋅P.Hash Queries:A chooses the identity ASIDi and sends to C. C calculates the hash value QASIDi=H1ASIDi and sends it to A.Private Key Queries:A makes the sign private key queries in this stage. C maintains a list of legal signers. When A queries signer’s private key by sending the anonymous identity code ASIDi to C, C checks the list of legal signers. When i=i∗, abort. When i≠i∗, if i,ASIDi,QASIDi,DASIDi exists, C returns QASIDi,DASIDi directly to A. Otherwise, C returns QASIDi=H1ASIDi and DASIDi=s′⋅QASIDi to A and adds i,ASIDi,QASIDi,DASIDi to the list of legal signers.Sign Queries: adversary conducts signature queries at this stage.C prepares a signature list to record all queries and responses. The list is empty at the beginning, and the format is m,Ri,S1i,S2i.A selects the identity ASIDi and message m, requesting the blind signature from C. When A queries the signature of m,ASIDi,QASIDi, if i=i∗, abort. Otherwise, C randomly chooses k∈Zq∗ and returns σi′=Ri,S1i,S2i to A, where Ri=kP, S1i=k−1mP, and S2i=k−1DASIDi. Then, C adds m,Ri,S1i,S2i to the signature list.Outputs:A finally outputs a valid forged signature σ∗=Ri∗,S1i∗,S2i∗ of ASIDi∗ about the message m∗. In addition, A cannot solve the ECDLP problem, so A cannot get s′ from σi′=Ri,S1i,S2i. However, according to assumption A gets the signature σ∗ of message m∗. Therefore, C obtains the solution s′ of ECDLP according to the signature σ∗ and the question previously queried.
Finally,A solves the ECDLP assumption, but ECDLP is a difficult problem that cannot be calculated. Hence, under the difficulty assumption of ECDLP, the proposed group blind signature is existential unforgeability.


### 3.2.2. Anonymity

The correspondenceSIDi,ASIDi between a group member’s real identity SIDi and his anonymous identity code ASIDi is only known by the group manager. Any other group members and external users cannot obtain it. The group member uses the anonymous identity to sign the message submitted by external users. No one obtains the real identity of the signer except the group manager, which implements the anonymity of the signer.


### 3.2.3. Traceability

The group member must submit his real identitySIDi to the group manager during the stage of group member joining. Then, he receives the anonymous identity code ASIDi and the private key DASIDi. In this way, he becomes a legal group member and has the ability to sign messages. As long as the group member wants to correctly sign, he must use the anonymous identity code and private key distributed by the group manager. Therefore, the group manager has the ability to trace the real identity of the signer using SIDi,ASIDi stored in his database to achieve traceability.


### 3.2.4. Revocability

If a group member signs invalidly multiple times, he is identified as a malicious member. In this case, he revoked the group membership by the member revocation algorithm. Then, he loses the ability to sign on behalf of the group. Therefore, the proposed scheme has the revocability of group members.


## 3.2.1. Unforgeability

Theorem 1.
If the ECDLP question is hard, under the existential unforgeability against chosen message attack (EU-CMA) model, the group blind signature scheme is existentially unforgeable.Proof.
We assume thatA is an adversary authorized by a malicious user and able to forge group blind signatures. C is a challenger who uses the adversary’s ability to solve the ECDLP. However, this is contrary to the assumption of ECDLP, so the group blind signature scheme is secure. The group blind signature algorithm is modelled as a signing oracle, and the game is depicted as follows:Setup: challengerC performs the setup algorithm to generate system parameter and transmits it to A. The system parameter includes G1,G2,P,PG,H1,H2,H3. C randomly chooses an integer i∗∈1,l, where l denotes the maximum times of private key queries. Then, C randomly chooses s′∈Zq∗ as the private key, where the private key s′ is equivalent to s. C computes the public key PG=s′⋅P.Hash Queries:A chooses the identity ASIDi and sends to C. C calculates the hash value QASIDi=H1ASIDi and sends it to A.Private Key Queries:A makes the sign private key queries in this stage. C maintains a list of legal signers. When A queries signer’s private key by sending the anonymous identity code ASIDi to C, C checks the list of legal signers. When i=i∗, abort. When i≠i∗, if i,ASIDi,QASIDi,DASIDi exists, C returns QASIDi,DASIDi directly to A. Otherwise, C returns QASIDi=H1ASIDi and DASIDi=s′⋅QASIDi to A and adds i,ASIDi,QASIDi,DASIDi to the list of legal signers.Sign Queries: adversary conducts signature queries at this stage.C prepares a signature list to record all queries and responses. The list is empty at the beginning, and the format is m,Ri,S1i,S2i.A selects the identity ASIDi and message m, requesting the blind signature from C. When A queries the signature of m,ASIDi,QASIDi, if i=i∗, abort. Otherwise, C randomly chooses k∈Zq∗ and returns σi′=Ri,S1i,S2i to A, where Ri=kP, S1i=k−1mP, and S2i=k−1DASIDi. Then, C adds m,Ri,S1i,S2i to the signature list.Outputs:A finally outputs a valid forged signature σ∗=Ri∗,S1i∗,S2i∗ of ASIDi∗ about the message m∗. In addition, A cannot solve the ECDLP problem, so A cannot get s′ from σi′=Ri,S1i,S2i. However, according to assumption A gets the signature σ∗ of message m∗. Therefore, C obtains the solution s′ of ECDLP according to the signature σ∗ and the question previously queried.
Finally,A solves the ECDLP assumption, but ECDLP is a difficult problem that cannot be calculated. Hence, under the difficulty assumption of ECDLP, the proposed group blind signature is existential unforgeability.


## 3.2.2. Anonymity

The correspondenceSIDi,ASIDi between a group member’s real identity SIDi and his anonymous identity code ASIDi is only known by the group manager. Any other group members and external users cannot obtain it. The group member uses the anonymous identity to sign the message submitted by external users. No one obtains the real identity of the signer except the group manager, which implements the anonymity of the signer.


## 3.2.3. Traceability

The group member must submit his real identitySIDi to the group manager during the stage of group member joining. Then, he receives the anonymous identity code ASIDi and the private key DASIDi. In this way, he becomes a legal group member and has the ability to sign messages. As long as the group member wants to correctly sign, he must use the anonymous identity code and private key distributed by the group manager. Therefore, the group manager has the ability to trace the real identity of the signer using SIDi,ASIDi stored in his database to achieve traceability.


## 3.2.4. Revocability

If a group member signs invalidly multiple times, he is identified as a malicious member. In this case, he revoked the group membership by the member revocation algorithm. Then, he loses the ability to sign on behalf of the group. Therefore, the proposed scheme has the revocability of group members.


## 4. A Privacy-Aware Electricity Consumption Data Collection Model Based on Group Blind Signature

By introducing the proposed group blind signature scheme into electricity consumption data collection, we propose a privacy-aware electricity consumption data collection model. The detail of the proposed model is as follows.


### 4.1. System Model

The system model in this study is shown in Figure2, which involves three entities: control center (CC), smart substation (SS), and smart meter (SM). The working relationships and security requirements of the entities are as follows.Figure 2
System model.


#### 4.1.1. Control Center

CC generates system parameters, registers entities, verifies the electricity consumption data, and traces other entities conditionally. If the signature and electricity data verification is invalid, CC traces the identity of the signer and user. CC exists in two forms, which are a fixed server located in the power plant and servers distributed in different places. CC needs to be highly credible.


