# EPLC: An Efficient Privacy-Preserving Line-Loss Calculation Scheme for Residential Areas of Smart Grid

Authors: Yinqiao Xiong; Peidong Zhu; Zhizhu Liu; Hui Yin; Tiantian Deng
Journal: Security and Communication Networks
 (2019)

---

## Abstract

Recently, smart grid is considered as the next generation of power grid by introducing information and communication technologies. Line-loss is an important synthetic indicator which can directly reflect the energy efficiency and power management level of smart grid enterprises. In order to obtain all residential areas, line-loss requires obtaining electricity consumption of each user. However, data about users’ electricity consumption could reveal sensitive information; a sophisticated adversary can use some data analysis methods to deduce economic situation, habits, lifestyles, etc. In order to solve the problem, we propose an Efficient Privacy-preserving scheme for Line-loss Calculation, named EPLC. In our scheme, a data item is reading from one smart meter which implies the energy consumption in a time period of the user who owns it, and each user lives in a residential area. For each user, we encrypt user’s data based on Paillier cryptosystem by using two Horner parameters, by leveraging homomorphism, and each residential area gateway calculates relevant data about corresponding line-loss and control center hides the area-level polynomial into the final output for representing line-loss of all residential areas which are both in the form of ciphertext. Finally, we can still recover each residential area line-loss with possessing private keys and Horner parameters. Moreover, EPLC adopts the batch verification technique to lower authentication cost. Finally, our analysis indicates that EPLC is not only efficient but also can protect individual user’s electricity consumption privacy, and the flexibility and expansibility of EPLC are very suitable for smart grid.


---

## Body

## 1. Introduction

In the modern world, electrical energy plays a crucially important role in economic, social, and industrial development of all nations and regions. Smart grid, defined by the US Department of Energy [1], is considered to be the next generation of power grid infrastructure by integrating information and communication technologies (ICT) and can real-time monitor and control the physical processes of power system to constantly heighten the electrical energy using efficiency and optimize services to adjust electrical energy supply to meet demand, so smart grid is characterised by high intelligence, efficiency, reliability, economic behavior, and security. Figure 1 shows the architecture of smart grid provided by National Institute of Standards and Technology (NIST) [2], which contains seven domains: generation domain, generating electrical energy; transmission domain, transmitting electrical energy to and from the distribution; distribution domain, distributing electrical energy to and from customers; customers domain, users or home area networks (HANs); operation domain, managing the electricity flow; market domain, managing the electricity market in the smart grid; service provider domain, managing all the third-party operations.Figure 1
Smart grid architecture.Smart meter is a kind of intelligent instrument with significant capabilities for two-way communication, measuring and reporting electricity consumption in near real-time (15 minutes) periodically [3, 4], and also as one kind of the key components for realization of smart grid deployed at users, voltage transformers, and wherever needed. Accordingly, smart meter is set to become one of the most important sources of near real-time electrical energy flows data in smart grid. Based on the detailed view on electrical energy flows, through near real-time state estimation, not only the monitoring of smart grid’s performance, but also optimization of supply, distribution, and consumption can be executed synchronously well.Line-loss, the decrease of electrical energy from the source to destination due to inherent inefficiencies and defects in smart grid, is an important synthetic indicator to reflect the management level and is also a main content of assessment for performance level of smart grid enterprises [5]. A variety of factors such as resistance effect (variable losses, with the increasing of current), electromagnetism influence (fixed losses, with the increasing of voltage), management factors (electric larceny, metering error, and electricity leakage), etc. are the causes of the line-loss. Especially for residential areas which are located in the grid terminal and the most bottom of administrative level, they generally consist of various kinds of equipment and directly associated with all kinds of users, so line-loss such as electric larceny, leakage, and etc. is much more likely to happen. As a result, we only consider the line-loss of residential areas in our scheme.Fortunately, based on the idea of electrical energy quantity [6] for line-loss calculation, the basic method is fairly simple by considering the line-loss as distributed sale electric quantity noncorrespondence [7, 8], which can extrapolate line-loss for most environment or variables, so the process of line-loss calculation for each residential area only needs to do some sums and subtractions over the corresponding data of near real-time electricity consumption recorded by smart meters. But unfortunately these data can directly reflect the privacy of users [9–13] such as the occupancy of a household, and an sophisticated adversary A can leverage some data mining algorithms by some clever tricks to infer the lifestyle habits, economic status, etc. [3, 4, 14], and even users’ interests as well [15]. Worse yet, some opportunities for criminal purpose will be provided too [16].In general, smart meter has its own secure components [17], and symmetric cryptosystem is introduced [11, 18], after completion symmetric encryption operation. Although all the sensitive and private data measured by smart meter achieve cryptographic storages as well as communications, many utilities such as the line-loss calculation mentioned above and data that are encrypted need to be decrypted before they can be used. Therefore, there are still considerable risks for exposure of users’ sensitive information by inside attack [19].EPLC is the scheme mainly focusing on preserving privacy of users while calculating the line-loss by the method mentioned above of each residential area. To preserve privacy of users from internal and external attacks, the communication channels, gateways, and servers are not fully trusted. All sensitive data should be encrypted against eavesdropping before sending; all receivers should verify the ciphertext received to catch tampering before processing. The line-loss calculation and the storage both depend on ciphertext to resist the attack from the inside such as administrator of servers or gateways, and all the detailed elaboration will be made in a later section.The remainder of our paper is organized as follows: in Section2, overview of related works is provided; Section 3 elaborates on system model, security requirements, and design goal; we introduce the bilinear pairing, Paillier cryptosystem, and Horner’s rule as the preliminaries of EPLC in Section 4; Section 5 presents the process of EPLC scheme step by step; security analysis and performance evaluation are described in Sections 6 and 7, respectively; finally, a conclusion is given in Section 8.


## 2. Related Work

Recently, the leakage of personalized privacy in smart grid from data of smart meters which demonstrate electricity consumption of users becomes a potential problem. For preserving users’ privacy, predecessors have proposed several approaches.Y. Sun et al. [20] hide household load in the data of smart meters by leveraging existed thermal appliances and energy storage units to protect privacy of users. The study [21] obfuscates the real electricity consumption based on masking. Based on the differential privacy-preserving technique [22] and Boneh-Goh-Nissim cryptosystem [23], the scheme [24] uses Laplace noise in the form of ciphertext to protect the privacy of users in the honest-but-curious model.For privacy-preserving in aggregation, super-increasing sequences and Horner’s ruler are introduced to structure multidimensional data of smart meters, respectively [10, 25]. The scheme [26], named privacy-preserving multisubset aggregation (PPMA), divides users electricity consumption data into different subsets which represented different ranges before aggregation for improving the efficiency. Reference [27] can aggregate hybrid IoT devices data into one with resisting against false data injection attack; the scheme [28] performs aggregation with privacy-preserving and fault tolerance and recovers the private key by Shamirs secret-sharing scheme [29]. All works [10, 25–28] implement aggregation of smart meters’ data as well as keeping the privacy of users are based on the homomorphic property of Paillier cryptosystem [30]. Additionally, privacy-preserving aggregation is performed by sharing the session keys of users with wireless [31]; fully homomorphic encryption (FHE) and secure multiparty computation are leveraged for achieving users privacy preserving in secure in-network data aggregation by smart grid V2G networks [32], W. Han et al. proposed an integrated privacy-preserving data management architecture (IP2DM) [33] which achieves anonymous data aggregation by partial homomorphic encryption [34] for privacy-preserving data management.According to the line-loss calculation method mentioned above, this paper focuses on efficient line-loss calculation of residential areas based on data of smart meters as well as avoiding any leaks of private information of users.


