# EPPDC: An Efficient Privacy-Preserving Scheme for Data Collection in Smart Grid

Authors: Jie Chen; Junping Shi; Yueyu Zhang
Journal: International Journal of Distributed Sensor Networks
 (2015)

---

## Abstract

Different from the traditional grid, smart grid builds a real-time connection network between the user and the grid company by smart terminals, which can achieve bidirectional data transmission and information control. In smart grid, the smart meters send various information to the power generators and substations. Frequent data collection meets real-time management, but it tends to raise privacy concerns from the users about privacy information leakage. Based on the blind signature and the key distribution scheme, an efficient and privacy-preserving data collection (EPPDC) scheme is proposed for smart grid to cope with the above problems. In EPPDC scheme, the users’ data information is transmitted to the local aggregator by building gateway with privacy preserving. In addition, the security analysis indicates that EPPDC scheme not only can resist replay attack, but also has source authentication and data integrity, confidentiality, unforgeability, nonrepudiation, and evolution of shared keys. Furthermore, performance analysis shows that EPPDC scheme has less computation cost than existing scheme.


---

## Body

## 1. Introduction

Smart grid is one of the most important public infrastructures for smart cities. It builds a real-time connection network between the user and the grid company by smart terminals and supports bidirectional data transmission and information control. Depending on it, smart cities could ensure resilient supply and delivery of energy, which help smart cities to fulfil many enhanced and innovative functions and even more efficiencies compared with traditional cities. Furthermore, smart grid can also facilitate coordination among people who are responsible for public safety and the public, such as urban officials and infrastructure operators [1]. The advantage of smart grid is attracting more and more attention and research in smart city projects. Currently, around one-third of the smart city projects are primarily focused on smart grid or other energy innovations. Almost half of smart city strategies include energy-focused projects [2].Smart grid can support the bidirectional information flow between the power consumer and the utility provider [3]. This two-way interaction allows electricity to be generated in real-time based on consumers’ demands and power requests. As an important technique in smart cities, the advanced metering will affect not only the power sector but also other utilities such as gas/heating and water which will make use of smart meters to read and process consumption data remotely [4]. In smart cities, each house may contain a smart meter connecting to all electric appliances in the house. The utility transmits requests and commands to the smart meters and gathers and analyzes power usage data responded by each smart meter. If being leaked, that information will indicate not only the amount of energy consumed by each user but also behaviors like when they are at home, at work, or traveling [5]. Furthermore, it is possible to infer what types of home appliances are used by attackers who compromise users’ home area networks. If a criminal or malicious attacker can determine when a user is not at home, they may break into his/her house at such a time. And energy information can support burglars or provide business intelligence to competitors [6]. By this information, the users’ habits or lifestyles can be tracked. And a series of problems arises in case of information leakage. Thus, authentication and user privacy preservation are two important security issues on the information flow in smart grid.Thus, there is need to design schemes which can achieve data transmission between smart meters and smart grid provider with privacy preserving. This paper just studies the privacy-preserving data collection scheme for smart grid.


## 2. Related Works

The proposed privacy-preserving schemes about smart grid are mainly constructed by two kinds of cryptographic tools, homomorphic encryption [7–9] and signcryption [10, 11]. By homomorphic encryption, smart meters (SMs) encrypt the messages and send them to gateway (BGW), but gateway cannot get any users’ messages without the system private key. Then, gateway signs encrypted messages and sends them to control center (CC). Based on the property of homomorphic encryption, control center can make use of the system private key to recover every user’s messages.Secure data aggregation schemes in smart grid have been investigated by several researchers. Lu et al. proposed a privacy-preserving aggregation scheme [7], which is based on the homomorphic Paillier cryptosystem. But in [7], it is assumed that the session keys between SM and BGW are unchanged. Once an adversary A compromises the session keys, A can decrypt any previous response message. Based on [7], Li et al. proposed a privacy-preserving demand and response scheme with adaptive key evolution [9]. Both [7, 9] make use of homomorphic encryption to achieve privacy preserving, and they can meet aggregation for some data. In addition, several researchers focused on privacy-preserving aggregation in different conditions by using multiparty computation [12, 13], differential privacy [14], and the aggregated pseudostatus variation [15]. As signcryption based schemes, they can complete digital signature and encryption for a message in one time. In particular, SMs signcrypt the messages and send them to gateway. Gateway cannot get any users’ messages from the encrypted messages. Then, gateway signs and sends encrypted messages to control center. Control center can recover every user’s messages by the shared key between CC and SMs. In [10], an identity-based signcryption scheme for smart grid was proposed. But in [10], the management of pseudonymous ID is a problem. Reference [11] adopted the pseudonym technology to achieve the user identity anonymity and adopted the signcryption to complete digital signature and encryption in one time in smart grid.However, the smart grid needs not only to protect users’ sensitive information but also to meet their demands for personalized data application with multilevel and multigranularity. Thus many users’ messages cannot be aggregated, which should be sent to control center detail by detail. And existing homomorphic encryption to achieve privacy preserving is based on the computational expensive operations [7, 9], which may not be desirable for smart grids with limited resources in terms of both bandwidth and computation. And the existing signcryption based schemes in smart grid [10, 11] cannot meet forward secrecy.This paper proposes an efficient privacy-preserving data collection scheme for smart grid, which is based on the blind signature and the key distribution scheme. In this scheme, users’ data information is transmitted to the local aggregator via gateway, while gateway cannot get any users’ messages. Moreover, this scheme can achieve forward secrecy of SM’s session key, and evolution of SM’s private keys.The remainder of paper is organized as follows. Section3 introduces models and design goal. Section 4 describes preliminaries. Section 5 presents the proposed EPPDC scheme. Section 6 shows the security analysis and the computation overhead of the scheme in this paper, respectively. Finally, Section 7 makes a conclusion.


## 3. Models and Design Goal

In this section, we give the system model, security model, and the design goal.


### 3.1. System Model

As shown in Figure1, smart grid is divided into a number of hierarchical networks, which is comprised of control center (CC), district area network (DAN), building area network (BAN), and home area network (HAN). The CC covers n1 DANs. For the sake of simplicity, we assume that each DAN comprises n2 BANs and each BAN comprises n3 HANs. Each HAN is assigned a smart meter (SM) enabling an automated, bidirectional communication between the CC and the HAN users. Meantime, each BAN is equipped with a gateway (BGW) and each DAN is equipped with a local aggregator (LAG). And each SM can directly communicate with LAG via the BGW.Figure 1
Hierarchical architecture of smart grid.In this paper, the system model of smart grid contains 5 parties, including trusted authority (TA), central aggregator (CAG), LAG, BGW, and SM. LAG is the entity that can directly communicate with CAG on behalf of those geographically dispersed HANs. TA belongs to some independent organizations like Regional Transmission Organizations (RTO) or Independent System Operators (ISO). TA does the system initiation, such as generating public system parameters and assigning private key for each entity.Then we give a partial relationship for smart grid in China, which is shown in Figure2. The provincial operator is viewed as central aggregator CAG, and municipal operator is viewed as LAG. For example, there is focus on the Northwest China. It has a CAG located in Shaanxi and multiple LAGs dispersed in Xi’an, Hanzhong, Yulin, and other towns. And ISO, Northwest China, plays the role of TA. The provincial operator is responsible for generating and transmitting parameters of CAG, predicting flexible power demand and managing renewable generation in its province. Generally, the provincial operator can refer to municipal electricity demand curve to make power supply plan and generation dispatching plan with a day ahead. The municipal operator is responsible for generating networks parameters and aggregating the power demand. At present in China, the communication between the provincial operator and the municipal operator is used by fiber optic link which is assumed to be safe. The municipal operator can refer to load curve. According to preferred load curve, time of use (TOU) prices, and customers demand, each BAN makes bids in the electricity market. Both municipal and BAN operator need real-time communication and data management. Usually, wireless communication is used to transfer data between BGW and SM.Figure 2
An envisioned relationship diagram for smart grid in China.


### 3.2. Security Model

In our security model, CAG and LAG are trusted by all parties and are infeasible for any adversary to compromise. BGW can comply with the scheme but with diligent curiosity. Thus BGW possibly gets the user’s privacy information in the process of implementing the scheme. We consider the following security goals.(1)
Confidentiality: the messages sent to LAG from SM should be confidential; that is, if an adversaryA captures the messages, it cannot identify the encrypted messages.(2)
Authenticity and data integrity: BGW and HAN users should be authenticated by LAG and BGW each other, respectively. Meanwhile, if an adversaryA modifies the messages, the malicious operations can be detected.(3)
Privacy preservation: the users’ electricity information should not be disclosed to the undesirable entities. Privacy preservation should meet the anonymous authentication and data encryption, which make attacker not able to get any information from any of the users. In smart grid, if an adversaryA hacks into the database of BGWs, it cannot determine the contents of ciphertexts. In order to protect the users’ privacy, even BGW cannot determine the detailed electrical information to certain users.(4)
Evolution of users’ private keys: the evolution of users’ private keys should be achieved. If an adversaryA compromises any previous private key of a HAN user, A cannot use it currently or in the future.


### 3.3. Design Goal

Under the above models, our design goal is to develop an efficient privacy-preserving scheme for data collection in smart grid. Specifically, the following two desirable objectives will be achieved.(1)
The proposed privacy-preserving scheme should achieve the message source authentication, data integrity, and the confidentiality of the messages.(2)
The proposed scheme should be cost-effective in terms of computation and communication overheads.


