Abstract
Blockchain gives a new method for distributed data ledgering. The smart grid obtains efficient two-way data transmission and information control. It effectively monitors and regulates the grid by collecting real-time electricity consumption data of users. However, online data collection brings privacy leakage. To solve the problem of privacy leakage in the electricity data collection in the smart grid, a privacy-aware electricity data collection model is proposed. Firstly, we propose a new group blind signature scheme by introducing the blind feature into the identity-based encryption method. Secondly, by applying the proposed group blind signature scheme to the electricity data collection process, we propose a privacy-aware electricity data collection model. The proposed model ensures the conditional anonymity and traceability of user identity and the privacy protection and unforgeability of electricity consumption data.
1. Introduction
Blockchain technology originated from Satoshi Nakamoto’s paper published in 2008. Blockchain, as a distributed shared ledger and database, in which records are copied and shared among its members, has the characteristics of decentralization, immutability, whole-process traces, openness, and transparency. Blockchain can store large decentralized data with better performance, availability, and scalability. Information leakage and low efficiency of blockchain are key issues that need to be addressed. A smart grid [1] is a new type of grid that combines traditional power grids with communication and information control technologies. It implements the two-way flow of the management information and power between the users and the power service provider. The architecture is shown in Figure 1. The smart grid is composed of four entities: power plant (PP), control center (CC), smart substation (SS), and smart meter (SM). There is a control center, several smart substations, and smart meters in a certain area, and the number of SSs is far less than SMs. Each SS is responsible for delivering power to users in a user area and collecting user electricity consumption data. The SM submits the user’s electricity consumption data to CC by SS. CC analyses users’ electricity consumption data and arranges PP to generate power. The power arrives at SS in the form of high voltage through the high voltage transmission line. SS transforms high voltage power into low voltage power. Then, SS transmits power to a certain user area through the power distribution line.
Privacy protection issues are crucial in various systems, which are related to the reliability and security of the system. Chen et al. [2] proposed a visible routing approach PSSPR to achieve the source location privacy protection in WSNs. Li et al. [3] proposed a strong forward secure ring signature scheme based on RSA and introduced the ring signature into the privacy-aware PKI model, which achieves the privacy protection and user anonymity. Chen et al. [4] proposed a dynamic multi-key FHE scheme based on the LWE assumption in the public key setting. Otherwise, as a new biometric authentication technology, gait recognition [5–7] has attracted more and more researchers’ attention in recent years. Some cloud computing-related works [8, 9] also help with privacy protection and data storage work greatly. In the smart grid, frequent information exchanges between SS and SM bring privacy leakages [10, 11]. The adversary knows the user’s daily schedule by eavesdropping on the electricity consumption data between SS and SM. Therefore, privacy protection in the smart grid receives more attention [12–15]. Zhao et al. [16] proposed a smart and practical privacy-preserving data aggregation scheme with smart pricing and packing method. Zhang et al. [17] proposed a blind signature-aided privacy-preserving power request scheme for a smart grid. The scheme protects the user’s daily schedule. However, when the signature is invalid, CC cannot obtain the identity of the signer. The fine-grained requirements of the CC for electricity consumption data cannot be met. Some data aggregation schemes [18, 19] have been proposed in recent years. It is necessary to propose a method to implement user conditional anonymity and signer’s traceability. In addition, CC obtains fine-grained electricity consumption data and verifies the integrity of the data.
Group blind signature technology provides a new way for us to achieve conditional anonymity and privacy protection for users in the smart grid. Group blind signature integrates the characteristics of group signature and blind signature at the same time. It allows the legal group member to anonymously generate signatures on behalf of the group. After the signing activity, the signer uses the group public key to verify the validity of the signature like others. However, he cannot know the signed time and who signed the signature. Due to the high anonymity and the traceability of the group blind signature, more and more new practical schemes [20–22] have been proposed by domestic and foreign scholars. The group signature is applied in the electronic voting system [23], electronic cash system [24], intelligent transportation [25], and other fields to ensure system security. In recent years, the research of combining the group blind signature with quantum cryptography and lattice cryptography is also very popular [26–31].