## 3. System Model, Security Requirements, and Design Goal

In this section, we formalize the system model and security requirements, identify our design goals, and refer to Table1 for listing some notations to represent the main entities and definitions in system model.Table 1
Main notations.
Notation Description CC, VT, SM Control Center, Voltage Transformer, Smart Meter DA, RA District Area, Residential Area Di Theith district area of system model Rij Thejth residential area of the ith district area Uijk Thekth user in the Rij Uijτ The VT which is equipped in theRij RAGWij The RAGW which belongs to theRij


### 3.1. System Model

In our system model, our focus is on how to get the line-loss in residential areas correctly and efficiently while keeping users’ privacy. As shown in Figure2, on the one hand by the aspect of electricity, the electrical energies generated from power plants, solar panels, windmills, and etc. are transmitted through transmission and distribution to each voltage transformer (VT) of residential areas and then transmit to users by using electrical lines of the residential area (RA) to meet needs, and some RAs form a district area (DA) generally; on the other hand, according to the information technology, there are four types of entities: Control Center (CC), Residential Area Gateway (RAGW), Home Area Network (HAN or user), and Smart Meter (SM). In general, there is only one CC in the system, according to the needs of self-business management, the CC manages at most m DAs D={D1,D2,…,Dk,…,Dm}, and each DA contains at most n RAs; the RAs in the ith DA Di could be described as R={Ri1,Ri2,…,Rik,…,Rin}. Also, each RA has at most s HANs or residential users, taking a typical RA Rij as an example, as shown in Figure 3, which means the jth (1≤j≤n) RA of the ith (1≤i≤m) DA managed by the CC in the system, the Rij comprises at most s residential users U={Uij1,Uij2,…,Uijk,…,Uijm}, and the notation Uijk∈U means the kth user of the jth RA in the ith DA. (1≤i≤m,1≤j≤nand1≤k≤s).Figure 2
System model.Figure 3
System model of a residential area.The nearly real-time (e.g., 15 minutes) electricity consumption of users and RAs can be recorded automatically and respectively by corresponding smart meters, which are equipped in each HAN (User) and VT of RA. RAGW is a powerful computing resource and primarily completes three functions: authentication, line-loss calculation for corresponding RA, and relaying. Firstly, RAGW can perform some authentication operations to guarantee the received data’s authenticity and integrity; secondly, by getting the data (ciphertext) from smart meters of users and VT of corresponding RA, RAGW can calculate the line-loss ciphertext of the RA; thirdly, the relaying component is responsible for forwarding the line-loss ciphertext of corresponding RA to CC. According to business need, CC is responsible for receiving the reports (ciphertext) from all RAGWs and decrypting each line-loss of RAs, which can help itself get the real-time situation awareness and produce some responses.As mentioned before, according to Figure3, all electricity consumption of users in one RA comes from the VT of the RA. In other words, all the electrical energies consumed by users of the RA can be recorded periodically (e.g., 15 minutes) by the smart meter equipped on the VT. However, the data of the VT’s smart meter record not only the electricity consumption of all users in the RA, but also the line-loss of the RA, such as loss of the electrical lines and other types of equipment, equipment failures, and even electric larceny in the process of energies transmission as shown in red dash dotted box of Figure 3. To get the line-loss of each residential area, firstly we make the aggregation by collecting all users’ electricity consumption of the corresponding residential area, respectively; secondly, we calculate the difference by subtracting the aggregation result from the corresponding reading of VT’s smart meter.Typically, considering the communication model in one residential area RA as shown in Figure3, the number of users is limited, the distances between the two sides of the communications are short and there are not too much electromagnetic interferences, so the communications between users Uijk∈U and RAGW of the RA can use relatively inexpensive wireless technology, e.g., WiFi technology. On the other hand, according to Figure 2, since the distances between the RAGWs and CC are far away, the communications between them are through the use of some wired links with high bandwidth and low delay, like optical fiber.


### 3.2. Security Requirements

Security is crucial for our scheme. In our security model, we consider the CC fully trusted, and RAGWs and users follow the honest-but-curious model. Although RAGW will execute correctly according to design, keeping all data from smart meters and all intermediate computational results will lead to a huge threat of users’ privacy leakage. Users will not drop or distort any source data spitefully and keep the system running correctly. However, another potential risk for privacy leakage is using collusion attack to infer other users’ electricity consumption. There might exist an external adversaryA in the system, who can eavesdrop not only residential users’ but also RAGWs’ reports on different kinds of communication channels, like wireless technology in RA and wired links between CC and RAGW. More seriously, a powerful adversary A even could intrude in the databases of RAGWs and CC to steal some private and personal-sensitive data of electricity consumption or put forward to launch some active attacks to compromise the data integrity. As is clear from the above descriptions, to avoid being sniffed and to detect malicious actions which are both by the adversary A, we should achieve the following security requirements in our scheme:(i)
Confidentiality. In our system, for protecting privacy of individual users of residential areas against malicious actions of adversary A, even if eavesdropping occurs on communication channels and data in databases of CC or RAGWs have been stolen, adversary A also can neither obtain any information of individual users’ electricity energy consumption, nor identify or infer any other users’ privacy information.(ii)
Authentication and Data Integrity. Notice that RAs are in public places, a skilled adversary A can easily hack into the communication system, then forge or modify reports which are sent by legal residential users. So we must authenticate encrypted reports which are really sent by their corresponding legal residential users and have not been tampered during the transmission.


### 3.3. Design Goal

Under our system model and for achieving the aforementioned security requirements, our design goal is to develop an efficient, privacy-preserving line-loss calculation scheme. Particularly, the scheme achieved the following three objectives:(i)
Security and Reliability. The security and reliability are the most essential goals in our scheme. Without the security and reliability, the privacy information about users’ real-time electricity consumption will be leaked or even tampered, after which error results will be generated in processing the tampered information and then sent to CC. If the error results are applied in the planning, operation or analysis fields of power system, it will cause collapse for the worst. So our proposed scheme should guarantee the authentication, confidentiality, and integrity simultaneously.(ii)
High Efficiency. Consider the real-timeness requirement and characteristics of communication architecture in smart grid system. For example, the communication channels in RA always use wireless technology, which is featured with low-bandwidth and high-delay compared to wired technology, and smart meters have limited computing ability, memory, and so on. So our proposed scheme should reduce communication cost and improve the efficiency of the line-loss calculation processing.(iii)
Good Flexibility. Even though the numbers of users, RAs, or DAs varied, the business logic changed constantly, etc., the proposed scheme still can carry out flexible line-loss calculation for each RA very well.


## 3.1. System Model

In our system model, our focus is on how to get the line-loss in residential areas correctly and efficiently while keeping users’ privacy. As shown in Figure2, on the one hand by the aspect of electricity, the electrical energies generated from power plants, solar panels, windmills, and etc. are transmitted through transmission and distribution to each voltage transformer (VT) of residential areas and then transmit to users by using electrical lines of the residential area (RA) to meet needs, and some RAs form a district area (DA) generally; on the other hand, according to the information technology, there are four types of entities: Control Center (CC), Residential Area Gateway (RAGW), Home Area Network (HAN or user), and Smart Meter (SM). In general, there is only one CC in the system, according to the needs of self-business management, the CC manages at most m DAs D={D1,D2,…,Dk,…,Dm}, and each DA contains at most n RAs; the RAs in the ith DA Di could be described as R={Ri1,Ri2,…,Rik,…,Rin}. Also, each RA has at most s HANs or residential users, taking a typical RA Rij as an example, as shown in Figure 3, which means the jth (1≤j≤n) RA of the ith (1≤i≤m) DA managed by the CC in the system, the Rij comprises at most s residential users U={Uij1,Uij2,…,Uijk,…,Uijm}, and the notation Uijk∈U means the kth user of the jth RA in the ith DA. (1≤i≤m,1≤j≤nand1≤k≤s).Figure 2
System model.Figure 3
System model of a residential area.The nearly real-time (e.g., 15 minutes) electricity consumption of users and RAs can be recorded automatically and respectively by corresponding smart meters, which are equipped in each HAN (User) and VT of RA. RAGW is a powerful computing resource and primarily completes three functions: authentication, line-loss calculation for corresponding RA, and relaying. Firstly, RAGW can perform some authentication operations to guarantee the received data’s authenticity and integrity; secondly, by getting the data (ciphertext) from smart meters of users and VT of corresponding RA, RAGW can calculate the line-loss ciphertext of the RA; thirdly, the relaying component is responsible for forwarding the line-loss ciphertext of corresponding RA to CC. According to business need, CC is responsible for receiving the reports (ciphertext) from all RAGWs and decrypting each line-loss of RAs, which can help itself get the real-time situation awareness and produce some responses.As mentioned before, according to Figure3, all electricity consumption of users in one RA comes from the VT of the RA. In other words, all the electrical energies consumed by users of the RA can be recorded periodically (e.g., 15 minutes) by the smart meter equipped on the VT. However, the data of the VT’s smart meter record not only the electricity consumption of all users in the RA, but also the line-loss of the RA, such as loss of the electrical lines and other types of equipment, equipment failures, and even electric larceny in the process of energies transmission as shown in red dash dotted box of Figure 3. To get the line-loss of each residential area, firstly we make the aggregation by collecting all users’ electricity consumption of the corresponding residential area, respectively; secondly, we calculate the difference by subtracting the aggregation result from the corresponding reading of VT’s smart meter.Typically, considering the communication model in one residential area RA as shown in Figure3, the number of users is limited, the distances between the two sides of the communications are short and there are not too much electromagnetic interferences, so the communications between users Uijk∈U and RAGW of the RA can use relatively inexpensive wireless technology, e.g., WiFi technology. On the other hand, according to Figure 2, since the distances between the RAGWs and CC are far away, the communications between them are through the use of some wired links with high bandwidth and low delay, like optical fiber.