## 3.1. System Model

As shown in Figure1, smart grid is divided into a number of hierarchical networks, which is comprised of control center (CC), district area network (DAN), building area network (BAN), and home area network (HAN). The CC covers n1 DANs. For the sake of simplicity, we assume that each DAN comprises n2 BANs and each BAN comprises n3 HANs. Each HAN is assigned a smart meter (SM) enabling an automated, bidirectional communication between the CC and the HAN users. Meantime, each BAN is equipped with a gateway (BGW) and each DAN is equipped with a local aggregator (LAG). And each SM can directly communicate with LAG via the BGW.Figure 1
Hierarchical architecture of smart grid.In this paper, the system model of smart grid contains 5 parties, including trusted authority (TA), central aggregator (CAG), LAG, BGW, and SM. LAG is the entity that can directly communicate with CAG on behalf of those geographically dispersed HANs. TA belongs to some independent organizations like Regional Transmission Organizations (RTO) or Independent System Operators (ISO). TA does the system initiation, such as generating public system parameters and assigning private key for each entity.Then we give a partial relationship for smart grid in China, which is shown in Figure2. The provincial operator is viewed as central aggregator CAG, and municipal operator is viewed as LAG. For example, there is focus on the Northwest China. It has a CAG located in Shaanxi and multiple LAGs dispersed in Xi’an, Hanzhong, Yulin, and other towns. And ISO, Northwest China, plays the role of TA. The provincial operator is responsible for generating and transmitting parameters of CAG, predicting flexible power demand and managing renewable generation in its province. Generally, the provincial operator can refer to municipal electricity demand curve to make power supply plan and generation dispatching plan with a day ahead. The municipal operator is responsible for generating networks parameters and aggregating the power demand. At present in China, the communication between the provincial operator and the municipal operator is used by fiber optic link which is assumed to be safe. The municipal operator can refer to load curve. According to preferred load curve, time of use (TOU) prices, and customers demand, each BAN makes bids in the electricity market. Both municipal and BAN operator need real-time communication and data management. Usually, wireless communication is used to transfer data between BGW and SM.Figure 2
An envisioned relationship diagram for smart grid in China.


## 3.2. Security Model

In our security model, CAG and LAG are trusted by all parties and are infeasible for any adversary to compromise. BGW can comply with the scheme but with diligent curiosity. Thus BGW possibly gets the user’s privacy information in the process of implementing the scheme. We consider the following security goals.(1)
Confidentiality: the messages sent to LAG from SM should be confidential; that is, if an adversaryA captures the messages, it cannot identify the encrypted messages.(2)
Authenticity and data integrity: BGW and HAN users should be authenticated by LAG and BGW each other, respectively. Meanwhile, if an adversaryA modifies the messages, the malicious operations can be detected.(3)
Privacy preservation: the users’ electricity information should not be disclosed to the undesirable entities. Privacy preservation should meet the anonymous authentication and data encryption, which make attacker not able to get any information from any of the users. In smart grid, if an adversaryA hacks into the database of BGWs, it cannot determine the contents of ciphertexts. In order to protect the users’ privacy, even BGW cannot determine the detailed electrical information to certain users.(4)
Evolution of users’ private keys: the evolution of users’ private keys should be achieved. If an adversaryA compromises any previous private key of a HAN user, A cannot use it currently or in the future.


## 3.3. Design Goal

Under the above models, our design goal is to develop an efficient privacy-preserving scheme for data collection in smart grid. Specifically, the following two desirable objectives will be achieved.(1)
The proposed privacy-preserving scheme should achieve the message source authentication, data integrity, and the confidentiality of the messages.(2)
The proposed scheme should be cost-effective in terms of computation and communication overheads.


## 4. Preliminaries

In this section, we review bilinear pairings, hash function and HMAC [16], group key distribution scheme [17], and Nyberg-Rueppel blind signature technology [18], which will serve as the basis of the proposed scheme.


### 4.1. Bilinear Pairings

LetG1 be a cyclic additive group of prime order q and let GT be a cyclic multiplicative group of the same order. A map e: G1×G1→GT is called a bilinear map if it satisfies the following properties:(1) bilinearity:e(Q,W+Z)=e(Q,W)e(Q,Z) and e(Q+W,Z)=e(Q,Z)e(W,Z), for all Q,W,Z∈G1;(2) nondegeneracy: there existsP,Q∈G1 such that e(P,Q)≠1;(3) computability: there is an efficient algorithm to computee(P,Q) for P,Q∈G1.


### 4.2. Hash Function and HMAC

A one-way hash functionh(·) is said to be secure if the following properties are satisfied.(1)
h(·) can take a message of arbitrary length as input and produce a message digest of a fixed-length output.(2)
Givenx, it is easy to compute h(x)=y. However, it is hard to compute h-1(y)=x given y.(3)
Givenx, it is computationally infeasible to find x′≠x such that h(x′)=h(x).Hash-based message authentication code (HMAC) is a specific construction for computing a message authentication code (MAC) using a cryptographic hash function in combination with a secret key. Both data integrity and authenticity of a message can be achieved using such a technique. Due to the property of hash functions, an HMAC value can be computed in a much shorter time than a traditional digital signature. In this paper, we denote the HMAC value on messageM is HMACK(M) using the secret key K.


### 4.3. Group Key Distribution Scheme

The purpose of group key distribution is to distribute keys to selected group members so that each of the selected group members shares a distinct personal key with the group manager, but the other group members cannot get any information of the keys. In [17], the group manager broadcasted a message, and all the selected group members could derive their keys from the message. The approach of [17] chose a random t-degree polynomial f(x) from Fq[x] and selected f(i) for each group member Ui as the shared person key. The group manager constructed a single broadcast polynomial w(x) such that, for a selected group member Ui, f(i) could be recovered from the knowledge of w(x) and the personal secret Si. But for any revoked group member, Ui′, f(i′) could not be determined from w(x) and Si′.In [17], w(x)=g(x)f(x)+h(x) was constructed by f(x) with the help of a revocation polynomial g(x) and a masking polynomial h(x). The revocation polynomial g(x) was constructed in such a way that g(i)≠0 for any selected group member Ui, but g(i′)=0 for any revoked group member Ui′. During setup phase, each group member Uv had its own personal secret Sv={h(v)}, which might be distributed by the group manager through the secure communication channel between each group member and the group manager. Thus, for any selected group member Ui, new personal key f(i) could be computed by f(i)=[w(i)-h(i)]/g(i), but for any revoked group member Ui′, new personal key could not be computed because g(i′)=0. Specific steps were as follows.(1)
Setup: the group manager randomly picked a2t-degree masking polynomial, h(x)=h0+h1x+⋯+h2tx2t, from Fq[x]. Each group member Ui got the personal secret Si={h(i)} from the group manager.(2)
Broadcast: given a set of revoked group membersR={r1,r2,…,rw}(R≤t), the group manager distributed the shares of t-degree polynomial f(x) to nonrevoked group members via the following broadcast message: B={R}∪{w(x)=g(x)f(x)+h(x)}, where the revocation polynomial g(x)=(x-r1)(x-r2)⋯(x-rw).(3)
Personal key recovery: if any nonrevoked group memberUi received such a broadcast message, it evaluated the polynomial w(x) at point i and got w(i)=g(i)f(i)+h(i). Because Ui knew h(i) and g(i)≠0, it could compute the new personal key f(i)=[w(i)-h(i)]/g(i).


### 4.4. Nyberg-Rueppel Blind Signature

Blind signatures enable users to obtain valid signatures on a message without revealing its content to the signer. Nyberg-Rueppel blind signature scheme was proposed by Camenisch et al., which was based on the discrete logarithm problem [18]. The scheme had three parts as follows.(1)
Setup system parameters: the system parameters consisted of a primep, a prime factor q of p-1, and an element g∈Zq* of order q. The signer’s private key was a random element x∈Zq*, while the corresponding public key was y=gx(mod⁡p).(2)
Sign: Bob could obtain a valid signature on a messagem from Alice without revealing its content to Alice.
(a)
Alice randomly selectedk′∈Zq*, computed r′=gk′(mod⁡p), and sent r′ to Bob.(b)
Bob selectedα,β∈Zq* at random and computed r=mgαr′β(mod⁡p) and m′=rβ-1(mod⁡q). Bob checked whether it was satisfied with m′∈Zp*. If this was not the case, a new (α,β) would be chosen until it was satisfied with m′∈Zp*. Then, Bob sent m′ to Alice.(c)
Alice computeds′=m′x+k′(mod⁡q) and sent s′ to Bob.(d)
Bob computeds=s′β+α(mod⁡q). (r,s) was the signature of Alice on message m.(3)
Verify: anyone could verify the validity of the signature (r,s) on message m by(1)g-syrr=mg-s′β-α+xr+k′β+α=mg-m′xβ-k′β+xr+k′β=mmod⁡p.


## 4.1. Bilinear Pairings

LetG1 be a cyclic additive group of prime order q and let GT be a cyclic multiplicative group of the same order. A map e: G1×G1→GT is called a bilinear map if it satisfies the following properties:(1) bilinearity:e(Q,W+Z)=e(Q,W)e(Q,Z) and e(Q+W,Z)=e(Q,Z)e(W,Z), for all Q,W,Z∈G1;(2) nondegeneracy: there existsP,Q∈G1 such that e(P,Q)≠1;(3) computability: there is an efficient algorithm to computee(P,Q) for P,Q∈G1.


