A New Secure and Anonymous Metering Scheme for Smart Grid Communications

Abstract

The smart meter is one of the most important components of the smart grid, which enables bi-directional communication between electric power providers and in-home appliances. However, the fine-grained metering mechanism that reports real-time electricity usage to the provider may result in some privacy and security issues for the owner of the smart meter. In this paper, we propose a new secure and anonymous smart metering scheme based on the technique of direct anonymous attestation and identity-based signatures. We utilize the trusted platform module to realize the tamper resistance of the smart meter. Moreover, our scheme is able to detect malfunctioning meters in which data is reported more than once in a time period. Finally, the performance and security results show that our proposed scheme is efficient and satisfies the security requirements of the smart grid communication system.

1. Introduction

Electrical energy is one of the most important factors for the advancement of industrial development, urbanization, and economic globalization of any country [1]. Nowadays, the problems of climate change and electrical energy consumption are becoming more and more serious. The globe is facing an energy crisis because of the steadily increasing demand for electrical energy as well as high emissions of carbon dioxide (CO${}_2$) [2]. Many countries in the world are seeking new technologies to develop renewable energies (derived from wind, sunlight, waters, etc) and to reduce CO${}_2$ emissions and air pollution. Nevertheless, there also exists problems in dealing with the integration, system stability, and storage of different kinds of energy sources [3]. Fortunately, the emergence of smart grid techniques has provided solutions for such problems.

Smart grid, according to the studies [4,5,6], is a new generation of electric power grid infrastructure for improved efficiency, reliability, and safety, with smooth integration of renewable and alternative energy sources, through automated control and modern communications technologies. With the high development of industry 4.0 and the emergence of 5G mobile communications technology, the smart grid, which is concerned as an important part of Internet of Things and smart cities, has been playing an important role in people’s daily lives.

In order to efficiently use the electric power resources and utilize different kinds of renewable energies, in recent years, many different kinds of distributed energy management systems have been proposed by researchers [7,8,9,10]. Such kinds of energy management systems can be applied in facilities that need two or more kinds of energy usage, such as airports, hospitals, and hotel buildings [11,12].

However, in the smart grid communication network, the smart meter’s fine-grained metering mechanism, which reports real-time electricity usage to the utilities (the electricity providers or service providers), may result in privacy issues for the owner of the smart meter [13]. The inhabitants’ behavioral patterns (e.g., the appliances they use, the time they wake up, take a shower, or leave home, etc.) can be deduced from the fine-grained meter readings [14,15]. Moreover, it is essential to guarantee data security and integrity any time that the meter data is stored in the smart meter or transmitted in the channel of the smart grid network.

Over the past decade, in order to preserve privacy and security in the smart grid network, many privacy-preserving smart metering schemes have been proposed by researchers [16,17,18,19]. The schemes can be classified into two large categories. The first category involves concealing fine-grained metering data using symmetric/public encryption [20,21], homomorphic encryption [22,23,24,25], identity-based signcryption [26], secure multiparty computation [27], and other data masking techniques such as noise addition [15,28] and using rechargeable batteries [29,30,31]. The other category involves hiding the identity of the smart meter utilizing anonymity techniques, such as group signatures [32,33], ring signatures [34], zero knowledge signatures [35,36], and other pseudonym techniques [37,38,39]. In order to prevent the meter data from being manipulated or altered by the meter owner, a tamper-resistant trusted platform module (TPM chip) is adopted by the smart meter [40]. However, in most of the solutions, although they claimed that the smart meter was embedded with a TPM chip [32,35], they did not split the smart meter into two entities: A TPM and a host platform (the meter). Since the TPM has limited bandwidth and computational capability, most of the operations should be calculated in the computing module of the meter. Later, Zhao et al. [34] realized this problem, and in their solution, the TPM and the smart meter work together to generate a signature. However, they use ring signatures, where the computational complexity of smart meters will increase linearly with the total number of members in a ring; thus, their scheme will be inefficient for large-scale smart meter scenarios.

To solve this problem, in this paper, we design a new privacy-preserving scheme for the smart grid communication network. We use a pairing-based direct anonymous attestation (DAA) signature [41] to realize a tamper-resistant anonymous signature for smart meters. The DAA signature is adopted in the TPM version 2.0 [42]. To alleviate the computational burden on the TPM chip, the host (the computation module of the smart meter) and the TPM chip will jointly generate the anonymous signature of the meter data. Moreover, the computational efficiency of smart meters will not be affected by the group members in the assigned domain in a data aggregator. Meanwhile, an efficient and provably secure identity-based signature (IBS) [43] is used by the data aggregator to guarantee the data integrity and secure transmission of aggregated metering data.