## 3.2. Security Requirements

Security is crucial for our scheme. In our security model, we consider the CC fully trusted, and RAGWs and users follow the honest-but-curious model. Although RAGW will execute correctly according to design, keeping all data from smart meters and all intermediate computational results will lead to a huge threat of users’ privacy leakage. Users will not drop or distort any source data spitefully and keep the system running correctly. However, another potential risk for privacy leakage is using collusion attack to infer other users’ electricity consumption. There might exist an external adversaryA in the system, who can eavesdrop not only residential users’ but also RAGWs’ reports on different kinds of communication channels, like wireless technology in RA and wired links between CC and RAGW. More seriously, a powerful adversary A even could intrude in the databases of RAGWs and CC to steal some private and personal-sensitive data of electricity consumption or put forward to launch some active attacks to compromise the data integrity. As is clear from the above descriptions, to avoid being sniffed and to detect malicious actions which are both by the adversary A, we should achieve the following security requirements in our scheme:(i)
Confidentiality. In our system, for protecting privacy of individual users of residential areas against malicious actions of adversary A, even if eavesdropping occurs on communication channels and data in databases of CC or RAGWs have been stolen, adversary A also can neither obtain any information of individual users’ electricity energy consumption, nor identify or infer any other users’ privacy information.(ii)
Authentication and Data Integrity. Notice that RAs are in public places, a skilled adversary A can easily hack into the communication system, then forge or modify reports which are sent by legal residential users. So we must authenticate encrypted reports which are really sent by their corresponding legal residential users and have not been tampered during the transmission.


## 3.3. Design Goal

Under our system model and for achieving the aforementioned security requirements, our design goal is to develop an efficient, privacy-preserving line-loss calculation scheme. Particularly, the scheme achieved the following three objectives:(i)
Security and Reliability. The security and reliability are the most essential goals in our scheme. Without the security and reliability, the privacy information about users’ real-time electricity consumption will be leaked or even tampered, after which error results will be generated in processing the tampered information and then sent to CC. If the error results are applied in the planning, operation or analysis fields of power system, it will cause collapse for the worst. So our proposed scheme should guarantee the authentication, confidentiality, and integrity simultaneously.(ii)
High Efficiency. Consider the real-timeness requirement and characteristics of communication architecture in smart grid system. For example, the communication channels in RA always use wireless technology, which is featured with low-bandwidth and high-delay compared to wired technology, and smart meters have limited computing ability, memory, and so on. So our proposed scheme should reduce communication cost and improve the efficiency of the line-loss calculation processing.(iii)
Good Flexibility. Even though the numbers of users, RAs, or DAs varied, the business logic changed constantly, etc., the proposed scheme still can carry out flexible line-loss calculation for each RA very well.


## 4. Preliminaries

Based on the bilinear pairing technique [35], the Paillier cryptosystem [30], and Horner’s rule [36], we propose the EPLC scheme.


### 4.1. The Bilinear Pairing

LetG1 and G2 be two additive cyclic groups of the same large prime number q, P be a generator of group G1, and let e:G1×G1→G2 be a bilinear map. The bilinear pairing contains the following properties.(i)
Bilinearity. e(aP,bQ)=e(P,Q)ab∈G2 for ∀P,Q∈G1 and ∀a,b∈Zq∗.(ii)
Nondegeneracy. e(P,P)≠1G2.(iii)
Computability. For any P,Q∈G1, there exists an efficient polynomial time algorithm to compute e(P,Q) and the group operation in G1 is also efficiently computable.(iv)
Symmetry. The map e is symmetric: e(aP,bQ)=e(P,Q)ab=e(bP,aQ).Bilinear Pairing Generation Algorithm.A bilinear parameter generator Gen is a probabilistic algorithm, which takes a security parameter κ as input and then outputs a five-tuple (q,P,G1,G2,e); in the tuple, the q is a κ-bit prime number, the P∈G1 is a generator, and the e:G1×G1→G2 is a bilinear map which has the above properties.Computational Diffie-Hellman (CDH) Problem [37].By given two elements S1 and S2 from group G1, define DHP(S1,S2)=defabP, when S1=aP and S2=bP, then(1)DHPS1,S2=abP=aS2=bS1The definition of CDH problem is given randomly chosen S1 and S2; then compute DHP(S1,S2).


### 4.2. The Paillier Cryptosystem

Just as the Goldwasser-Micali, RSA, and Rabin encryption schemes, the Paillier cryptosystem is also based on the hardness of factoring a composite numberN which is a product of two prime numbers, while the more specially and importantly is that the Paillier cryptosystem possesses unique homomorphic characteristic property, and its efficiency is almost the same with RSA and Rabin but higher than Goldwasser-Micali.The Paillier cryptosystem utilizes the groupZN2∗, which is isomorphic to ZN×ZN∗ with isomorphism f:ZN×ZN∗→ZN2∗(2)fa,b=1+Na·bNmod⁡N2where N=pq, p and q are both big prime numbers of the same length with different values, a∈ZN, b∈ZN∗, f(a,b)∈ZN2∗, and gcd(N,ϕ(N))=1, the order of (1+N) in ZN2∗ is N because for an integer a with 0≤a≤N, and the equation (1+N)a=1+aNmod⁡N2 will always be true.Algorithms of Paillier Cryptosystem (i)
Key Generation. This cryptosystem takes a security parameter ξ as input and then chooses two big prime numbers p and q of the same length ξ, output N=pq, and λ=lcm(p-1,q-1); define a function L(u)=u-1/N, then choose g=(1+N)∈ZN2∗, and calculate μ=(Lgλmod⁡N2)-1mod⁡N. Finally distribute the public keys pk=(N,g) and the corresponding private keys sk=(λ,μ). (ii)
Encryption. For each user’s message m∈ZN, a random number r∈ZN∗ was chosen by the user; then generate the ciphertext c=E(m)=gm·rNmod⁡N2. (iii)
Decryption. When the user get a ciphertext c∈ZN2∗, deciphering it by D(c)=L(cλmod⁡N2)·μmod⁡N, the corresponding message m can be got.


### 4.3. Horner’s Rule

The Horner algorithm is a fast algorithm for computing polynomials, which was named for William George Horner who is an English mathematician. According to a parameterΥ, Horner’s rule will actually be able to turn any polynomial expressed as p(Υ)=a0+a1Υ+⋯+akΥk+⋯+anΥn into another form p(Υ)=a0+Υ(a1+Υ(a2+⋯+Υ(an-1+anΥ))). After transformation, calculating the polynomial only needs n multiplications and n additions; obviously it is more efficient than before.Particularly, given a set of dataV={v0,v1,…,vk,…,vn} and Υ>max⁡{v0,v1,⋯,vk,…,vn}, then we can construct a polynomial p(Υ)=v0+v1Υ+⋯+vkΥk+⋯+vnΥn=v0+Υ(v1+Υ(v2+⋯+Υ(vn-1+vnΥ))), then all the information of the set V is interpreted by the p(Υ) as a number. After that, if only we know the value of the p(Υ) and Υ, retrieving the V by n exact divisions and modulo operations, respectively, is going to be easy.


## 4.1. The Bilinear Pairing

LetG1 and G2 be two additive cyclic groups of the same large prime number q, P be a generator of group G1, and let e:G1×G1→G2 be a bilinear map. The bilinear pairing contains the following properties.(i)
Bilinearity. e(aP,bQ)=e(P,Q)ab∈G2 for ∀P,Q∈G1 and ∀a,b∈Zq∗.(ii)
Nondegeneracy. e(P,P)≠1G2.(iii)
Computability. For any P,Q∈G1, there exists an efficient polynomial time algorithm to compute e(P,Q) and the group operation in G1 is also efficiently computable.(iv)
Symmetry. The map e is symmetric: e(aP,bQ)=e(P,Q)ab=e(bP,aQ).Bilinear Pairing Generation Algorithm.A bilinear parameter generator Gen is a probabilistic algorithm, which takes a security parameter κ as input and then outputs a five-tuple (q,P,G1,G2,e); in the tuple, the q is a κ-bit prime number, the P∈G1 is a generator, and the e:G1×G1→G2 is a bilinear map which has the above properties.Computational Diffie-Hellman (CDH) Problem [37].By given two elements S1 and S2 from group G1, define DHP(S1,S2)=defabP, when S1=aP and S2=bP, then(1)DHPS1,S2=abP=aS2=bS1The definition of CDH problem is given randomly chosen S1 and S2; then compute DHP(S1,S2).