## 4.2. Hash Function and HMAC

A one-way hash functionh(·) is said to be secure if the following properties are satisfied.(1)
h(·) can take a message of arbitrary length as input and produce a message digest of a fixed-length output.(2)
Givenx, it is easy to compute h(x)=y. However, it is hard to compute h-1(y)=x given y.(3)
Givenx, it is computationally infeasible to find x′≠x such that h(x′)=h(x).Hash-based message authentication code (HMAC) is a specific construction for computing a message authentication code (MAC) using a cryptographic hash function in combination with a secret key. Both data integrity and authenticity of a message can be achieved using such a technique. Due to the property of hash functions, an HMAC value can be computed in a much shorter time than a traditional digital signature. In this paper, we denote the HMAC value on messageM is HMACK(M) using the secret key K.


## 4.3. Group Key Distribution Scheme

The purpose of group key distribution is to distribute keys to selected group members so that each of the selected group members shares a distinct personal key with the group manager, but the other group members cannot get any information of the keys. In [17], the group manager broadcasted a message, and all the selected group members could derive their keys from the message. The approach of [17] chose a random t-degree polynomial f(x) from Fq[x] and selected f(i) for each group member Ui as the shared person key. The group manager constructed a single broadcast polynomial w(x) such that, for a selected group member Ui, f(i) could be recovered from the knowledge of w(x) and the personal secret Si. But for any revoked group member, Ui′, f(i′) could not be determined from w(x) and Si′.In [17], w(x)=g(x)f(x)+h(x) was constructed by f(x) with the help of a revocation polynomial g(x) and a masking polynomial h(x). The revocation polynomial g(x) was constructed in such a way that g(i)≠0 for any selected group member Ui, but g(i′)=0 for any revoked group member Ui′. During setup phase, each group member Uv had its own personal secret Sv={h(v)}, which might be distributed by the group manager through the secure communication channel between each group member and the group manager. Thus, for any selected group member Ui, new personal key f(i) could be computed by f(i)=[w(i)-h(i)]/g(i), but for any revoked group member Ui′, new personal key could not be computed because g(i′)=0. Specific steps were as follows.(1)
Setup: the group manager randomly picked a2t-degree masking polynomial, h(x)=h0+h1x+⋯+h2tx2t, from Fq[x]. Each group member Ui got the personal secret Si={h(i)} from the group manager.(2)
Broadcast: given a set of revoked group membersR={r1,r2,…,rw}(R≤t), the group manager distributed the shares of t-degree polynomial f(x) to nonrevoked group members via the following broadcast message: B={R}∪{w(x)=g(x)f(x)+h(x)}, where the revocation polynomial g(x)=(x-r1)(x-r2)⋯(x-rw).(3)
Personal key recovery: if any nonrevoked group memberUi received such a broadcast message, it evaluated the polynomial w(x) at point i and got w(i)=g(i)f(i)+h(i). Because Ui knew h(i) and g(i)≠0, it could compute the new personal key f(i)=[w(i)-h(i)]/g(i).


## 4.4. Nyberg-Rueppel Blind Signature

Blind signatures enable users to obtain valid signatures on a message without revealing its content to the signer. Nyberg-Rueppel blind signature scheme was proposed by Camenisch et al., which was based on the discrete logarithm problem [18]. The scheme had three parts as follows.(1)
Setup system parameters: the system parameters consisted of a primep, a prime factor q of p-1, and an element g∈Zq* of order q. The signer’s private key was a random element x∈Zq*, while the corresponding public key was y=gx(mod⁡p).(2)
Sign: Bob could obtain a valid signature on a messagem from Alice without revealing its content to Alice.
(a)
Alice randomly selectedk′∈Zq*, computed r′=gk′(mod⁡p), and sent r′ to Bob.(b)
Bob selectedα,β∈Zq* at random and computed r=mgαr′β(mod⁡p) and m′=rβ-1(mod⁡q). Bob checked whether it was satisfied with m′∈Zp*. If this was not the case, a new (α,β) would be chosen until it was satisfied with m′∈Zp*. Then, Bob sent m′ to Alice.(c)
Alice computeds′=m′x+k′(mod⁡q) and sent s′ to Bob.(d)
Bob computeds=s′β+α(mod⁡q). (r,s) was the signature of Alice on message m.(3)
Verify: anyone could verify the validity of the signature (r,s) on message m by(1)g-syrr=mg-s′β-α+xr+k′β+α=mg-m′xβ-k′β+xr+k′β=mmod⁡p.


## 5. EPPDC Scheme

Based on the blind signature and the key distribution scheme, this section gives the EPPDC scheme for smart grid. This scheme can achieve that the users’ data is transmitted to the LAG via BGW with privacy preserving. In this section, we propose the scheme, which consists of five phases: system initialization, certificate issuing, user registration, data collection, and key evolution.


### 5.1. System Initialization

We assume that TA will initialize the whole system. TA chooses the following:(1)
primesp and q such that q∣p-1,   q≥2140 and p≥2512;(2)
an elementg∈Zp* with order q; that is, gq=1(mod⁡p), and g≠1;(3)
a one-way hash functionh:0,1*→0,1l;(4)
a security parameterλ∈N and bilinear group (G,GT) with prime order p>2λ, which satisfies with g being a generator of G;(5)
a random numbers∈Zq* as TA’s private key so that SKTA=s.Then, TA computes its public keyPKTA=gs and publishes the tuple (p,q,g,h,PKTA) as the system parameters.


### 5.2. Certificate Issuing

During this phase, TA verifies the identity and issues the certificate for every entity. These entities include all the CAGs, LAGs, and BGWs. As an example, TA issues the certificate for a certainLAGi as follows.(1)
TA chooses a random numberSKLAGi∈Zq* as the LAGi’s private key and computes the LAGi’s public key PKLAGi=gSKLAGi(mod⁡p).(2)
TA generates the signatureσTA,LAGi, where σTA,LAGi=SigSKTA(PKLAGi) is a signature on PKLAGi using TA’s private key SKTA.(3)
TA deliversSKLAGi and CertLAGi to LAGi, where CertLAGi=(PKLAGi,σTA,LAGi). The delivery of SKLAGi must be via a secure channel, such as a Secure Socket Layer.


### 5.3. User Registration

Before accessing smart grid, every SM needs to get a certificate from TA and register in certain LAG which SM belongs to. AssumeSMi-LAGi indicates that a certain SM belongs to LAGi. In Figure 3, an example of user registration for SMi-LAGi is as follows.Figure 3
The flow chart ofSMi-LAGi registration.(1)
After TA verifies the identity ofSMi-LAGi, TA delivers the SKSMi-LAGi and certificate CertSMi-LAGi to SMi-LAGi, which is the same as the process in Section 5.2.
(2)
S
M
i
-
LG
A
i encrypts the message CertSMi-LAGi∥T∥SigSKSMi-LAGiCertSMi-LAGi∥T by PKLAGi and sends it to LAGi, where T is the current timestamp.
(3)
LAG
i decrypts the received message by its private key SKLAGi. LAGi verifies the validity of timestamp T, CertSMi-LAGi and SigSKSMi-LAGiCertSMi-LAGi∥T. If all those are available, go to step (4). Otherwise, go back to Step (2).
(4)
LAG
i chooses a random number SLAGi-SMi∈Zq* and computes PLAGi-SMi=gSLAGi-SMi, KLAGi-SMi=(PKSMi-LAGi)SLAGi-SMi, and HLAGi-SMi=HMACKLAGi-SMi(PLAGi-SMi). Then, LAGi sends PLAGi-SMi and HLAGi-SMi to SMi-LAGi.
(5)
S
M
i
-
LA
G
i can get noninteractively shared key KLAGi-SMi=(PLAGi-SMi)SKSMi-LAGi and can verify the correctness of HLAGi-SMi. If HLAGi-SMi is consistent, go to Step (6). Otherwise, go back to Step (2).
(6)
S
M
i
-
LA
G
i sends PLAGi-SMi∥TS∥SigSKSMi-LAGi(PLAGi-SMi∥TS) to LAGi, where TS is the current timestamp.
(7)
LAG
i verifies the validity of signature in Step (6). If it is available, go to Step (8). Otherwise, go back to Step (4).
(8)
LAG
i stores the CertSMi-LAGi, SLAGi-SMi, and KLAGi-SMi in its database. Then LAGi sends thepermit defined as PKSMi-LAGi∥TSpermit∥d∥SigSKLAGi(PKSMi-LGAi∥TSpermit∥d) to SMi-LAGi, where TSpermit is the current timestamp and d is the expiry length of time.


