Two Is Not Enough: Privacy Assessment of Aggregation Schemes in Smart Metering

Abstract

Abstract:The widespread deployment of smart meters that frequently report energy consumption information, is a known threat to consumers' privacy. Many promising privacy protection mechanisms based on secure aggregation schemes have been proposed. Even though these schemes are cryptographically secure, the energy provider has access to the plaintext aggregated power consumption. A privacy trade-off exists between the size of the aggregation scheme and the personal data that might be leaked, where smaller aggregation sizes leak more personal data. Recently, a UK industrial body has studied this privacy trade-off and identified that two smart meters forming an aggregate, are sufficient to achieve privacy. In this work, we challenge this study and investigate which aggregation sizes are sufficient to achieve privacy in the smart grid. Therefore, we propose a flexible, yet formal privacy metric using a cryptographic game based definition. Studying publiclyavailable, real world energy consumption datasets with various temporal resolutions, ranging from minutes to hourly intervals, we show that a typical household can be identified with very high probability. For example, we observe a 50% advantage over random guessing in identifying households for an aggregation size of 20 households with a 15-minutes reporting interval. Furthermore, our results indicate that single appliances can be identified with significant probability in aggregation sizes up to 10 households.

Review of results on smart‐meter privacy by data manipulation, demand shaping, and load scheduling

“…In 2015, a study by industrial body Energy Networks Association in the UK concluded that aggregating the consumption of only two smart meters provides privacy [49]. The conclusions of this study were recently disputed in [50]; however, it was shown that larger groups (of around hundreds) with lower temporal resolution (sampling time of multiple hours) can provide significant privacy to households. One way to obtain aggregate consumption reports is to measure the electricity consumption at substation levels.…”

“…As stated in the introduction, tracing attacks against aggregated smart‐meter readings [50] and non‐intrusive load monitoring attacks [18] are two common privacy attacks used by adversaries. In [78], it is shown that noiseless privacy can severely disrupt performance of such attacks.…”

Understanding Game-Based Privacy Proofs for Energy Consumption Aggregation Protocols

“…At this point, the goal of the aggregation protocol as well as our analysis ends. Yet, the data concentrator is not capable to extract individual measurements from the sum, if the number of smart meters is large enough [20]. • The aggregator, if present, performs mathematical operations on the protected measurements, but has no means to see the bare individual measurements.…”

“…• Heuristic: Problems that are not trivial to solve in general, but may be easy for some hard-to-define cases or input data. For example, extracting (disaggregating) one distinct measurement m d from an aggregation result M = m d + i m i depends on the distribution of the measurements [20].…”

The influence of differential privacy on short term electric load forecasting

“…In this work, we strive to bring energy providers in the position to train load forecast models on differentially private aggregated data from electricity customers. Differential Privacy is required due to possible insufficiencies of pure aggregation for privacy protection [8,31].…”