# PAS: An Efficient Privacy-Preserving Multidimensional Aggregation Scheme for Smart Grid

Authors: Hui Zhu; Fen Liu; Rong Yan; Hui Li
Journal: International Journal of Distributed Sensor Networks
 (2015)

---

## Abstract

As a convergence of traditional power system engineering and information technology, smart grid, which can provide convenient environment of operation and management for the power provider, has attracted considerable interest recently. However, the flourish of smart grid is still facing many challenges in data security and privacy preservation. In this paper, we propose an efficient privacy-preserving multidimensional aggregation scheme for smart grid, called PAS. Without disclosing the privacy-sensitive information (e.g., identity and power consumption) of users, the operation center can obtain the number of users and power consumption at each step in different dimensions. Based on an improved Paillier cryptosystem, the operation center can acquire more valid information to regulate the generated energy, and an efficient anonymous authentication scheme is employed to protect the privacy of user’s identity from the regional center. Detailed security analysis shows the security and privacy-preserving ability of PAS. In addition, performance evaluations via extensive simulations demonstrate that PAS is implemented with great efficiency for smart grid in terms of computation and communication overhead.


---

## Body

## 1. Introduction

The 22nd world energy congress under the theme of “Securing Tomorrow’s Energy Today” was held on October 13, 2013, in Daegu, South Korea [1], which offered a unique opportunity for participants to get a better understanding of energy issues and solutions from a global perspective. Simultaneously, the optimization of energy structure and the improvement of energy utilization were taken into consideration inevitably. Especially in the electric area, the lack of reasonable electrical structure to meet growing demands has stretched the power grid to its limits. Furthermore, in the past 100 years, there has been no dramatic change in the basic structure of electrical power grid. Experience has shown that the hierarchical, centrally controlled power grid cannot meet the growing demands of the 21st century [2]. Therefore, researching for a new power grid, which can support the new power system and enhance the efficiency of power consumption, is currently an emergency for most countries.Recently the appearance of smart grid has attracted plenty of countries’ interest and has been regarded as the next generation of power grid [3–8]. Compared with traditional grid, smart grid supports centralized two-way transmission and efficiency-driven response. Besides, smart grid relies on cyber-physical systems or the Internet of Things to provide intelligent scheduling for power transmission and distribution [9]. For instance, smart meter equipped with network interfaces (e.g., wireless sensors) reports power consumption to the operation center via the advanced meter controlled by the regional center, as shown in Figure 1. The operation center spans different geographic regions and can transmit the result of data analysis to the power supplier in a distributed way, whose responsibility is to adjust power supply dynamically to meet demands and detect and respond to the weaknesses or failures of power system in real time.Figure 1
The conceptual architecture of smart grid.Smart meter (SM) which is two-way communication device and deployed at users premise is indispensable component in the smart grid, since it can record real-time power consumption periodically. With SM, smart grid is capable of collecting real-time information about grid operations and status at the operation center. SM will send the encrypted power consumption to the regional center after being authorized. Through the regional center, smart grid can transmit the user’s detailed electricity information to the operation center, which may then change electricity price accordingly or even adjust user’s usage. However, if there is an adversary in the regional area, he/she may infer user’s physical activities based on the power consumption of a family. For instance, unusual low daily power consumption of a household indicates that the home owners are probably away from home. Therefore, such privacy-sensitive information must be protected from unauthorized access [10, 11].However, the majority of existing schemes [12–15] can offer total power consumption to the power supplier; this user-centric information is far from enough for the service provider (e.g., the electric company) to allocate power resource. For example, many service providers adopt the multistep electricity pricing policy [16] where the price of electricity is based on the user’s power consumption. In order to utilize and dispatch different kinds of step electricity for service providers, more information related to users (e.g., the number of users and power consumption at each step, etc.) is required. With regard to the power supplier, not only can it classify users depending on the power consumption, but also it works out a practical and reasonable business strategy.In this paper, from the perspective of power supplier, under the promise of protecting the confidentiality of user’s identity and power consumption, we propose an efficient privacy-preserving multidimensional aggregation scheme for smart grid, called PAS. The characteristics of proposed PAS are offering more valid user information to the power supplier and achieving user’s identity privacy and data confidentiality. The main contributions of this paper are threefold.(i)
First, PAS provides more valid user information without disclosing user’s data and identity privacy. Upon the employment of an improved Paillier cryptosystem [17] technique, the operation center can acquire both the number of users and power consumption at each step by decrypting the preliminary aggregations from the regional center. Simultaneously, compared with the existing aggregation schemes [18–20], PAS provides more effective information to the power supplier to make more planed electricity strategy.(ii)
Second, PAS can guarantee fine-grained privacy preserving. Although the aggregation scheme [12] can guarantee the privacy of user’s information, the authenticator still knows the identity which corresponds to the signature. However, in our scheme, the improved group signature [21] scheme makes user’s identity unrecognized by the regional center. Meanwhile, data privacy preservation requirements can be achieved through the improved Paillier cryptosystem.(iii)
Third, PAS achieves the traceable anonymity of smart grid. We employ a specific group signature scheme between the smart grid and the regional center, which can obtain the authentication and traceability of message. The regional center checks out the message and signature without knowing the smart grid’s identity. But if the smart grid’s signature is proved to be invalid, the identity of malicious smart grid could be ferreted out with the help of TA.The remainder of this paper is organized as follows. In Section2, we formalize the system model and security requirements and identify our design goal. Then, we recall the discrete logarithm and Paillier cryptosystem as the preliminaries in Section 3. Then, we present our PAS scheme in Section 4, followed by the security analysis and performance evaluation in Sections 5 and 6, respectively. We also discuss some related works in Section 7. Finally, we draw our conclusions and identify some future work in Section 8.


## 2. System Model, Security Requirements, and Design Goal

In this section, we formalize the system model and security requirements and identify our design goal.


### 2.1. System Model

In our system model, we mainly focus on how to report user’s privacy-preserving power consumption information to the operation center. Specifically, the system consists of four parts: trusted authority (TA), residential area (RA), operation center (OC), and regional center (RC), as shown in Figure2.Figure 2
System model under consideration.TA: the trusted authority is fully trustable in the whole system, whose duty is to bootstrap the system initialization and distribute secret keys to the SM, RC, and OC (some parameters must be kept private, while others are public). In addition to system initialization, TA is offline in other phases. Only in the case that errors exist in the process of authentication, TA can respond to it in time; for example, when errors arise in the authentication, TA can recover the malicious identity of SM based on the group signature scheme. Therefore, TA is an indispensable part in this system.RA: we consider a typical residential area, which mainly consists of a connection with RC and a great number of users that are equipped with smart metersSM1,SM2,…,SMn. SMi records the real-time data about power consumption, and the data will be reported to RC in a certain period.RC: RC is a powerful workshop, which mainly performs three functions: authentication, aggregation, and relaying. Some authentication operations must be performed to guarantee the privacy of user’s identity before SM transmits user’s encrypted data to RC. The aggregation component is responsible for aggregating user’s multidimensional power consumption into a compressed one. The relaying component transmits aggregation data to OC.OC: the responsibility of OC is to analyze the aggregated regional data. It can supply power supplier with valid user information which includes the number of users and power consumption at each step, so as to carry out the dynamic step tariff and locate the trouble spot.