### 5.4. Data Collection

When a certainLAGi needs to make statistical analysis and collect energy information in its DAN, LAGi broadcasts the data collection command to its subordinate BGWs. Similarly, each BGW will broadcast the data collection command to its subordinate SMs. As an example, the process of data collection from SMi-LAGi to LAGi is as follows.(I) Each BGW Collects Eligible SMs’ Permits
(1)
After receiving the data collection command fromBGWj-LAGi, SMi-LAGi chooses a random number uSMi-LAGi∈Zq* and computes K1SMi-LAGi=guSMi-LAGi. Here BGWj-LAGi is a certain BGW who is LAGi’s subordinate and SMi-LAGi’s superior. Then, SMi-LAGi encrypts the message C1SMi-LAGi=permit∥K1SMi-LAGi∥T1∥SigSKSMi-LAGi(permit∥K1SMi-LAGi∥T1) by PKBGWj-LAGi and sends it to BGWj-LAGi, where T1 is the current timestamp.
(2)
BG
W
j
-
LA
G
i verifies the validity of C1SMi-LAGi using Algorithm 1. For eligible SMi-LAGi, BGWj-LAGi chooses two random numbers uBGWj-LAGi, kBGWj-LAGi′∈Zq* and computes rBGWj-LAGi′, K2BGWj-LAGi, KSMi-BGWj-LAGi, where rBGWj-LAGi′=gkBGWj-LAGi′(mod⁡p), K2BGWj-LAGi=guBGWj-LAGi(mod⁡p), and KSMi-BGWj-LAGi=K1SMi-LAGiuBGWj-LAGi(mod⁡p).
(3)
BG
W
j
-
LA
G
i sends the message C2SMi-LAGi=rBGWj-LAGi′∥K2BGWj-LAGi∥T2∥HMACKSMi-BGWj-LAGi(rBGWj-LAGi′∥K2BGWj-LAGi∥T2) to SMi-LAGi, where T2 is the current timestamp.
(4)
After receivingC2SMi-LAGi, SMi-LAGi can get noninteractively shared key KSMi-BGWj-LAGi=K2BGWj-LAGiuSMi-LAGi(mod⁡p) and compute HMACKSMi-BGWj-LAGi(rBGWj-LAGi′∥K2BGWj-LAGi∥T2).
(5)
If the value of HMAC is consistent, go to Step (5). Otherwise, go back to Step (1).
(6)
S
M
i
-
LA
G
i sends permit∥T3∥HMACKSMi-BGWj-LAGi(permit∥T3) to BGWj-LAGi, where T3 is the current timestamp.
(7)
WhenT3-T2<ΔT, BGWj-LAGi verifies the correctness of received messages in Step (5) by HMAC, where ΔT is the limit for time difference. Then, BGWj-LAGi collects all eligible SMs’permits and sends them to LAGi.Algorithm 1:The process of verifying C1SMi-LAGi.
Require: EncPKBGWj-LAGi[C1SMi-LAGi]
(1) DecryptEncPKBGWj-LAGi[C1SMi-LAGi] by BGWj-LAGi’s private key SKBGWj-LAGi.
(2) VerifyT1 − TSpermit < d, d is the expiry length of time.
(3)if  T1 is valid then
VerifySigSKSMi-LAGi(permit∥K1SMi-LAGi∥T1) by PKSMi-LAGi.
if  SigSKSMi-LAGi(permit∥K1SMi-LAGi∥T1) is valid then
VerifySigSKLAGi(PKSMi-LGAi∥TSpermit∥d) by PKLAGi.
if  SigSKLAGi(PKSMi-LGAi∥TSpermit∥d) is valid then
acceptC1SMi-LAGi.
(4)end if
(5)end if
(6)end if(II) Generate the Shared Blind Factors between LAG and Every SM
(1)
After receiving all thepermits from BGWj-LAGi, LAGi confirms the total ofpermits as NBGWj-LAGi. Then LAGi finds the corresponding KLAGi-SMi in its database, where KLAGi-SMi is the shared key of LAGi with SMi-LAGi. And LAGi generates the message {BBGWj-LAGi,K3BGWj-LAGi} by using Algorithm 2.
(2)
LAG
i sends message {BBGWj-LAGi,K3BGWj-LAGi} to BGWj-LAGi.
(3)
After receiving the message fromLAGi, BGWj-LAGi stores K3BGWj-LAGi in its database and broadcasts BBGWj-LAGi to its every subordinate SM. If SM’spermit is eligible, SM can recover KLAGi-BGWj-LAGi1 and KLAGi-BGWj-LAGi2. As an example, SMi-LAGi can get KLAGi-BGWj-LAGi1=gBGWj-LAGi(KLAGi-SMi) + KLAGi-BGWj-LAGi1 and KLAGi-BGWj-LAGi2=gBGWj-LAGi(KLAGi-SMi)+KLAGi-BGWj-LAGi2, respectively. In the following, SMi-LAGi is an example of data collection, which is the same as other SMs.
(4)
S
M
i
-
LA
G
i computes two blind factors αLAGi-SMi=HKLAGi-BGWj-LAGi1∥KLAGi-SMi and βLAGi-SMi=HKLAGi-BGWj-LAGi2∥KLAGi-SMi, where H is a one-way hash function.Algorithm 2:Message generation algorithm for LAG.
Require: g, p, q, KLAGi-SM1,…,KLAGi-SMNBGWj-LAGi
(1) Construct functiongBGWj-LAGi(x)=(x-KLAGi-SM1)·(x-KLAGi-SM2)⋯(x-KLAGi-SMNBGWj-LAGi),
where fromKLAGi-SM1 to KLAGi-SMNBGWj-LAGi indicates NBGWj-LAGi
shared keys of LAG with SMs whichpermit past validation.
(2) Select random numbersKLAGi-BGWj-LAGi1∈ Zq* and KLAGi-BGWj-LAGi2∈Zq*.
(3) GenerateBBGWj-LAGi={gBGWj-LAGi(x)+KLAGi-BGWj-LAGi1, gBGWj-LAGi(x)+KLAGi-BGWj-LAGi2}.
(4) Select a random numberuBGWj-LAGi′∈Zq*.
(5) ComputeK3BGWj-LAGi=guBGWj-LAGi′(modp).
Return  {BBGWj-LAGi,K3BGWj-LAGi}(III) LAG Collects Data from SM via BGW
(1)
S
M
i
-
LA
G
i reads the current electricity information mi-LAGi and computes ri-LAGi=mi-LAGigαLAGi-SMirBGWj-LAGi′βLAGi-SMi(mod⁡p),mi-LAGi′=ri-LAGiβLAGi-SMi-1. SMi-LAGi sends C3SMi-LAGi=mi-LAGi′∥T4∥SigSKSMi-LAGi(mi-LAGi′∥T4) to BGWj-LAGi, where T4 is the current timestamp.
(2)
BG
W
j
-
LA
G
i verifies the validity of signature in Step (1). If the signature is valid, go to Step (3). Otherwise, BGWj-LAGi requires SMi-LAGi resending the message as in Step (1) within the valid time range.
(3)
BG
W
j
-
LA
G
i chooses a random number uBGWj-LAGi′′∈Zq* and computes K4BGWj-LAGi = guBGWj-LAGi′′(mod⁡p), KSMi-BGWj-LAGi′ = K3BGWj-LAGiuBGWj-LAGi′′(mod⁡p). BGWj-LAGi signs the message mi-LAGi′ with sSMi-BGWj-LAGi′ = mi-LAGi′SKBGWj-LAGi + kBGWj-LAGi′(mod⁡p) using blind signature.
(4)
BG
W
j
-
LA
G
i sends C4SMi-LAGi=rBGWj-LAGi′∥sSMi-BGWj-LAGi′∥PKSMi-LAGi∥mi-LAGi′∥T4∥SigSKSMi-LAGimi-LAGi′∥T4∥K4BGWj-LAGi∥T5 and HMACKSMi-BGWj-LAGi′C4SMi-LAGi to LAGi.
(5)
LAG
i can get SMi-LAGi’s current electricity information mi-LAGi using Algorithm 3.Algorithm 3:The process of recovering message for LAG.
(1)   VerifyT5-T4<ΔT, where ΔT is the limit for time difference.
(2)if  T5-T4<ΔT  then
computeKSMi-BGWj-LAGi′ = K4BGWj-LAGiuBGWj-LAGi′(modp).
(3)   Verify the validity ofHMACKSMi-BGWj-LAGi′(C4SMi-LAGi).
(4)if HMAC is valid then
findKLAGi-SMi in its database according to PKSMi-LAGi.
(5)   ComputesαLAGi-SMi=H(KLAGi-BGWj-LAGi1∥KLAGi-SMi), βLAGi-SMi=H(KLAGi-BGWj-LAGi2∥KLAGi-SMi).
(6)   GetsSMi-BGWj-LAGi=sSMi-BGWj-LAGi′βLAGi-SMi+αLAGi-SMi,
ri-LAGi=mi-LAGi′βLAGi-SMi,
mi-LAGi=ri-LAGig-αLAGi-SMirBGWj-LAGi′-βLAGi-SMi(mod⁡p).
(7)   Judgeg-sSMi-BGWj-LAGiPKBGWj-LAGiri-LAGiri-LAGi(mod⁡p)=mi-LAGi
if equation holds then
Record the messagemi-LAGi and signature (sSMi-BGWj-LAGi, ri-LAGi) in the corresponding database.
(8)end if
(9)end if
(10)end if


### 5.5. Key Evolution

TheSM’spermit is only valid from TSpermit to TSpermit+d. After TSpermit+d, thepermit is automatically revoked if SM does not apply for a newpermit. Assuming d′ is the corresponding number of days for d, here we extend the shared key KLAG-SM to d′ dimensional vector KLAG-SM=(K1,K2,…,Kd′). For d′ dimensional vector KLAG-SM, K1=KLAG-SM, K2=H(K1), and K3=H(K2),…,Kd′=H(Kd′-1), where H is a one-way hash function. Note that the extension does not influence the previous EPPDC scheme. Then, both SM and LAG can deduce d′ dimensional shared key KLAG-SM=(K1,K2,…,Kd′) within the terms ofpermit.Here we assume that every shared key is valid for one day.d′ dimensional shared key is valid for d′ days during the validity ofpermit. Accordingly, both SM and LAG can confirm the intraday shared key KLAG-SM from d′ dimensional key KLAG-SM.EverySM only stores the intraday shared key KLAG-SM withinpermit validity period. The day before the expiration of permit, SM applies for registration in LAG again. For eligible SM, LAG will issue the newpermit and form the new shared key KLAG-SM to SM. When previouspermit has expired, SM deletes previouspermit and KLAG-SM. Thus, the shared key KLAG-SM evolution is achieved.