In this study, we apply a new identity-based group blind signature to the privacy-aware electricity consumption data collection model. The model achieves user conditional anonymity and privacy protection. The contributions of this study are listed as follows:(1)By modifying the member-managing method, a new identity-based group blind signature scheme is proposed. The proposed group blind signature need not save the public keys of group members, which reduce the storage pressure of the system. The scheme effectively revokes the group members without updating the key of group manager and other group members.(2)Based on the proposed group blind signature scheme, a privacy-aware electricity consumption data collection model is proposed. Group blind signature assures the privacy of the electricity consumption data. In addition, we implement the user’s anonymous authentication and homomorphic verification tags, which ensure the privacy protection of user identity and the integrity of consumption data.
The organization of this study is as follows. Section 2 shows the preliminaries of this study. In Section 3, we propose a new group blind signature scheme and give its unforgeability proof. Then, we propose a privacy-aware electricity consumption data collection model based on group blind signature in Section 4. Section 5 shows the security and performance analysis of the data collection model. We conclude this study in Section 6.
2. Preliminaries
2.1. Elliptic Curve Discrete Logarithm Problem
The elliptic curve discrete logarithm problem (ECDLP) is that considering a point of prime order on the elliptic curve , if is a possible point on . It is difficult to find an , which satisfied the equation .
2.2. Group Blind Signature
A. Lysyanskaya and Z. Ramzan combined group signature and blind signature for the first time in 1998 to design the first group blind signature scheme-Lys98 scheme [32]. They used this scheme to construct an online and anonymous electronic cash system. The entities in the scheme usually contain the group manager, the group member, and the external user.
2.3. Homomorphic Tag
Homomorphism refers to mapping from one algebraic structure to another algebraic structure, and the anterior and posterior structure remains unchanged. The homomorphic tag is the tag with the property of homomorphism. Therefore, the tag of any two blocks of data can be computed from the sum of the tags of these two blocks. At the same time, when using the homomorphism tag to verify the integrity of the data, the verification can be completed only by verifying a part of the data block.
3. New Group Blind Signature Scheme
By introducing the blind feature into identity-based digital signature [33], this study proposes a new group blind signature scheme using the bilinear pairing mapping on the elliptic curve. The identity-based feature of the proposed scheme ensures that the signature system does not need to store the public key of group members. This feature reduces the storage overload of the system. In the new scheme, group members are effectively revoked without changing the key of the group manager and other group members. Security analysis indicates that the new scheme is reliable.
3.1. Group Blind Signature Scheme
Bilinear pairing is used to implement the identity-based group blind signature scheme. is an elliptic curve additive cyclic group whose order is a prime number , and is a multiplicative cyclic group whose order is . Meanwhile, a bilinear mapping is . In the effective time, the discrete logarithm problem cannot be calculated whether in or .
3.1.1. System Initialization
The group manager selects generator and three one-way hash functions: ,, and . He chooses a random number as the private key and calculates as his public key. Then, he initializes the group bulletin board and the corresponding time . The group manager releases system public parameters and announces the product of on the group bulletin board, denoted as .
3.1.2. Group Member Joining
A new member joins this group. He first submits his real identity to the group manager. After the group manager verifies the validity of the identity, an anonymous identity code is generated. The member’s public key and private key are as follows:
The group manager saves in his database. Then, he sends the group member’s private key and anonymous identity code to . At the same time, the group manager updates in the group bulletin board.
3.1.3. Group Member Revocation
The group manager updates the time and to revoke the member . CC calculates :, where . At the same time, the group manager updates to the present time. In this way, the group manager performs a multiplication operation to update without changing the group public key and the group member key.
3.1.4. Group Blind Signature
For a received message, the group member signs it on behalf of the group. For instance, the signature steps of the group member are as follows:(1)A requester wants to acquire the signature of message . He first chooses a random number and calculates . Then, he transmits to .(2)After receiving , chooses a random number and calculates , , and . Then, he sends the blind signature to requester, where is the signature time.(3)requester chooses a random number and calculates the signature of message as follows:
3.1.5. Signature Verification
The validity verification of the signature is divided into two steps. Firstly, the verifier selects the corresponding based on the comparison between time and and verifies whether is divisible by . If is not divisible, the signature is invalid. Otherwise, the signer is a member of the group. Then, the verifier uses the group public key by comparing with to verify the validity of the signature. If the equation holds, is a validity signature. Otherwise, is invalid.