### 2.2. Security Requirements

In our security model, we consider RA (e.g., a typical residential area) mainly consists of a connection with RC (e.g., the property management) and a great number of users that are equipped with SM. OC (e.g., the electric company) spans different RC and analyzes the aggregation regional data. Specifically, we assume that RC and OC are not in collusion with each other and both of them are honest but curious. That is, RC and OC aggregate the encrypted data from SM exactly, but it is curious to SM’s real-time data and identity. In addition, the confidentiality and the integrity of data need be guaranteed. Therefore, in order to prevent the user’s data in RC and OC, PAS must satisfy the following three security requirements.(i)
Confidentiality. The scheme should protect user’s data from being analyzed by RC, and guarantee the user’s identity privacy. Though RC has all the data from SMi, it cannot identify the contents of reports, neither can it distinguish any user’s data. In such a way, our system model can meet the privacy-preserving requirements of user’s data.(ii)
Authentication. The scheme should guarantee that an encrypted report at RC is really sent by a legitimate residential user and has not been transformed during the transmission to RC; that is, if the adversary forges or modifies a report, the malicious operations should be detected at RC. Thus, only the correct user information can be received by RC.(iii)
Anonymity.The identity of user should be unknown in the scheme. On one hand, when RC receives the messages from SMi, the signature could be checked without disclosing the identity of SMi. On the other hand, OC can acquire the number of users at each step without knowing the users’ identities. Under this circumstance, the identity of user is kept secret from RC and OC.


### 2.3. Design Goal

According to the aforementioned system model and security requirements, our design goal is to develop an efficient privacy-preserving multidimensional aggregation scheme for smart grid. Specifically, the following three objectives should be achieved.(i)
The scheme should provide more effective information to the power supplier and satisfy a classified management. The power supplier should obtain the total power usage information that is the number of users and power consumption at each step. With these valid data, not only can it develop a reasonable step tariff strategy, but also the power consumption in one RA can realize load balancing. Through the implementation of step tariff strategy, we can get energy conservation to some extent. Therefore, compared with electric energy production, system engineers can discover the trouble spot in the process of power transport.(ii)
The confidentiality of user’s identity and power consumption should be guaranteed. If the smart grid does not take the security of user information into account, the residential user’s privacy information would be revealed, and the real-time power consumption data could be modified. Therefore, the proposed scheme should achieve identity and data privacy preservation requirements simultaneously.(iii)
The proposed PAS scheme should be effective and practical to the smart grid. Although the performance of smart grid is continuously improved today, it still cannot afford the high computational overhead. The proposed scheme should also consider the effectiveness in terms of computation and communication to be acceptable to smart grid.


## 2.1. System Model

In our system model, we mainly focus on how to report user’s privacy-preserving power consumption information to the operation center. Specifically, the system consists of four parts: trusted authority (TA), residential area (RA), operation center (OC), and regional center (RC), as shown in Figure2.Figure 2
System model under consideration.TA: the trusted authority is fully trustable in the whole system, whose duty is to bootstrap the system initialization and distribute secret keys to the SM, RC, and OC (some parameters must be kept private, while others are public). In addition to system initialization, TA is offline in other phases. Only in the case that errors exist in the process of authentication, TA can respond to it in time; for example, when errors arise in the authentication, TA can recover the malicious identity of SM based on the group signature scheme. Therefore, TA is an indispensable part in this system.RA: we consider a typical residential area, which mainly consists of a connection with RC and a great number of users that are equipped with smart metersSM1,SM2,…,SMn. SMi records the real-time data about power consumption, and the data will be reported to RC in a certain period.RC: RC is a powerful workshop, which mainly performs three functions: authentication, aggregation, and relaying. Some authentication operations must be performed to guarantee the privacy of user’s identity before SM transmits user’s encrypted data to RC. The aggregation component is responsible for aggregating user’s multidimensional power consumption into a compressed one. The relaying component transmits aggregation data to OC.OC: the responsibility of OC is to analyze the aggregated regional data. It can supply power supplier with valid user information which includes the number of users and power consumption at each step, so as to carry out the dynamic step tariff and locate the trouble spot.


## 2.2. Security Requirements

In our security model, we consider RA (e.g., a typical residential area) mainly consists of a connection with RC (e.g., the property management) and a great number of users that are equipped with SM. OC (e.g., the electric company) spans different RC and analyzes the aggregation regional data. Specifically, we assume that RC and OC are not in collusion with each other and both of them are honest but curious. That is, RC and OC aggregate the encrypted data from SM exactly, but it is curious to SM’s real-time data and identity. In addition, the confidentiality and the integrity of data need be guaranteed. Therefore, in order to prevent the user’s data in RC and OC, PAS must satisfy the following three security requirements.(i)
Confidentiality. The scheme should protect user’s data from being analyzed by RC, and guarantee the user’s identity privacy. Though RC has all the data from SMi, it cannot identify the contents of reports, neither can it distinguish any user’s data. In such a way, our system model can meet the privacy-preserving requirements of user’s data.(ii)
Authentication. The scheme should guarantee that an encrypted report at RC is really sent by a legitimate residential user and has not been transformed during the transmission to RC; that is, if the adversary forges or modifies a report, the malicious operations should be detected at RC. Thus, only the correct user information can be received by RC.(iii)
Anonymity.The identity of user should be unknown in the scheme. On one hand, when RC receives the messages from SMi, the signature could be checked without disclosing the identity of SMi. On the other hand, OC can acquire the number of users at each step without knowing the users’ identities. Under this circumstance, the identity of user is kept secret from RC and OC.


## 2.3. Design Goal

According to the aforementioned system model and security requirements, our design goal is to develop an efficient privacy-preserving multidimensional aggregation scheme for smart grid. Specifically, the following three objectives should be achieved.(i)
The scheme should provide more effective information to the power supplier and satisfy a classified management. The power supplier should obtain the total power usage information that is the number of users and power consumption at each step. With these valid data, not only can it develop a reasonable step tariff strategy, but also the power consumption in one RA can realize load balancing. Through the implementation of step tariff strategy, we can get energy conservation to some extent. Therefore, compared with electric energy production, system engineers can discover the trouble spot in the process of power transport.(ii)
The confidentiality of user’s identity and power consumption should be guaranteed. If the smart grid does not take the security of user information into account, the residential user’s privacy information would be revealed, and the real-time power consumption data could be modified. Therefore, the proposed scheme should achieve identity and data privacy preservation requirements simultaneously.(iii)
The proposed PAS scheme should be effective and practical to the smart grid. Although the performance of smart grid is continuously improved today, it still cannot afford the high computational overhead. The proposed scheme should also consider the effectiveness in terms of computation and communication to be acceptable to smart grid.


## 3. Preliminaries

In this section, we review the discrete logarithm problem and the Paillier cryptosystem [17], which support the security of signature and can serve as the basis of proposed PAS scheme.


### 3.1. Discrete Logarithm Problem

The difficulty of computing discrete logarithms [22] is the basic problem underlying the results of this thesis.Definition 1.
LetG be a finite cyclic group and let g′∈G be a generator of G. Given an element a∈G, the discrete logarithm to the base g′ of a in the group G is the unique integer b (0≤b≤G) such that a=g′b.
Usually, the discrete logarithm is also called index of an elementa. If g′ is not a generator, the notion of discrete logarithm of a to the base g′ is extended to be the smallest integer b, such that a=g′b, if it exists.Definition 2.
The discrete logarithm problem (DLP) is stated as follows: given a finite cyclic groupG, a generator g′, and an element a of G, to find the integer b (0≤b≤G-1) such that a=g′b.Definition 3 (computational Diffie-Hellman (CDH)).
Letp and q be primes such that q∣p-1. Suppose g is an element selected from Zq∗ with order q. Let B be an attacker. B tries to solve the following problem:giveng,ga,gbfor uniformly chosena,b∈Zq∗at random,computegab. We define B’s advantage in solving the CDH problem by AdvB=PrBg,ga,gb=gab.