Contributions: We propose a scheme which utilizes an efficient pairing-based DAA to realize the tamper resistance and anonymous signatures in smart meters. Moreover, in order to avoid accidents caused by smart meters, our scheme is able to detect malfunctioning meters that report twice during a time period, and to revoke such kinds of smart meters. In addition, we use identity-based signatures to ensure the secure communication between the data aggregator and operation center. Finally, the security results show that our scheme satisfies the security requirements of smart grid communications, namely, correctness, data integrity, authenticity, anonymity, and traceability of malfunctioning meters. The experimental results show that our scheme is efficient and practical, especially in the signing of smart meters.

Organization: The rest of this paper is organized as follows. The next section introduces the methodology of our paper. In Section 3, we present the security and performance results of our scheme. Finally, the discussion and conclusions are respectively presented in Section 4 and Section 5.

2. Methodology

In this section, we introduce our methodology, which includes the cryptographic primitive, mathematical hard problem, system model, and detailed constructions of our proposed scheme. The notations used in our paper are described in

Table 1. The notations used in the paper.

Notations	Descriptions
DAA	Direct anonymous attestation
IBS	Identity-based signature
SM	Smart meter
DA	Data aggregator
OC	Operation center
TPM	Trusted platform module
SM${}_{\mathrm{i}}$	The i-th smart meter
DA${}_{\mathrm{j}}$	The j-th data aggregator
TPM${}_{\mathrm{i}}$	The TPM chip embedded in SM${}_{\mathrm{i}}$
ID${}_{\mathrm{j}}$	The identity of DA${}_{\mathrm{j}}$
ms	millisecond
n	The total number of SMs in a domain
m	The total number of DAs
$\widehat{e}$	Bilinear map
${\mathbb{G}}_1$,${\mathbb{G}}_2$,${\mathbb{G}}_T$	Multiplicative cyclic groups
k	The security parameter
q	Prime order of ${\mathbb{G}}_1$ and ${\mathbb{G}}_2$
$g_1$	A generator of ${\mathbb{G}}_1$
$g_2$	A generator of ${\mathbb{G}}_2$
$\psi$	A computable isomorphism from ${\mathbb{G}}_2$ to ${\mathbb{G}}_1$
gsk	The system master key
gpk	The system public key
f	The secret key of the SM
F	The public key of the SM
cre	The credential of the SM
$H_1$	A secure hash function that $H_1:{\{0,1\}}^{*}\to {\mathbb{Z}}_q^{*}$
$H_2$	A secure hash function that $H_2:{\{0,1\}}^{*}\to {\mathbb{G}}_1$
$H_3$	A secure hash function that $H_3:{\{0,1\}}^{*}\times {\mathbb{G}}_T\to {\mathbb{Z}}_q^{*}$
RL	The list of rogue/malfuctioning smart meters
TS	The current timestamp
msg${}_{\mathrm{i}}$	Metering data of SM${}_{\mathrm{i}}$
M${}_{\mathrm{j}}$	Aggregated meter data of DA${}_{\mathrm{j}}$
$S_{I{D}_j}$	Identity-based private key of DA${}_{\mathrm{j}}$
M${}_{\mathrm{OC}}$	The entire meter consumption of the OC
J	A base point of elliptive curve
K	Pseudonym of the SM
T	The blind credential of the SM
$\left|\right|$	Concatenation operation
${\{0,1\}}^l$	The set of all binary strings of length l
RSA	The public-key encryption algorithm
AES-256	The symmetric encryption–decryption algorithm
SHA-256	The hash function

.

2.1. Bilinear Maps

The DAA signature and IBS signature used in our scheme are based on an bilinear pairings. Let ${\mathbb{G}}_1$ and ${\mathbb{G}}_2$ be two multiplicative cyclic groups of prime order q with the generator $g_1$ and $g_2$, respectively. We claim that $\widehat{e}:{\mathbb{G}}_1\times {\mathbb{G}}_2\to {\mathbb{G}}_T$ is a bilinear map if it satisfies the following properties [43,44,45]:

• Bilinearity: $\forall (g,h)\in {\mathbb{G}}_1\times {\mathbb{G}}_2,and\forall a,b\in {\mathbb{Z}}_q^{*}$, $\widehat{e}(g^a,h^b)=\widehat{e}{(g,h)}^{ab}$.
• Non-degeneracy: $\forall g\in {\mathbb{G}}_1$, $\widehat{e}(g,h)=1$ for all $h\in {\mathbb{G}}_2$ iff $g=1_{{\mathbb{G}}_T}$.
• Computability: $\forall (g,h)\in {\mathbb{G}}_1\times {\mathbb{G}}_2$, $\widehat{e}(g,h)$ is efficiently computable.
• There exists an efficient and publicly computable isomorphism $\psi :{\mathbb{G}}_2\to {\mathbb{G}}_1$ such that $\psi (g_2)=g_1$.