The verification process is as follows:
3.2. Security Analysis
The group blind signature scheme proposed in this study satisfies unforgeability, anonymity, traceability, and revocability.
3.2.1. Unforgeability
Theorem 1. If the ECDLP question is hard, under the existential unforgeability against chosen message attack (EU-CMA) model, the group blind signature scheme is existentially unforgeable.
Proof. We assume that is an adversary authorized by a malicious user and able to forge group blind signatures. is a challenger who uses the adversary’s ability to solve the ECDLP. However, this is contrary to the assumption of ECDLP, so the group blind signature scheme is secure. The group blind signature algorithm is modelled as a signing oracle, and the game is depicted as follows: Setup: challenger performs the setup algorithm to generate system parameter and transmits it to . The system parameter includes . randomly chooses an integer , where denotes the maximum times of private key queries. Then, randomly chooses as the private key, where the private key is equivalent to . computes the public key . Hash Queries: chooses the identity and sends to . calculates the hash value and sends it to . Private Key Queries: makes the sign private key queries in this stage. maintains a list of legal signers. When queries signer’s private key by sending the anonymous identity code to , checks the list of legal signers. When , abort. When , if exists, returns directly to . Otherwise, returns and to and adds to the list of legal signers. Sign Queries: adversary conducts signature queries at this stage. prepares a signature list to record all queries and responses. The list is empty at the beginning, and the format is . selects the identity and message , requesting the blind signature from . When queries the signature of , if , abort. Otherwise, randomly chooses and returns to , where , , and . Then, adds to the signature list. Outputs: finally outputs a valid forged signature of about the message . In addition, cannot solve the ECDLP problem, so cannot get from . However, according to assumption gets the signature of message . Therefore, obtains the solution of ECDLP according to the signature and the question previously queried.Finally, solves the ECDLP assumption, but ECDLP is a difficult problem that cannot be calculated. Hence, under the difficulty assumption of ECDLP, the proposed group blind signature is existential unforgeability.
3.2.2. Anonymity
The correspondence between a group member’s real identity and his anonymous identity code is only known by the group manager. Any other group members and external users cannot obtain it. The group member uses the anonymous identity to sign the message submitted by external users. No one obtains the real identity of the signer except the group manager, which implements the anonymity of the signer.
3.2.3. Traceability
The group member must submit his real identity to the group manager during the stage of group member joining. Then, he receives the anonymous identity code and the private key . In this way, he becomes a legal group member and has the ability to sign messages. As long as the group member wants to correctly sign, he must use the anonymous identity code and private key distributed by the group manager. Therefore, the group manager has the ability to trace the real identity of the signer using stored in his database to achieve traceability.
3.2.4. Revocability
If a group member signs invalidly multiple times, he is identified as a malicious member. In this case, he revoked the group membership by the member revocation algorithm. Then, he loses the ability to sign on behalf of the group. Therefore, the proposed scheme has the revocability of group members.
4. A Privacy-Aware Electricity Consumption Data Collection Model Based on Group Blind Signature
By introducing the proposed group blind signature scheme into electricity consumption data collection, we propose a privacy-aware electricity consumption data collection model. The detail of the proposed model is as follows.
4.1. System Model
The system model in this study is shown in Figure 2, which involves three entities: control center (CC), smart substation (SS), and smart meter (SM). The working relationships and security requirements of the entities are as follows.
4.1.1. Control Center
CC generates system parameters, registers entities, verifies the electricity consumption data, and traces other entities conditionally. If the signature and electricity data verification is invalid, CC traces the identity of the signer and user. CC exists in two forms, which are a fixed server located in the power plant and servers distributed in different places. CC needs to be highly credible.
4.1.2. Smart Substation
SS directly communicates with SM, verifies the user’s identity, and generates the blind signature. SS does not know the user’s real identity when he interacts with the user. SS needs to perform anonymous authentication on the user. SSs are fixed in certain places, generally.
4.1.3. Smart Meter
SM sends the regular electricity consumption data to CC. However, the electricity data may be tampered with within this process. Therefore, a reliable mechanism is needed to prevent the user’s electricity data. SMs are installed in users’ homes.