### 3.2. Paillier Cryptosystem

The Paillier cryptosystem is widely used in privacy-preserving applications [23, 24], which can achieve the privacy-preserving properties. Specifically, the Paillier cryptosystem is comprised of three parts: key generation, encryption, and decryption.(i)
Key generation (Gen(k1)): given a security parameter k1, then system selects two large primes p1,p2(p1=p2=k1). Then, the RSA modulus n=p1·p2 and λ=lcm⁡p1-1,p2-1 are achieved. Define a function Lu=u-1/n, and after choosing a generator g∈Zn2∗, μ=Lgλmod⁡n2-1 will be calculated. Finally, the public key is pk=n,g and the corresponding private key is sk=λ,μ.(ii)
Encryption: given a user’s datam∈Zn, choose a random number r∈zn∗, and the ciphertext can be expressed as c=Em=gmrnmod⁡n2.(iii)
Decryption: given the ciphertextc∈Zn2∗, the corresponding data can be recovered as m=Dc=Lcλmod⁡n2·μmod⁡n.


## 3.1. Discrete Logarithm Problem

The difficulty of computing discrete logarithms [22] is the basic problem underlying the results of this thesis.Definition 1.
LetG be a finite cyclic group and let g′∈G be a generator of G. Given an element a∈G, the discrete logarithm to the base g′ of a in the group G is the unique integer b (0≤b≤G) such that a=g′b.
Usually, the discrete logarithm is also called index of an elementa. If g′ is not a generator, the notion of discrete logarithm of a to the base g′ is extended to be the smallest integer b, such that a=g′b, if it exists.Definition 2.
The discrete logarithm problem (DLP) is stated as follows: given a finite cyclic groupG, a generator g′, and an element a of G, to find the integer b (0≤b≤G-1) such that a=g′b.Definition 3 (computational Diffie-Hellman (CDH)).
Letp and q be primes such that q∣p-1. Suppose g is an element selected from Zq∗ with order q. Let B be an attacker. B tries to solve the following problem:giveng,ga,gbfor uniformly chosena,b∈Zq∗at random,computegab. We define B’s advantage in solving the CDH problem by AdvB=PrBg,ga,gb=gab.


## 3.2. Paillier Cryptosystem

The Paillier cryptosystem is widely used in privacy-preserving applications [23, 24], which can achieve the privacy-preserving properties. Specifically, the Paillier cryptosystem is comprised of three parts: key generation, encryption, and decryption.(i)
Key generation (Gen(k1)): given a security parameter k1, then system selects two large primes p1,p2(p1=p2=k1). Then, the RSA modulus n=p1·p2 and λ=lcm⁡p1-1,p2-1 are achieved. Define a function Lu=u-1/n, and after choosing a generator g∈Zn2∗, μ=Lgλmod⁡n2-1 will be calculated. Finally, the public key is pk=n,g and the corresponding private key is sk=λ,μ.(ii)
Encryption: given a user’s datam∈Zn, choose a random number r∈zn∗, and the ciphertext can be expressed as c=Em=gmrnmod⁡n2.(iii)
Decryption: given the ciphertextc∈Zn2∗, the corresponding data can be recovered as m=Dc=Lcλmod⁡n2·μmod⁡n.


## 4. Proposed Schemes

In this section, we propose the efficient privacy-preserving multidimensional aggregation scheme for smart grid, called PAS, which mainly consists of the following four parts: system initialization, user data acquisition, privacy-preserving regional aggregation, and data analysis. For easier expression, we give the description of notations used in PAS in the following notations.Notations Used in PAS
A: the large prime added to the last step of consumption,
p
1
,
p
2
,
f
,
p
1
′
,
p
2
′: five big primes, and p1=2fp1′+1; p2=2fp2′+1,
n
=
p
1
·
p
2
,
g: the public key of holomorphic encryption,
g
′: g′∈Zn∗, g′ generates a circle group with the order f,
g: g∈Zn2∗, a generator in the Paillier cryptosystem,
h
(
): h() is a secure cryptographic hash function,
x
T
A: xTA∈Zn∗, the private key of TA,
y
T
A: yTA=g′xTA, the authentication public key of TA,
I
D
T
A: IDTA∈Zn∗, TA’s identity number,
e
,
d: d·e=1mod⁡ϕn,
k: a security parameter k for Gen(),
k
i: ki∈Zn∗, the private key of SM,
r
i: a random number ri∈Zn∗ chosen by SMi,
x
R
C: xRC∈Zn∗, the private key of RC,
n
,
g
′
,
y
R
C: the public key of RC, yRC=g′xRCmod⁡n,
λ
,
μ: the private key in the Paillier cryptosystem,
ω: the maximum number of households in a residential area,
l: the number of step electricity,
T
1
,
T
2
,
…
,
T
l: the power consumption at each step, and T1 is the basic step,
d
2: the value of each type Ti is less than a constant d2,
a
→
=
a
1
,
a
2
,
…
,
a
l: (a2,…,al) are big prime numbers,
g
→
=
(
g
1
,
g
2
,
…
,
g
l
): gi=gai  fori=1,2,…,l.


### 4.1. System Initialization

For a single authority smart grid system under consideration, a trusted TA bootstraps the whole system which is responsible for distributing secret keys to SM, RC, and OC. In particular, TA first chooses a security parameterk to obtain the Paillier cryptosystem’s key (g,μ,λ,p1,p2,n=p1·p2) by running Gen(k), where pk=n,g and sk=λ,μ are the public key and the corresponding private key, respectively, and then selects g′∈Zn∗, where g′ generates a circle group with the order f. Afterwards, TA chooses a secure cryptographic hash function h(), where h:{0,1}∗→Zn∗.Assuming that the maximum number of SM in RC is less thanω, the power consumption at each step is T1,T2,…,Tl in which T1 is the basic step and the value of each type Ti is less than a constant d2. A big prime vector a→=(a1=1,a2,…,al) satisfies that the length ai≥k, ∑j=1i-1aj·ω·d2<ai  i=2,…,l, and ∑i=1laj·ω·d2<n, and then the vector g→=(g1,g2,…,gl) is calculated as gi=gai  fori=1,2,…,l. TA chooses an integer number e which satisfies gcd⁡e,ϕn=1 and calculates the corresponding d according to d·e=1mod⁡ϕn. At the same time, TA selects a large prime A whose length is 30 bits less than q and A is much larger than the total power consumption of users in 15 minutes. In addition, TA chooses a random number xTA∈Zn∗ as its private key and calculates the corresponding public key yTA=g′xTA. RC chooses a random number xRC∈Zn∗ as its private key and calculates the corresponding public key yRC=g′xRC.When a localSMi in the residential area registers in the system, firstly SMi chooses a random number ki  ki∈Zn∗ as its private key and calculates IDi=g′kimod⁡n and then transmits IDi to TA. Once getting the IDi of SM, TA chooses a random number α∈Zn∗ and calculates r=g′αmod⁡n, s=α+rxTAhIDimod⁡f, and w=IDTAryTArhIDiIDi-dmod⁡n. TA stores the qualification certificate of SMir,s,w,IDi in the regional database.Finally, TA sendsr,s,w and Paillier cryptosystem’s key λ,μ to the registered SMi and OC, respectively, by a secure channel, keeps xTA,q1,q2 secretly, and publishes the system parameters n,g,g′,G,h(),a→,g→,A,yTA.