#### 4.1.2. Smart Substation

SS directly communicates with SM, verifies the user’s identity, and generates the blind signature. SS does not know the user’s real identity when he interacts with the user. SS needs to perform anonymous authentication on the user. SSs are fixed in certain places, generally.


#### 4.1.3. Smart Meter

SM sends the regular electricity consumption data to CC. However, the electricity data may be tampered with within this process. Therefore, a reliable mechanism is needed to prevent the user’s electricity data. SMs are installed in users’ homes.


### 4.2. Adversary Model

The adversary model contains two main types of adversaries. One is the external adversary who is not in the data collection model. The other is the internal adversary who has the user’s identity in the data collection model:(1)
The external adversary obtains electricity consumption data by eavesdropping on the channel between SM and SS. The malicious forgery and replacement by the adversary threaten the integrity of the data.(2)
The internal adversary contains two types. One is the curious user who wants to acquire other users’ electricity consumption data, but they do not tamper with any data. The other is the malicious user who tampers with his electricity consumption data.


### 4.3. Privacy-Aware Electricity Consumption Data Collection Model Based on Group Blind Signature

To protect the privacy of the user’s identity and the electricity consumption data, an identity-based group blind signature scheme is used in the electricity consumption data collection model. CC and SSs form a group. SSs are group members, and CC is the group manager. We use the Schnorr identification protocol and the homomorphic verifiable tag mechanism to implement the anonymity of the user and the integrity verification of the electricity data. At the same time, the group blind signature mechanism ensures the traceability of the signer.The notations used in this study are shown in Table1.Table 1
Description of notations in this study.
NotationsDescriptionsq, pThe large primesG1The cyclic additive groupG2The cyclic multiplicative groupeBilinear pairingPA generator pointZq∗Nonzero integers not larger thanqH⋅One-way hash functionsPrivate key of group managerPGPublic key of group manager, wherePG=s⋅PTThe time of announcementE in the group bulletin boardEThe product of hashes of anonymous group membersSIDiReal identity code of the group memberASIDiAnonymous identity code of the group memberDASIDiPublic key of group member, whereDASIDi=s⋅QASIDiQASIDiPrivate key of group membermThe original message to be signedm′The blinded messagekThe random integer numbert1,t2The blind factorsσ′Blind signatureσDigital signature formnProduct of two large prime numbers, wheren=pqgPrimitive root of the modularnaGroup public key, which is public key of RSAbGroup private key, which is public key of RSAxPrivate key of group manageryPublic key of group managerinforiThe information of usergtiEncrypted value after user information has been hashed, wheregti=HinforixmodnwiThe random integer numberIiThe pseudonym of userλSecurity parameters of the electricity consumption data blocks generated by smart metersstkThe private key of tagptkThe public key of tagmxjThe random value chosen bySMujThe value needed to compute the tag is the same for each data blocktagiThe value of tag for data blockMThe encrypted value of electricity data and the corresponding tagTGMultiplicative value of data block labels in a dayMGjThe sum of the electricity data of jth dimension in a dayDGMultiplications of bilinear pairing operation values for each data blockHSThe cumulative product of the hash value in a dayIn particular, the data collection model includes six stages: system initialization, anonymous identity authentication and data reporting, blind signature on reported electricity consumption data, data integrity verification and identity tracing, group member joining, and group member revocation. Figure3 shows the framework of the data collection model.Figure 3
Framework of the data collection model.


#### 4.3.1. System Initialization

In this stage, CC first generates system parameters. Then, the SS uses the real identity to apply for the group member private key and anonymous identity code. After CC verifies the identity of the SS, he distributes the anonymous identity code and the group member private key to the SS. CC saves the real identity and anonymous identity of SS in the database. SM also delivers its real information to CC and generates its own pseudonym. CC saves the real identity and pseudonym of SM in the database. The data stored by CC, SS, and SM are, respectively, shown in Tables2–4.(1)
Generating System Parameters.(i)
CC computesn=pq, where p and q are two different large primes that meet p|q−1.(ii)
CC computes the group public keya and the private key b, where a,b satisfies the key pair property of RSA, namely ab≡1modϕn.(iii)
CC chooses a random numberx∈2,n−2 and computes y=gxmodn, where g is a primitive root of the modular n. y and x are the public key and private key of the group manager, respectively.(iv)
CC chooses generatorP∈G1 and three one-way hash functions: H:0,1∗⟶0,1k,H1:0,1∗⟶G1, H2:0,1∗⟶Zq∗, and H3:G1⟶Zq∗.(v)
CC chooses a random numbers∈Zq∗ as the system private key and computes PG=s⋅P as the system public key. CC initializes the group bulletin board E=1 and the corresponding time T. Then, CC releases system public parameters G1,G2,P,PG,n,g,H1,H2,H3,a,y and announces the time T and product of H2ASIDi on the group bulletin board, denoted as E=∏iH2ASIDi.(2)
Registering Stage.(i)
IfSSi wants to become a group member, he first submits real identity SIDi to CC. After CC verifies the validity of the identity, an anonymous identity code ASIDi is generated. Then, CC calculates public key QASIDi and private key DASIDi for SSi as follows:(4)QASIDi=H1ASIDi,DASIDi=s⋅QASIDi.CC encrypts the real identity of the group member with the group public keya and saves SIDia,ASIDi in the database. Then, CC updates E=H2ASIDi⋅E.(ii)
If a new userUseri wants to participate in the smart grid. He first acquires infori=IDiaddresstimestack. Then, he encrypts his information infori into inforia and sends it to CC. CC stores inforia in his database and calculates gti=Hinforixmodn sending it to Useri. The smart meters are distributed to users by CC. SMi chooses a random number wi to compute his pseudonym Ii=gwimodn. SMi sends Ii to CC.Table 2
Data stored by CC.
DefinitionSymbolGroup public/private keya,bGroup manager public/private keyy,xSystem public/private keyPG,sThe group bulletin boardEThe information of smart substationSSi<SIDia,ASIDi>QASIDi,DASIDiThe information of smart meterSMiinforiaHinforixgtiIiM,σTable 3
Data stored bySSi.
DefinitionSymbolAnonymous identity codeASIDiPublic/private keyQASIDi,DASIDiThe pseudonym ofSMiIiThe blind signatureσ′Table 4
Data stored bySMi.
DefinitionSymbolThe information of userinforiThe encrypted value of the information hashgtiRandom numberwiPseudonymIiPublic/private tag keyptk,stkElectricity consumption data blockand corresponding tagm,TagThe blind signature and signature of electricity consumption dataσ′,σ


#### 4.3.2. Anonymous Identity Authentication and Data Reporting

In this stage, by the Schnorr identity authentication protocol, SM proves his legitimacy to SS under the condition of anonymity. Then, SM generates electricity consumption data blocks for a whole period. He calculates the data tag for each data block to ensure the integrity of data.(1) Anonymous Identity Authentication. SS is not completely trusted in the model. When SM interacts with SS, the real identity of SM needs to be hidden. Therefore, the Schnorr identity authentication protocol is used to verify the legitimacy of SM. The authentication process is shown in Figure 4.Figure 4
Anonymous identity authentication.Figure 5
Structure of electricity consumption data.(2) Data Reporting. SS believes in the legitimacy of SM by anonymous identity authentication. Then, SM sends the encrypted electricity consumption data to SS. We take the example of Userk encrypting and reporting electricity consumption data in one day. The whole day’s data are m.(i)
The data blocks generated in a day are restricted by the security parameterλ. We set the security parameter λ to 24, and SM generates 24 data blocks in one day. The structure of data blocks generated in one day is shown in Figure 5. Each data block mi represents one hour of electricity consumption data and has a corresponding tag tagi. l-Dimensional attribute values are contained in each data block.(ii)
SMk randomly chooses the private tag key stk∈Zq∗ and computes ptk=gtkstkmodn as the public tag key.(iii)
SMk chooses l values mx1,mx2,mx3,……,mxl, randomly. Then, SMk computes uj=gtkmxjmodn, where j∈1,l. SMk calculates tagi=HMIDi⋅∏j=1lujmijstk for each data block mi, where MID represents the data’s summary and mij means the jth dimension attribute value of the ith data block. SMk gets the tag set Tag=tag1,tag2,tag3,……,tagi, where the i∈1,24/λ.(iv)
SMk computes M=mTaga using the group public key a and calculates H2m.


