Abstract
Smart grid is an emerging power system capable of providing appropriate electricity generation and distribution adjustments in the two-way communication mode. However, privacy preservation is a critical issue in the power request system since malicious adversaries could obtain users’ daily schedule through power transmission channel. Blind signature is an effective method of hiding users’ private information. In this paper, we propose an untraceable blind signature scheme under the reputable modification digital signature algorithm (MDSA). Moreover, we put forward an improved credential-based power request system architecture integrated with the proposed blind signature. In addition, we prove our blind signature’s blindness and unforgeability under the assumption of Elliptic Curve Discrete Logarithm Problem (ECDLP). Meanwhile, we analyze privacy preservation, unforgeability, untraceability, and verifiability of the proposed scheme. Computational cost analysis demonstrates that our scheme has better efficiency compared with other two blind signatures.
1. Introduction
The concept of “Intelligrid” is first proposed by the American Electric Power Research Institute in 2001 [1], and exploration of smart grid is becoming more and more popular. Since the notion of industry 4.0 is put forward, operation and management of smart grid are optimized through connection of various facilities, equipment, and devices [2]. Smart grid is regarded as the next-generation power grid infrastructure capable of promoting secure and effective electricity transmission from power operators to electric appliance. Power operation and management in smart grid are upgraded by integrating advanced bidirectional communications and widespread computing capabilities for efficient control, distribution, reliability, and safety [3]. Smart grid not only eliminates barriers between users and power producers but also ensures continuous electricity supply for users due to intelligently monitoring electricity consumption behaviour of users to realize suitable adjustments in the amount of power deployment [4].
In general, a smart grid network is roughly comprised of three layers: control center, substations, and smart appliances (i.e., smart meters) [5]. Figure 1 depicts a simplified architecture of the smart grid network. As a kind of physical carrier, smart meters are installed in each electricity appliance system and users could send power request to substation with the help of smart meters. Moreover, smart meters will push appliance information to substations periodically. Substations could collect users’ real-time demand and forward it to the control center via the Supervisory Control and Data Acquisition (SCADA) system [6, 7]. Then, the power control center will make further power deployment analysis and distribute proper electricity amount to substations as various requirements. Finally, users could obtain the required electricity through substations.
It should be noted that the major differences between traditional power network and smart grid are that smart meters bearing users’ application information communicate with substations via wired or wireless networks. Specifically, one of the main information is the users’ real-time electricity consumption and demands. Due to the power request which has the potential of leaking users’ daily schedule, which is private, we devote to the privacy and security issues of electricity request communication. Furthermore, power demands are not only related to users’ privacy directly but also related to the charging policy and fairness. How to take effective measures to guarantee genuineness of power demand sources and the user’s privacy is a significant issue. The former problem could be solved by identity authentication, and the latter needs privacy preservation techniques to be settled [8].
The digital signature is an important cryptographic protocol for ensuring the authenticity and the integrity of messages [9–11]. The blind signature is a special digital signature, which is an effective method for user’s privacy preservation. The pioneer of blind signature conception is from Chaum et al.’s research [12], in which they established a user’s privacy-preserved electric payment system based on blind signature. The blind digital signature generation process contains two parties: a signer and a user . On receiving a blind signature request from a user , the signer generates a random element and sends it to . Then, the user utilizes received element and produced blind factors to blind the original message . The blinded message denoted by is sent to . Actually, signs as a secure signature scheme. Finally, unblinded signature values from to obtain the ultimate blind signature. In the above process, cannot recognize the real signing message even if he saves all the signature scripts that he has signed. The unmatchability between output of blind signature and signer’s signature scripts is viewed as untraceability.