### 4.2. User Data Acquisition

In order to achieve the nearly real-time user’s power consumption at every 15 minutes, each user in the regional area equips aSMi to collect l types of data di1,di2,…,dil which is the power consumption at each step T1,T2,…,Tl. And then SMi calculates the encrypted data ci and signature of SMi as follows.Step 1.
S
M
i gets the power consumption mi, which is located at two-step interval [k,k+1], and computes the real power consumption (dti1,dti2,…,dtil) at each step where dti1=T1, dtij=Tj-Tj-1(for2≤j≤k), dti(k+1)=mi-Tk, and dtij=0(fork+1<j≤l). Then SMi obtains di1,di2,…,dil, where dim=dtim(m=1,2,…,k,k+2,…,l) and di(k+1)=dti(k+1)+A.Step 2.
S
M
i chooses a random number ri∈Zn∗ and then calculates the encrypted power consumption ci=∏j=1lgjdijrinmod⁡n2.Step 3.
S
M
i selects two random numbers q1,q2∈Zn∗ and uses the private key ki to make the signature SigSMi=(u,v1,v2,TS) as (1)z=q2eg′q1mod⁡n,u=hz,ci,TS,v1=q1+s+kiu,v2=q2wumod⁡nin which the TS is the current time stamp.Step 4.
S
M
i sends the encrypted power consumption and the signature ci,SigSMi to RC.


### 4.3. Privacy-Preserving Regional Aggregation

While receivingci,SigSMi (i=1,2,…,ω) at time TS′, RC first checks the validity of time stamp TS in order to resist the replaying attack. If TS′-TS≤ΔT, where ΔT denotes the excepted valid time interval for transmission delay, the TS is accepted. Then, RC computes z′=IDTAug′v1v2emod⁡n, u′=hz′,ci,TS and checks whether u=u′. If it does hold, the signature is accepted, since (2)z′=IDTAug′v1v2emod⁡n=IDTAug′q1+s+kiq2wuemod⁡n=IDTAug′q1ryTArhIDiuIDiuq2eIDTAryTArhIDiIDi-umod⁡n=q2eg′q1mod⁡n=zu′=hz′,ci,TS.If the validity is checked, RC performs the following steps to achieve the privacy-preserving data aggregation.Step 1.
RC computes the aggregated and encrypted dataC as C=∏i=1ωcimod⁡n2.Step 2.
RC chooses a random numbert∈Zn∗, which satisfies gcd⁡t,n-1=1, and then uses private key xRC to make a signature SigRC=(TSRC,RRC,SRC) as HRC=hC,TS,RCi, RRC=g′tmod⁡n, and SRC=HRC-xRCRRCt-1mod⁡n-1, where TSRC is the current time stamp.Step 3.
RC sends the preliminary aggregation data and the signatureC,SigRC to OC.If the above verification fails, RC will verify the signature with the help of TA and announce the maliciousIDi. In this case, TA uses the unaccepted signature ci,SigSMi to compute η=u-1mod⁡ϕn and δ=IDTAug′v1mod⁡n and then contrasts the stored g′s,w,IDi in the regional database to reveal the malicious identity IDi that sent the unaccepted message as IDi=(g′v1(δg′s·u)-1)ηw-emod⁡n=IDTA-1g′-s(IDTAgα+xTArhIDiIDi). By doing this, RC can achieve the tracking of malicious operations.


### 4.4. Data Analysis

After receiving the messageC,SigRC from RC, OC first checks the validity of time stamp TSRC with the receiving time TSRC′. If |TSRC′-TSRC|≤ΔT, the TSRC is accepted. Then RC uses the public key of RC yRC to verify the signature SigRC by checking whether yRCRRCRRCSRC=g′hC,TS,RCimod⁡n. If it does hold, OC will decrypt the aggregated cipher report C as follows: (3)C=∏i=1ωcimod⁡n2=∏i=1ωg1di1g2di2⋯gldil·rinmod⁡n2=g1∑i=1ωdi1g2∑i=1ωdi2⋯gl∑i=1ωdil∏i=1ωrinmod⁡n2=ga1∑i=1ωdi1ga2∑i=1ωdi2⋯gal∑i=1ωdil∏i=1ωrinmod⁡n2=ga1∑i=1ωdi1+a2∑i=1ωdi2+⋯+al∑i=1ωdil∏i=1ωrinmod⁡n2.Step 1.
LetM and R be a1∑i=1ωdi1+a2∑i=1ωdi2+⋯+al∑i=1ωdilmod⁡n and ∏i=1ωri, respectively, and C=gM·Rnmod⁡n2. According to M=LCλmod⁡n2·μmod⁡n, OC recovers M by the master key (λ,μ).Step 2.
By executing Algorithm1, OC can recover the aggregated data D1,D2,…,Dl, where Dj=∑i=1ωdij is the power information at the jth step.Algorithm 1:Recover the aggregated data.
Procedure: RECOVER THE AGGREGATED DATA
Input: a→=(a1=1,a2,…,al) and M
Output: (D1,D2,…,Dl)
set Xl+1=M
for  j=1 to l  do
Xj=Xj+1mod⁡aj
Dj=Xj+1-Xj/ajmod⁡q
end for
return (D1,D2,…,Dl)
end procedureStep 3.
After OC achieving power information at each step, OC invokes Algorithm2 to obtain the real power consumption DTj and the number of SM nj (j=1,2,…,l) at each step, respectively.Algorithm 2:Recover the power consumption.
Procedure: RECOVER THE POWER CONSUMPTION
Input: (D1,D2,…,Dl)
Output: (n1,n2,…,nl) and (DT1,DT2,…,DTl)
set (DT1,DT2,…,DTl)=(D1,D2,…,Dl)
for  j=1 to l  do
DTj=Djmod⁡A
nj=(Dj-DTj)/A
end for
return (n1,n2,…,nl) and (DT1,DT2,…,DTl)
end procedureSinceDj=∑i=1ωdij=njA+∑i=1ωdtij (∑i=1ωdtij is real power consumption at jth step), DTj=Djmod⁡A=∑i=1ωdtij, and nj=Dj-DTj/A, the correctness of Algorithm 2 is shown.Finally, OC can obtain the valid information, which contains the true power consumption(DT1,DT2,…,DTl) and the number of SM (n1,n2,…,nl) at each step without knowing any private information of SM, and simultaneously OC accomplishes data interaction with power supplier.


## 4.1. System Initialization

For a single authority smart grid system under consideration, a trusted TA bootstraps the whole system which is responsible for distributing secret keys to SM, RC, and OC. In particular, TA first chooses a security parameterk to obtain the Paillier cryptosystem’s key (g,μ,λ,p1,p2,n=p1·p2) by running Gen(k), where pk=n,g and sk=λ,μ are the public key and the corresponding private key, respectively, and then selects g′∈Zn∗, where g′ generates a circle group with the order f. Afterwards, TA chooses a secure cryptographic hash function h(), where h:{0,1}∗→Zn∗.Assuming that the maximum number of SM in RC is less thanω, the power consumption at each step is T1,T2,…,Tl in which T1 is the basic step and the value of each type Ti is less than a constant d2. A big prime vector a→=(a1=1,a2,…,al) satisfies that the length ai≥k, ∑j=1i-1aj·ω·d2<ai  i=2,…,l, and ∑i=1laj·ω·d2<n, and then the vector g→=(g1,g2,…,gl) is calculated as gi=gai  fori=1,2,…,l. TA chooses an integer number e which satisfies gcd⁡e,ϕn=1 and calculates the corresponding d according to d·e=1mod⁡ϕn. At the same time, TA selects a large prime A whose length is 30 bits less than q and A is much larger than the total power consumption of users in 15 minutes. In addition, TA chooses a random number xTA∈Zn∗ as its private key and calculates the corresponding public key yTA=g′xTA. RC chooses a random number xRC∈Zn∗ as its private key and calculates the corresponding public key yRC=g′xRC.When a localSMi in the residential area registers in the system, firstly SMi chooses a random number ki  ki∈Zn∗ as its private key and calculates IDi=g′kimod⁡n and then transmits IDi to TA. Once getting the IDi of SM, TA chooses a random number α∈Zn∗ and calculates r=g′αmod⁡n, s=α+rxTAhIDimod⁡f, and w=IDTAryTArhIDiIDi-dmod⁡n. TA stores the qualification certificate of SMir,s,w,IDi in the regional database.Finally, TA sendsr,s,w and Paillier cryptosystem’s key λ,μ to the registered SMi and OC, respectively, by a secure channel, keeps xTA,q1,q2 secretly, and publishes the system parameters n,g,g′,G,h(),a→,g→,A,yTA.