4.2. Adversary Model
The adversary model contains two main types of adversaries. One is the external adversary who is not in the data collection model. The other is the internal adversary who has the user’s identity in the data collection model:(1)The external adversary obtains electricity consumption data by eavesdropping on the channel between SM and SS. The malicious forgery and replacement by the adversary threaten the integrity of the data.(2)The internal adversary contains two types. One is the curious user who wants to acquire other users’ electricity consumption data, but they do not tamper with any data. The other is the malicious user who tampers with his electricity consumption data.
4.3. Privacy-Aware Electricity Consumption Data Collection Model Based on Group Blind Signature
To protect the privacy of the user’s identity and the electricity consumption data, an identity-based group blind signature scheme is used in the electricity consumption data collection model. CC and SSs form a group. SSs are group members, and CC is the group manager. We use the Schnorr identification protocol and the homomorphic verifiable tag mechanism to implement the anonymity of the user and the integrity verification of the electricity data. At the same time, the group blind signature mechanism ensures the traceability of the signer.
The notations used in this study are shown in Table 1.
In particular, the data collection model includes six stages: system initialization, anonymous identity authentication and data reporting, blind signature on reported electricity consumption data, data integrity verification and identity tracing, group member joining, and group member revocation. Figure 3 shows the framework of the data collection model.
4.3.1. System Initialization
In this stage, CC first generates system parameters. Then, the SS uses the real identity to apply for the group member private key and anonymous identity code. After CC verifies the identity of the SS, he distributes the anonymous identity code and the group member private key to the SS. CC saves the real identity and anonymous identity of SS in the database. SM also delivers its real information to CC and generates its own pseudonym. CC saves the real identity and pseudonym of SM in the database. The data stored by CC, SS, and SM are, respectively, shown in Tables 2–4.(1)Generating System Parameters.(i)CC computes , where and are two different large primes that meet .(ii)CC computes the group public key and the private key , where satisfies the key pair property of RSA, namely .(iii)CC chooses a random number and computes , where is a primitive root of the modular . and are the public key and private key of the group manager, respectively.(iv)CC chooses generator and three one-way hash functions: , , and .(v)CC chooses a random number as the system private key and computes as the system public key. CC initializes the group bulletin board and the corresponding time . Then, CC releases system public parameters and announces the time and product of on the group bulletin board, denoted as .(2)Registering Stage.(i)If wants to become a group member, he first submits real identity to CC. After CC verifies the validity of the identity, an anonymous identity code is generated. Then, CC calculates public key and private key for as follows: CC encrypts the real identity of the group member with the group public key and saves in the database. Then, CC updates .(ii)If a new user wants to participate in the smart grid. He first acquires . Then, he encrypts his information into and sends it to CC. CC stores in his database and calculates sending it to . The smart meters are distributed to users by CC. chooses a random number to compute his pseudonym . sends to CC.
4.3.2. Anonymous Identity Authentication and Data Reporting
In this stage, by the Schnorr identity authentication protocol, SM proves his legitimacy to SS under the condition of anonymity. Then, SM generates electricity consumption data blocks for a whole period. He calculates the data tag for each data block to ensure the integrity of data.
(1) Anonymous Identity Authentication. SS is not completely trusted in the model. When SM interacts with SS, the real identity of SM needs to be hidden. Therefore, the Schnorr identity authentication protocol is used to verify the legitimacy of SM. The authentication process is shown in Figure 4.
(2) Data Reporting. SS believes in the legitimacy of SM by anonymous identity authentication. Then, SM sends the encrypted electricity consumption data to SS. We take the example of encrypting and reporting electricity consumption data in one day. The whole day’s data are .(i)The data blocks generated in a day are restricted by the security parameter . We set the security parameter to 24, and SM generates 24 data blocks in one day. The structure of data blocks generated in one day is shown in Figure 5. Each data block represents one hour of electricity consumption data and has a corresponding tag . l-Dimensional attribute values are contained in each data block.(ii) randomly chooses the private tag key and computes as the public tag key.(iii) chooses values , randomly. Then, computes , where . calculates for each data block , where MID represents the data’s summary and means the jth dimension attribute value of the ith data block. gets the tag set , where the .(iv) computes using the group public key and calculates .