Then, the two groups (${\mathbb{G}}_1$,${\mathbb{G}}_2$) in the above are considered as a bilinear map pair.

2.2. Mathematical Problem

Our scheme is based on the q-Strong Diffie–Hellman Problem. To introduce this problem, we follow the description given by Boneh and Boyen [46]. Let $({\mathbb{G}}_1,{\mathbb{G}}_2,{\mathbb{G}}_T)$ be the bilinear map groups of prime order q with two generators, $g_1\in {\mathbb{G}}_1$ and $g_2\in {\mathbb{G}}_2$. The q-Strong Diffie–Hellman (q-SDH) problem in $({\mathbb{G}}_1,{\mathbb{G}}_2)$ is defined as follows: Given a (q+2)-tuple $(g_1,g_2,g_2^x,g_2^{x^2},\dots ,g_2^{x^q})$ as input, the output is a pair $(g_1^{1/(x+\alpha )},\alpha )$ where $\alpha \in {\mathbb{Z}}_q^{*}$. An algorithm $\mathcal{A}$ has advantage $ϵ$ in solving the q-SDH in $({\mathbb{G}}_1,{\mathbb{G}}_2)$ if

$$\mathrm{Pr}\left[\mathcal{A}(g_1,g_2,g_2^x,\dots ,g_2^{x^q})=(1/(x+\alpha ),\alpha )\right]\ge ϵ,$$

(1)

where the probability is over the random choice of x in ${\mathbb{Z}}_q^{*}$ and random bits consumed by $\mathcal{A}$.

We only introduce bilinear maps and the q-SDH problem here. For more detailed hard problems and detailed protocols of DAA and IBS, readers can refer to the references of DAA signatures [41] and IBS signatures [43].

2.3. System Model

In this paper, we adopt a three-level network model of a smart grid communication network according to [22,23,35]. As depicted in Figure 1, the system can be simply divided into three entities: Smart Meter (SM), Data Aggregator (DA), and Operation Center (OC). In our model, the OC covers m DAs, and each DA is assumed to be responsible for connecting n SMs. The detailed functionality of each entity is described as follows.

Smart Meter (SM): The smart meter, which is located in its owner’s house, plays the role of metering the household’s electricity consumption and continuously transmitting the near-real-time metering data to the data aggregator in each time period. Meanwhile, in order to guarantee the security of an SM, a tamper-resistant TPM chip is installed in each SM by the manufacturer when the SM is made.

Data Aggregator (DA): The data aggregator is responsible for aggregating the electricity consumption of smart meters in its specific domain. It verifies the signatures sent from smart meters, and relays the aggregated data to the operation center.

Operation Center (OC): The operation center is the backbone of the smart grid network; it controls the whole system of the smart grid communication network. It communicates with DAs and SMs, and collects the data from DAs for meter data management.

In addition, the communication channel between SM and DA, which can use the technology of WiFi or 3G/4G/5G, is wireless. The connection between DA and OC is wired, and uses the technology of fiber communication networks.

2.4. Construction of Our Proposed Scheme

This section presents our proposed secure and anonymous metering scheme. The scheme mainly consists of five phases: System initialization, membership registration, communications between the SM and DA, detection of malfunctioning meters, and communications between the DA and OC. The DAA signature is used in the communications between the SM and DA, while the IBS signature is used in the communications between the DA and OC. The detailed phases are described as follows.

2.4.1. System Initialization

The system initialization is similar to that of DAA [41] and IBS [43]. We used the same parameters for the initialization of DAA and IBS, since the security of both signature protocols that we used is based on the same assumption (q-strong Diffie–Hellman assumption [46]) and the same bilinear map groups [45]. Given a security parameter k, the system is initialized by OC as follows.

• Find a prime $q>2^k$, and select an asymmetric bilinear group pair $({\mathbb{G}}_1,{\mathbb{G}}_2)$ of order q to satisfy a pairing function as follows:

  $$\widehat{e}:{\mathbb{G}}_1\times {\mathbb{G}}_2\to {\mathbb{G}}_T,$$

  (2)

  along with the generators $g_2\in {\mathbb{G}}_2$, $g_1=\psi (g_2)\in {\mathbb{G}}_1$, where $\psi$ is a computable isomorphism from ${\mathbb{G}}_2$ to ${\mathbb{G}}_1$.
• Choose ${\xi }_1,{\xi }_2\leftarrow {\mathbb{G}}_1$ and select a system master key $s\leftarrow {\mathbb{Z}}_q^{*}$; compute a system public key $\eta$ where