## 5.1. System Initialization

We assume that TA will initialize the whole system. TA chooses the following:(1)
primesp and q such that q∣p-1,   q≥2140 and p≥2512;(2)
an elementg∈Zp* with order q; that is, gq=1(mod⁡p), and g≠1;(3)
a one-way hash functionh:0,1*→0,1l;(4)
a security parameterλ∈N and bilinear group (G,GT) with prime order p>2λ, which satisfies with g being a generator of G;(5)
a random numbers∈Zq* as TA’s private key so that SKTA=s.Then, TA computes its public keyPKTA=gs and publishes the tuple (p,q,g,h,PKTA) as the system parameters.


## 5.2. Certificate Issuing

During this phase, TA verifies the identity and issues the certificate for every entity. These entities include all the CAGs, LAGs, and BGWs. As an example, TA issues the certificate for a certainLAGi as follows.(1)
TA chooses a random numberSKLAGi∈Zq* as the LAGi’s private key and computes the LAGi’s public key PKLAGi=gSKLAGi(mod⁡p).(2)
TA generates the signatureσTA,LAGi, where σTA,LAGi=SigSKTA(PKLAGi) is a signature on PKLAGi using TA’s private key SKTA.(3)
TA deliversSKLAGi and CertLAGi to LAGi, where CertLAGi=(PKLAGi,σTA,LAGi). The delivery of SKLAGi must be via a secure channel, such as a Secure Socket Layer.


## 5.3. User Registration

Before accessing smart grid, every SM needs to get a certificate from TA and register in certain LAG which SM belongs to. AssumeSMi-LAGi indicates that a certain SM belongs to LAGi. In Figure 3, an example of user registration for SMi-LAGi is as follows.Figure 3
The flow chart ofSMi-LAGi registration.(1)
After TA verifies the identity ofSMi-LAGi, TA delivers the SKSMi-LAGi and certificate CertSMi-LAGi to SMi-LAGi, which is the same as the process in Section 5.2.
(2)
S
M
i
-
LG
A
i encrypts the message CertSMi-LAGi∥T∥SigSKSMi-LAGiCertSMi-LAGi∥T by PKLAGi and sends it to LAGi, where T is the current timestamp.
(3)
LAG
i decrypts the received message by its private key SKLAGi. LAGi verifies the validity of timestamp T, CertSMi-LAGi and SigSKSMi-LAGiCertSMi-LAGi∥T. If all those are available, go to step (4). Otherwise, go back to Step (2).
(4)
LAG
i chooses a random number SLAGi-SMi∈Zq* and computes PLAGi-SMi=gSLAGi-SMi, KLAGi-SMi=(PKSMi-LAGi)SLAGi-SMi, and HLAGi-SMi=HMACKLAGi-SMi(PLAGi-SMi). Then, LAGi sends PLAGi-SMi and HLAGi-SMi to SMi-LAGi.
(5)
S
M
i
-
LA
G
i can get noninteractively shared key KLAGi-SMi=(PLAGi-SMi)SKSMi-LAGi and can verify the correctness of HLAGi-SMi. If HLAGi-SMi is consistent, go to Step (6). Otherwise, go back to Step (2).
(6)
S
M
i
-
LA
G
i sends PLAGi-SMi∥TS∥SigSKSMi-LAGi(PLAGi-SMi∥TS) to LAGi, where TS is the current timestamp.
(7)
LAG
i verifies the validity of signature in Step (6). If it is available, go to Step (8). Otherwise, go back to Step (4).
(8)
LAG
i stores the CertSMi-LAGi, SLAGi-SMi, and KLAGi-SMi in its database. Then LAGi sends thepermit defined as PKSMi-LAGi∥TSpermit∥d∥SigSKLAGi(PKSMi-LGAi∥TSpermit∥d) to SMi-LAGi, where TSpermit is the current timestamp and d is the expiry length of time.