## 4.2. User Data Acquisition

In order to achieve the nearly real-time user’s power consumption at every 15 minutes, each user in the regional area equips aSMi to collect l types of data di1,di2,…,dil which is the power consumption at each step T1,T2,…,Tl. And then SMi calculates the encrypted data ci and signature of SMi as follows.Step 1.
S
M
i gets the power consumption mi, which is located at two-step interval [k,k+1], and computes the real power consumption (dti1,dti2,…,dtil) at each step where dti1=T1, dtij=Tj-Tj-1(for2≤j≤k), dti(k+1)=mi-Tk, and dtij=0(fork+1<j≤l). Then SMi obtains di1,di2,…,dil, where dim=dtim(m=1,2,…,k,k+2,…,l) and di(k+1)=dti(k+1)+A.Step 2.
S
M
i chooses a random number ri∈Zn∗ and then calculates the encrypted power consumption ci=∏j=1lgjdijrinmod⁡n2.Step 3.
S
M
i selects two random numbers q1,q2∈Zn∗ and uses the private key ki to make the signature SigSMi=(u,v1,v2,TS) as (1)z=q2eg′q1mod⁡n,u=hz,ci,TS,v1=q1+s+kiu,v2=q2wumod⁡nin which the TS is the current time stamp.Step 4.
S
M
i sends the encrypted power consumption and the signature ci,SigSMi to RC.


## 4.3. Privacy-Preserving Regional Aggregation

While receivingci,SigSMi (i=1,2,…,ω) at time TS′, RC first checks the validity of time stamp TS in order to resist the replaying attack. If TS′-TS≤ΔT, where ΔT denotes the excepted valid time interval for transmission delay, the TS is accepted. Then, RC computes z′=IDTAug′v1v2emod⁡n, u′=hz′,ci,TS and checks whether u=u′. If it does hold, the signature is accepted, since (2)z′=IDTAug′v1v2emod⁡n=IDTAug′q1+s+kiq2wuemod⁡n=IDTAug′q1ryTArhIDiuIDiuq2eIDTAryTArhIDiIDi-umod⁡n=q2eg′q1mod⁡n=zu′=hz′,ci,TS.If the validity is checked, RC performs the following steps to achieve the privacy-preserving data aggregation.Step 1.
RC computes the aggregated and encrypted dataC as C=∏i=1ωcimod⁡n2.Step 2.
RC chooses a random numbert∈Zn∗, which satisfies gcd⁡t,n-1=1, and then uses private key xRC to make a signature SigRC=(TSRC,RRC,SRC) as HRC=hC,TS,RCi, RRC=g′tmod⁡n, and SRC=HRC-xRCRRCt-1mod⁡n-1, where TSRC is the current time stamp.Step 3.
RC sends the preliminary aggregation data and the signatureC,SigRC to OC.If the above verification fails, RC will verify the signature with the help of TA and announce the maliciousIDi. In this case, TA uses the unaccepted signature ci,SigSMi to compute η=u-1mod⁡ϕn and δ=IDTAug′v1mod⁡n and then contrasts the stored g′s,w,IDi in the regional database to reveal the malicious identity IDi that sent the unaccepted message as IDi=(g′v1(δg′s·u)-1)ηw-emod⁡n=IDTA-1g′-s(IDTAgα+xTArhIDiIDi). By doing this, RC can achieve the tracking of malicious operations.


## 4.4. Data Analysis

After receiving the messageC,SigRC from RC, OC first checks the validity of time stamp TSRC with the receiving time TSRC′. If |TSRC′-TSRC|≤ΔT, the TSRC is accepted. Then RC uses the public key of RC yRC to verify the signature SigRC by checking whether yRCRRCRRCSRC=g′hC,TS,RCimod⁡n. If it does hold, OC will decrypt the aggregated cipher report C as follows: (3)C=∏i=1ωcimod⁡n2=∏i=1ωg1di1g2di2⋯gldil·rinmod⁡n2=g1∑i=1ωdi1g2∑i=1ωdi2⋯gl∑i=1ωdil∏i=1ωrinmod⁡n2=ga1∑i=1ωdi1ga2∑i=1ωdi2⋯gal∑i=1ωdil∏i=1ωrinmod⁡n2=ga1∑i=1ωdi1+a2∑i=1ωdi2+⋯+al∑i=1ωdil∏i=1ωrinmod⁡n2.Step 1.
LetM and R be a1∑i=1ωdi1+a2∑i=1ωdi2+⋯+al∑i=1ωdilmod⁡n and ∏i=1ωri, respectively, and C=gM·Rnmod⁡n2. According to M=LCλmod⁡n2·μmod⁡n, OC recovers M by the master key (λ,μ).Step 2.
By executing Algorithm1, OC can recover the aggregated data D1,D2,…,Dl, where Dj=∑i=1ωdij is the power information at the jth step.Algorithm 1:Recover the aggregated data.
Procedure: RECOVER THE AGGREGATED DATA
Input: a→=(a1=1,a2,…,al) and M
Output: (D1,D2,…,Dl)
set Xl+1=M
for  j=1 to l  do
Xj=Xj+1mod⁡aj
Dj=Xj+1-Xj/ajmod⁡q
end for
return (D1,D2,…,Dl)
end procedureStep 3.
After OC achieving power information at each step, OC invokes Algorithm2 to obtain the real power consumption DTj and the number of SM nj (j=1,2,…,l) at each step, respectively.Algorithm 2:Recover the power consumption.
Procedure: RECOVER THE POWER CONSUMPTION
Input: (D1,D2,…,Dl)
Output: (n1,n2,…,nl) and (DT1,DT2,…,DTl)
set (DT1,DT2,…,DTl)=(D1,D2,…,Dl)
for  j=1 to l  do
DTj=Djmod⁡A
nj=(Dj-DTj)/A
end for
return (n1,n2,…,nl) and (DT1,DT2,…,DTl)
end procedureSinceDj=∑i=1ωdij=njA+∑i=1ωdtij (∑i=1ωdtij is real power consumption at jth step), DTj=Djmod⁡A=∑i=1ωdtij, and nj=Dj-DTj/A, the correctness of Algorithm 2 is shown.Finally, OC can obtain the valid information, which contains the true power consumption(DT1,DT2,…,DTl) and the number of SM (n1,n2,…,nl) at each step without knowing any private information of SM, and simultaneously OC accomplishes data interaction with power supplier.