  $$\eta :=g_2^s.$$

  (3)
• Select secure hash functions $H_1:{\{0,1\}}^{*}\to {\mathbb{Z}}_q^{*}$, $H_2:{\{0,1\}}^{*}\to {\mathbb{G}}_1$, $H_3:{\{0,1\}}^{*}\times {\mathbb{G}}_T\to {\mathbb{Z}}_q^{*}$.
• Pre-compute the following pairings:

  $${\theta }_1=\widehat{e}(g_1,g_2),$$

  (4)

  $${\theta }_2=\widehat{e}({\xi }_1,g_2),$$

  (5)

  $${\theta }_3=\widehat{e}({\xi }_2,g_2),$$

  (6)

  $${\theta }_4=\widehat{e}({\xi }_2,\eta ).$$

  (7)
• Output the system public key and master key

  $$gpk=\{{\mathbb{G}}_1,{\mathbb{G}}_2,{\mathbb{G}}_T,q,\widehat{e},g_1,g_2,{\xi }_1,{\xi }_2,\eta ,H_1,H_2,H_3,{\theta }_1,{\theta }_2,{\theta }_3,{\theta }_4\}$$

  (8)

  $$gsk=s.$$

  (9)

2.4.2. Membership Registration

The membership registration includes smart meter registration and data aggregator registration. We assume that all of the registrations are executed through a secure channel.

A. Smart Meter Registration

This is a protocol between the SM and OC. In our model, the smart meter consists of two main components: A host (meter) and a tamper-resistant module (TPM chip). In order to protect the sensitive information of the SM, any operation related to the smart meter’s secret key should be calculated in the TPM chip. When a valid smart meter SM${}_{\mathrm{i}}$ (i = 1, 2,..., n) registers itself into the system, it will finally get a legal DAA credential from the OC, which is shown in Figure 2. In the original DAA scheme [41], the credential is issued by the issuer. The issuer can be the manufacturer, the third party service provider, or the electricity authority. In this paper, we assume that the credential is issued by the OC. Finally, the credential can be further used for anonymously signing the meter data. The protocol proceeds as follows.

• The OC randomly chooses a nonce $n_I\in {\{0,1\}}^{*}$ and sends $n_I$ to SM${}_{\mathrm{i}}$.
• The TPM${}_{\mathrm{i}}$ in the smart meter selects a secret key $f\leftarrow {\mathbb{Z}}_q^{*}$, and computes the associated public key

  $$F={\xi }_1^f.$$

  (10)
  Then, the TPM${}_{\mathrm{i}}$ makes a zero-knowledge proof [47] to prove that the TPM${}_{\mathrm{i}}$ owns the secret key f, i.e.,

  $$\mathrm{PK}\{(f):{\xi }_1^f=F\}.$$

  (11)
  Finally, the TPM${}_{\mathrm{i}}$ sends the proof message, $cm{t}_f$ and $n_I$, to the OC.
• Upon receiving the $cm{t}_f$ and $n_I$, the OC checks F against the RL to verify the correctness of $cm{t}_f$. RL is a rogue list, which is set to be empty at the system setup, and will contain the invalid secret key $f^{\prime }$ of malfunctioning or rogue smart meters. Then, the OC computes a credential cre by calculating:

  $$A={(g_1·F)}^{1/x+s}.$$

  (12)
  A is a signature on the public key F (therefore on f). Then, the OC sends $cre=(A,x)$ to SM${}_{\mathrm{i}}$.
• SM${}_{\mathrm{i}}$ verifies the correctness of the credential cre such that

  $$\widehat{e}(A,\eta g_2^x)=\widehat{e}(g_{1}F,g_2).$$

  (13)
  Thus, SM${}_{\mathrm{i}}$ gets a membership credential cre on its secret key f.

B. Data Aggregator Registration

When a data aggregator DA${}_{\mathrm{j}}$ (j = 1,2,..., m) registers itself into the system, the OC computes the identity-based private key $S_{I{D}_j}$ for each of them as follows:

$$S_{I{D}_j}=g_1^{1/(s+H_1(I{D}_j))},$$

(14)

where ID${}_{\mathrm{j}}$ is a unique identity string of ID${}_{\mathrm{j}}$ and s is the system master key. Then, the OC sends $S_{I{D}_j}$ to each DA through a secure channel.

2.4.3. Communications between the SM and DA

The mutual communications contain the meter data signing protocol in the SM and verification algorithm in the DA.