## 5.4. Data Collection

When a certainLAGi needs to make statistical analysis and collect energy information in its DAN, LAGi broadcasts the data collection command to its subordinate BGWs. Similarly, each BGW will broadcast the data collection command to its subordinate SMs. As an example, the process of data collection from SMi-LAGi to LAGi is as follows.(I) Each BGW Collects Eligible SMs’ Permits
(1)
After receiving the data collection command fromBGWj-LAGi, SMi-LAGi chooses a random number uSMi-LAGi∈Zq* and computes K1SMi-LAGi=guSMi-LAGi. Here BGWj-LAGi is a certain BGW who is LAGi’s subordinate and SMi-LAGi’s superior. Then, SMi-LAGi encrypts the message C1SMi-LAGi=permit∥K1SMi-LAGi∥T1∥SigSKSMi-LAGi(permit∥K1SMi-LAGi∥T1) by PKBGWj-LAGi and sends it to BGWj-LAGi, where T1 is the current timestamp.
(2)
BG
W
j
-
LA
G
i verifies the validity of C1SMi-LAGi using Algorithm 1. For eligible SMi-LAGi, BGWj-LAGi chooses two random numbers uBGWj-LAGi, kBGWj-LAGi′∈Zq* and computes rBGWj-LAGi′, K2BGWj-LAGi, KSMi-BGWj-LAGi, where rBGWj-LAGi′=gkBGWj-LAGi′(mod⁡p), K2BGWj-LAGi=guBGWj-LAGi(mod⁡p), and KSMi-BGWj-LAGi=K1SMi-LAGiuBGWj-LAGi(mod⁡p).
(3)
BG
W
j
-
LA
G
i sends the message C2SMi-LAGi=rBGWj-LAGi′∥K2BGWj-LAGi∥T2∥HMACKSMi-BGWj-LAGi(rBGWj-LAGi′∥K2BGWj-LAGi∥T2) to SMi-LAGi, where T2 is the current timestamp.
(4)
After receivingC2SMi-LAGi, SMi-LAGi can get noninteractively shared key KSMi-BGWj-LAGi=K2BGWj-LAGiuSMi-LAGi(mod⁡p) and compute HMACKSMi-BGWj-LAGi(rBGWj-LAGi′∥K2BGWj-LAGi∥T2).
(5)
If the value of HMAC is consistent, go to Step (5). Otherwise, go back to Step (1).
(6)
S
M
i
-
LA
G
i sends permit∥T3∥HMACKSMi-BGWj-LAGi(permit∥T3) to BGWj-LAGi, where T3 is the current timestamp.
(7)
WhenT3-T2<ΔT, BGWj-LAGi verifies the correctness of received messages in Step (5) by HMAC, where ΔT is the limit for time difference. Then, BGWj-LAGi collects all eligible SMs’permits and sends them to LAGi.Algorithm 1:The process of verifying C1SMi-LAGi.
Require: EncPKBGWj-LAGi[C1SMi-LAGi]
(1) DecryptEncPKBGWj-LAGi[C1SMi-LAGi] by BGWj-LAGi’s private key SKBGWj-LAGi.
(2) VerifyT1 − TSpermit < d, d is the expiry length of time.
(3)if  T1 is valid then
VerifySigSKSMi-LAGi(permit∥K1SMi-LAGi∥T1) by PKSMi-LAGi.
if  SigSKSMi-LAGi(permit∥K1SMi-LAGi∥T1) is valid then
VerifySigSKLAGi(PKSMi-LGAi∥TSpermit∥d) by PKLAGi.
if  SigSKLAGi(PKSMi-LGAi∥TSpermit∥d) is valid then
acceptC1SMi-LAGi.
(4)end if
(5)end if
(6)end if(II) Generate the Shared Blind Factors between LAG and Every SM
(1)
After receiving all thepermits from BGWj-LAGi, LAGi confirms the total ofpermits as NBGWj-LAGi. Then LAGi finds the corresponding KLAGi-SMi in its database, where KLAGi-SMi is the shared key of LAGi with SMi-LAGi. And LAGi generates the message {BBGWj-LAGi,K3BGWj-LAGi} by using Algorithm 2.
(2)
LAG
i sends message {BBGWj-LAGi,K3BGWj-LAGi} to BGWj-LAGi.
(3)
After receiving the message fromLAGi, BGWj-LAGi stores K3BGWj-LAGi in its database and broadcasts BBGWj-LAGi to its every subordinate SM. If SM’spermit is eligible, SM can recover KLAGi-BGWj-LAGi1 and KLAGi-BGWj-LAGi2. As an example, SMi-LAGi can get KLAGi-BGWj-LAGi1=gBGWj-LAGi(KLAGi-SMi) + KLAGi-BGWj-LAGi1 and KLAGi-BGWj-LAGi2=gBGWj-LAGi(KLAGi-SMi)+KLAGi-BGWj-LAGi2, respectively. In the following, SMi-LAGi is an example of data collection, which is the same as other SMs.
(4)
S
M
i
-
LA
G
i computes two blind factors αLAGi-SMi=HKLAGi-BGWj-LAGi1∥KLAGi-SMi and βLAGi-SMi=HKLAGi-BGWj-LAGi2∥KLAGi-SMi, where H is a one-way hash function.Algorithm 2:Message generation algorithm for LAG.
Require: g, p, q, KLAGi-SM1,…,KLAGi-SMNBGWj-LAGi
(1) Construct functiongBGWj-LAGi(x)=(x-KLAGi-SM1)·(x-KLAGi-SM2)⋯(x-KLAGi-SMNBGWj-LAGi),
where fromKLAGi-SM1 to KLAGi-SMNBGWj-LAGi indicates NBGWj-LAGi
shared keys of LAG with SMs whichpermit past validation.
(2) Select random numbersKLAGi-BGWj-LAGi1∈ Zq* and KLAGi-BGWj-LAGi2∈Zq*.
(3) GenerateBBGWj-LAGi={gBGWj-LAGi(x)+KLAGi-BGWj-LAGi1, gBGWj-LAGi(x)+KLAGi-BGWj-LAGi2}.
(4) Select a random numberuBGWj-LAGi′∈Zq*.
(5) ComputeK3BGWj-LAGi=guBGWj-LAGi′(modp).
Return  {BBGWj-LAGi,K3BGWj-LAGi}(III) LAG Collects Data from SM via BGW
(1)
S
M
i
-
LA
G
i reads the current electricity information mi-LAGi and computes ri-LAGi=mi-LAGigαLAGi-SMirBGWj-LAGi′βLAGi-SMi(mod⁡p),mi-LAGi′=ri-LAGiβLAGi-SMi-1. SMi-LAGi sends C3SMi-LAGi=mi-LAGi′∥T4∥SigSKSMi-LAGi(mi-LAGi′∥T4) to BGWj-LAGi, where T4 is the current timestamp.
(2)
BG
W
j
-
LA
G
i verifies the validity of signature in Step (1). If the signature is valid, go to Step (3). Otherwise, BGWj-LAGi requires SMi-LAGi resending the message as in Step (1) within the valid time range.
(3)
BG
W
j
-
LA
G
i chooses a random number uBGWj-LAGi′′∈Zq* and computes K4BGWj-LAGi = guBGWj-LAGi′′(mod⁡p), KSMi-BGWj-LAGi′ = K3BGWj-LAGiuBGWj-LAGi′′(mod⁡p). BGWj-LAGi signs the message mi-LAGi′ with sSMi-BGWj-LAGi′ = mi-LAGi′SKBGWj-LAGi + kBGWj-LAGi′(mod⁡p) using blind signature.
(4)
BG
W
j
-
LA
G
i sends C4SMi-LAGi=rBGWj-LAGi′∥sSMi-BGWj-LAGi′∥PKSMi-LAGi∥mi-LAGi′∥T4∥SigSKSMi-LAGimi-LAGi′∥T4∥K4BGWj-LAGi∥T5 and HMACKSMi-BGWj-LAGi′C4SMi-LAGi to LAGi.
(5)
LAG
i can get SMi-LAGi’s current electricity information mi-LAGi using Algorithm 3.Algorithm 3:The process of recovering message for LAG.
(1)   VerifyT5-T4<ΔT, where ΔT is the limit for time difference.
(2)if  T5-T4<ΔT  then
computeKSMi-BGWj-LAGi′ = K4BGWj-LAGiuBGWj-LAGi′(modp).
(3)   Verify the validity ofHMACKSMi-BGWj-LAGi′(C4SMi-LAGi).
(4)if HMAC is valid then
findKLAGi-SMi in its database according to PKSMi-LAGi.
(5)   ComputesαLAGi-SMi=H(KLAGi-BGWj-LAGi1∥KLAGi-SMi), βLAGi-SMi=H(KLAGi-BGWj-LAGi2∥KLAGi-SMi).
(6)   GetsSMi-BGWj-LAGi=sSMi-BGWj-LAGi′βLAGi-SMi+αLAGi-SMi,
ri-LAGi=mi-LAGi′βLAGi-SMi,
mi-LAGi=ri-LAGig-αLAGi-SMirBGWj-LAGi′-βLAGi-SMi(mod⁡p).
(7)   Judgeg-sSMi-BGWj-LAGiPKBGWj-LAGiri-LAGiri-LAGi(mod⁡p)=mi-LAGi
if equation holds then
Record the messagemi-LAGi and signature (sSMi-BGWj-LAGi, ri-LAGi) in the corresponding database.
(8)end if
(9)end if
(10)end if


## 5.5. Key Evolution

TheSM’spermit is only valid from TSpermit to TSpermit+d. After TSpermit+d, thepermit is automatically revoked if SM does not apply for a newpermit. Assuming d′ is the corresponding number of days for d, here we extend the shared key KLAG-SM to d′ dimensional vector KLAG-SM=(K1,K2,…,Kd′). For d′ dimensional vector KLAG-SM, K1=KLAG-SM, K2=H(K1), and K3=H(K2),…,Kd′=H(Kd′-1), where H is a one-way hash function. Note that the extension does not influence the previous EPPDC scheme. Then, both SM and LAG can deduce d′ dimensional shared key KLAG-SM=(K1,K2,…,Kd′) within the terms ofpermit.Here we assume that every shared key is valid for one day.d′ dimensional shared key is valid for d′ days during the validity ofpermit. Accordingly, both SM and LAG can confirm the intraday shared key KLAG-SM from d′ dimensional key KLAG-SM.EverySM only stores the intraday shared key KLAG-SM withinpermit validity period. The day before the expiration of permit, SM applies for registration in LAG again. For eligible SM, LAG will issue the newpermit and form the new shared key KLAG-SM to SM. When previouspermit has expired, SM deletes previouspermit and KLAG-SM. Thus, the shared key KLAG-SM evolution is achieved.


## 6. Security Analysis and Computation Overhead

In this section, we analyze the security properties and the computation of the EPPDC scheme.