#### 4.3.3. Blind Signature on Reported Electricity Consumption Data

In this stage, SM needs to get blind signature from SS. Then, SM reports the electricity consumption data and the signature to CC.SS signs the electricity consumption data by the signature method provided in Section3. SS sends the blind signature σ' to SM. SM removes the blind factor to get the signature σ. Then, SM sends σ and M to CC together. The signature generation process is shown in Figure 6.Figure 6
Generate the signature.


#### 4.3.4. Data Integrity Verification and Identity Traceability

In this stage, CC verifies the validity of the signature and the integrity of data. Firstly, CC verifies the signature. If equation (1) holds, the signature is valid, it indicates that m has not been modified during the transmission process after being signed by SS. Otherwise, the signature is invalid. CC traces the signer’s identity. Next, CC verifies the data integrity. CC uses Tag to check the integrity of the electricity consumption data. If equation (6) holds, the data are integral. Otherwise, the data have been modified. CC determines who tampered with the data. It is possible that the user or adversary has tampered with m before transmission. Therefore, CC obtains gtk corresponding to M. CC compares gtk with gti calculated using the user’s real information stored in his database. If gtk is in CC’s database, it indicates that the user tampers with the data. Otherwise, the adversary tampers with the data. The flow chart of signature verification and identity tracing is shown in Figure 7.Figure 7
Flow chart of signature verification and identity tracing.(1) The Verification of Signature and Data. The verifier uses the group public key PG to verify the validity of the signature σ=R,S,t. σ is the signature of M by the anonymous member ASIDi.(i)
After receiving theM, CC gets the electricity consumption data m by decrypting the M. Then, CC computes H2m and the member’s signature public key QASIDi=H2ASIDi.(ii)
According to the comparison between timet and T, CC selects the corresponding E and verifies whether H2ASIDi is divisible by E. If H2ASIDi is not divisible, the signature is invalid. Otherwise, the signer is a member of the group. Then, CC uses equation 1 to verify the validity of the signature. If equation 1 holds, the signature is valid. Otherwise, the signature is invalid.(5)eR,S=eP,PH2m⋅ePG,QASIDiH3R.(iii)
If the signature is valid, CC verifies the integrity ofM. CC decrypts M to get Tag, m,uj and calculates the following equations:(6)TG=∏i=124/λtagi,MGj=∑i=124/λmij,DG=∏j=1leuj,ptkMGj,HS=∏i=124/λhMIDi.(iv)
CC verifies whether equation6 holds every 24 hours:(7)DG⋅eHS,ptk=eTG,gtk.(v)
If equation6 holds, the data have not been modified by the user or the adversary before transmission. Otherwise, the data have been modified.(2) Tracing the Signer and the User.(i)
If equation (1) does not hold, CC traces the signer’s identity. The SIDia,ASIDi is saved in CC’s database during the phase of group members joining. Therefore, CC uses the group private key b to decrypt SIDia to obtain SIDi.(ii)
If equation (1) holds and equation (6) does not hold, CC traces the user’s identity to know who modified the data. CC uses the group private key b to decrypt inforia stored in his database to obtain infori. Then, CC calculates gti with the decrypted information one by one.(8)gti=Hinforixmodn=HIDiaddresstimestackxmodn.Furthermore, CC comparesgti with gtk, which is corresponding to M to ensure the user’s identity.


#### 4.3.5. Joining of Group Members

A new memberSSi joins the group. SSi first sends his real identity SIDi to CC through a reliable channel. CC generates an anonymous identity code ASIDi, the public key QASIDi and the private key DASIDi for the new member SSi. Then, CC updates E=H2ASIDi⋅E=H2ASIDi⋅∏iH2ASIDi in the group bulletin board.


#### 4.3.6. Revocation of Group Members

CC updates the timeT and E published on the group bulletin board to revoke the member SSj. CC calculates the corresponding E=H2ASIDj−1⋅∏iH2ASIDi at time T, where j∈0,i.


## 4.1. System Model

The system model in this study is shown in Figure2, which involves three entities: control center (CC), smart substation (SS), and smart meter (SM). The working relationships and security requirements of the entities are as follows.Figure 2
System model.


### 4.1.1. Control Center

CC generates system parameters, registers entities, verifies the electricity consumption data, and traces other entities conditionally. If the signature and electricity data verification is invalid, CC traces the identity of the signer and user. CC exists in two forms, which are a fixed server located in the power plant and servers distributed in different places. CC needs to be highly credible.


### 4.1.2. Smart Substation

SS directly communicates with SM, verifies the user’s identity, and generates the blind signature. SS does not know the user’s real identity when he interacts with the user. SS needs to perform anonymous authentication on the user. SSs are fixed in certain places, generally.


### 4.1.3. Smart Meter

SM sends the regular electricity consumption data to CC. However, the electricity data may be tampered with within this process. Therefore, a reliable mechanism is needed to prevent the user’s electricity data. SMs are installed in users’ homes.


## 4.1.1. Control Center

CC generates system parameters, registers entities, verifies the electricity consumption data, and traces other entities conditionally. If the signature and electricity data verification is invalid, CC traces the identity of the signer and user. CC exists in two forms, which are a fixed server located in the power plant and servers distributed in different places. CC needs to be highly credible.


## 4.1.2. Smart Substation

SS directly communicates with SM, verifies the user’s identity, and generates the blind signature. SS does not know the user’s real identity when he interacts with the user. SS needs to perform anonymous authentication on the user. SSs are fixed in certain places, generally.


## 4.1.3. Smart Meter

SM sends the regular electricity consumption data to CC. However, the electricity data may be tampered with within this process. Therefore, a reliable mechanism is needed to prevent the user’s electricity data. SMs are installed in users’ homes.


## 4.2. Adversary Model

The adversary model contains two main types of adversaries. One is the external adversary who is not in the data collection model. The other is the internal adversary who has the user’s identity in the data collection model:(1)
The external adversary obtains electricity consumption data by eavesdropping on the channel between SM and SS. The malicious forgery and replacement by the adversary threaten the integrity of the data.(2)
The internal adversary contains two types. One is the curious user who wants to acquire other users’ electricity consumption data, but they do not tamper with any data. The other is the malicious user who tampers with his electricity consumption data.