A. The Signing Protocol

This is a protocol performed by SM${}_{\mathrm{i}}$ to produce an anonymous signature on fine-grained metering data. On input of the system public key $gpk$, membership credential $cre=(A,x)$, membership key f, meter data $ms{g}_i$, Meter${}_{\mathrm{i}}$ and TPM${}_{\mathrm{i}}$ in SM${}_{\mathrm{i}}$ jointly run the signing protocol. Since meter data should be uploaded to DA${}_{\mathrm{j}}$ without revealing the smart meter’s identity (f, F, and cre), the smart meter needs to prove the knowledge of f and cre (F is not used in this phase, so we do not need to prove the knowledge of it).

The protocol is depicted in Figure 3, which is similar to the sign protocol of the DAA scheme [41]. Firstly, to allow DA${}_{\mathit{j}}$ to verify the identity of SM${}_{\mathrm{i}}$ and recognize the malfunctioning/rogue smart meter, SM${}_{\mathrm{i}}$ needs to generate a pseudonym K instead of public key F and a proof of knowledge that the pseudonym is generated by its own valid secret key f, where

$$K=J^f,$$

(15)

$$J=H_2(TS||ms{g}_i),$$

(16)

where $TS$ is a timestamp and $ms{g}_i$ is meter data generated in a timestamp. If $(J,K)$ is generated more than one time in a time period, the smart meter will be linked; the details will be illustrated in Section 2.4.4 (Malfunctioning Meter Detection). Then, SM${}_{\mathrm{i}}$ needs to compute a blind credential T as follows:

$$T=A·{\xi }_2^a,$$

(17)

where $a\leftarrow {\mathbb{Z}}_q^{*}$. Also, SM${}_{\mathrm{i}}$ needs to provide a proof of knowledge that T is a blind credential on a valid secret key f. Finally, using the method of the Fiat–Shamir heuristic [48,49], SM${}_{\mathrm{i}}$ and TPM${}_{\mathrm{i}}$ jointly generate a signature of proof of knowledge

$$\mathrm{SPK}\{(x,f,a):\widehat{e}{(T,g_2)}^x·\widehat{e}{({\xi }_1,g_2)}^f·\widehat{e}{({\xi }_2,g_2)}^{ax}·\widehat{e}{({\xi }_2,\eta )}^a=\widehat{e}(T,\eta )/\widehat{e}(g_1,g_2)\}(ms{g}_i).$$

(18)

The detailed signature is shown in Figure 3. Finally, SM${}_{\mathrm{i}}$ outputs the signature

$${\sigma }_i=(J,K,T,c,TS,n_t,v_f,v_x,v_a,v_b),$$

(19)

and sends $(ms{g}_i,{\sigma }_i)$ to the data aggregator DA${}_{\mathrm{j}}$.

B. The Verification Algorithm

Upon receiving the anonymous signature ${\sigma }_i$ and message $ms{g}_i$ from SM${}_{\mathrm{i}}$, DA${}_{\mathrm{j}}$ runs a verification algorithm to check the validity of SM${}_{\mathrm{i}}$’s signature ${\sigma }_i$. Firstly, DA${}_{\mathrm{j}}$ checks if the pseudonym K is generated by an invalid $f^{\prime }$ in the rogue list. Then, DA${}_{\mathrm{j}}$ checks if ${\sigma }_i$ does prove the knowledge of a secret key f and knowledge of a valid membership credential $cre$ on the same f. The detailed algorithm is described in Figure 4, which is identical to that in the DAA scheme [41]. However, in our algorithm, we check the validity of TS and J at the beginning. If ${\sigma }_i$ is correct and valid, DA${}_{\mathrm{j}}$ accepts the meter data $ms{g}_i$.

However, before uploading all of the meters’ electricity consumptions to the operation center, DA${}_{\mathrm{j}}$ needs to perform a phase of detection of malfunctioning meters. If all of the meter data are honestly uploaded by the smart meters, this phase will be ignored.

2.4.4. Malfunctioning Meter Detection

Malfunctioning meter detection includes two phases: The linking algorithm and the tracing protocol. The linking algorithm is to check if there exists a smart meter signing a message more than once in a time period. If any two signatures are linked, the tracing protocol will help to identify the linked smart meter.

A. The Linking Algorithm

This algorithm is run by DA${}_{\mathrm{j}}$. When DA${}_{\mathrm{j}}$ receives all of the meter data ${\{ms{g}_i\}}_{i=1}^n$ from SM${}_{\mathrm{i}}$$(i=1,2,\dots ,n)$ at a time period $TS$, it needs to check if there exists a smart meter signing a message more than once in a time period $TS$. If so, this smart meter may be malfunctioning, and we need to identify this meter. Firstly, DA${}_{\mathrm{j}}$ collects all of the messages and signatures generated in a time period $TS$. If there exist two identical messages ($ms{g}_0=ms{g}_1$), DA${}_{\mathrm{j}}$ runs the linking algorithm in Figure 5, and it is similar to the linking algorithm of the DAA scheme [41]. Otherwise, if there are no identical messages, this step as well as the next step are stopped.