## 4.2. The Paillier Cryptosystem

Just as the Goldwasser-Micali, RSA, and Rabin encryption schemes, the Paillier cryptosystem is also based on the hardness of factoring a composite numberN which is a product of two prime numbers, while the more specially and importantly is that the Paillier cryptosystem possesses unique homomorphic characteristic property, and its efficiency is almost the same with RSA and Rabin but higher than Goldwasser-Micali.The Paillier cryptosystem utilizes the groupZN2∗, which is isomorphic to ZN×ZN∗ with isomorphism f:ZN×ZN∗→ZN2∗(2)fa,b=1+Na·bNmod⁡N2where N=pq, p and q are both big prime numbers of the same length with different values, a∈ZN, b∈ZN∗, f(a,b)∈ZN2∗, and gcd(N,ϕ(N))=1, the order of (1+N) in ZN2∗ is N because for an integer a with 0≤a≤N, and the equation (1+N)a=1+aNmod⁡N2 will always be true.Algorithms of Paillier Cryptosystem (i)
Key Generation. This cryptosystem takes a security parameter ξ as input and then chooses two big prime numbers p and q of the same length ξ, output N=pq, and λ=lcm(p-1,q-1); define a function L(u)=u-1/N, then choose g=(1+N)∈ZN2∗, and calculate μ=(Lgλmod⁡N2)-1mod⁡N. Finally distribute the public keys pk=(N,g) and the corresponding private keys sk=(λ,μ). (ii)
Encryption. For each user’s message m∈ZN, a random number r∈ZN∗ was chosen by the user; then generate the ciphertext c=E(m)=gm·rNmod⁡N2. (iii)
Decryption. When the user get a ciphertext c∈ZN2∗, deciphering it by D(c)=L(cλmod⁡N2)·μmod⁡N, the corresponding message m can be got.


## 4.3. Horner’s Rule

The Horner algorithm is a fast algorithm for computing polynomials, which was named for William George Horner who is an English mathematician. According to a parameterΥ, Horner’s rule will actually be able to turn any polynomial expressed as p(Υ)=a0+a1Υ+⋯+akΥk+⋯+anΥn into another form p(Υ)=a0+Υ(a1+Υ(a2+⋯+Υ(an-1+anΥ))). After transformation, calculating the polynomial only needs n multiplications and n additions; obviously it is more efficient than before.Particularly, given a set of dataV={v0,v1,…,vk,…,vn} and Υ>max⁡{v0,v1,⋯,vk,…,vn}, then we can construct a polynomial p(Υ)=v0+v1Υ+⋯+vkΥk+⋯+vnΥn=v0+Υ(v1+Υ(v2+⋯+Υ(vn-1+vnΥ))), then all the information of the set V is interpreted by the p(Υ) as a number. After that, if only we know the value of the p(Υ) and Υ, retrieving the V by n exact divisions and modulo operations, respectively, is going to be easy.


## 5. Our Proposed EPLC Scheme

In this section, an efficient privacy-preserving line-loss calculation scheme for residential areas of smart grid is proposed, which is made up of the following four parts: system initialization, user report generation, privacy-preserving line-loss calculation, and decryption of line-loss. Following the description of system model, we assume the numbers of DAs, RAs of each DA, and users in each RA are not larger thanm, n, and s, respectively. In the meanwhile, the line-loss of each RA is less than a constant Θ. The main parameters used in our scheme are listed in Table 2.Table 2
Main parameters.
Parameter Description κ, q, P, G1, G2, e Parameters of Bilinear Pairing ξ, N, p, q, g, λ, μ Parameters of Pallier Cryptosystem x i j, Yij The private key and public key ofRAGWij x i j k, Yijk The private key and public key ofUijk x i j τ, Yijτ The private key and public key of VT(Uijτ) Υ 1, Υ2 Two common factors in line-loss calculation m, n, s The maximum numbers of DAs, RAs of each DA and users in each RA respectively Θ The maximum number of line-loss in each RA NDA After initialization, the number of DAs NiRA After initialization, the number of RAs in theDi NijU After initialization, the number of users in theRij LLD_CijT The ciphertext of line-loss inRij at time T LLD_PijT The plaintext of line-loss inRij at time T LLD_CT All the line-loss of the system at timeT in the form of cipher as a number LLD_PT All the line-loss of the system at timeT in the form of polynomials as a number


### 5.1. System Initialization

We assume the single trusted authority CC is responsible for bootstrapping the whole system. In the system initialization, use the presented security parameters to generate system parameters firstly and secondly register system entities in CC.(i) Generating Process of System Parameters (1)
Based on the Bilinear Pairing technique, given the security parameterκ, after running Gen(κ), CC can generate parameters (q,P,G1,G2,e). (2)
Again, given the security parameterξ, according to the Paillier cryptosystem, after choosing two large prime numbers p and q, whose length are both ξ, then CC can calculate the public keys (N=pq,g) and the private keys (λ,μ). (3)
CC chooses a secure cryptographic hash functionH:{0,1}∗→G1. (4)
CC also chooses two common factorsΥ1 and Υ2 as line-loss calculation parameters randomly, which must meet the requirements that Υ1>Θ, Υ2>Υ1n·Θ. (5)
At last, CC publishes the system parameters{q,P,G1,G2,e,N,g,H,Υ1,Υ2} as public keys and keeps the master key {λ,μ} secret.(ii) Registering Process of System Entities (1)
All RAGWs send registration requests to CC; as shown in Figure2, each RAGW belongs to a RA; the RA is in a DA. According to its actual business and administrative situation, CC sets a unique number i from the sequence set {1,2,…,m} and another unique number j from another sequence set {1,2,…,n} to the RAGW. The notation RAGWij represents the RAGW which belongs to the Rij (the jth RA of the ith DA). (2)
EachRAGWij(i∈{1,2,…,m},j∈{1,2,…,n}) randomly chooses xij∈Zq∗ as its private key and calculates Yij=xijP as its public key. (3)
All users in theAij send registration requests to RAGWij; as shown in Figure 3, according to the management situation, RAGWij, respectively, set a unique number k from the sequence set {1,2,…,s} to the user, as the section of system model mentioned; the notation Uijk means the kth user of the jth RA in the ith DA. (4)
EachUijk(i∈{1,2,…,m},j∈{1,2,…,n},k∈{1,2,…,s}) randomly chooses xijk∈Zq∗ as its private key, and calculates Yijk=xijkP as its public key. (5)
All the VTs, which equipped with smart meters located in all RAs, also send requests to their corresponding RAGWs. Without loss of generality, considering theRij, RAGWij sets the two numbers i,j to the VTs; for the convenience of discussion and without loss of correctness, we utilize the notation Uijτ for expressing the VT equipped in the Rij. (6)
The VT injth RA of the ith DA, Uijτ(i∈{1,2,…,m},j∈{1,2,…,n}) randomly chooses xijτ∈Zq∗ as its private key and calculates Yijτ=xijτP as its public key.In our system, after the two initialization processes above, we assumed the numbers of DAs, RAs in theDi and users in the Rij are NDA, NiRA, and NijU, respectively.


### 5.2. Report Generation

EachUijk and VT(Uijτ)(i∈{1,2,…,m},j∈{1,2,…,n},k∈{1,2,…,s}) can collect electricity consumption periodically (e.g., 15 minutes) by equipped with smart meters. After collecting nearly real-time electricity usage for different time T, each user and each VT need to utilize the public keys published by CC to encrypt the data firstly, make a signature of the data by using individual private keys xijk, xijτ secondly, and generate a corresponding report thirdly.(1)
Uijk and Uijτ encrypt collecting data of electricity consumption dijk and dijτ, respectively, as follows:(3)Cijk=gΥ2i·Υ1j·dijk·rijkNmod⁡N2Cijτ=gΥ2i·Υ1j·dijτ·rijτNmod⁡N2whererijk and rijτ are both chosen by users and VTs randomly from ZN∗, respectively (rijk,rijτ∈ZN∗).(2)
Uijk and Uijτ use their private keys xijk and xijτ, respectively, and hash function H of CC to generate individual signatures as follows:(4)σijk=xijk·HCijk∥i∥j∥k∥Tσijτ=xijτ·HCijτ∥i∥j∥τ∥T(3)
Uijk and Uijτ generate reports (see (5)), respectively:(5)Dijk=Cijk∥i∥j∥k∥T∥σijkDijτ=Cijτ∥i∥j∥τ∥T∥σijτAfter the report is generated, Uijk and Uijτ send Dijk and Dijτ to RAGWij for each k∈{1,2,…,NijU}, respectively.