## 5. Security Analysis

In this section, we analyze the security properties of PAS scheme. According to the security requirements discussed earlier, our analysis will focus on how PAS can achieve the privacy preservation of user’s data and identity.(i) The Confidentiality of User’s Data and the Aggregated Data Are Obtained. In the proposed PAS scheme, each SMi’s power consumption data di1,di2,…,dil are formed as a Paillier cryptosystem [17] ciphertext ci=g1di1·g2di2⋯gldil·rinmod⁡n2, which can be implicitly expressed as ci=ga1di1+a2di2+⋯+aldil·rinmod⁡n2. Let mi be a1di1+a2di2+⋯+aldil, and then the data (di1,di2,…,dil) in ci=gmi·rinmod⁡n2 is also semantically secure and privacy preserving. Therefore, although an adversaryM eavesdrops ci, he/she still cannot recognize the unencrypted contents. After collecting all reports (c1,c2,…,cω) from the residential users, RC does not recover each report; instead, it just computes C=∏i=1ωcimod⁡n2 to perform report aggregation. Therefore, even if the adversary M intrudes in RC’s database, he/she cannot obtain the individual report di1,di2,…,dil either. Finally, after receiving C=∏i=1ωcimod⁡n2 from RC, OC recovers C as D1,D2,…,Dl. However, since each Dj=∑j=1ωdi=njA+∑i=1ωdtij is an aggregated result, OC still cannot obtain the user SMi’s data di1,di2,…,dil. Therefore, from the above analysis, the user’s data is privacy preserving in the proposed PAS scheme.(ii) The Authentication of User’s Data and the Aggregated Data Are Achieved. In the proposed PAS scheme, each user’s data and the aggregated data are signed by an improved group signature algorithm.Definition 4 (the improved efficient group signature scheme).
The improved efficient group signature scheme is defined by the following algorithms.
Setup. Providing some security parameter k as input, the key generation center (KGC) runs this algorithm to create a master key xTA and a list of public parametersparams.
SetSecretValue. Takingparams as input, this algorithm picks ki∈RZn∗ and outputs the secret value ki.
SetPublicKey. Providingparams and ki as input, the user (the owner of ki) runs this algorithm to set a public key IDi.
PartialPrivateKeyExtract. Providingparams and IDi as input, KGC runs this algorithm to set r,s,w and sends to user by a secure channel.
Sign. Providingparams, r,s,w,IDi, ki, and a message M as input, any entity runs this algorithm to create a signature Sig=(u,v1,v2,M).
Verify. Providingparams, xTA, Sig, and IDi, the receiver run this algorithm to verify the signature.Definition 5 (security of the signature scheme).
A signature scheme is said to achieve unforgeability against a chosen message attack (UF-CMA secure) if no polynomials bounded adversaryM has a nonnegligible advantage in the following game.
Setup. The challenger runs setup by taking a security parameter k as input to generate a master key xTA and a list of public parametersparams. It givesparams to adversary M and keeps xTA secret.
SecretValue Request. The challenger runs SetSecretValue to generate the secret value ki and return it to adversary M.
PartialPrivateKey Request. The challenger runs PartialPrivateKeyExtract to generate the private key r,s,w and return it to adversary M.
PublicKeyReplacement. The adversary M can repeatedly replace the public key for any entity with any value of its choice. The current value of an entity’s public key is used by the challenger in any computation or response to the adversary’s requests.
Verify Queries. The challenger runs Verify with xTA and Sig as input and returns the verification result to adversary M.
Sign Queries. The challenger runs Sign with r,s,w,IDi, ki, and a message M as input to generate the Sig and then return it to adversary M.
Challenge Phase. Once M decides that above is over, it outputs the challenge identity ID∗ and two equal-length messages M0, M1. Note that ID∗ has not been queried to extract a partial private key nor a private key at any time. The challenger picks β∈R0,1 and creates a target signature Sig∗ of Mβ under the current public key PKID∗. The challenger returns Sig∗ to M.
Guess.
M outputs its guess β′∈0,1 for β.
We defineM’s advantage in the above game by Adv(M)=2Pr[β′=β]-1/2. A scheme is said to be UF-CMA secure if no probabilistic polynomial-time adversary has nonnegligible advantage in the above games.Then, we analyze the security of the improved group signature.Theorem 6.
One’s improved efficient signature scheme is EUF-CMA secure in the random oracle model, assuming that the CDH problem is intractable.The above theorem is obtained by combining Lemma7.Lemma 7.
SupposeH1, H2 are random oracles and there exists a UF-CMA adversary M against the signature scheme with advantage ε when making qpv PrivateValue requests, qppk PartialPrivateKey queries, qpkr PublicKeyReplacement queries, qs Sign queries, qv Verify queries, and qi random oracle queries to Hi  (i=1or2). Then, for any 0≤ν≤ε there exists either an algorithm B to solve the CDH problem with advantage ε′≥ε-ν/q2 or an attacker that breaks the UF-CMA security of the RSA signature with advantage ν.Proof.
To prove the lemma, we first assume that the RSA signature scheme is UF-CMA secure with advantageν  0≤ν≤ε within time t′.
LetM be an adversary against the signature scheme. We show how to construct an algorithm B to solve the CDH problem.
B is given a random instance g,ga,gb of the CDH problem. B sets yTA=ga and simulates theSetup algorithm of the signature scheme by supplying M with n,e,g,H1(),H2(),yTA as public parameters, where H1, H2 are random oracles controlled by B. B chooses a random I, 1≤I≤n.
M may make queries to random oracles Hi  i=1or2 at any time during its attack and B responds as follows.
H
1
Queries.
B maintains a H1 list of tuples (i,IDi),ei. On receiving such a query on i, B does the following.
If there is a tuple(i,IDi),ei on the H1 list, B returns ei as answer.
Otherwise,B chooses ei∈RZq∗, adds i,IDi,ei to the H1 list, and returns ei as answer.
H
2
Queries.
B maintains a H2 list of tuples zi,Mi,ui. On receiving such a query on zi,Mi, if there is a tuple zi,Mi,ui on the H2 list, B returns u as answer. Otherwise, B picks ui∈RZq∗, adds zi,Mi,ui to the H2 list, and returns ui as answer.
SecretValue Request.
B maintains a SecretValue list of tuples i,IDi,ki. On receiving such a query on i, B responds as follows.
Ifi≠I, chooses ki∈RZn∗ and computes public key IDi=gki. Then B adds i,IDi,ki to the public key list. Return ki as answer.
Otherwise (i=I), B aborts.
PartialPrivateKey Request.
B maintains a PartialPrivateKey list of tuples i,IDi,r,s,w. On receiving such a query on IDi, B responds as follows.
Ifi≠I, B searches the H1 list for i,IDi,ki, chooses a random number α∈Zn∗, and calculates r=g′αmod⁡n, s=α+rxTAhIDimod⁡f, and w=IDTAryTArhIDiIDi-dmod⁡n. Then B adds r,s,w to the PartialPrivateKey list and returns it as answer.
Otherwise (i=I), B aborts.
Public Key Replacement.
M may replace the public key IDi for any entity i with any value IDi′ of its choice. B records the change.
Verify Queries. Suppose the request is to verify signature Sig=(u,v1,v2,M) for IDi. B searches the public key for IDG. Then B does the following. (1)
If the public key has not been replaced andi≠I, B searches the PartialPrivateKey list for a tuple i,IDi,r,s,w and computes z=IDTAugv1v2emod⁡n. If u=hzi,Mi,TS, return Y. Otherwise, output ⊥.(2)
Otherwise, search theH2 list for a tuple zi,Mi,ui satisfying u=ui, zi=IDTAugv1v2emod⁡n. Return Y if such a tuple exists. Otherwise, output ⊥.
Signature Queries.
M outputs ID∗ and two messages M0, M1 on which it wishes to be challenged. Upon receiving ID∗, B searches the public key list for the tuple i,IDi,ki and then conducts the following:(1)
picksq1∗,q2∗∈RZn∗, β∈R0,1, IDi∈R,(2)
setsv1∗=q1∗+s∗+ki∗b and s∗=H1ID∗, v2∗=q2∗w∗bmod⁡n,(3)
definesb=H2(z∗,Mβ) and z∗=q2∗e∗gq1∗mod⁡n,(4)
computesSig∗=(u∗,v1∗,v2∗,Mβ∗) as the challenge signature.
B continues to respond to M’s requests in the same way as it did above. Note that M cannot make a private key extraction query on ID∗.
Guess. Eventually, M outputs its guess β′. If β′=β, B chooses a random pair IDi,ei from H1 list and outputs gv1∗-q1∗/ID∗r∗1/be∗r∗ as the solution to the CDH problem. Otherwise, B cannot solve the CDH problem.
Analysis. We first evaluate the simulations of the random oracles. From the construction of H1, it is clear that the simulation of H1 is perfect. And as long as M does not query (z∗,Mβ) to H2, the simulation of H2 is perfect. Let AskH2∗ denote the event that (z∗,Mβ) has been queried to H2. Let ¬Abort denote the event that B do not abort. Let E=AskH2∗∣¬Abort. It is clear that if E does not happen during the simulation, B will not gain any advantage greater than 1/2 to guess β. Namely, Pr[β′=β∣E]≤1/2. We obtain Pr[β′=β]=Pr[β′=β∣E]Pr[E]+Pr[β′=β∣¬E]Pr[¬E].
By definition ofε, we have ε-ν≤ε-ν/1-ν≤Pr[E]≤Pr[AskH2∗]/Pr[¬Abort], Pr[¬Abort]≥1/q2. Hence, it is not difficult for us to reach Pr[AskH2∗]≥ε-νPr[¬Abort]≥ε-ν/q2. The advantage for B to solve the CDH problem is ε′≥ε-ν/q2.
The running time of the CDH bounded byt′≤t+(q1+q2)O(1)+qppk(2Tex+O(1))+(qs+qv)(3Tex+O(1)), where Tex donates the time for computing exponentiation in Zn∗.(iii) The Anonymity of Users and Traceability Can Be Guaranteed. In the proposed PAS scheme, each user’s data is signed by an improved group signature.Theorem 8.
Our improved efficient signature scheme satisfies the anonymity and traceability.Proof.
Assume that theH1 and H2 are random functions. Given a valid signature SigSMi=(u,v1,v2,TS), identifying the actual signer is computationally hard for everyone but the group manager (KGC). Deciding whether some group member with certificate originated requires computing the discrete logarithms loggyTA. This is assumed to be infeasible under DLP and hence anonymity is guaranteed.
The group manager (KGC) is able to open any valid group signature and provably identify the actual signer: assuming that the signature is valid, this implies thatu,v1,v2, are of the required form and so IDi can be uniquely recovered as IDi=(g′v1(δg′s·u)-1)ηw-emod⁡n.
According to the anonymity, it is impossible for the regional center to recognize user’s identity. And if there are any errors in the process of verification, TA can recover the malicious SM’s identity. Therefore, the identify privacy of user can be guaranteed.
From the above analysis, we can see that the proposed PAS scheme is secure and privacy preserving and achieves our security design goal.