## 4.3. Privacy-Aware Electricity Consumption Data Collection Model Based on Group Blind Signature

To protect the privacy of the user’s identity and the electricity consumption data, an identity-based group blind signature scheme is used in the electricity consumption data collection model. CC and SSs form a group. SSs are group members, and CC is the group manager. We use the Schnorr identification protocol and the homomorphic verifiable tag mechanism to implement the anonymity of the user and the integrity verification of the electricity data. At the same time, the group blind signature mechanism ensures the traceability of the signer.The notations used in this study are shown in Table1.Table 1
Description of notations in this study.
NotationsDescriptionsq, pThe large primesG1The cyclic additive groupG2The cyclic multiplicative groupeBilinear pairingPA generator pointZq∗Nonzero integers not larger thanqH⋅One-way hash functionsPrivate key of group managerPGPublic key of group manager, wherePG=s⋅PTThe time of announcementE in the group bulletin boardEThe product of hashes of anonymous group membersSIDiReal identity code of the group memberASIDiAnonymous identity code of the group memberDASIDiPublic key of group member, whereDASIDi=s⋅QASIDiQASIDiPrivate key of group membermThe original message to be signedm′The blinded messagekThe random integer numbert1,t2The blind factorsσ′Blind signatureσDigital signature formnProduct of two large prime numbers, wheren=pqgPrimitive root of the modularnaGroup public key, which is public key of RSAbGroup private key, which is public key of RSAxPrivate key of group manageryPublic key of group managerinforiThe information of usergtiEncrypted value after user information has been hashed, wheregti=HinforixmodnwiThe random integer numberIiThe pseudonym of userλSecurity parameters of the electricity consumption data blocks generated by smart metersstkThe private key of tagptkThe public key of tagmxjThe random value chosen bySMujThe value needed to compute the tag is the same for each data blocktagiThe value of tag for data blockMThe encrypted value of electricity data and the corresponding tagTGMultiplicative value of data block labels in a dayMGjThe sum of the electricity data of jth dimension in a dayDGMultiplications of bilinear pairing operation values for each data blockHSThe cumulative product of the hash value in a dayIn particular, the data collection model includes six stages: system initialization, anonymous identity authentication and data reporting, blind signature on reported electricity consumption data, data integrity verification and identity tracing, group member joining, and group member revocation. Figure3 shows the framework of the data collection model.Figure 3
Framework of the data collection model.


### 4.3.1. System Initialization

In this stage, CC first generates system parameters. Then, the SS uses the real identity to apply for the group member private key and anonymous identity code. After CC verifies the identity of the SS, he distributes the anonymous identity code and the group member private key to the SS. CC saves the real identity and anonymous identity of SS in the database. SM also delivers its real information to CC and generates its own pseudonym. CC saves the real identity and pseudonym of SM in the database. The data stored by CC, SS, and SM are, respectively, shown in Tables2–4.(1)
Generating System Parameters.(i)
CC computesn=pq, where p and q are two different large primes that meet p|q−1.(ii)
CC computes the group public keya and the private key b, where a,b satisfies the key pair property of RSA, namely ab≡1modϕn.(iii)
CC chooses a random numberx∈2,n−2 and computes y=gxmodn, where g is a primitive root of the modular n. y and x are the public key and private key of the group manager, respectively.(iv)
CC chooses generatorP∈G1 and three one-way hash functions: H:0,1∗⟶0,1k,H1:0,1∗⟶G1, H2:0,1∗⟶Zq∗, and H3:G1⟶Zq∗.(v)
CC chooses a random numbers∈Zq∗ as the system private key and computes PG=s⋅P as the system public key. CC initializes the group bulletin board E=1 and the corresponding time T. Then, CC releases system public parameters G1,G2,P,PG,n,g,H1,H2,H3,a,y and announces the time T and product of H2ASIDi on the group bulletin board, denoted as E=∏iH2ASIDi.(2)
Registering Stage.(i)
IfSSi wants to become a group member, he first submits real identity SIDi to CC. After CC verifies the validity of the identity, an anonymous identity code ASIDi is generated. Then, CC calculates public key QASIDi and private key DASIDi for SSi as follows:(4)QASIDi=H1ASIDi,DASIDi=s⋅QASIDi.CC encrypts the real identity of the group member with the group public keya and saves SIDia,ASIDi in the database. Then, CC updates E=H2ASIDi⋅E.(ii)
If a new userUseri wants to participate in the smart grid. He first acquires infori=IDiaddresstimestack. Then, he encrypts his information infori into inforia and sends it to CC. CC stores inforia in his database and calculates gti=Hinforixmodn sending it to Useri. The smart meters are distributed to users by CC. SMi chooses a random number wi to compute his pseudonym Ii=gwimodn. SMi sends Ii to CC.Table 2
Data stored by CC.
DefinitionSymbolGroup public/private keya,bGroup manager public/private keyy,xSystem public/private keyPG,sThe group bulletin boardEThe information of smart substationSSi<SIDia,ASIDi>QASIDi,DASIDiThe information of smart meterSMiinforiaHinforixgtiIiM,σTable 3
Data stored bySSi.
DefinitionSymbolAnonymous identity codeASIDiPublic/private keyQASIDi,DASIDiThe pseudonym ofSMiIiThe blind signatureσ′Table 4
Data stored bySMi.
DefinitionSymbolThe information of userinforiThe encrypted value of the information hashgtiRandom numberwiPseudonymIiPublic/private tag keyptk,stkElectricity consumption data blockand corresponding tagm,TagThe blind signature and signature of electricity consumption dataσ′,σ


### 4.3.2. Anonymous Identity Authentication and Data Reporting

In this stage, by the Schnorr identity authentication protocol, SM proves his legitimacy to SS under the condition of anonymity. Then, SM generates electricity consumption data blocks for a whole period. He calculates the data tag for each data block to ensure the integrity of data.(1) Anonymous Identity Authentication. SS is not completely trusted in the model. When SM interacts with SS, the real identity of SM needs to be hidden. Therefore, the Schnorr identity authentication protocol is used to verify the legitimacy of SM. The authentication process is shown in Figure 4.Figure 4
Anonymous identity authentication.Figure 5
Structure of electricity consumption data.(2) Data Reporting. SS believes in the legitimacy of SM by anonymous identity authentication. Then, SM sends the encrypted electricity consumption data to SS. We take the example of Userk encrypting and reporting electricity consumption data in one day. The whole day’s data are m.(i)
The data blocks generated in a day are restricted by the security parameterλ. We set the security parameter λ to 24, and SM generates 24 data blocks in one day. The structure of data blocks generated in one day is shown in Figure 5. Each data block mi represents one hour of electricity consumption data and has a corresponding tag tagi. l-Dimensional attribute values are contained in each data block.(ii)
SMk randomly chooses the private tag key stk∈Zq∗ and computes ptk=gtkstkmodn as the public tag key.(iii)
SMk chooses l values mx1,mx2,mx3,……,mxl, randomly. Then, SMk computes uj=gtkmxjmodn, where j∈1,l. SMk calculates tagi=HMIDi⋅∏j=1lujmijstk for each data block mi, where MID represents the data’s summary and mij means the jth dimension attribute value of the ith data block. SMk gets the tag set Tag=tag1,tag2,tag3,……,tagi, where the i∈1,24/λ.(iv)
SMk computes M=mTaga using the group public key a and calculates H2m.