B. The Tracing Protocol

After the linking phase, if DA${}_{\mathrm{j}}$ finds out that a suspected pair $(J_R,K_R)$ was generated more than once in a time period, it will ask SM${}_{\mathrm{i}}$$(i=1,2,\dots ,n)$ for proof of knowledge that it did not generate $(J_R,K_R)$ before. SM${}_{\mathrm{i}}$ needs to prove that its secret key $f_i\ne {log}_{J_R}{K}_R$, and computes a zero-knowledge proof that

$$\mathrm{PK}\{(f_i):K_i=J_i^{f_i}\wedge K_R\ne J_R^{f_i}\}.$$

(20)

We use the zero-knowledge proof protocol designed by Camenisch and Shoup [50] for proving that two discrete logarithms are not equal. The method is as follows. The prover (the smart meter SM${}_{\mathrm{i}}$) and verifier (the tracer, which can be the OC) have common inputs $Ji,K_i,J_R,K_R\in G_1$, where ${log}_{J_i}{K}_i\ne {log}_{J_R}{K}_R$. SM${}_{\mathrm{i}}$ has an additional input $f_i$, as follows:

$$f_i={log}_{J_i}{K}_i.$$

(21)

Then, SM${}_{\mathrm{i}}$ shows proof to the tracer with the following steps.

• SM${}_{\mathrm{i}}$ selects $\iota \leftarrow {\mathbb{Z}}_q^{*}$ and computes $\tau$ by

  $$\tau =\iota ·f_i.$$

  (22)
• SM${}_{\mathrm{i}}$ executes the proof of knowledge that

  $$\mathrm{PK}\{(\tau ,\iota ):C=J_R^{\tau }·{(1/K_R)}^{\iota }\wedge 1=J_i^{\tau }·{(1/K_i)}^{\iota }\}$$

  (23)

  and sends the result to the tracer.
• The tracer accepts that the smart meter is not a malfunctioning one if it accepts in step 2. Otherwise, the tracer rejects the meter, and ensures that the present SM${}_{\mathrm{i}}$ is the malfunctioning smart meter.

The detailed proof is shown in Figure 6. The malfunctioning smart meter will be revoked and replaced by the electricity provider.

2.4.5. Communications between the DA and OC

After the phases of verification and malfunctioning meter detection, the data collector DA${}_{\mathrm{j}}$ collects the meter data at the same timestamp sent from the smart meters in its domain area, and calculates the aggregated electricity consumptions $M_j$ as follows:

$$M_j=\sum _{i=1}^{n}ms{g}_i.$$

(24)

Then, the DA${}_{\mathrm{j}}$ securely reports the aggregated meter data to the OC using the identity-based signature [43].

A. Signing

Using the identity-based private key $S_{I{D}_j}$, $D{A}_j$ signs the aggregated meter data $M_j$ as follows. It picks up a random value $\mu \leftarrow Z_q^{*}$, and computes the following equations:

$$\nu ={\theta }_1^{\mu },$$

(25)

$$h=H_3(M_j\left|\right|I{D}_j\left|\right|TS,\nu )\in {\mathbb{Z}}_q^{*},$$

(26)

$$\mathcal{S}=S_{I{D}_j}^{(\mu +h)},$$

(27)

where TS is the current timestamp.

Then, the signature on $M_j$ is ${\sigma }_j=(h,\mathcal{S})\in {\mathbb{Z}}_q^{*}\times G_1$. Finally, DA${}_{\mathrm{j}}$ forwards $({\sigma }_j,M_j,I{D}_j,TS)$ to the OC.

B. Verification

After receiving $({\sigma }_j,M_j,I{D}_j,TS)$ from each data aggregator DA${}_{\mathrm{j}}$$(j=1,2,\dots ,m)$, the OC will check if the sender is valid. It verifies the validity of ID${}_{\mathrm{j}}$ and $TS$ and checks the correctness of the message signature by computing

$$\tilde{h}=H_3(M_j,\widehat{e}(\mathcal{S},g_2^{H_1(I{D}_j)}·\eta )·{\theta }_1^{-h}).$$

(28)

If $\tilde{h}=h$, the OC accepts the message $M_j$.

Lastly, the OC computes the entire meter consumption $M_{OC}$, where

$$M_{OC}=\sum _{j=1}^m{M}_j.$$

(29)

Then, the OC receives the meter consumptions of the whole smart grid network at timestamp TS.

