[Paper Review] Smart Meter Privacy via the Trapdoor Channel

Miguel Arrieta, Iñaki Esnaola|arXiv (Cornell University)|Aug 15, 2017

Smart Grid Security and Resilience25 references3 citations

TL;DR

This paper proposes a battery charging policy for smart meters that ensures privacy by limiting information leakage to the utility provider through a trapdoor channel mechanism. It establishes an upper bound on the information leakage rate that depends on the user's average energy consumption, showing that extreme consumption levels minimize leakage, and proves the bound is tight for i.i.d. consumption processes.

ABSTRACT

A battery charging policy that provides privacy guarantees for smart meter systems with finite capacity battery is proposed. For this policy an upper bound on the information leakage rate is provided. The upper bound applies for general random processes modelling the energy consumption of the user. It is shown that the average energy consumption of the user determines the information leakage rate to the utility provider. The upper bound is shown to be tight by deriving the probability law of a random process achieving the bound.

Motivation & Objective

• To address privacy risks in smart meter systems where energy consumption patterns can reveal sensitive user behavior.
• To design a battery-based energy management policy that limits information leakage to the utility provider while maintaining system functionality.
• To derive an upper bound on the information leakage rate for general random energy consumption processes.
• To show that the average energy consumption governs the achievable privacy level under the proposed policy.
• To prove the tightness of the upper bound using a specific class of i.i.d. random processes.

Proposed method

• Models the energy management system (EMS) as a finite-state channel with a battery of finite capacity β and initial state s₀.
• Proposes a stable battery charging policy that ensures energy requests Yᵢ are determined by the user's consumption Xᵢ and battery state Sᵢ, with constraints to prevent power outages.
• Uses a block-based structure where energy requests are grouped into blocks of length l = ⌈(β+1)/α⌉ to enable analysis of entropy rates.
• Applies information-theoretic bounds to derive an upper limit on the information leakage rate, expressed as (1/l) × H₂(μₙ/α), where H₂ is the binary entropy function.
• Demonstrates that the upper bound is tight by constructing a random process where the entropy rate achieves equality in the bound.
• Analyzes the system in the asymptotic regime (n → ∞) to characterize the leakage rate under known average consumption μₙ.

Experimental results

Research questions

• RQ1 How can a finite-capacity battery be used to minimize information leakage from smart meter readings to the utility provider?
• RQ2 What is the fundamental upper bound on the information leakage rate for general random energy consumption processes?
• RQ3 How does the average energy consumption of the user affect the achievable privacy level?
• RQ4 Can the derived upper bound on information leakage be achieved in practice, and under what conditions?
• RQ5 What is the role of the battery size relative to peak consumption in determining privacy guarantees?

Key findings

• The information leakage rate is upper bounded by (1/l) × H₂(μₙ/α), where l = ⌈(β+1)/α⌉, and this bound is tight for i.i.d. consumption processes.
• The upper bound is concave in μₙ/α, indicating that privacy is maximized at intermediate average consumption levels and minimized at extremes.
• For large n, the information leakage rate decreases as battery capacity β increases, but the reduction is less significant for extreme average consumption values.
• When the energy consumption process is i.i.d. and block-structured with block length l = ⌈(β+1)/α⌉, the entropy rate of the energy request sequence achieves the upper bound.
• The average energy consumption μₙ directly governs the privacy performance: extreme values of μₙ lead to lower information leakage to the utility provider.
• The proposed policy ensures bounded information leakage without requiring probabilistic assumptions on the consumption process, making it robust to non-stationary and non-i.i.d. behavior.