### 4.3.3. Blind Signature on Reported Electricity Consumption Data

In this stage, SM needs to get blind signature from SS. Then, SM reports the electricity consumption data and the signature to CC.SS signs the electricity consumption data by the signature method provided in Section3. SS sends the blind signature σ' to SM. SM removes the blind factor to get the signature σ. Then, SM sends σ and M to CC together. The signature generation process is shown in Figure 6.Figure 6
Generate the signature.


### 4.3.4. Data Integrity Verification and Identity Traceability

In this stage, CC verifies the validity of the signature and the integrity of data. Firstly, CC verifies the signature. If equation (1) holds, the signature is valid, it indicates that m has not been modified during the transmission process after being signed by SS. Otherwise, the signature is invalid. CC traces the signer’s identity. Next, CC verifies the data integrity. CC uses Tag to check the integrity of the electricity consumption data. If equation (6) holds, the data are integral. Otherwise, the data have been modified. CC determines who tampered with the data. It is possible that the user or adversary has tampered with m before transmission. Therefore, CC obtains gtk corresponding to M. CC compares gtk with gti calculated using the user’s real information stored in his database. If gtk is in CC’s database, it indicates that the user tampers with the data. Otherwise, the adversary tampers with the data. The flow chart of signature verification and identity tracing is shown in Figure 7.Figure 7
Flow chart of signature verification and identity tracing.(1) The Verification of Signature and Data. The verifier uses the group public key PG to verify the validity of the signature σ=R,S,t. σ is the signature of M by the anonymous member ASIDi.(i)
After receiving theM, CC gets the electricity consumption data m by decrypting the M. Then, CC computes H2m and the member’s signature public key QASIDi=H2ASIDi.(ii)
According to the comparison between timet and T, CC selects the corresponding E and verifies whether H2ASIDi is divisible by E. If H2ASIDi is not divisible, the signature is invalid. Otherwise, the signer is a member of the group. Then, CC uses equation 1 to verify the validity of the signature. If equation 1 holds, the signature is valid. Otherwise, the signature is invalid.(5)eR,S=eP,PH2m⋅ePG,QASIDiH3R.(iii)
If the signature is valid, CC verifies the integrity ofM. CC decrypts M to get Tag, m,uj and calculates the following equations:(6)TG=∏i=124/λtagi,MGj=∑i=124/λmij,DG=∏j=1leuj,ptkMGj,HS=∏i=124/λhMIDi.(iv)
CC verifies whether equation6 holds every 24 hours:(7)DG⋅eHS,ptk=eTG,gtk.(v)
If equation6 holds, the data have not been modified by the user or the adversary before transmission. Otherwise, the data have been modified.(2) Tracing the Signer and the User.(i)
If equation (1) does not hold, CC traces the signer’s identity. The SIDia,ASIDi is saved in CC’s database during the phase of group members joining. Therefore, CC uses the group private key b to decrypt SIDia to obtain SIDi.(ii)
If equation (1) holds and equation (6) does not hold, CC traces the user’s identity to know who modified the data. CC uses the group private key b to decrypt inforia stored in his database to obtain infori. Then, CC calculates gti with the decrypted information one by one.(8)gti=Hinforixmodn=HIDiaddresstimestackxmodn.Furthermore, CC comparesgti with gtk, which is corresponding to M to ensure the user’s identity.


### 4.3.5. Joining of Group Members

A new memberSSi joins the group. SSi first sends his real identity SIDi to CC through a reliable channel. CC generates an anonymous identity code ASIDi, the public key QASIDi and the private key DASIDi for the new member SSi. Then, CC updates E=H2ASIDi⋅E=H2ASIDi⋅∏iH2ASIDi in the group bulletin board.


### 4.3.6. Revocation of Group Members

CC updates the timeT and E published on the group bulletin board to revoke the member SSj. CC calculates the corresponding E=H2ASIDj−1⋅∏iH2ASIDi at time T, where j∈0,i.


## 4.3.1. System Initialization

In this stage, CC first generates system parameters. Then, the SS uses the real identity to apply for the group member private key and anonymous identity code. After CC verifies the identity of the SS, he distributes the anonymous identity code and the group member private key to the SS. CC saves the real identity and anonymous identity of SS in the database. SM also delivers its real information to CC and generates its own pseudonym. CC saves the real identity and pseudonym of SM in the database. The data stored by CC, SS, and SM are, respectively, shown in Tables2–4.(1)
Generating System Parameters.(i)
CC computesn=pq, where p and q are two different large primes that meet p|q−1.(ii)
CC computes the group public keya and the private key b, where a,b satisfies the key pair property of RSA, namely ab≡1modϕn.(iii)
CC chooses a random numberx∈2,n−2 and computes y=gxmodn, where g is a primitive root of the modular n. y and x are the public key and private key of the group manager, respectively.(iv)
CC chooses generatorP∈G1 and three one-way hash functions: H:0,1∗⟶0,1k,H1:0,1∗⟶G1, H2:0,1∗⟶Zq∗, and H3:G1⟶Zq∗.(v)
CC chooses a random numbers∈Zq∗ as the system private key and computes PG=s⋅P as the system public key. CC initializes the group bulletin board E=1 and the corresponding time T. Then, CC releases system public parameters G1,G2,P,PG,n,g,H1,H2,H3,a,y and announces the time T and product of H2ASIDi on the group bulletin board, denoted as E=∏iH2ASIDi.(2)
Registering Stage.(i)
IfSSi wants to become a group member, he first submits real identity SIDi to CC. After CC verifies the validity of the identity, an anonymous identity code ASIDi is generated. Then, CC calculates public key QASIDi and private key DASIDi for SSi as follows:(4)QASIDi=H1ASIDi,DASIDi=s⋅QASIDi.CC encrypts the real identity of the group member with the group public keya and saves SIDia,ASIDi in the database. Then, CC updates E=H2ASIDi⋅E.(ii)
If a new userUseri wants to participate in the smart grid. He first acquires infori=IDiaddresstimestack. Then, he encrypts his information infori into inforia and sends it to CC. CC stores inforia in his database and calculates gti=Hinforixmodn sending it to Useri. The smart meters are distributed to users by CC. SMi chooses a random number wi to compute his pseudonym Ii=gwimodn. SMi sends Ii to CC.Table 2
Data stored by CC.
DefinitionSymbolGroup public/private keya,bGroup manager public/private keyy,xSystem public/private keyPG,sThe group bulletin boardEThe information of smart substationSSi<SIDia,ASIDi>QASIDi,DASIDiThe information of smart meterSMiinforiaHinforixgtiIiM,σTable 3
Data stored bySSi.
DefinitionSymbolAnonymous identity codeASIDiPublic/private keyQASIDi,DASIDiThe pseudonym ofSMiIiThe blind signatureσ′Table 4
Data stored bySMi.
DefinitionSymbolThe information of userinforiThe encrypted value of the information hashgtiRandom numberwiPseudonymIiPublic/private tag keyptk,stkElectricity consumption data blockand corresponding tagm,TagThe blind signature and signature of electricity consumption dataσ′,σ