### 5.3. Verification by RAGW

InRij, after the RAGWij receives all the reports of time T: {Dijk,Dijτ}, for each k∈{1,2,…,NijU}, based on the bilinear pairings, by verifying(6)eP,σij1=?eYij1,HCij1∥i∥j∥1∥TeP,σij2=?eYij2,HCij2∥i∥j∥2∥T⋯eP,σijk=?eYijk,HCijk∥i∥j∥k∥T⋯eP,σijNijU=?eYijNijU,HCijNijU∥i∥j∥NijU∥TeP,σijτ=?eYijτ,HCijτ∥i∥j∥τ∥Tif all the equations of (6) are hold, then reports Dijk and Dijτ are accepted, not vice versa. Because the function e of bilinear pairing technique is time-consuming and high cost, after introducing batch verification [10, 38], we can make the verification efficiently. The batch verification in the Rij performs as(7)eP,∑k=1NijUσijk+σijτ=?eP,(∑k=1NijUxijk·HCijk∥i∥j∥k∥T+xijτ·HCijτ∥i∥j∥τ∥T=?∏k=1NijUeP,xijk·HCijk∥i∥j∥k∥T·eP,xijτ·HCijτ∥i∥j∥τ∥T=?∏k=1NijUeYijk,HCijk∥i∥j∥k∥T·eYijτ,HCijτ∥i∥j∥τ∥TAs a result, the batch verification can reduce the running times ofe from 2·(NijU+1) to NijU+2 compared to the original verification.


### 5.4. Privacy-Preserving Line-Loss Calculation

After RAGWs received the verified reporters of timeT, each RAGW generates line-loss of its corresponding RA in the form of cipher by privacy-preserving calculation. Once each RA’s ciphertext of line-loss is generated, all of them will be sent to CC, then CC also performs calculation to convert all the whole RAs’ line-loss cipher data of time T to a number. The steps are as follows.


#### 5.4.1. Processing in RAGW

Let the notationLLD_CijT represent a value of Rij at time T which is calculated by(8)LLD_CijT=Cijτ·∏k=1NijUCijk-1mod⁡N2=Cijτ∏k=1NijUCijkmod⁡N2=gΥ2i·Υ1j·dijτ·rijτNgΥ2i·Υ1j·dij1+⋯+Υ2i·Υ1j·dijNijU·rij1N⋯rijNijUNmod⁡N2=gΥ2i·Υ1j·dijτ-Υ2i·Υ1j·dij1+⋯+Υ2i·Υ1j·dijNijUrijτN·rij1-1N⋯rijNijU-1Nmod⁡N2=gΥ2i·Υ1j·dijτ-dij1+⋯+dijNijU·rijτ·rij1-1⋯rijNijU-1Nmod⁡N2Let(9)LLD_PijT=dijτ-dij1+⋯+dijNijUAccording to section of system model, in (8), the notation LLD_PijT means the plaintext of the line-loss of the Rij, so the LLD_CijT shows the line-loss in Rij at time T in the form of cipher.After theLLD_CijT is generated, the corresponding RAGWij creates its signature σij as(10)σij=xij·HLLD_CijT∥i∥j∥TUtilizing the signature, theRAGWij generates a report Dij as(11)Dij=LLD_CijT∥i∥j∥T∥σijAt last, each RAGW sends its reports of different time to CC.


#### 5.4.2. Processing in CC

Similar to the verification by RAGW, after importing the batch verification, CC can verify all theDijs came from RAGWs by verifying the follow equations:(12)eP,∑i=1NDA∑j=1NiRAσij=?eP,∑i=1NDA∑j=1NiRAxij·HLLD_CijT∥i∥j∥T=?∏i=1NDA∏j=1NiRAeP,xij·HLLD_CijT∥i∥j∥T=?∏i=1NDA∏j=1NiRAeYij,HLLD_CijT∥i∥j∥TAfter allDijs of time T are verified by CC, CC calculates a number LLD_CT to represent the line-loss originated from all RAs of the system at time T in the form of cipher as follows:(13)LLD_CT=∏i=1NDA∏j=1NiRALLD_CijTmod⁡N2=∏i=1NDA∏j=1NiRAgΥ2i·Υ1j·dijτ-dij1+⋯+dijNijU·rijτ·rij1-1⋯rijNijU-1Nmod⁡N2=g∑i=1NDA∑j=1NiRAΥ2i·Υ1j·dijτ-dij1+⋯+dijNijU·∏i=1NDA∏j=1NiRArijτ·rij1-1⋯rijNijU-1Nmod⁡N2=g∑i=1NDA∑j=1NiRAΥ2i·Υ1j·LLD_PijT·∏i=1NDA∏j=1NiRArijτ·rij1-1⋯rijNijU-1Nmod⁡N2=gLLD_PT·∏i=1NDA∏j=1NiRArijτ·rij1-1⋯rijNijU-1Nmod⁡N2(LetLLD_PT=∑i=1NDA∑j=1NiRAΥ2i·Υ1j·LLD_PijT.)At last, CC stores a tuple<LLD_CT,T> in database to imply the line-loss of the whole RAs at the time T without any privacy leaks.


### 5.5. Decryption of Line-Loss

CC also can recover any RA’s line-loss of different DAs at different timeT.(14)gLLD_PT·∏i=1NDA∏j=1NiRArijτ·rij1-1⋯rijNijU-1Nmod⁡N2Obviously, (14) coming from (13) is still in the form of ciphertext which can be generated by Paillier cryptosystem:(15)gm·rNmod⁡N2where(16)LLD_PT=m(17)∏i=1NDA∏j=1NiRArijτ·rij1-1⋯rijNijU-1=rTherefore, after searching from database byT, CC can get the LLD_CT, then by using private keys (λ,μ), the LLD_PT can be recovered from (14). Using Algorithm 1 can extract any LLD_PijT of its corresponding Rij at different time T, and also if CC just want to get the line-loss of a specified RA Rαβ, only they need to perform the line 3 of Algorithm 1 with the parameters α and β described as (18):(18)LLD_PαβT←LLD_PT/Υ2αmod⁡Υ2Υ1βmod⁡Υ1Algorithm 1:Generating each LLD_PijT with Horner’s rule.
Input:  LLD_PT Output:  SetofallLLD_PijTs f o r   e a c h   i ∈ 1,2 , ⋯ , N D A ,   j ∈ 1,2 , ⋯ , N i R A 1: for  i←1toNDA  do 2:for  j←1toNiRA  do 3:LLD_PijT←LLD_PT/Υ2imod⁡Υ2Υ1jmod⁡Υ1 4: end for 5: end for 6: return   LLD_P11T⋯LLD_P1N1RATLLD_P21T⋯LLD_P2N2RAT⋮⋱⋮LLD_PNDA1T⋯LLD_PNDANNDARAT


## 5.1. System Initialization

We assume the single trusted authority CC is responsible for bootstrapping the whole system. In the system initialization, use the presented security parameters to generate system parameters firstly and secondly register system entities in CC.(i) Generating Process of System Parameters (1)
Based on the Bilinear Pairing technique, given the security parameterκ, after running Gen(κ), CC can generate parameters (q,P,G1,G2,e). (2)
Again, given the security parameterξ, according to the Paillier cryptosystem, after choosing two large prime numbers p and q, whose length are both ξ, then CC can calculate the public keys (N=pq,g) and the private keys (λ,μ). (3)
CC chooses a secure cryptographic hash functionH:{0,1}∗→G1. (4)
CC also chooses two common factorsΥ1 and Υ2 as line-loss calculation parameters randomly, which must meet the requirements that Υ1>Θ, Υ2>Υ1n·Θ. (5)
At last, CC publishes the system parameters{q,P,G1,G2,e,N,g,H,Υ1,Υ2} as public keys and keeps the master key {λ,μ} secret.(ii) Registering Process of System Entities (1)
All RAGWs send registration requests to CC; as shown in Figure2, each RAGW belongs to a RA; the RA is in a DA. According to its actual business and administrative situation, CC sets a unique number i from the sequence set {1,2,…,m} and another unique number j from another sequence set {1,2,…,n} to the RAGW. The notation RAGWij represents the RAGW which belongs to the Rij (the jth RA of the ith DA). (2)
EachRAGWij(i∈{1,2,…,m},j∈{1,2,…,n}) randomly chooses xij∈Zq∗ as its private key and calculates Yij=xijP as its public key. (3)
All users in theAij send registration requests to RAGWij; as shown in Figure 3, according to the management situation, RAGWij, respectively, set a unique number k from the sequence set {1,2,…,s} to the user, as the section of system model mentioned; the notation Uijk means the kth user of the jth RA in the ith DA. (4)
EachUijk(i∈{1,2,…,m},j∈{1,2,…,n},k∈{1,2,…,s}) randomly chooses xijk∈Zq∗ as its private key, and calculates Yijk=xijkP as its public key. (5)
All the VTs, which equipped with smart meters located in all RAs, also send requests to their corresponding RAGWs. Without loss of generality, considering theRij, RAGWij sets the two numbers i,j to the VTs; for the convenience of discussion and without loss of correctness, we utilize the notation Uijτ for expressing the VT equipped in the Rij. (6)
The VT injth RA of the ith DA, Uijτ(i∈{1,2,…,m},j∈{1,2,…,n}) randomly chooses xijτ∈Zq∗ as its private key and calculates Yijτ=xijτP as its public key.In our system, after the two initialization processes above, we assumed the numbers of DAs, RAs in theDi and users in the Rij are NDA, NiRA, and NijU, respectively.