3. Results

In this section, we present the results of our study, which contain the security results and performance results.

3.1. Security Results

In this section, we show that our proposed secure and anonymous metering scheme achieves the security requirements of correctness and data integrity, as well as authenticity, anonymity, and traceability.

• Correctness: According to the verification procedures in our proposed security protocol, the anonymous signature generated by a valid smart meter and the signature generated by an honest data aggregator can surely pass the verification.
• Data Integrity and Authenticity: The properties of integrity and authenticity require that the entity in the communications should be a valid registered membership, and that no attackers could tamper with or forge the data generated by the entity. In our scheme, all of the smart meters are equipped with a tamper-resistant TPM chip, which prevents meter data from being altered by the attacker. Meanwhile, secure DAA and IBS protocols are used in our scheme to ensure the authenticity. Without valid credentials, a smart meter cannot successfully sign the meter data or forge a valid signature. In addition, without a valid identity-based secret key, a fake data aggregator cannot produce a valid signature that can pass the verification by the operation center. Thus, our scheme satisfies data integrity and authenticity concerns.
• Anonymity: Anonymity is the privacy requirement of our scheme. It requires that each valid signature is unable to expose any of the information of the signer, and no one can distinguish whether two normal signatures are generated by the same signer. In fact, as described in Section 2.4.3, during the data upload, SM${}_{\mathrm{i}}$ hides its credential and uses a pseudonym K instead of the real identity F; as a result, no adversary can recognize the identity of the data owner. Meanwhile, for any two different pairs $(J_1,K_1)$ and $(J_2,K_2)$ in signatures $({\sigma }_1,{\sigma }_2)$, if the adversary can determine whether they are generated by the same SM${}_{\mathrm{i}}$ (i.e., determine whether $f_1=f_2$, where $f_1={log}_{J_1}{K}_1$, $f_2={log}_{J_2}{K}_2$), then it will break the decisional Diffie–Hellman(DDH) problem [51]. Thus, our scheme satisfies the requirement of anonymity.
• Malfunctioning Meter Traceability: As presented in Section 2.4.4, our scheme has the property of malfunctioning meter detection. If any two signatures are dishonestly generated by the SM, i.e., the SM signs a message twice in a time period—even though two such signatures can pass the verification—they can be linked and traced by the utilities.

3.2. Performance Results

In this section, we evaluate the computational cost of our proposed scheme, and compare the performance with Zhao et al.’s scheme [34].

To analyze our scheme, we mainly focus on six cost-expensive operations: Pairing, exponentiation, scalar multiplication, the map-to-point function, the hash function, and symmetric encryption/decryption. Other lightweight operations such as concatenation and modular addition are ignored due to their high efficiency.

The security level for the RSA public-key encryption algorithm in [34] is 1024 bits. In order to achieve the approximate cryptographic security level, in our scheme, we use the 80-bit security level elliptic curves (MNT curves) introduced in [52,53] by selecting a 170-bit prime q, with an embedding degree of 6.

The experiments were conducted on a personal computer with the Intel(R) Core(TM) i7-7820X CPU 3.60GHz and 16 GB memory. All of the operations were executed on a GNU Compiler Collection (version 7.1) with the Pairing-Based Cryptography library (PBC-0.5.14) and Openssl crypto library (version 1.1.1).

To simulate the scheme of [34], we adopted the AES-256 as the symmetric encryption–decryption algorithm and the SHA-256 as the hash function. For convenience, some notations are defined in the following list, and the average running time of each operation is presented in

Table 2. The average execution time of operations (ms).

T${}_{\mathit{pr}}$	T${}_{\mathit{mul}}$	T${}_{\mathit{exp}}$	T${}_{\mathit{hp}}$	T${}_{\mathit{sym}}$	T${}_{\mathit{H}}$
1.238	0.325	0.286	0.029	0.00779	0.00198

.

• $T_{pr}$: The execution time of a bilinear pairing operation $\widehat{e}:{\mathbb{G}}_1\times {\mathbb{G}}_2\to {\mathbb{G}}_T$.
• $T_{mul}$: The execution time of a scalar multiplication in ${\mathbb{G}}_1$, ${\mathbb{G}}_2$.
• $T_{exp}$: The execution time of a modular exponentiation operation.
• $T_{hp}$: The execution time of the map-to-point function in ${\mathbb{G}}_1$.
• $T_{sym}$: The execution time of symmetric encryption or decryption.
• $T_H$: The execution time of the hash function.

Table 3. Comparisons of computational cost for the communications between the SM and DA.