## 4.3.2. Anonymous Identity Authentication and Data Reporting

In this stage, by the Schnorr identity authentication protocol, SM proves his legitimacy to SS under the condition of anonymity. Then, SM generates electricity consumption data blocks for a whole period. He calculates the data tag for each data block to ensure the integrity of data.(1) Anonymous Identity Authentication. SS is not completely trusted in the model. When SM interacts with SS, the real identity of SM needs to be hidden. Therefore, the Schnorr identity authentication protocol is used to verify the legitimacy of SM. The authentication process is shown in Figure 4.Figure 4
Anonymous identity authentication.Figure 5
Structure of electricity consumption data.(2) Data Reporting. SS believes in the legitimacy of SM by anonymous identity authentication. Then, SM sends the encrypted electricity consumption data to SS. We take the example of Userk encrypting and reporting electricity consumption data in one day. The whole day’s data are m.(i)
The data blocks generated in a day are restricted by the security parameterλ. We set the security parameter λ to 24, and SM generates 24 data blocks in one day. The structure of data blocks generated in one day is shown in Figure 5. Each data block mi represents one hour of electricity consumption data and has a corresponding tag tagi. l-Dimensional attribute values are contained in each data block.(ii)
SMk randomly chooses the private tag key stk∈Zq∗ and computes ptk=gtkstkmodn as the public tag key.(iii)
SMk chooses l values mx1,mx2,mx3,……,mxl, randomly. Then, SMk computes uj=gtkmxjmodn, where j∈1,l. SMk calculates tagi=HMIDi⋅∏j=1lujmijstk for each data block mi, where MID represents the data’s summary and mij means the jth dimension attribute value of the ith data block. SMk gets the tag set Tag=tag1,tag2,tag3,……,tagi, where the i∈1,24/λ.(iv)
SMk computes M=mTaga using the group public key a and calculates H2m.


## 4.3.3. Blind Signature on Reported Electricity Consumption Data

In this stage, SM needs to get blind signature from SS. Then, SM reports the electricity consumption data and the signature to CC.SS signs the electricity consumption data by the signature method provided in Section3. SS sends the blind signature σ' to SM. SM removes the blind factor to get the signature σ. Then, SM sends σ and M to CC together. The signature generation process is shown in Figure 6.Figure 6
Generate the signature.


## 4.3.4. Data Integrity Verification and Identity Traceability

In this stage, CC verifies the validity of the signature and the integrity of data. Firstly, CC verifies the signature. If equation (1) holds, the signature is valid, it indicates that m has not been modified during the transmission process after being signed by SS. Otherwise, the signature is invalid. CC traces the signer’s identity. Next, CC verifies the data integrity. CC uses Tag to check the integrity of the electricity consumption data. If equation (6) holds, the data are integral. Otherwise, the data have been modified. CC determines who tampered with the data. It is possible that the user or adversary has tampered with m before transmission. Therefore, CC obtains gtk corresponding to M. CC compares gtk with gti calculated using the user’s real information stored in his database. If gtk is in CC’s database, it indicates that the user tampers with the data. Otherwise, the adversary tampers with the data. The flow chart of signature verification and identity tracing is shown in Figure 7.Figure 7
Flow chart of signature verification and identity tracing.(1) The Verification of Signature and Data. The verifier uses the group public key PG to verify the validity of the signature σ=R,S,t. σ is the signature of M by the anonymous member ASIDi.(i)
After receiving theM, CC gets the electricity consumption data m by decrypting the M. Then, CC computes H2m and the member’s signature public key QASIDi=H2ASIDi.(ii)
According to the comparison between timet and T, CC selects the corresponding E and verifies whether H2ASIDi is divisible by E. If H2ASIDi is not divisible, the signature is invalid. Otherwise, the signer is a member of the group. Then, CC uses equation 1 to verify the validity of the signature. If equation 1 holds, the signature is valid. Otherwise, the signature is invalid.(5)eR,S=eP,PH2m⋅ePG,QASIDiH3R.(iii)
If the signature is valid, CC verifies the integrity ofM. CC decrypts M to get Tag, m,uj and calculates the following equations:(6)TG=∏i=124/λtagi,MGj=∑i=124/λmij,DG=∏j=1leuj,ptkMGj,HS=∏i=124/λhMIDi.(iv)
CC verifies whether equation6 holds every 24 hours:(7)DG⋅eHS,ptk=eTG,gtk.(v)
If equation6 holds, the data have not been modified by the user or the adversary before transmission. Otherwise, the data have been modified.(2) Tracing the Signer and the User.(i)
If equation (1) does not hold, CC traces the signer’s identity. The SIDia,ASIDi is saved in CC’s database during the phase of group members joining. Therefore, CC uses the group private key b to decrypt SIDia to obtain SIDi.(ii)
If equation (1) holds and equation (6) does not hold, CC traces the user’s identity to know who modified the data. CC uses the group private key b to decrypt inforia stored in his database to obtain infori. Then, CC calculates gti with the decrypted information one by one.(8)gti=Hinforixmodn=HIDiaddresstimestackxmodn.Furthermore, CC comparesgti with gtk, which is corresponding to M to ensure the user’s identity.


## 4.3.5. Joining of Group Members

A new memberSSi joins the group. SSi first sends his real identity SIDi to CC through a reliable channel. CC generates an anonymous identity code ASIDi, the public key QASIDi and the private key DASIDi for the new member SSi. Then, CC updates E=H2ASIDi⋅E=H2ASIDi⋅∏iH2ASIDi in the group bulletin board.


## 4.3.6. Revocation of Group Members

CC updates the timeT and E published on the group bulletin board to revoke the member SSj. CC calculates the corresponding E=H2ASIDj−1⋅∏iH2ASIDi at time T, where j∈0,i.


## 5. Security and Performance Analysis

The security and performance analysis section shows that the proposed data collection model is secure and reliable.


### 5.1. Security Analysis

The security of the model is mainly based on difficult problems, such as discrete logarithm problem, elliptic curve discrete logarithm problem, and integer decomposition problem. The following shows that the proposed model has the characteristics of privacy protection, anonymity, unforgeability, and traceability.


#### 5.1.1. Privacy Protection

Theorem 2.
Due to the difficulty of the integer decomposition problem, the adversary cannot obtain the user’s electricity consumption data.Proof.
Adversary stealsm when the user reports data and obtains the blind signature stage. However, the user’s electricity consumption data m are encrypted into M by the RSA encryption method. M=mTaga can be decrypted only by the group private key b. In the data collection model, only CC has the group private key b. If the adversary wants to get m, he must obtain the private key b. The possible method is that the adversary solves the factor decomposition problem and decomposes n into correct p and q. Then, the adversary obtains the group private key b. However, the factor decomposition problem cannot be solved. The privacy protection of user electricity consumption data is implemented in our proposed model.


#### 5.1.2. Anonymity

Anonymity includes the anonymity of the real identity of the SS and the real identity of the user who installed the SM.(1) Group Member Anonymity. Only CC knows the correspondence SIDia,ASIDi between the anonymous identity and the real identity of SS. In the blind signature generation stage, the SS uses the anonymous identity to sign. Therefore, CC knows the real identity of the signer by a signature.(2) User Identity Anonymity.Theorem 3.
Because the discrete logarithm problem is difficult,A cannot obtain the identity of the user by the decrypted electricity consumption data m and the corresponding tag Tag from the CC’s database.Proof.
The user’s identity informationinfori in CC’s database is encrypted to inforia. The RSA encryption is secure, and the adversary cannot calculate the group private key. Therefore, the adversary cannot obtain the user’s identity information by decryption. If the adversary wants to get the user’s identity, he calculates gtk from the tagi=HMIDi⋅∏j=1lujmijstk=HMIDi⋅∏j=1lgtkmxjmijstk. Then, he compares gtk with Hinforixmodn to determine the user’s identity. However, the discrete logarithm problem is difficult, and the adversary cannot calculate gtk from tagi. The proposed model guarantees the anonymity of the user’s identity information.