Amounts of blind signature schemes have been proposed [13–19], but they cannot hold untraceability, where the signer can find a match between his signature scripts and blind signature outputs. Thus, can distinguish the original message he has signed and privacy of user could not be ensured. In this paper, we improved Bütün and Demirer’s scheme and proposed a secure blind signature. Based on the advanced blind signature, we put forward a power request system model. Contributions of this paper are as follows: (i)We put forward an improved blind signature-aided power request privacy preservation system model, in which smart meters (i.e., users) could send power request, a blindly signed credential with a certain amount, to substations, and the control center cannot identify the real user identity through blind signature verification(ii)We analyze Bütün and Demirer’s scheme and point out its weakness, that is a malicious signer could find a match message between his signing scripts and user’s blind signature outputs(iii)We propose a secure blind signature scheme under the reputable MDSA digital signature. What is more, blindness and unforgeability of our proposed blind signature are proved under difficulty assumption of ECDLP
1.1. Organizations of This Paper
Some works related to blind signature and smart grid privacy preservation are described in Section 2. Section 3 are preliminaries of this paper, which introduces our proposed system model, fundamental knowledge, definition of blind signature, and security model of blind signature. In Section 4, we review Bütün and Demirer’s scheme. Then, we point out the linkability attack on the reviewed scheme in Section 5, that is, a signer can find an original message he has signed. In Section 6, we proposed our improved blind signature with untraceability. In Section 7, we prove our scheme’s blindness and unforgeability and analyze properties of privacy preservation, unforgeability, untraceability, and verifiability. Section 8 gives comparisons of security properties and computational costs with Bütün and Demirer’s scheme [13] and Verma and Singh’s scheme [16].
2. Related Works
Since the advent of “smart grid” concept, a flow of smart grid surveys has sprung up [3, 20–26]. Fang et al. explore three major systems and gave the future expectations for smart grid [20]. This paper has an important reference value for the following smart grid survey. Alshehri gives further research for smart grid and studied multiperiod demand response management [21]. Wen et al. [25] and Makhadmenh et al. [26], respectively, conducted researches on smart meters and smart homes. However, some sensitive information of users may leak through the two-way communication channel. Therefore, privacy preservation is especially significant.
Si et al. analyze the existing privacy problems and enumerate some solutions from a global perspective for smart grid [27]. Mahmood et al. propose an elliptic curve-based authentication to provide communication security between customers and substations [28]. Blind signature is an effective way of hiding users’ sensitive information and first proposed by Camenisch et al. [29]. Blind signature could guarantee anonymity of participants. Tseng put forward a specific privacy-preserving communication protocol utilizing the restrictive partially blind signature [30]. Sarde and Banerjee propose an incentive-based demand response privacy-preserving scheme for the smart grid [14]. Yang et al. make an attempt to identify the privacy-preserving issues and put forward a reward architecture for V2G networks [31]. Yu et al. propose a power request scheme to satisfy the security requirements [32]. Han and Xiao give a thorough and deep survey on the privacy preservation for smart grid and point out that the blind signature is a universal method for users’ security issues [33], but they do not give a detailed blind signature based privacy preservation scheme.
In conclusion, the above papers have great effects on the smart grid privacy preservation research. But they either give a general description or lack of a comprehensive blind signature scheme. In this paper, we proposed an integrated blind signature-aided privacy-preserving power request scheme for smart grid.
3. Preliminaries
In this section, we introduce the system model, fundamental knowledge, definition of blind signature, and security model of blind signature.
3.1. The System Model
In this subsection, we propose an improved system model of Cheung et al.’s architecture [34]. A smart grid network can be simplified into a hierarchical structure consisting of three basic layer-control centers, substations, and smart meters. It can be shown that they have different characteristics. (i)A control center (CC) is at the top level and maintained by the power operator. It can be a single server inside the power plant or be distributed servers at different locations responsible for parameter generation, entity registration, and issuing credentials for smart meters. In this paper, we assume that the control center is trusted(ii)Substations (SS) are at the middle of the structure and fixed in a particular geographic location as it contains expensive electric devices. They could communicate with users directly(iii)Smart meters (SM) are at the lowest level and installed in the power application positions such as users’ homes. They could send power requests to the control center
In our system construction, the main idea is that the control center makes good use of the proposed blind signature scheme to sign credentials for users. In this case, identities of users cannot be recognized when he or she sends a request to the control center, while the user’s identity can be validly verified due to only legal user could have requested control center for blind signatures.