## 5.2. Report Generation

EachUijk and VT(Uijτ)(i∈{1,2,…,m},j∈{1,2,…,n},k∈{1,2,…,s}) can collect electricity consumption periodically (e.g., 15 minutes) by equipped with smart meters. After collecting nearly real-time electricity usage for different time T, each user and each VT need to utilize the public keys published by CC to encrypt the data firstly, make a signature of the data by using individual private keys xijk, xijτ secondly, and generate a corresponding report thirdly.(1)
Uijk and Uijτ encrypt collecting data of electricity consumption dijk and dijτ, respectively, as follows:(3)Cijk=gΥ2i·Υ1j·dijk·rijkNmod⁡N2Cijτ=gΥ2i·Υ1j·dijτ·rijτNmod⁡N2whererijk and rijτ are both chosen by users and VTs randomly from ZN∗, respectively (rijk,rijτ∈ZN∗).(2)
Uijk and Uijτ use their private keys xijk and xijτ, respectively, and hash function H of CC to generate individual signatures as follows:(4)σijk=xijk·HCijk∥i∥j∥k∥Tσijτ=xijτ·HCijτ∥i∥j∥τ∥T(3)
Uijk and Uijτ generate reports (see (5)), respectively:(5)Dijk=Cijk∥i∥j∥k∥T∥σijkDijτ=Cijτ∥i∥j∥τ∥T∥σijτAfter the report is generated, Uijk and Uijτ send Dijk and Dijτ to RAGWij for each k∈{1,2,…,NijU}, respectively.


## 5.3. Verification by RAGW

InRij, after the RAGWij receives all the reports of time T: {Dijk,Dijτ}, for each k∈{1,2,…,NijU}, based on the bilinear pairings, by verifying(6)eP,σij1=?eYij1,HCij1∥i∥j∥1∥TeP,σij2=?eYij2,HCij2∥i∥j∥2∥T⋯eP,σijk=?eYijk,HCijk∥i∥j∥k∥T⋯eP,σijNijU=?eYijNijU,HCijNijU∥i∥j∥NijU∥TeP,σijτ=?eYijτ,HCijτ∥i∥j∥τ∥Tif all the equations of (6) are hold, then reports Dijk and Dijτ are accepted, not vice versa. Because the function e of bilinear pairing technique is time-consuming and high cost, after introducing batch verification [10, 38], we can make the verification efficiently. The batch verification in the Rij performs as(7)eP,∑k=1NijUσijk+σijτ=?eP,(∑k=1NijUxijk·HCijk∥i∥j∥k∥T+xijτ·HCijτ∥i∥j∥τ∥T=?∏k=1NijUeP,xijk·HCijk∥i∥j∥k∥T·eP,xijτ·HCijτ∥i∥j∥τ∥T=?∏k=1NijUeYijk,HCijk∥i∥j∥k∥T·eYijτ,HCijτ∥i∥j∥τ∥TAs a result, the batch verification can reduce the running times ofe from 2·(NijU+1) to NijU+2 compared to the original verification.


## 5.4. Privacy-Preserving Line-Loss Calculation

After RAGWs received the verified reporters of timeT, each RAGW generates line-loss of its corresponding RA in the form of cipher by privacy-preserving calculation. Once each RA’s ciphertext of line-loss is generated, all of them will be sent to CC, then CC also performs calculation to convert all the whole RAs’ line-loss cipher data of time T to a number. The steps are as follows.


### 5.4.1. Processing in RAGW

Let the notationLLD_CijT represent a value of Rij at time T which is calculated by(8)LLD_CijT=Cijτ·∏k=1NijUCijk-1mod⁡N2=Cijτ∏k=1NijUCijkmod⁡N2=gΥ2i·Υ1j·dijτ·rijτNgΥ2i·Υ1j·dij1+⋯+Υ2i·Υ1j·dijNijU·rij1N⋯rijNijUNmod⁡N2=gΥ2i·Υ1j·dijτ-Υ2i·Υ1j·dij1+⋯+Υ2i·Υ1j·dijNijUrijτN·rij1-1N⋯rijNijU-1Nmod⁡N2=gΥ2i·Υ1j·dijτ-dij1+⋯+dijNijU·rijτ·rij1-1⋯rijNijU-1Nmod⁡N2Let(9)LLD_PijT=dijτ-dij1+⋯+dijNijUAccording to section of system model, in (8), the notation LLD_PijT means the plaintext of the line-loss of the Rij, so the LLD_CijT shows the line-loss in Rij at time T in the form of cipher.After theLLD_CijT is generated, the corresponding RAGWij creates its signature σij as(10)σij=xij·HLLD_CijT∥i∥j∥TUtilizing the signature, theRAGWij generates a report Dij as(11)Dij=LLD_CijT∥i∥j∥T∥σijAt last, each RAGW sends its reports of different time to CC.


### 5.4.2. Processing in CC

Similar to the verification by RAGW, after importing the batch verification, CC can verify all theDijs came from RAGWs by verifying the follow equations:(12)eP,∑i=1NDA∑j=1NiRAσij=?eP,∑i=1NDA∑j=1NiRAxij·HLLD_CijT∥i∥j∥T=?∏i=1NDA∏j=1NiRAeP,xij·HLLD_CijT∥i∥j∥T=?∏i=1NDA∏j=1NiRAeYij,HLLD_CijT∥i∥j∥TAfter allDijs of time T are verified by CC, CC calculates a number LLD_CT to represent the line-loss originated from all RAs of the system at time T in the form of cipher as follows:(13)LLD_CT=∏i=1NDA∏j=1NiRALLD_CijTmod⁡N2=∏i=1NDA∏j=1NiRAgΥ2i·Υ1j·dijτ-dij1+⋯+dijNijU·rijτ·rij1-1⋯rijNijU-1Nmod⁡N2=g∑i=1NDA∑j=1NiRAΥ2i·Υ1j·dijτ-dij1+⋯+dijNijU·∏i=1NDA∏j=1NiRArijτ·rij1-1⋯rijNijU-1Nmod⁡N2=g∑i=1NDA∑j=1NiRAΥ2i·Υ1j·LLD_PijT·∏i=1NDA∏j=1NiRArijτ·rij1-1⋯rijNijU-1Nmod⁡N2=gLLD_PT·∏i=1NDA∏j=1NiRArijτ·rij1-1⋯rijNijU-1Nmod⁡N2(LetLLD_PT=∑i=1NDA∑j=1NiRAΥ2i·Υ1j·LLD_PijT.)At last, CC stores a tuple<LLD_CT,T> in database to imply the line-loss of the whole RAs at the time T without any privacy leaks.


## 5.4.1. Processing in RAGW

Let the notationLLD_CijT represent a value of Rij at time T which is calculated by(8)LLD_CijT=Cijτ·∏k=1NijUCijk-1mod⁡N2=Cijτ∏k=1NijUCijkmod⁡N2=gΥ2i·Υ1j·dijτ·rijτNgΥ2i·Υ1j·dij1+⋯+Υ2i·Υ1j·dijNijU·rij1N⋯rijNijUNmod⁡N2=gΥ2i·Υ1j·dijτ-Υ2i·Υ1j·dij1+⋯+Υ2i·Υ1j·dijNijUrijτN·rij1-1N⋯rijNijU-1Nmod⁡N2=gΥ2i·Υ1j·dijτ-dij1+⋯+dijNijU·rijτ·rij1-1⋯rijNijU-1Nmod⁡N2Let(9)LLD_PijT=dijτ-dij1+⋯+dijNijUAccording to section of system model, in (8), the notation LLD_PijT means the plaintext of the line-loss of the Rij, so the LLD_CijT shows the line-loss in Rij at time T in the form of cipher.After theLLD_CijT is generated, the corresponding RAGWij creates its signature σij as(10)σij=xij·HLLD_CijT∥i∥j∥TUtilizing the signature, theRAGWij generates a report Dij as(11)Dij=LLD_CijT∥i∥j∥T∥σijAt last, each RAGW sends its reports of different time to CC.