### 6.1. Security Analysis

EPPDC scheme can achieve data collection fromSM to LAG via BGW. And EPPDC scheme not only can resist replay attack, but also has source authentication and data integrity, confidentiality, unforgeability, nonrepudiation, and evolution of shared keys.Property 1 (correctness).
In EPPDC scheme,LAG can verify the blind signature of BGW and recover the message sent by SM.Proof.
During Stage III of data collection in EPPDC scheme,BGWj-LAGi sends the (rBGWj-LAGi′,sSMi-BGWj-LAGi′) message mi-LAGi′ and PKSMi-LAGi to LAGi. LAGi can find the corresponding KLAGi-SMi in its database according to PKSMi-LAGiand the current timestamp. Then, LAGi recovers the current electricity information mi-LAGi using Algorithm 3, which is proved by(2)ri-LAGi·g-αLAGi-SMi·rBGWj-LAGi′-βLAGi-SMimod⁡p=mi-LAGi·gαLAGi-SMi·rBGWj-LAGi′βLAGi-SMi×g-αLAGi-SMi·rBGWj-LAGi′-βLAGi-SMimod⁡p=mi-LAGi.
TheBGWj-LAGi’s signature on mi-LAGi is (sSMi-BGWj-LAGi,ri-LAGi), which can be proved by(3)g-(sSMi-BGWj-LAGi)PKBGWj-LAGiri-LAGi·ri-LAGimod⁡p=g-(sSMi-BGWj-LAGi′)βLAGi-SMi+αLAGi-SMi·gSKBGWj-LAGi·mi-LAGi′·βLAGi-SMi·ri-LAGimod⁡p=g-{[mi-LAGi′SKBGWj-LAGi+kBGWj-LAGi′]·βLAGi-SMi+αLAGi-SMi}·g(SKBGWj-LAGi·mi-LAGi′·βLAGi-SMi)·ri-LAGimod⁡p=g-kBGWj-LAGi′·βLAGi-SMi-αLAGi-SMi·ri-LAGimod⁡p=rBGWj-LAGi′-βLAGi-SMi·g-αLAGi-SMi·(mi-LAGigαLAGi-SMirBGWj-LAGi′βLAGi-SMi)mod⁡p=mi-LAGi.Property 2 (to resist replay attack).
In EPPDC scheme, we assume that there is an adversaryA who can intercept and capture the messages sent by SMs. When adversary A resends the messages, BGW can detect the replay attack based on the SM’s signature or HMAC with the current timestamp. For the same reason, LAG can also detect the replay attack, when an adversary A resends the BGW’s messages.Property 3 (confidentiality).
In EPPDC scheme, the messages maintain their confidentiality when messages are sent toLAG from SM.Proof.
During Stage III of data collection in EPPDC scheme,SMi-LAGi has processed the information mi-LAGi into mi-LAGi′ by blind factors αLAGi-SMi and βLAGi-SMi, before SMi-LAGi sends the messages to BGWj-LAGi.
We consider the following game played between a challengeC and an adversary A. C runs the system initialization and sends the system parameters to A. A performs a polynomial bounded number of queries (these queries may be made adaptively; that is, each query may depend on the answer to the previous queries). By queries, A can get many couples of (mi-LAGi)* and (mi-LAGi′)*, where (mi-LAGi)*≠mi-LAGi. Based on discrete logarithm problem, A cannot get the blind factors αLAGi-SMi and βLAGi-SMi from (mi-LAGi)* and (mi-LAGi′)*. For the same reason, A cannot get mi-LAGi if it does not know αLAGi-SMi and βLAGi-SMi.
Therefore, an adversaryA cannot get mi-LAGi, even if BGWj-LAGi cannot get mi-LAGi too. Thus the messages maintain their confidentiality when messages are sent to LAG from SM.Property 4 (nonrepudiation and unforgeability).
During Stage III of data collection in EPPDC scheme,SMi-LAGi sends mi-LAGi′∥T4 and its signature to BGWj-LAGi, which is sent to LAGi by BGWj-LAGi at a later step.We consider the following game played between a challengeC and an adversary A. A performs a polynomial bounded number of adaptive queries. By queries, A can get many couples of (mi-LAGi′∥T4)* and SigSKSMi-LAGi(mi-LAGi′∥T4)*. Based on the properties of signature [19], A cannot forge the SMi-LAGi’s signature SigSKSMi-LAGi(mi-LAGi′∥T4) on message (mi-LAGi′∥T4)*. Thus, SMi-LAGi cannot repudiate mi-LAGi′∥T4 being sent by himself.In the following steps,BGWj-LAGi signs the message mi-LAGi′ via blind signature with its private key SKBGWj-LAGi. By adaptive queries, A can get many couples of mi-LAGi′* and (sSMi-BGWj-LAGi*,ri-LAGi*). Based on discrete logarithm problem, A cannot get BGWj-LAGi’s private key SKBGWj-LAGi. Based on discrete logarithm problem, if A forges BGWj-LAGi’s blind signature, the signature will not be authenticated by LAGi making use of (3). Thus, BGWj-LAGi cannot repudiate (mi-LAGi′,sSMi-BGWj-LAGi,ri-LAGi) being sent by himself.Furthermore, based on the properties of signature, the messages sent bySMi-LAGi and BGWj-LAGi are provided with the source authentication and data integrity.Property 5 (forward security).
In EPPDC scheme, thepermit has a validity period d. Whenpermit is valid, both SM and LAG can noninteractively share d′ dimensional key KLAG-SM=(K1,K2,…,Kd′), where d′ is the corresponding number of days for d. Thereby in d′ days, SM and LAG use different shared key every day.In the key evolution phase,SM deletes the previous shared key after it has computed the new shared key KLAG-SM. If an adversary A compromises a HAN user’s SM, it gets the current shared key H(KLAG-SM). Assume that an adversary A can perform a polynomial bounded number of adaptive queries for a challenge C. By queries, A can get many shared keys KLAG-SM*. Based on the property of one-way for hash function, A cannot get any previous shared key KLAG-SM making using of the current shared key H(KLAG-SM). Thus adversary A cannot compute the previous blind factor, and then it cannot get previous message m sent by SM. Therefore, EPPDC scheme provides the evolution and forward secrecy of shared key KLAG-SM.Finally, we present the comparison results of security levels in Table1. It can be seen that scheme [7] and scheme [10] achieve confidentiality, authenticity, and data integrity and scheme [9] cannot resist replay attack.Table 1
Comparison of security level.
[7]
[9]
[10]
EPPDC
Confidentiality
Yes
Yes
Yes
Yes
Authenticity
Yes
Yes
Yes
Yes
Data integrity
Yes
Yes
Yes
Yes
To resist replay attack
No
No
No
Yes
Forward secrecy
No
Yes
No
Yes
Private key evolution
No
Yes
No
Yes


### 6.2. Computation Overhead

In EPPDC scheme, everySM sends its processed messages m′ and its corresponding signatures to BGW. BGW verifies the validity of SM’s signature. For available signature, BGW signs message m′ making use of blind signature and sends it to LAG. LAG can verify that the message is indeed sent by BGW and SM. Furthermore, LAG can recover the original message m.In EPPDC, we assume that the SM’s signature can be converted into the same as the existing literatures such as [7–11] using bilinear pairing, which can also perform the bath verification [7]. So here we mainly discuss the computation complexity of messages m turning to m′, the signature of BGW, verification of BGW’s signature, and recovery for the original message m. Because the computation complexity is similar in [7, 9] which are both realized by homomorphic encryption, we only consider [7] in the following comparisons.In EPPDC scheme,SMi-LAGi needs 2 exponentiation operations, 3 multiplication operations, and 1 inverse operation in Zp* to blind message m to m′. In [7], SMi-LAGi needs 2 exponentiation operations and 1 multiplication operation in Zn2 to encrypt message m to C using homomorphic encryption. In [10], SMi-LAGi encrypts message m to C making use of AES block cipher.In EPPDC scheme, BGW can perform the bath verification. BGW makes use of blind signature to sign blinded messages which are authenticated. Here BGW only needs 1 addition operation and 1 multiplication operation inZp*. In [7], BGW needs 1 multiplication operation in G1 and 1 hash operation. In [10], BGW needs 1 addition operation and 2 multiplication operations in G1.In EPPDC scheme, LAG verifies that the message is indeed sent by BGW and recovers the original messagem which needs 4 exponentiation operations, 6 multiplication operations, 1 addition operation, and 2 inverse operations in Zp*. In [7], LAG can verify that the message is indeed sent by BGW and recover the original message m, which needs 1 exponentiation operation, 1 multiplication operation in Zn2, 2 pairing operations, and 1 hash operation. In [10], LAG can verify that the message is indeed sent by BGW and recover the original message m, which needs 2 pairing operations, 1 multiplication operation in G1, 1 exponentiation operation in GT, 2 exponentiation operations in Zp, and AES decryption.Since the AES encryption or decryption and hash function are negligible compared with exponentiation and pairing operations, here we mainly consider the computation overhead for other operations. Table2 gives the test time for the involved cryptography operations [20]. The experiments are conducted on a computer with Intel i5-3210-2.5 GHz CPU and 4-GB RAM.Table 2
Cryptographic operations execution time.
Denotation
Time (ms)
T
EX
An exponentiation inZp*
0.067
T
Ad
An addition inZp
0.001
T
Mu
A multiplication inZp*
0.001
T
In
⁡
An inverse operation inZp*
0.004
T
Add
An addition inG1
0.038
T
PM
A multiplication inG1
8.006
T
Mul
A multiplication inGT
0.013
T
EXp
An exponentiation inGT
1.882
T
P
A pairing operation
16.064When a message is sent by SM, the comparisons of computation complexity for SM, BGW, and LAG are shown in Table3.Table 3
The comparisons of computation complexity.
SM
BGW
LAG
Reference
2
T
EX + TMu
T
PM
T
EX + TMu + 2TP
[7]
0
2
T
PM + TAdd
2
T
EX + TEXp + TPM + 2TP
[10]
2
T
EX + 3TMu + TIn⁡
T
Mu + TAd
4
T
EX + 6TMu + TAd + 2TIn⁡
This paperWhenn messages are sent by different SMs to the same LAG, LAG can make use of the bath verification to reduce pairing operation from 2n to n+1 [7, 10].With the exact operation costs, we depict the variation of computation costs in terms of the message numbern in Figures 4 and 5, which is for BGW and LAG, respectively. From the figures, it can be obviously shown that the EPPDC scheme largely reduces the computation complexity for both BGW and LAG.Figure 4
Computation cost of BGW.Figure 5
Computation cost of LAG.