The workflow of the system model is shown in Figure 2 [5]. In the system setup phase, the control center (CC) generates a pair of public and private keys and assigns a unique identifier for each smart meter (SM) to be registered. In the smart meter registration phase, the CC first authenticates the SM’s identity and decides to accept or reject this SM. Then, each user submits the blinded credential information to the CC. Each credential consists of a unique identity CID, issuance date , a substation identifier , and a value of power amount that a credential holder could request. Then, the CC generates a blind signature for the credential and sends it to SM. Eventually, the SM unblinds the signature and obtains a signed credential. In the power requesting phase, smart meters of a user request for more power when it finds the electric appliances cannot be satisfied. The SM chooses a signed credential of required value and transmits it to the SS with identity noted in the credential. Then, SS sends the signature credential to CC. If the signature is valid and the credential’s identity CID is not in the credential revocation list, CC distributes proper power as the credential to the SS. Meanwhile, CC adds CID in the credential revocation list. Finally, the SM receives required power amount.
In the above process, the control center cannot recognize the real user identity through blind signature. Therefore, the power consumption information is not disclosed to CC. In the next subsection, we will introduce blind signatures related to knowledge.
3.2. Fundamental Knowledge
3.2.1. Elliptic Curve
Given a large prime and the finite field , the elliptic curve equation is defined by , where . All points satisfying the elliptic curve equation together with a point at infinity are composed of an Abelian group. Order of the group is denoted by .
Elliptic Curve Discrete Logarithm Problem (ECDLP). Suppose that is a generator on and is a possible point on the elliptic curve, it is difficult to find an such that the equation holds.
3.2.2. The Modification Digital Signature Algorithm (MDSA)
As cited, the MDSA is mainly composed of three phases as follows: key generation, signing, and verifying. (i)Key Generation. The signer randomly chooses an as the private key and computes as the public key(ii)Signing. The user selects a random number and computes . is denoted by . Then, he calculates and . The signature output is (iii)Verifying. Upon receiving , the verifier first computes and extracts . Then, he verifies the equation . If it is the case, is a valid signature
3.3. Definition of Blind Signature
A complete blind signature is composed of setup phase, key generation phase, blind signature phase, and verification phase [29]. Specifically, the blind signature phase consists of two probabilistic polynomial-time (PPT) interactive algorithms in the respective party of signer and user . (i)Setup Phase. On inputting a security parameter for expected security level, a series of public parameters are output in this phase(ii)Key Generation Phase. This is a probabilistic polynomial-time (PPT) algorithm. Taking the security parameter as input, outputting a public and private key (iii)Blind Signature Phase. This phase includes two interactive PPT algorithms and (a) or . Upon inputting a public key and the corresponding secret key generated by , the signer outputs or through blind signature interactive process(b) or . Upon inputting a common public key of , selected blind factors , and the message to be signed, the user selects the demanded blind outputs or through blind signature interactive process(iv)Verification Phase. This is a deterministic polynomial-time algorithm. On inputting public key , message , and the signature , it always outputs with the condition that both signer and user follows the blind signature and outputs , outputs
3.4. Security Model of Blind Signature
We refer to Okamoto who proposed a security model for blind signatures and consider the following two properties: blindness and unforgeability [35].
3.4.1. Blindness
The blindness of blind signature is depicted by the following game between an adversarial signer and a simulator which controls two honest users . (i)An adversary inputs the security parameter to obtain the public key and two ordered messages denoted by . Then, are transmitted to the simulator (ii) randomly chooses a bit to reorder the two messages and, respectively, distributes and to and as secret information. Then, selects proper blind factors and inputs corresponding message and to run algorithm(iii) engages in these two parallel interactive blind signatures separately with (iv)If , respectively, outputs valid blind signatures , send the two signatures to in random order. Otherwise, output (v)Finally, outputs a guess bit
We define
where is the advantage of adversary breaking the blindness property.
Definition 1 (blindness property). A blind signature protocol is recognized to be -blind if no PPT adversary breaks the blindness property in time at most , and is at least .
3.4.2. Unforgeability
The unforgeability of blind signature is described by the following game between an honest signer and a malicious user . (i) is run to obtain public and private keys . Then, is sent to and is secretly held by (ii) adaptively engages in polynomially parallel interactive blind signatures by algorithm with executing algorithm(iii)Let denote the number of executions among and , where outputs (iv) wins the game if he outputs valid signature such that they are different signatures for different messages and
We define is the probability that wins the above game. Then, we give the definition of blind signature unforgeability.