## 5.4.2. Processing in CC

Similar to the verification by RAGW, after importing the batch verification, CC can verify all theDijs came from RAGWs by verifying the follow equations:(12)eP,∑i=1NDA∑j=1NiRAσij=?eP,∑i=1NDA∑j=1NiRAxij·HLLD_CijT∥i∥j∥T=?∏i=1NDA∏j=1NiRAeP,xij·HLLD_CijT∥i∥j∥T=?∏i=1NDA∏j=1NiRAeYij,HLLD_CijT∥i∥j∥TAfter allDijs of time T are verified by CC, CC calculates a number LLD_CT to represent the line-loss originated from all RAs of the system at time T in the form of cipher as follows:(13)LLD_CT=∏i=1NDA∏j=1NiRALLD_CijTmod⁡N2=∏i=1NDA∏j=1NiRAgΥ2i·Υ1j·dijτ-dij1+⋯+dijNijU·rijτ·rij1-1⋯rijNijU-1Nmod⁡N2=g∑i=1NDA∑j=1NiRAΥ2i·Υ1j·dijτ-dij1+⋯+dijNijU·∏i=1NDA∏j=1NiRArijτ·rij1-1⋯rijNijU-1Nmod⁡N2=g∑i=1NDA∑j=1NiRAΥ2i·Υ1j·LLD_PijT·∏i=1NDA∏j=1NiRArijτ·rij1-1⋯rijNijU-1Nmod⁡N2=gLLD_PT·∏i=1NDA∏j=1NiRArijτ·rij1-1⋯rijNijU-1Nmod⁡N2(LetLLD_PT=∑i=1NDA∑j=1NiRAΥ2i·Υ1j·LLD_PijT.)At last, CC stores a tuple<LLD_CT,T> in database to imply the line-loss of the whole RAs at the time T without any privacy leaks.


## 5.5. Decryption of Line-Loss

CC also can recover any RA’s line-loss of different DAs at different timeT.(14)gLLD_PT·∏i=1NDA∏j=1NiRArijτ·rij1-1⋯rijNijU-1Nmod⁡N2Obviously, (14) coming from (13) is still in the form of ciphertext which can be generated by Paillier cryptosystem:(15)gm·rNmod⁡N2where(16)LLD_PT=m(17)∏i=1NDA∏j=1NiRArijτ·rij1-1⋯rijNijU-1=rTherefore, after searching from database byT, CC can get the LLD_CT, then by using private keys (λ,μ), the LLD_PT can be recovered from (14). Using Algorithm 1 can extract any LLD_PijT of its corresponding Rij at different time T, and also if CC just want to get the line-loss of a specified RA Rαβ, only they need to perform the line 3 of Algorithm 1 with the parameters α and β described as (18):(18)LLD_PαβT←LLD_PT/Υ2αmod⁡Υ2Υ1βmod⁡Υ1Algorithm 1:Generating each LLD_PijT with Horner’s rule.
Input:  LLD_PT Output:  SetofallLLD_PijTs f o r   e a c h   i ∈ 1,2 , ⋯ , N D A ,   j ∈ 1,2 , ⋯ , N i R A 1: for  i←1toNDA  do 2:for  j←1toNiRA  do 3:LLD_PijT←LLD_PT/Υ2imod⁡Υ2Υ1jmod⁡Υ1 4: end for 5: end for 6: return   LLD_P11T⋯LLD_P1N1RATLLD_P21T⋯LLD_P2N2RAT⋮⋱⋮LLD_PNDA1T⋯LLD_PNDANNDARAT


## 6. Correctness and Security Analysis

In this section, we analyze our scheme on correctness and security aspects. Our scheme’s design is correctly proved with bilinear pairing and Horner’s rule, while its security is presented in privacy preserving, authentication, and integrity.


### 6.1. Correctness Analysis

Before getting into details about the security of our scheme, let us firstly prove our scheme’s correctness based on the properties of bilinear pairing and Horner’s rule.Theorem 1.
Each RAGW and CC will only process correct (not tampered and from a legal sender) data.Proof.
We leverage the properties of bilinear pairing mentioned in Section4.1 to ensure the correctness of data, so all RAGWs and CC will only process correct (not tampered and from a legal sender) data after (7) and (12) are verified, respectively.Theorem 2.
Using Horner’s rule iteratively will recover each line-loss of all RAs or any specified RA’s line-loss correctly.Proof.
The cipher in (3) contains not only the data from corresponding SM but also the information about its region information (RA and DA) by parameters Υ1 and Υ2. After RAGW’s processing in (8), we can also record both line-loss of the RA (see (9)) and the region information in the form of cipher. Similarly, according to (13), all line-loss data and its area information both will be stored in a cipher (number). Finally, after decryption of the Paillier by using private keys, we can get (16) which is calculated by the polynomial in (13), because of the reasonable choice of the parameters Υ1 and Υ2 (Υ1>Θ, Υ2>Υ1n·Θ), then we can use Horner’s rule iteratively to get the coefficients of the polynomial then recover each line-loss of all RAs or any specified RA’s line-loss correctly as shown in Algorithm 1 and (18).


### 6.2. Security Analysis

Particularly, based on the security requirements discussed before, considering from three aspects, which involves privacy, authentication, and integrity, this section focuses on analyzing the security properties of the proposed EPLC scheme individually.(i) Privacy-Preserving. Since Paillier cryptosystem had been proved semantic secure against the chosen plaintext attack, based on the proposed EPLC scheme applied in the system model, the analyses are as follows.Theorem 3.
The users’ and VTs’ reports are privacy preserving in our proposed scheme.Proof.
In our scheme, the almost real-time electricity consumption datadijk and dijτ are collected by smart meters equipped at each user (Uijk) and VT(Uijτ), which are formed and encrypted as (3).
Obviously, the ciphertextsCijk=gΥ2i·(Υ1j·(-dijk))·rijkNmod⁡N2 and Cijτ=gΥ2i·(Υ1j·dijτ)·rijτNmod⁡N2 have the same form as a valid ciphertext of Paillier cryptosystem gm·rNmod⁡N2, so the data dijk in Cijk and dijτ in Cijτ are sematic secure and privacy preserved. Specially, since each rijk and each rijτ are a random number in ZN∗, based on different rijk≠ri′j′k′, the two same data dijk=di′j′k′ are encrypted to different ciphertexts Cijk≠Ci′j′k′ for resisting dictionary attacks. If the collusion attacks are launched by several users, which means all of them can share all their individual information with each other, including ID, random number r (for Paillier Encryption), and the corresponding ciphertext and in conjunction with the public information of system, no one can infer any others’ private information.Theorem 4.
The processing in RAGW and CC are also privacy preserving in our proposed scheme.Proof.
After having received all reportsCij1,Cij2,…,CijNijU, if the adversary A hijacks RAGW. Firstly, all the private information of the reports received from users and VTs is encrypted by Paillier cryptosystem. Secondly, all the line-loss calculations on RAGW are based on ciphertexts generated from users and VTs. Thirdly, even if there exist collusion attacks launched by several users, VTs, and RAGWs, which means all of them can share and analyze each other’s and their own information, as mentioned before, the information will involve ID, random number used by Paillier cryptosystem, and public information of the system. Because of the existence of semantic security of Paillier cryptosystem, the adversary A cannot infer any sensitive information of users and VTs.
The processing of CC is similar to the methods of RAGW, so in the actual operation, CC also can guarantee the users privacy away from infringement of adversaryA.
To summarise, even if the adversaryA can eavesdrop and intercept reports on communication channel, hijack RAGW, intrude into the database of CC, and steal some data about line-loss of the system, each user’s sensitive data of almost real-time electricity consumption are privacy preserved in the proposed EPLC scheme as long as the system keeps the private keys under the secret protection.(ii) Authentication and Integrity. Based on the CDH problem [37] of the random oracle model, BLS short signature has been proved to be secure, which is tamper-resistant and guarantees each report is from its corresponding legal sender.Theorem 5.
The authentication and data integrity of the users’ and VTs’ reports,LLD_C, are both guaranteed in our proposed scheme.Proof.
In EPLC scheme, utilizing individual private keys of each entity, reports of each individual user and VT and each ciphertextLLD_CijT of line-loss calculated by RAGWs are both signed by BLS short signature [39] before sending. Because the secure of BLS short signature has been proved, which is tamper-resistant and can guarantee each report is from its corresponding legal sender, so malicious behaviors of the adversary A such as tampering and falsifying in the system can be detected. So the authentication and the integrity of reporters from each users, VTs, and RAGWs are guaranteed by EPLC.


## 6.1. Correctness Analysis

Before getting into details about the security of our scheme, let us firstly prove our scheme’s correctness based on the properties of bilinear pairing and Horner’s rule.Theorem 1.
Each RAGW and CC will only process correct (not tampered and from a legal sender) data.Proof.
We leverage the properties of bilinear pairing mentioned in Section4.1 to ensure the correctness of data, so all RAGWs and CC will only process correct (not tampered and from a legal sender) data after (7) and (12) are verified, respectively.Theorem 2.
Using Horner’s rule iteratively will recover each line-loss of all RAs or any specified RA’s line-loss correctly.Proof.
The cipher in (3) contains not only the data from corresponding SM but also the information about its region information (RA and DA) by parameters Υ1 and Υ2. After RAGW’s processing in (8), we can also record both line-loss of the RA (see (9)) and the region information in the form of cipher. Similarly, according to (13), all line-loss data and its area information both will be stored in a cipher (number). Finally, after decryption of the Paillier by using private keys, we can get (16) which is calculated by the polynomial in (13), because of the reasonable choice of the parameters Υ1 and Υ2 (Υ1>Θ, Υ2>Υ1n·Θ), then we can use Horner’s rule iteratively to get the coefficients of the polynomial then recover each line-loss of all RAs or any specified RA’s line-loss correctly as shown in Algorithm 1 and (18).