Scheme	Cost on SM	Time (ms)	Cost on DA	Time (ms)
[34]	$(t{}^1+3)T_{exp}+t$ × $T_{sym}+3T_H$	≈0.2938 t + 0.8639	$3T_{exp}+2T_H$	≈0.862
Ours	$1T_{pr}+6T_{mul}+1T_{exp}+3T_{hp}$	≈3.561	$1T_{pr}+4T_{mul}+4T_{exp}+3T_{hp}$	≈3.769

${}^1$t is the ring size (total number of SMs) in [34]. t is set to be 10, 50, and 100. When t = 10, the cost on the SM is 3.802 ms; when t = 50, the cost on the SM is 15.549 ms; when t = 100, the cost on the SM is 30.243 ms.

presents the comparisons with the scheme [34] on the computational cost of communications between the SM and DA. Since in [34], a protocol between the DA and OC was not designed, in

Table 4. Computational cost of the communications between the DA and OC.

Cost on DA	Time (ms)	Cost on OC	Time (ms)
$2T_{mul}+1T_{exp}+2T_{hp}$	≈0.994	$1T_{pr}+1T_{mul}+1T_{exp}+2T_{hp}$	≈1.907

, we only present the computational cost for the communications between the DA and OC in our scheme.

In Table 3, we can see that, for the communications between the SM and DA, the smart meter needs to calculate $1T_{pr}+6T_{mul}+1T_{exp}+3T_{hp}$ operations in our scheme, while $(t+3)T_{exp}+t$ × $T_{sym}+3T_H$ operations are computed in that of [34]. The computational complexity of the smart meter in [34] depends on the ring size t (i.e., the total number of smart meters in a domain). In this case, the execution time of the smart meter will increase linearly with the growing number of smart meters in a ring. In the real world, the number of smart meters in a domain belonging to a data aggregator will be at least 10. Most of the time, the average number of smart meters can be 50 or even 100. This means that when $\mathit{t}=10\sim 100$, for each metering, the execution time of a SM in [34] will be at least 3.802 ms and at most 15.549 ms. However, in our scheme, the smart meter only need to spend 3.561 ms for each signing on the metering data. Therefore, for the same purpose of anonymous signatures based on TPM chips, our scheme has an advantage in the computational efficiency on the side of the smart meter. However, as shown in Table 3, our scheme has a drawback, in that the computational complexity in the DA is larger than that in [34]. Even so, this kind of disadvantage is not fatal. In the communications of a smart grid network, the efficient calculation complexity in the smart meter is more important than in the aggregator, since the aggregator has more powerful computational abilities than those of the smart meter.

4. Discussion

In our study, in order to design a tamper-resistant metering scheme, a trusted platform module (TPM chip) is embedded in each smart meter. The TPM is a trusted hardware module which is developed by the Trusting Computing Group (TCG). One of the goals of the TPM is to provide anonymous authentication with a remote verifier [54]. In the earlier version of the TPM, a privacy certification authority (Privacy CA) was adopted by TCG to act as a trusted third party to authenticate the TPM. However, in this solution, it was later found that the real identity of the TPM can be revealed with the help of the Privacy CA. Then, version 1.2 of the TPM Specification [55], the direct anonymous attestation (DAA) [54] was adopted. The construction of DAA prevents the leakage of the real identity of the TPM when anonymously signing a message. Later, the pairing-based DAA [41] was adopted in the TPM 2.0 Specification [56], which further reduced TPM resources; since the TPM has limited computational capacity, most of the operations should be calculated in the host of the TPM. In our paper, we use the property of strong anonymity of DAA to design an anonymous metering scheme. Though the TPM has the disadvantage that the capacity of storage and computation is limited, in our scheme, most of the operations are done in the smart meter (the host of the TPM). Meanwhile, in [34], Zhao et al. also shows that a TPM with cryptography primitives can be used to design a tamper-resistant smart meter. Therefore, our proposed smart metering scheme is practical.

5. Conclusions

In this paper, we propose a secure and anonymous smart metering scheme based on direct anonymous attestation (DAA) and identity-based signature schemes. Like many other works, the smart meter is equipped with a TPM chip to store the secret key and execute the anonymous signing of metering data using a DAA signature. However, on account of the limited capacity of the TPM, we divide the signer into two parts (the TPM and the host, i.e., the smart meter). We secure the communications between the data aggregator and the operation center by using identity-based signatures. We show that our scheme satisfies the properties of correctness, data integrity and authenticity, and anonymity. Moreover, our scheme is able to detect malfunctioning smart meters. The experimental results show that our scheme is efficient and practical. In our further work, we will consider how to improve the efficiency of verification in the data aggregator, and design a more secure and efficient metering scheme for smart grid communications.