## 6. Performance Evaluation

In this section, we evaluate the performance of proposed PAS scheme in terms of the computation complexity and overhead of the SM, RC, and OC using a simulator built in Java. We run it on a workstation with 2.0 GHz 6-core processor, 64 GB RAM. Concretely, with the parameter settingn=1024, we give that each RC includes 100 users and the number of RC is 10.


### 6.1. Computation Complexity

We evaluate the proposed PAS scheme in the computation complexity of SM, RC, and OC. Above all, we denote the computation overhead of an exponentiation operation inZn2, a multiplication operation in Zn2, an exponentiation operation in Zn, a multiplication operation in Zn, and a multiplication operation in Zn-1 by C1e, C1m, C2e, C2m, and C3m, respectively.In the proposed PAS scheme,SMi generates the encrypted power consumption ci and the signature SigSMi as shown in Section 4.2, which includes l+1∗C1e and 3∗C2m. As shown in Section 4.2, after receiving the ciphertext from ω users, RC first verifies the received data from different users, then aggregates it, and makes a signature SigRC. The computation complexity of RC is 3ω+1∗C2e+3∗C2m+ω-1∗C1m+C3m. With regard to OC, it verifies the aggregated data from RC and obtains valid user information by the Paillier decryption, which includes 3C2e and C1e.Comparing with the EPPA [12], the proposed PAS scheme enables acquiring more effective information and guarantees the anonymity of user’s identify simultaneously and has similar computation overhead as shown in Table 1, while Cm, Cet, Cp represent a multiplication operation in G, an exponentiation operation in GT, and a pairing operation, respectively.Table 1
Comparisons between PAS and EPPA scheme.
PAS
EPPA
Smart meter
(
l
+
1
)
∗
C
1
e
+
3
∗
C
2
m
(
l
+
1
)
∗
C
1
e
+
C
m
+
4
∗
C
p
Regional center
(
3
ω
+
1
)
∗
C
2
e
+
3
∗
C
2
m
+
(
ω
-
1
)
∗
C
1
m
+
C
3
m
(
ω
+
3
)
∗
C
p
+
C
m
Operation center
3
C
2
e
+
C
1
e
2
∗
C
p
+
C
1
e
+
4
∗
C
m
+
C
et


### 6.2. Simulation Results

According to the algorithms in our scheme, there are two factors that may affect the computation overhead. One is the number of users whose power consumption exceeds the basic step in RC which is denoted byr and the other is the number of step electricity l. Therefore, r and l are chosen to illustrate the computation overhead of SM, RC, and OC, and we present the comparison between PAS and EPPA. Note that EPPA cannot disclose users’ identify and cannot provide the detailed information (e.g., users’ numbers and power consumptions at each step in different dimensions).For the comparison with EPPA, we plot the computation overhead of SM, RC, and OC in basic step with 10 differentr from 0 to 50 in Figures 3(a), 3(b), and 3(c). They have shown that both PAS’s and EPPA’s processing times increase negligibly with the increase of r. The average processing times of SM and RC in PAS are 16ms and 460 ms, respectively, which are a little less than those in EPPA. Then, we consider the processing time of OC. The time used to recover M of OC in PAS approaches to 17ms which is higher than in EPPA. From the figure, we can see that, by increasing r, the average processing times of SM, RC, and OC are barely growing, which means r has a little influence on the computation overhead of SM, RC, and OC.Figure 3
The computation overhead of SM, RC, and OC.
(a)
Computation overhead of SM in basic step
(b)
Computation overhead of RC in basic step
(c)
Computation overhead of OC in basic step
(d)
Computation overhead of SM with variousl
(e)
Computation overhead of RC with variousl
(f)
Computation overhead of OC with variouslAs shown in Figures3(d), 3(e), and 3(f), we plot the PAS and EPPA’s computation overhead of SM, RC, and OC with the number of step consumption l selected from 1 to 10. We can see that, with the increase of l, the average processing times of SM also increase in PAS and EPPA. The reason is that SM’s power consumption may be in a higher step with l becoming larger and the SM will take more calculation on average. Afterwards, the average processing times of RC and OC are given, and by increasing l, the average operation times of RC and OC are barely growing. Thus, the number of step consumption l has a great influence on SM, but little on RC and OC. It is shown that the average processing times of SM and RC in PAS are a little less than that in EPPA, but the average processing time of OC in PAS is higher than that of EPPA.From the evaluation results above, the PAS scheme has similar computation overhead with the EPPA scheme. Furthermore, the processing time of users is less than 20ms which is acceptable to SM. And for RC and OC, they only need 400ms and 18ms, respectively, which is very efficient. The results of experiment show that our proposed PAS scheme is not only privacy preserving but also efficient and has stable computation performance.