4.3.3. Blind Signature on Reported Electricity Consumption Data
In this stage, SM needs to get blind signature from SS. Then, SM reports the electricity consumption data and the signature to CC.
SS signs the electricity consumption data by the signature method provided in Section 3. SS sends the blind signature to SM. SM removes the blind factor to get the signature . Then, SM sends and to CC together. The signature generation process is shown in Figure 6.
4.3.4. Data Integrity Verification and Identity Traceability
In this stage, CC verifies the validity of the signature and the integrity of data. Firstly, CC verifies the signature. If equation (1) holds, the signature is valid, it indicates that has not been modified during the transmission process after being signed by SS. Otherwise, the signature is invalid. CC traces the signer’s identity. Next, CC verifies the data integrity. CC uses to check the integrity of the electricity consumption data. If equation (6) holds, the data are integral. Otherwise, the data have been modified. CC determines who tampered with the data. It is possible that the user or adversary has tampered with before transmission. Therefore, CC obtains corresponding to . CC compares with calculated using the user’s real information stored in his database. If is in CC’s database, it indicates that the user tampers with the data. Otherwise, the adversary tampers with the data. The flow chart of signature verification and identity tracing is shown in Figure 7.
(1) The Verification of Signature and Data. The verifier uses the group public key to verify the validity of the signature . is the signature of by the anonymous member .(i)After receiving the , CC gets the electricity consumption data by decrypting the . Then, CC computes and the member’s signature public key .(ii)According to the comparison between time and , CC selects the corresponding and verifies whether is divisible by . If is not divisible, the signature is invalid. Otherwise, the signer is a member of the group. Then, CC uses equation 1 to verify the validity of the signature. If equation 1 holds, the signature is valid. Otherwise, the signature is invalid.(iii)If the signature is valid, CC verifies the integrity of . CC decrypts to get Tag, m, and calculates the following equations:(iv)CC verifies whether equation 6 holds every 24 hours:(v)If equation 6 holds, the data have not been modified by the user or the adversary before transmission. Otherwise, the data have been modified.
(2) Tracing the Signer and the User.(i)If equation (1) does not hold, CC traces the signer’s identity. The is saved in CC’s database during the phase of group members joining. Therefore, CC uses the group private key to decrypt to obtain .(ii)If equation (1) holds and equation (6) does not hold, CC traces the user’s identity to know who modified the data. CC uses the group private key to decrypt stored in his database to obtain . Then, CC calculates with the decrypted information one by one.
Furthermore, CC compares with , which is corresponding to to ensure the user’s identity.
4.3.5. Joining of Group Members
A new member joins the group. first sends his real identity to CC through a reliable channel. CC generates an anonymous identity code , the public key and the private key for the new member . Then, CC updates in the group bulletin board.
4.3.6. Revocation of Group Members
CC updates the time and published on the group bulletin board to revoke the member . CC calculates the corresponding at time , where .
5. Security and Performance Analysis
The security and performance analysis section shows that the proposed data collection model is secure and reliable.
5.1. Security Analysis
The security of the model is mainly based on difficult problems, such as discrete logarithm problem, elliptic curve discrete logarithm problem, and integer decomposition problem. The following shows that the proposed model has the characteristics of privacy protection, anonymity, unforgeability, and traceability.
5.1.1. Privacy Protection
Theorem 2. Due to the difficulty of the integer decomposition problem, the adversary cannot obtain the user’s electricity consumption data.
Proof. Adversary steals when the user reports data and obtains the blind signature stage. However, the user’s electricity consumption data are encrypted into by the RSA encryption method. can be decrypted only by the group private key . In the data collection model, only CC has the group private key . If the adversary wants to get , he must obtain the private key . The possible method is that the adversary solves the factor decomposition problem and decomposes into correct and . Then, the adversary obtains the group private key . However, the factor decomposition problem cannot be solved. The privacy protection of user electricity consumption data is implemented in our proposed model.
5.1.2. Anonymity
Anonymity includes the anonymity of the real identity of the SS and the real identity of the user who installed the SM.
(1) Group Member Anonymity. Only CC knows the correspondence between the anonymous identity and the real identity of SS. In the blind signature generation stage, the SS uses the anonymous identity to sign. Therefore, CC knows the real identity of the signer by a signature.