#### 5.1.3. Unforgeability

Unforgeability includes the unforgeability of the group blind signature and the unforgeability of the user electricity consumption data.(1) Unforgeability of Group Blind Signature. According to Theorem 1, we know whether the group blind signature is unforgeable.(2) Unforgeability of Electricity Consumption Data. The adversary cannot forge the electricity consumption data. We use the homomorphic verifiable tag mechanism to verify the integrity of data. By judging whether equation (6) holds, we know whether the user’s electricity consumption data have been forged or not. The detail is as follows:(9)Left=DG⋅eHS,ptk=∏j=1leuj,ptkMGj⋅eHS,ptk,Right=eTG,gtk=e∏i=124/λtagi,gtk,=e∏i=124/λHMIDi⋅∏j=1lujmijstk,gtk,=e∏i=124/λHMID|istk,gtk⋅e∏j=1l∏i=124/λujmijstk,gtk,=eHS,gtkstk⋅e∏j=1luj∑i=124/λmij,gtkstk,=eHS,gtkstk⋅e∏j=1luj,gtkstk∑i=124λmij,∏j=1leuj,ptkMGj=e∏j=1luj∑i=124/λmij,gtkstk,=∏j=1leuj∑i=124/λmij,gtkstk,=∏j=1leuj,gtkstk∑i=124/λmij,=e∏j=1luj,gtkstk∑i=124λmij,Left=Right.Therefore, we know the integrity of the user’s electricity consumption data by equation (6). The proposed model guarantees the unforgeability of user electricity consumption data.


#### 5.1.4. Traceability

As shown in Section 4.3.4, CC traces the identity of the malicious signer and user under certain conditions.If equation (1) does not hold, CC traces the identity of the signer. CC decrypts the SIDia corresponding to the signer’s anonymous identity code ASIDi stored in his database. SIDia=SIDiab=SIDi. Then, CC obtains the signer’s real identity SIDi. If equation (6) does not hold, CC traces the user’s identity. CC gets the user’s registration identity information inforia, which is stored in his database. CC decrypts inforia with the group private key b to obtain infori. Then, CC calculates gti=Hinforixmodn of the infori one by one. CC compares gti with the gtk, which is corresponding to the M to ensure the user’s identity. If gti is equal to gtk, infori is the user’s real identity.Therefore, the proposed model guarantees the traceability of the signer’s identity and the user’s identity.


### 5.2. Performance Analysis

In the performance analysis section, we analyse the calculation cost of the electricity data collection model in four stages, including the system initialization stage, the user authentication stage, the blind signature stage, and the verification stage.We assume to haveα smart meters and β smart substations, where B stands for bilinear pairing operation, H stands for hash operation, M stands for modular multiplication operation, L stands for modular exponentiation operation, A stands for the elliptic curve addition operation, N represents the exponential operation under the multiplication group, and W stands for the elliptic curve multiplication operation. In the system initialization stage, CC computes y, gti, Ii, Hinfori, QASIDi, PG, and DASIDi. Therefore, L=1+2α, H=α+β, and W=1+β. In the user authentication stage, the SM computes K and Si and the SS computes cb, so M=α, L=3β, and H=2α. Moreover, when data reporting, one SM within a day generates ptk, uj, tagi, H2m, and HMIDi. Hence, the computational cost is M=24/λ, L=1+l+24/λ, and H=1+24/λ. In the blind signature stage, the calculation cost of SM acquiring signatures in a day is W=7α, A=α, and H=α. In the verification stage, the computational cost of CC verifies that signatures in a day are B=3α, H=2α, and N=2α. The calculation cost of verifying the data within a day for one SM is B=l+2, M=24/λ, H=24/λ, and L=24/λ.


## 5.1. Security Analysis

The security of the model is mainly based on difficult problems, such as discrete logarithm problem, elliptic curve discrete logarithm problem, and integer decomposition problem. The following shows that the proposed model has the characteristics of privacy protection, anonymity, unforgeability, and traceability.


### 5.1.1. Privacy Protection

Theorem 2.
Due to the difficulty of the integer decomposition problem, the adversary cannot obtain the user’s electricity consumption data.Proof.
Adversary stealsm when the user reports data and obtains the blind signature stage. However, the user’s electricity consumption data m are encrypted into M by the RSA encryption method. M=mTaga can be decrypted only by the group private key b. In the data collection model, only CC has the group private key b. If the adversary wants to get m, he must obtain the private key b. The possible method is that the adversary solves the factor decomposition problem and decomposes n into correct p and q. Then, the adversary obtains the group private key b. However, the factor decomposition problem cannot be solved. The privacy protection of user electricity consumption data is implemented in our proposed model.


### 5.1.2. Anonymity

Anonymity includes the anonymity of the real identity of the SS and the real identity of the user who installed the SM.(1) Group Member Anonymity. Only CC knows the correspondence SIDia,ASIDi between the anonymous identity and the real identity of SS. In the blind signature generation stage, the SS uses the anonymous identity to sign. Therefore, CC knows the real identity of the signer by a signature.(2) User Identity Anonymity.Theorem 3.
Because the discrete logarithm problem is difficult,A cannot obtain the identity of the user by the decrypted electricity consumption data m and the corresponding tag Tag from the CC’s database.Proof.
The user’s identity informationinfori in CC’s database is encrypted to inforia. The RSA encryption is secure, and the adversary cannot calculate the group private key. Therefore, the adversary cannot obtain the user’s identity information by decryption. If the adversary wants to get the user’s identity, he calculates gtk from the tagi=HMIDi⋅∏j=1lujmijstk=HMIDi⋅∏j=1lgtkmxjmijstk. Then, he compares gtk with Hinforixmodn to determine the user’s identity. However, the discrete logarithm problem is difficult, and the adversary cannot calculate gtk from tagi. The proposed model guarantees the anonymity of the user’s identity information.


### 5.1.3. Unforgeability

Unforgeability includes the unforgeability of the group blind signature and the unforgeability of the user electricity consumption data.(1) Unforgeability of Group Blind Signature. According to Theorem 1, we know whether the group blind signature is unforgeable.(2) Unforgeability of Electricity Consumption Data. The adversary cannot forge the electricity consumption data. We use the homomorphic verifiable tag mechanism to verify the integrity of data. By judging whether equation (6) holds, we know whether the user’s electricity consumption data have been forged or not. The detail is as follows:(9)Left=DG⋅eHS,ptk=∏j=1leuj,ptkMGj⋅eHS,ptk,Right=eTG,gtk=e∏i=124/λtagi,gtk,=e∏i=124/λHMIDi⋅∏j=1lujmijstk,gtk,=e∏i=124/λHMID|istk,gtk⋅e∏j=1l∏i=124/λujmijstk,gtk,=eHS,gtkstk⋅e∏j=1luj∑i=124/λmij,gtkstk,=eHS,gtkstk⋅e∏j=1luj,gtkstk∑i=124λmij,∏j=1leuj,ptkMGj=e∏j=1luj∑i=124/λmij,gtkstk,=∏j=1leuj∑i=124/λmij,gtkstk,=∏j=1leuj,gtkstk∑i=124/λmij,=e∏j=1luj,gtkstk∑i=124λmij,Left=Right.Therefore, we know the integrity of the user’s electricity consumption data by equation (6). The proposed model guarantees the unforgeability of user electricity consumption data.