Definition 2 (unforgeability). A blind signature is -unforgeable if there does not exist PPT adversary win the above game, where is the most time, is the most times motivates the blind signature, and is the least .
Notations used in this paper are explained in Table 1.
4. Review of Bütün and Demirer’s Scheme
In this section, Bütün and Demirer’s scheme [13] will be briefly reviewed. Their scheme comprises the following five phases, including initialization, blinding, signing, unblinding, and verifying. Each phase of Bütün and Demirer’s scheme is presented in the following subsection. (i)Initialization Phase. The elliptic curve parameters are , where is a finite field defined by the big prime number ; defines the elliptic curve ; is a base point on with the order
The signer randomly selects an integer as the secret key and calculates as the public key. For each blind signature request from a user, the signer chooses a random number and computes the point and . If , the signer reselects the nonce ; otherwise, he transmits to the user. (ii)Blinding Phase. Upon receiving , the user first extracts from and chooses two blind factors . Then, he calculates and blinds message through . Finally, the user transmits the blinded message to the signer(iii)Signing Phase. On receiving the blinded message, the signer uses his private key to sign . He computes and sends to the user(iv)Unblinding Phase. On receiving , verifies whether is in the range of . If it holds, the signature is unblinded as follows:
Eventually, outputs the digital signature on message (v)Verifying Phase. On receiving , the verifier, respectively, calculates and . Then, he verifies the equation . If the equation holds, is a valid signature of the message ; otherwise, the signature is invalid
Correctness. The correctness can be verified by the following equations:
5. Attack on Bütün and Demirer’s Scheme
In this section, we show a malicious signer can find a link between the blind signature and the original message . Suppose that the signer saves all the transcripts of his signatures. Using the unblinded signature , can match a blinded signature he has signed to an original message . Detailed procedures are as follows: (i)Extracting from (ii)Calculating denoted as (iii)Calculating denoted as (iv)Using the private key to verify whether the following equation holds
If equation (4) holds, is able to find the linkage between the blind signature and his signed blind message ; otherwise, going through all transcripts and repeating the above process. This shows Bütün and Demirer’s scheme is insecure, because there is absence of untraceability. The next section is our improvement of Bütün and Demirer’s scheme.
6. Our Proposed Scheme
In this section, an untraceable blind signature scheme is completely described. Our blind signature scheme comprises four phases: setup phase, key generation phase, blind signing phase, and verification phase.
6.1. Setup Phase
On inputting the security parameter to reach the expected security magnitude, the elliptic curve parameters are output as , where is a large prime that specifies the finite field ; defines the elliptic curve ; is a base point on , and is the prime order of .
6.2. Key Generation Phase
The private and public key of the signer is generated by the following steps: First, generating a random nonce from . Second, calculating the elliptic curve point . Finally, keeps the private key secret and the public key published.
6.3. Blind Signing Phase
As shown in Figure 3, the user and the signer execute the following steps to generate a signature. (i)For each blind signature request, a random integer is generated by and the elliptic curve point is computed as follows:
Moreover, the signer checks . If the inequation holds, transmits the elliptic curve point to the user ; otherwise, reselects and repeats (5) to fulfill (ii)Upon receiving , performs the following operations to obtain the blinded message . Firstly, extracting from . Secondly, randomly selecting two factors and computes . Thirdly, extracting from . Finally, calculating to blind the original message. Having executed the above steps, sends the blinded message to (iii)Upon receiving , first extracts from . Then, he uses private key and selects a random nonce to compute the blind signature . Finally, transmits the blinded signature to (iv)On receiving , verifies whether satisfies. If it holds, the signature is unblinded as follows:
Eventually, outputs the digital signature on message
6.4. Verification Phase
Any verifier can verify the validity of the signature . First, using the public parameter and signature to compute ; second, extracting from ; third, using the signer’s public key and signature value to calculate ; finally, verifying whether the equation holds. If the equation holds, is a valid signature of message ; otherwise, the signature is invalid.