(2) User Identity Anonymity.
Theorem 3. Because the discrete logarithm problem is difficult, cannot obtain the identity of the user by the decrypted electricity consumption data and the corresponding tag from the CC’s database.
Proof. The user’s identity information in CC’s database is encrypted to . The RSA encryption is secure, and the adversary cannot calculate the group private key. Therefore, the adversary cannot obtain the user’s identity information by decryption. If the adversary wants to get the user’s identity, he calculates from the . Then, he compares with to determine the user’s identity. However, the discrete logarithm problem is difficult, and the adversary cannot calculate from . The proposed model guarantees the anonymity of the user’s identity information.
5.1.3. Unforgeability
Unforgeability includes the unforgeability of the group blind signature and the unforgeability of the user electricity consumption data.
(1) Unforgeability of Group Blind Signature. According to Theorem 1, we know whether the group blind signature is unforgeable.
(2) Unforgeability of Electricity Consumption Data. The adversary cannot forge the electricity consumption data. We use the homomorphic verifiable tag mechanism to verify the integrity of data. By judging whether equation (6) holds, we know whether the user’s electricity consumption data have been forged or not. The detail is as follows:
Therefore, we know the integrity of the user’s electricity consumption data by equation (6). The proposed model guarantees the unforgeability of user electricity consumption data.
5.1.4. Traceability
As shown in Section 4.3.4, CC traces the identity of the malicious signer and user under certain conditions.
If equation (1) does not hold, CC traces the identity of the signer. CC decrypts the corresponding to the signer’s anonymous identity code stored in his database. . Then, CC obtains the signer’s real identity . If equation (6) does not hold, CC traces the user’s identity. CC gets the user’s registration identity information , which is stored in his database. CC decrypts with the group private key to obtain . Then, CC calculates of the one by one. CC compares with the , which is corresponding to the to ensure the user’s identity. If is equal to , is the user’s real identity.
Therefore, the proposed model guarantees the traceability of the signer’s identity and the user’s identity.
5.2. Performance Analysis
In the performance analysis section, we analyse the calculation cost of the electricity data collection model in four stages, including the system initialization stage, the user authentication stage, the blind signature stage, and the verification stage.
We assume to have smart meters and smart substations, where B stands for bilinear pairing operation, H stands for hash operation, M stands for modular multiplication operation, L stands for modular exponentiation operation, A stands for the elliptic curve addition operation, N represents the exponential operation under the multiplication group, and W stands for the elliptic curve multiplication operation. In the system initialization stage, CC computes , , , , , , and . Therefore, , , and . In the user authentication stage, the SM computes and and the SS computes , so , , and . Moreover, when data reporting, one SM within a day generates , , , , and . Hence, the computational cost is , , and . In the blind signature stage, the calculation cost of SM acquiring signatures in a day is , , and . In the verification stage, the computational cost of CC verifies that signatures in a day are , , and . The calculation cost of verifying the data within a day for one SM is , , , and .
6. Conclusion
This study proposes a new identity-based group blind signature scheme and applies this signature scheme to the collection of user electricity consumption data in the smart grid. Then, we obtain a privacy-aware electricity consumption data collection model based on group blind signature. The model implements the conditional anonymity of user identity information and the privacy protection of consumption data in the process of collecting electricity data. In addition, when reporting electricity consumption data, the smart meter adds a tag to the data block generated every hour through the homomorphic tag mechanism. The user’s electricity consumption data for a whole day correspond to a tag set. The existence of the tag ensures the integrity and verifiability of the electricity consumption data. The security and performance analysis proves that the data collection model has privacy protection, anonymity, unforgeability, and traceability. In future work, we consider combining blockchain technology with the proposed signature scheme in the smart grid scenario to protect the privacy of the user’s electricity consumption data and identity information.
Data Availability
There are no data included in this study.
Conflicts of Interest
The authors declare that there are no conflicts of interest regarding the publication of this study.
Acknowledgments
The authors gratefully acknowledge the helpful comments and suggestions of the reviewers, which have greatly improved the quality of the study. This study was partly funded by EU Horizon 2020 DOMINOES Project (grant number: 771066).