### 5.1.4. Traceability

As shown in Section 4.3.4, CC traces the identity of the malicious signer and user under certain conditions.If equation (1) does not hold, CC traces the identity of the signer. CC decrypts the SIDia corresponding to the signer’s anonymous identity code ASIDi stored in his database. SIDia=SIDiab=SIDi. Then, CC obtains the signer’s real identity SIDi. If equation (6) does not hold, CC traces the user’s identity. CC gets the user’s registration identity information inforia, which is stored in his database. CC decrypts inforia with the group private key b to obtain infori. Then, CC calculates gti=Hinforixmodn of the infori one by one. CC compares gti with the gtk, which is corresponding to the M to ensure the user’s identity. If gti is equal to gtk, infori is the user’s real identity.Therefore, the proposed model guarantees the traceability of the signer’s identity and the user’s identity.


## 5.1.1. Privacy Protection

Theorem 2.
Due to the difficulty of the integer decomposition problem, the adversary cannot obtain the user’s electricity consumption data.Proof.
Adversary stealsm when the user reports data and obtains the blind signature stage. However, the user’s electricity consumption data m are encrypted into M by the RSA encryption method. M=mTaga can be decrypted only by the group private key b. In the data collection model, only CC has the group private key b. If the adversary wants to get m, he must obtain the private key b. The possible method is that the adversary solves the factor decomposition problem and decomposes n into correct p and q. Then, the adversary obtains the group private key b. However, the factor decomposition problem cannot be solved. The privacy protection of user electricity consumption data is implemented in our proposed model.


## 5.1.2. Anonymity

Anonymity includes the anonymity of the real identity of the SS and the real identity of the user who installed the SM.(1) Group Member Anonymity. Only CC knows the correspondence SIDia,ASIDi between the anonymous identity and the real identity of SS. In the blind signature generation stage, the SS uses the anonymous identity to sign. Therefore, CC knows the real identity of the signer by a signature.(2) User Identity Anonymity.Theorem 3.
Because the discrete logarithm problem is difficult,A cannot obtain the identity of the user by the decrypted electricity consumption data m and the corresponding tag Tag from the CC’s database.Proof.
The user’s identity informationinfori in CC’s database is encrypted to inforia. The RSA encryption is secure, and the adversary cannot calculate the group private key. Therefore, the adversary cannot obtain the user’s identity information by decryption. If the adversary wants to get the user’s identity, he calculates gtk from the tagi=HMIDi⋅∏j=1lujmijstk=HMIDi⋅∏j=1lgtkmxjmijstk. Then, he compares gtk with Hinforixmodn to determine the user’s identity. However, the discrete logarithm problem is difficult, and the adversary cannot calculate gtk from tagi. The proposed model guarantees the anonymity of the user’s identity information.


## 5.1.3. Unforgeability

Unforgeability includes the unforgeability of the group blind signature and the unforgeability of the user electricity consumption data.(1) Unforgeability of Group Blind Signature. According to Theorem 1, we know whether the group blind signature is unforgeable.(2) Unforgeability of Electricity Consumption Data. The adversary cannot forge the electricity consumption data. We use the homomorphic verifiable tag mechanism to verify the integrity of data. By judging whether equation (6) holds, we know whether the user’s electricity consumption data have been forged or not. The detail is as follows:(9)Left=DG⋅eHS,ptk=∏j=1leuj,ptkMGj⋅eHS,ptk,Right=eTG,gtk=e∏i=124/λtagi,gtk,=e∏i=124/λHMIDi⋅∏j=1lujmijstk,gtk,=e∏i=124/λHMID|istk,gtk⋅e∏j=1l∏i=124/λujmijstk,gtk,=eHS,gtkstk⋅e∏j=1luj∑i=124/λmij,gtkstk,=eHS,gtkstk⋅e∏j=1luj,gtkstk∑i=124λmij,∏j=1leuj,ptkMGj=e∏j=1luj∑i=124/λmij,gtkstk,=∏j=1leuj∑i=124/λmij,gtkstk,=∏j=1leuj,gtkstk∑i=124/λmij,=e∏j=1luj,gtkstk∑i=124λmij,Left=Right.Therefore, we know the integrity of the user’s electricity consumption data by equation (6). The proposed model guarantees the unforgeability of user electricity consumption data.


## 5.1.4. Traceability

As shown in Section 4.3.4, CC traces the identity of the malicious signer and user under certain conditions.If equation (1) does not hold, CC traces the identity of the signer. CC decrypts the SIDia corresponding to the signer’s anonymous identity code ASIDi stored in his database. SIDia=SIDiab=SIDi. Then, CC obtains the signer’s real identity SIDi. If equation (6) does not hold, CC traces the user’s identity. CC gets the user’s registration identity information inforia, which is stored in his database. CC decrypts inforia with the group private key b to obtain infori. Then, CC calculates gti=Hinforixmodn of the infori one by one. CC compares gti with the gtk, which is corresponding to the M to ensure the user’s identity. If gti is equal to gtk, infori is the user’s real identity.Therefore, the proposed model guarantees the traceability of the signer’s identity and the user’s identity.


## 5.2. Performance Analysis

In the performance analysis section, we analyse the calculation cost of the electricity data collection model in four stages, including the system initialization stage, the user authentication stage, the blind signature stage, and the verification stage.We assume to haveα smart meters and β smart substations, where B stands for bilinear pairing operation, H stands for hash operation, M stands for modular multiplication operation, L stands for modular exponentiation operation, A stands for the elliptic curve addition operation, N represents the exponential operation under the multiplication group, and W stands for the elliptic curve multiplication operation. In the system initialization stage, CC computes y, gti, Ii, Hinfori, QASIDi, PG, and DASIDi. Therefore, L=1+2α, H=α+β, and W=1+β. In the user authentication stage, the SM computes K and Si and the SS computes cb, so M=α, L=3β, and H=2α. Moreover, when data reporting, one SM within a day generates ptk, uj, tagi, H2m, and HMIDi. Hence, the computational cost is M=24/λ, L=1+l+24/λ, and H=1+24/λ. In the blind signature stage, the calculation cost of SM acquiring signatures in a day is W=7α, A=α, and H=α. In the verification stage, the computational cost of CC verifies that signatures in a day are B=3α, H=2α, and N=2α. The calculation cost of verifying the data within a day for one SM is B=l+2, M=24/λ, H=24/λ, and L=24/λ.


## 6. Conclusion

This study proposes a new identity-based group blind signature scheme and applies this signature scheme to the collection of user electricity consumption data in the smart grid. Then, we obtain a privacy-aware electricity consumption data collection model based on group blind signature. The model implements the conditional anonymity of user identity information and the privacy protection of consumption data in the process of collecting electricity data. In addition, when reporting electricity consumption data, the smart meter adds a tag to the data block generated every hour through the homomorphic tag mechanism. The user’s electricity consumption data for a whole day correspond to a tag set. The existence of the tag ensures the integrity and verifiability of the electricity consumption data. The security and performance analysis proves that the data collection model has privacy protection, anonymity, unforgeability, and traceability. In future work, we consider combining blockchain technology with the proposed signature scheme in the smart grid scenario to protect the privacy of the user’s electricity consumption data and identity information.



---

*Source: 4352291-2022-05-19.xml*