## 6.1. Computation Complexity

We evaluate the proposed PAS scheme in the computation complexity of SM, RC, and OC. Above all, we denote the computation overhead of an exponentiation operation inZn2, a multiplication operation in Zn2, an exponentiation operation in Zn, a multiplication operation in Zn, and a multiplication operation in Zn-1 by C1e, C1m, C2e, C2m, and C3m, respectively.In the proposed PAS scheme,SMi generates the encrypted power consumption ci and the signature SigSMi as shown in Section 4.2, which includes l+1∗C1e and 3∗C2m. As shown in Section 4.2, after receiving the ciphertext from ω users, RC first verifies the received data from different users, then aggregates it, and makes a signature SigRC. The computation complexity of RC is 3ω+1∗C2e+3∗C2m+ω-1∗C1m+C3m. With regard to OC, it verifies the aggregated data from RC and obtains valid user information by the Paillier decryption, which includes 3C2e and C1e.Comparing with the EPPA [12], the proposed PAS scheme enables acquiring more effective information and guarantees the anonymity of user’s identify simultaneously and has similar computation overhead as shown in Table 1, while Cm, Cet, Cp represent a multiplication operation in G, an exponentiation operation in GT, and a pairing operation, respectively.Table 1
Comparisons between PAS and EPPA scheme.
PAS
EPPA
Smart meter
(
l
+
1
)
∗
C
1
e
+
3
∗
C
2
m
(
l
+
1
)
∗
C
1
e
+
C
m
+
4
∗
C
p
Regional center
(
3
ω
+
1
)
∗
C
2
e
+
3
∗
C
2
m
+
(
ω
-
1
)
∗
C
1
m
+
C
3
m
(
ω
+
3
)
∗
C
p
+
C
m
Operation center
3
C
2
e
+
C
1
e
2
∗
C
p
+
C
1
e
+
4
∗
C
m
+
C
et


## 6.2. Simulation Results

According to the algorithms in our scheme, there are two factors that may affect the computation overhead. One is the number of users whose power consumption exceeds the basic step in RC which is denoted byr and the other is the number of step electricity l. Therefore, r and l are chosen to illustrate the computation overhead of SM, RC, and OC, and we present the comparison between PAS and EPPA. Note that EPPA cannot disclose users’ identify and cannot provide the detailed information (e.g., users’ numbers and power consumptions at each step in different dimensions).For the comparison with EPPA, we plot the computation overhead of SM, RC, and OC in basic step with 10 differentr from 0 to 50 in Figures 3(a), 3(b), and 3(c). They have shown that both PAS’s and EPPA’s processing times increase negligibly with the increase of r. The average processing times of SM and RC in PAS are 16ms and 460 ms, respectively, which are a little less than those in EPPA. Then, we consider the processing time of OC. The time used to recover M of OC in PAS approaches to 17ms which is higher than in EPPA. From the figure, we can see that, by increasing r, the average processing times of SM, RC, and OC are barely growing, which means r has a little influence on the computation overhead of SM, RC, and OC.Figure 3
The computation overhead of SM, RC, and OC.
(a)
Computation overhead of SM in basic step
(b)
Computation overhead of RC in basic step
(c)
Computation overhead of OC in basic step
(d)
Computation overhead of SM with variousl
(e)
Computation overhead of RC with variousl
(f)
Computation overhead of OC with variouslAs shown in Figures3(d), 3(e), and 3(f), we plot the PAS and EPPA’s computation overhead of SM, RC, and OC with the number of step consumption l selected from 1 to 10. We can see that, with the increase of l, the average processing times of SM also increase in PAS and EPPA. The reason is that SM’s power consumption may be in a higher step with l becoming larger and the SM will take more calculation on average. Afterwards, the average processing times of RC and OC are given, and by increasing l, the average operation times of RC and OC are barely growing. Thus, the number of step consumption l has a great influence on SM, but little on RC and OC. It is shown that the average processing times of SM and RC in PAS are a little less than that in EPPA, but the average processing time of OC in PAS is higher than that of EPPA.From the evaluation results above, the PAS scheme has similar computation overhead with the EPPA scheme. Furthermore, the processing time of users is less than 20ms which is acceptable to SM. And for RC and OC, they only need 400ms and 18ms, respectively, which is very efficient. The results of experiment show that our proposed PAS scheme is not only privacy preserving but also efficient and has stable computation performance.


## 7. Related Works

The study of privacy-preserving multidimensional aggregation for smart grid has gained great interest from the research community recently, and we briefly review some of them closely related to ours.Part of the existing schemes needs to decrypt the received data before aggregating them and then encrypt the aggregated result before forwarding it. This process is fairly expensive and risky when aggregator is not trusted. Castelluccia et al. [25] designed a symmetric-key aggregation scheme that blends inexpensive encryption techniques with simple aggregation methods to achieve very efficient aggregation of encrypted data. Although the aggregator is under attack, the adversary cannot acquire any privacy-sensitive information about residents.Then, differential privacy techniques are introduced to achieve multidimensional aggregation in smart grid without decrypting data, and the middle aggregator can be untrusted [26, 27]. Shi et al. [26] proposed a construction that could allow a group of participants to periodically upload encrypted values to a data aggregator. First, it utilizes applied cryptographic techniques to allow the aggregator to decrypt the sum from multiple ciphertexts encrypted under different users’ keys. Second, it describes a distributed data randomization procedure that guarantees the differential privacy of outcome statistic, even when a subset of participants might be compromised. Chan et al. [27] offered a protocol with an untrusted aggregator as well. Specifically, the protocol builds a binary interval tree over n users and allows the aggregator to estimate the sum of contiguous intervals of users represented by nodes in the interval tree. In order to achieve multidimensional privacy-preserving data aggregation, Kursawe et al. [14] designed a protocol that can be employed to compute aggregate meter measurements over defined sets of meters, allowing for fraud and leakage detection as well as further statistical processing of meter measurements, without revealing any additional information about the individual meter readings. Lin et al. [28] proposed a scheme to achieve privacy-preserving aggregation that can integrate the superincreasing sequence and perturbation techniques into compressed data aggregation and has the ability to combine more than one aggregated piece of data into one. Jia et al. [29] proposed a novel privacy-preserving data aggregation scheme which could support efficient data aggregation for time-series metering data without leaking the individual value. It could also thwart HAD attack by introducing some randomness to the aggregation result without affecting the aggregation utility. Lu et al. [12] thought the scheme in [28] is not practical to deploy and manage thousands of keys for users and RC and proposed the EPPA based on public cryptograph system.However, almost all the existing aggregation schemes focus on the privacy of users’ information, cannot afford more valid information to the service provider (e.g., the power supplier) for allocating resources, and neglect the anonymity of user’s identify. In this paper, we propose an efficient privacy-preserving multidimensional aggregation scheme, which can achieve more information from the aggregation data without disclosing user’s identity. Specifically, the employment of superincreasing sequence techniques and the importation of a big prime in the Paillier cryptosystem ensure that the scheme provides more effective information, and a group signature algorithm is adopted to protect the user’s identify from RC.


## 8. Conclusions

In this paper, we propose an efficient privacy-preserving multidimensional aggregation scheme for smart grid, named PAS. Without disclosing the privacy of user, we can acquire more valid information about the number of users and power consumption at each step after the detailed analysis of preliminary aggregated data by the operation center. Specifically, we employ an improved Paillier cryptosystem technique to obtain more information at the operation center and an efficient anonymous authentication scheme to protect the privacy of user’s identity from the regional center. Detailed security analysis shows the security strength and privacy-preserving ability of PAS. Moreover, with reasonable computation overhead, PAS can satisfy the high-frequency multidimensional data collection requirements in smart grid. For the future work, we will focus on reducing the computation overhead of smart meter and achieving a more efficient security scheme for smart grid.



---

*Source: 915795-2015-10-12.xml*