## 6.2. Security Analysis

Particularly, based on the security requirements discussed before, considering from three aspects, which involves privacy, authentication, and integrity, this section focuses on analyzing the security properties of the proposed EPLC scheme individually.(i) Privacy-Preserving. Since Paillier cryptosystem had been proved semantic secure against the chosen plaintext attack, based on the proposed EPLC scheme applied in the system model, the analyses are as follows.Theorem 3.
The users’ and VTs’ reports are privacy preserving in our proposed scheme.Proof.
In our scheme, the almost real-time electricity consumption datadijk and dijτ are collected by smart meters equipped at each user (Uijk) and VT(Uijτ), which are formed and encrypted as (3).
Obviously, the ciphertextsCijk=gΥ2i·(Υ1j·(-dijk))·rijkNmod⁡N2 and Cijτ=gΥ2i·(Υ1j·dijτ)·rijτNmod⁡N2 have the same form as a valid ciphertext of Paillier cryptosystem gm·rNmod⁡N2, so the data dijk in Cijk and dijτ in Cijτ are sematic secure and privacy preserved. Specially, since each rijk and each rijτ are a random number in ZN∗, based on different rijk≠ri′j′k′, the two same data dijk=di′j′k′ are encrypted to different ciphertexts Cijk≠Ci′j′k′ for resisting dictionary attacks. If the collusion attacks are launched by several users, which means all of them can share all their individual information with each other, including ID, random number r (for Paillier Encryption), and the corresponding ciphertext and in conjunction with the public information of system, no one can infer any others’ private information.Theorem 4.
The processing in RAGW and CC are also privacy preserving in our proposed scheme.Proof.
After having received all reportsCij1,Cij2,…,CijNijU, if the adversary A hijacks RAGW. Firstly, all the private information of the reports received from users and VTs is encrypted by Paillier cryptosystem. Secondly, all the line-loss calculations on RAGW are based on ciphertexts generated from users and VTs. Thirdly, even if there exist collusion attacks launched by several users, VTs, and RAGWs, which means all of them can share and analyze each other’s and their own information, as mentioned before, the information will involve ID, random number used by Paillier cryptosystem, and public information of the system. Because of the existence of semantic security of Paillier cryptosystem, the adversary A cannot infer any sensitive information of users and VTs.
The processing of CC is similar to the methods of RAGW, so in the actual operation, CC also can guarantee the users privacy away from infringement of adversaryA.
To summarise, even if the adversaryA can eavesdrop and intercept reports on communication channel, hijack RAGW, intrude into the database of CC, and steal some data about line-loss of the system, each user’s sensitive data of almost real-time electricity consumption are privacy preserved in the proposed EPLC scheme as long as the system keeps the private keys under the secret protection.(ii) Authentication and Integrity. Based on the CDH problem [37] of the random oracle model, BLS short signature has been proved to be secure, which is tamper-resistant and guarantees each report is from its corresponding legal sender.Theorem 5.
The authentication and data integrity of the users’ and VTs’ reports,LLD_C, are both guaranteed in our proposed scheme.Proof.
In EPLC scheme, utilizing individual private keys of each entity, reports of each individual user and VT and each ciphertextLLD_CijT of line-loss calculated by RAGWs are both signed by BLS short signature [39] before sending. Because the secure of BLS short signature has been proved, which is tamper-resistant and can guarantee each report is from its corresponding legal sender, so malicious behaviors of the adversary A such as tampering and falsifying in the system can be detected. So the authentication and the integrity of reporters from each users, VTs, and RAGWs are guaranteed by EPLC.


## 7. Performance Evaluation

In this section, we analyze the computational cost of users, RAGWs, and CC in the process of our EPLC scheme. Experiments are conducted on a PC with Processor: Intel(R) Core(TM) i5-3470 CPU @ 3.20GHz; Memory (RAM): 12 GB; OS: 64-bit Windows 10 Pro; Java-version 1.8.0_181; JPBC [40] library-version 2.0.0.; 1024-bit NN2=2048 for Paillier cryptosystem and 160-bit G1 for symmetric pairing.Meter’s data of users and VTs are established from the random numbers generated based on thenextInt method of java.util.Random package, and we assume the numbers of DAs and RAs in each DA and users in each RA are 10, 20, and 200; the range of values for line-loss and meter’s data of users are 10 to 100 and 10 to 2000, respectively. According to the requirement of our EPLC scheme, we set Υ1 to 101, slightly more than the maxima of line-loss and Υ2 to 1220190039947966824482749091552564190200101, slightly more than Υ1ThenumberofRAsineachDA (the maxima of line-loss).


### 7.1. The Analysis of Users’ Computational Cost

Meter’s data of users and VTs are established, followed by the encryption and signature processes. From Figure4, it can be seen that the computational cost of users and VTs belonged to different RAs of different DAs ranging from 200ms to 320ms and the distribution is affected fairly by the sequence number of DA. According to (3) and (4), the computational cost increase with the sequence number of DA is justified.Figure 4
Computational cost of each user.


### 7.2. The Analysis of RAGWs’ Computational Cost

When RAGW has received all reports of users and VT in corresponding RA at a certain timeT, then it performs batch verification and line-loss calculation. It can be seen from Figure 5 that the computational cost of RAGWs belonged to different RA of different DA range from 33300ms to 33530ms and are irrelevant to the sequence number of RA and DA.Figure 5
Computational cost of each RAGW.


### 7.3. The Analysis of CC’s Computational Cost

Similar to RAGW, batch verification and calculation of the numberLLD_CT will be executed when all reports belong to the certain time period T of RAGW received, and the computational cost of CC is 33562ms.The computational cost of decryption for each line-loss of RA can be seen from Figure6 range from 31ms to 47ms, also irrelevant to the sequence number of RA and DA.Figure 6
Computational cost of decrypting each RA line-loss.As mentioned before, in general, the standard period of measuring and reporting by smart meters is 15 minutes [3, 4], according to the computational cost of different entities. It is obvious that our scheme achieves high efficiency.


## 7.1. The Analysis of Users’ Computational Cost

Meter’s data of users and VTs are established, followed by the encryption and signature processes. From Figure4, it can be seen that the computational cost of users and VTs belonged to different RAs of different DAs ranging from 200ms to 320ms and the distribution is affected fairly by the sequence number of DA. According to (3) and (4), the computational cost increase with the sequence number of DA is justified.Figure 4
Computational cost of each user.


## 7.2. The Analysis of RAGWs’ Computational Cost

When RAGW has received all reports of users and VT in corresponding RA at a certain timeT, then it performs batch verification and line-loss calculation. It can be seen from Figure 5 that the computational cost of RAGWs belonged to different RA of different DA range from 33300ms to 33530ms and are irrelevant to the sequence number of RA and DA.Figure 5
Computational cost of each RAGW.


## 7.3. The Analysis of CC’s Computational Cost

Similar to RAGW, batch verification and calculation of the numberLLD_CT will be executed when all reports belong to the certain time period T of RAGW received, and the computational cost of CC is 33562ms.The computational cost of decryption for each line-loss of RA can be seen from Figure6 range from 31ms to 47ms, also irrelevant to the sequence number of RA and DA.Figure 6
Computational cost of decrypting each RA line-loss.As mentioned before, in general, the standard period of measuring and reporting by smart meters is 15 minutes [3, 4], according to the computational cost of different entities. It is obvious that our scheme achieves high efficiency.


## 8. Conclusion

In this paper, we have proposed an efficient privacy-preserving line-loss calculation scheme for residential areas of smart grid. The scheme can calculate the line-loss of each RA in different DA based on the Paillier cryptosystem and Horner’s rule with the protection of users’ privacy. For one timeT, the control center only needs to store a ciphertext LLD_CT to represent all values of RAs’ line-loss, then can obtain each line-loss of RA in different DA when possessing the private key, and further attain finer-grained electricity regulation for smart grid. We have also demonstrated our scheme’s security strength and privacy-preserving ability in the section of security analysis. And our scheme also satisfies the real-time requirement of smart grid in terms of computational cost. For the future work, line-loss of DA will be considered, and we will develop more flexible schemes to get line-loss of different areas, and then regulate electricity for RAs and DAs effectively.



---

*Source: 9637578-2019-04-01.xml*