## 6.1. Security Analysis

EPPDC scheme can achieve data collection fromSM to LAG via BGW. And EPPDC scheme not only can resist replay attack, but also has source authentication and data integrity, confidentiality, unforgeability, nonrepudiation, and evolution of shared keys.Property 1 (correctness).
In EPPDC scheme,LAG can verify the blind signature of BGW and recover the message sent by SM.Proof.
During Stage III of data collection in EPPDC scheme,BGWj-LAGi sends the (rBGWj-LAGi′,sSMi-BGWj-LAGi′) message mi-LAGi′ and PKSMi-LAGi to LAGi. LAGi can find the corresponding KLAGi-SMi in its database according to PKSMi-LAGiand the current timestamp. Then, LAGi recovers the current electricity information mi-LAGi using Algorithm 3, which is proved by(2)ri-LAGi·g-αLAGi-SMi·rBGWj-LAGi′-βLAGi-SMimod⁡p=mi-LAGi·gαLAGi-SMi·rBGWj-LAGi′βLAGi-SMi×g-αLAGi-SMi·rBGWj-LAGi′-βLAGi-SMimod⁡p=mi-LAGi.
TheBGWj-LAGi’s signature on mi-LAGi is (sSMi-BGWj-LAGi,ri-LAGi), which can be proved by(3)g-(sSMi-BGWj-LAGi)PKBGWj-LAGiri-LAGi·ri-LAGimod⁡p=g-(sSMi-BGWj-LAGi′)βLAGi-SMi+αLAGi-SMi·gSKBGWj-LAGi·mi-LAGi′·βLAGi-SMi·ri-LAGimod⁡p=g-{[mi-LAGi′SKBGWj-LAGi+kBGWj-LAGi′]·βLAGi-SMi+αLAGi-SMi}·g(SKBGWj-LAGi·mi-LAGi′·βLAGi-SMi)·ri-LAGimod⁡p=g-kBGWj-LAGi′·βLAGi-SMi-αLAGi-SMi·ri-LAGimod⁡p=rBGWj-LAGi′-βLAGi-SMi·g-αLAGi-SMi·(mi-LAGigαLAGi-SMirBGWj-LAGi′βLAGi-SMi)mod⁡p=mi-LAGi.Property 2 (to resist replay attack).
In EPPDC scheme, we assume that there is an adversaryA who can intercept and capture the messages sent by SMs. When adversary A resends the messages, BGW can detect the replay attack based on the SM’s signature or HMAC with the current timestamp. For the same reason, LAG can also detect the replay attack, when an adversary A resends the BGW’s messages.Property 3 (confidentiality).
In EPPDC scheme, the messages maintain their confidentiality when messages are sent toLAG from SM.Proof.
During Stage III of data collection in EPPDC scheme,SMi-LAGi has processed the information mi-LAGi into mi-LAGi′ by blind factors αLAGi-SMi and βLAGi-SMi, before SMi-LAGi sends the messages to BGWj-LAGi.
We consider the following game played between a challengeC and an adversary A. C runs the system initialization and sends the system parameters to A. A performs a polynomial bounded number of queries (these queries may be made adaptively; that is, each query may depend on the answer to the previous queries). By queries, A can get many couples of (mi-LAGi)* and (mi-LAGi′)*, where (mi-LAGi)*≠mi-LAGi. Based on discrete logarithm problem, A cannot get the blind factors αLAGi-SMi and βLAGi-SMi from (mi-LAGi)* and (mi-LAGi′)*. For the same reason, A cannot get mi-LAGi if it does not know αLAGi-SMi and βLAGi-SMi.
Therefore, an adversaryA cannot get mi-LAGi, even if BGWj-LAGi cannot get mi-LAGi too. Thus the messages maintain their confidentiality when messages are sent to LAG from SM.Property 4 (nonrepudiation and unforgeability).
During Stage III of data collection in EPPDC scheme,SMi-LAGi sends mi-LAGi′∥T4 and its signature to BGWj-LAGi, which is sent to LAGi by BGWj-LAGi at a later step.We consider the following game played between a challengeC and an adversary A. A performs a polynomial bounded number of adaptive queries. By queries, A can get many couples of (mi-LAGi′∥T4)* and SigSKSMi-LAGi(mi-LAGi′∥T4)*. Based on the properties of signature [19], A cannot forge the SMi-LAGi’s signature SigSKSMi-LAGi(mi-LAGi′∥T4) on message (mi-LAGi′∥T4)*. Thus, SMi-LAGi cannot repudiate mi-LAGi′∥T4 being sent by himself.In the following steps,BGWj-LAGi signs the message mi-LAGi′ via blind signature with its private key SKBGWj-LAGi. By adaptive queries, A can get many couples of mi-LAGi′* and (sSMi-BGWj-LAGi*,ri-LAGi*). Based on discrete logarithm problem, A cannot get BGWj-LAGi’s private key SKBGWj-LAGi. Based on discrete logarithm problem, if A forges BGWj-LAGi’s blind signature, the signature will not be authenticated by LAGi making use of (3). Thus, BGWj-LAGi cannot repudiate (mi-LAGi′,sSMi-BGWj-LAGi,ri-LAGi) being sent by himself.Furthermore, based on the properties of signature, the messages sent bySMi-LAGi and BGWj-LAGi are provided with the source authentication and data integrity.Property 5 (forward security).
In EPPDC scheme, thepermit has a validity period d. Whenpermit is valid, both SM and LAG can noninteractively share d′ dimensional key KLAG-SM=(K1,K2,…,Kd′), where d′ is the corresponding number of days for d. Thereby in d′ days, SM and LAG use different shared key every day.In the key evolution phase,SM deletes the previous shared key after it has computed the new shared key KLAG-SM. If an adversary A compromises a HAN user’s SM, it gets the current shared key H(KLAG-SM). Assume that an adversary A can perform a polynomial bounded number of adaptive queries for a challenge C. By queries, A can get many shared keys KLAG-SM*. Based on the property of one-way for hash function, A cannot get any previous shared key KLAG-SM making using of the current shared key H(KLAG-SM). Thus adversary A cannot compute the previous blind factor, and then it cannot get previous message m sent by SM. Therefore, EPPDC scheme provides the evolution and forward secrecy of shared key KLAG-SM.Finally, we present the comparison results of security levels in Table1. It can be seen that scheme [7] and scheme [10] achieve confidentiality, authenticity, and data integrity and scheme [9] cannot resist replay attack.Table 1
Comparison of security level.
[7]
[9]
[10]
EPPDC
Confidentiality
Yes
Yes
Yes
Yes
Authenticity
Yes
Yes
Yes
Yes
Data integrity
Yes
Yes
Yes
Yes
To resist replay attack
No
No
No
Yes
Forward secrecy
No
Yes
No
Yes
Private key evolution
No
Yes
No
Yes


## 6.2. Computation Overhead

In EPPDC scheme, everySM sends its processed messages m′ and its corresponding signatures to BGW. BGW verifies the validity of SM’s signature. For available signature, BGW signs message m′ making use of blind signature and sends it to LAG. LAG can verify that the message is indeed sent by BGW and SM. Furthermore, LAG can recover the original message m.In EPPDC, we assume that the SM’s signature can be converted into the same as the existing literatures such as [7–11] using bilinear pairing, which can also perform the bath verification [7]. So here we mainly discuss the computation complexity of messages m turning to m′, the signature of BGW, verification of BGW’s signature, and recovery for the original message m. Because the computation complexity is similar in [7, 9] which are both realized by homomorphic encryption, we only consider [7] in the following comparisons.In EPPDC scheme,SMi-LAGi needs 2 exponentiation operations, 3 multiplication operations, and 1 inverse operation in Zp* to blind message m to m′. In [7], SMi-LAGi needs 2 exponentiation operations and 1 multiplication operation in Zn2 to encrypt message m to C using homomorphic encryption. In [10], SMi-LAGi encrypts message m to C making use of AES block cipher.In EPPDC scheme, BGW can perform the bath verification. BGW makes use of blind signature to sign blinded messages which are authenticated. Here BGW only needs 1 addition operation and 1 multiplication operation inZp*. In [7], BGW needs 1 multiplication operation in G1 and 1 hash operation. In [10], BGW needs 1 addition operation and 2 multiplication operations in G1.In EPPDC scheme, LAG verifies that the message is indeed sent by BGW and recovers the original messagem which needs 4 exponentiation operations, 6 multiplication operations, 1 addition operation, and 2 inverse operations in Zp*. In [7], LAG can verify that the message is indeed sent by BGW and recover the original message m, which needs 1 exponentiation operation, 1 multiplication operation in Zn2, 2 pairing operations, and 1 hash operation. In [10], LAG can verify that the message is indeed sent by BGW and recover the original message m, which needs 2 pairing operations, 1 multiplication operation in G1, 1 exponentiation operation in GT, 2 exponentiation operations in Zp, and AES decryption.Since the AES encryption or decryption and hash function are negligible compared with exponentiation and pairing operations, here we mainly consider the computation overhead for other operations. Table2 gives the test time for the involved cryptography operations [20]. The experiments are conducted on a computer with Intel i5-3210-2.5 GHz CPU and 4-GB RAM.Table 2
Cryptographic operations execution time.
Denotation
Time (ms)
T
EX
An exponentiation inZp*
0.067
T
Ad
An addition inZp
0.001
T
Mu
A multiplication inZp*
0.001
T
In
⁡
An inverse operation inZp*
0.004
T
Add
An addition inG1
0.038
T
PM
A multiplication inG1
8.006
T
Mul
A multiplication inGT
0.013
T
EXp
An exponentiation inGT
1.882
T
P
A pairing operation
16.064When a message is sent by SM, the comparisons of computation complexity for SM, BGW, and LAG are shown in Table3.Table 3
The comparisons of computation complexity.
SM
BGW
LAG
Reference
2
T
EX + TMu
T
PM
T
EX + TMu + 2TP
[7]
0
2
T
PM + TAdd
2
T
EX + TEXp + TPM + 2TP
[10]
2
T
EX + 3TMu + TIn⁡
T
Mu + TAd
4
T
EX + 6TMu + TAd + 2TIn⁡
This paperWhenn messages are sent by different SMs to the same LAG, LAG can make use of the bath verification to reduce pairing operation from 2n to n+1 [7, 10].With the exact operation costs, we depict the variation of computation costs in terms of the message numbern in Figures 4 and 5, which is for BGW and LAG, respectively. From the figures, it can be obviously shown that the EPPDC scheme largely reduces the computation complexity for both BGW and LAG.Figure 4
Computation cost of BGW.Figure 5
Computation cost of LAG.


## 7. Conclusions

This paper proposes an efficient and privacy-preserving data collection scheme for smart grid, which is based on the blind signature and the key distribution scheme. This scheme can achieve that the users’ data information is transmitted to the local aggregator through building gateway. And we analyze the EPPDC scheme. The analysis shows that the scheme not only provides privacy preserving but also has less computation cost than existing schemes.



---

*Source: 656219-2015-05-20.xml*