Correctness. The correctness can be verified by the following equations:
7. Security
In this section, we give the formal security proof of our blind signature scheme’s blindness property and unforgeability.
7.1. Security Proof
According to the security model of blindness in Section 3.4, the blindness is to guarantee that an adversarial signer cannot distinguish signatures from two different messages. We will show that our scheme’s signature values are independent from the view of .
Theorem 3 (blindness property). Our proposed blind signature keeps blindness property.
Proof. For any public key output from the malicious signer , is perfectly independent from in the blind signature process in the view of . On the one hand, the is a completely random number chosen from . On the other hand, , where is the -coordinate of . Due to the randomness of , is independent of .☐
Next, we will prove that the signature is independent from the view of . Since and cannot be obtained from , is perfectly independent. Moreover, and is not related to . Therefore, the signature values are independent in the view of .
Above all, our blind signature scheme keeps perfectly blindness property.
Theorem 4 (unforgeability). If the ECDLP assumption holds, our proposed blind signature is existential unforgeability against chosen-message attacks (EU-CMA).
Proof. Suppose that is an adversary delegated for a malicious user that forges the proposed blind signature scheme, there exists a challenger that can break unforgeability of the MDSA. Then, it is contradictory to the ECDLP assumption.☐
In this proof, algorithm is modelled as a signing oracle and forging process of the proposed blind signature is depicted as follows. (i) runs the to generate a pair of public and private keys . Then, sends to as the public key(ii) executes signing oracle following the proposed blind signature, that is, the signing oracle outputs and with the corresponding from (iii) could adaptively request times to sign different as the proposed interactive blind signature(iv)If outputs different signatures , there exists one signature forged by . In addition, cannot obtain the secret key through due to is unrelated to and the private key cannot be recovered by the equation with unknown to
Moreover, the signature is a variant of MDSA since where and the signature is verified by the equation . Therefore, unforgeability of the proposed blind signature is reduced to the security of MDSA. Under the difficulty assumption of ECDLP, MDSA is existential unforgeability.
7.2. Security Analysis
According to references, we analyze identity privacy preservation, unforgeability, untraceability, and verifiability of the proposed scheme. (i)Privacy Preservation. We have proven blindness of our proposed blind signature in 7.1. Therefore, nobody including the control center and substations could recognize the real identity of users when they request for more power. Thus, identity and electricity consumption privacy of users could be protected(ii)Unforgeability. As shown in 7.1, the proposed blind signature scheme is existential unforgeability. Thereby, any users (i.e., smart meters) cannot unforge blind signatures for credentials with desired values(iii)Untraceability. Suppose that a control center attempts to find linkage among the credential he signed and signature. For this, he could preserve all the transcripts . Even after the blind signature is made public by the user, the control center is still unable to find the blind factors . Moreover, and are independent of each other. Above all, it is impossible for the control center to link the signature with corresponding transcript (iv)Verifiability. The correctness of proposed blind signature insures that the control center can verify validity of credentials by checking equation
8. Performance Analysis
In this section, we compare the proposed scheme with Bütün and Demirer’s [13], Verma and Singh’s [16], Chaudhry et al.’s [36], and Mahmood et al.’s [37] in terms of security properties, computational cost, and communication cost. The results are listed in Tables 2 and 3 separately.
8.1. Security Properties
As we have analyzed in this paper, Bütün and Demirer’s scheme [13] cannot resist that a malicious signer traces the original message he has signed, which means there is no untraceability in Bütün and Demirer’s scheme. Furthermore, traceability provides opportunities for adversaries to recognize users’ daily schedule and privacy preservation does not hold. In addition, [36] does not provide unlinkability proof and [37] does not have privileged insider resistance and unlinkability proof.
8.2. Performance Analysis
8.2.1. Computational Cost
In this subsection, we mainly consider the more time-consuming operations hash-to-point , point multiplication , and modular inversion and adopt the executing time in [38] as shown in Table 4. It can be seen that the proposed scheme requires 3 point multiplication operations and 4 modular inversions, i.e., 6.663 ms, which is only slightly larger than that of [13] and smaller than the other three schemes’ computational cost.
8.2.2. Communication Cost
We set the size of point on is 512 bits, size of is 256 bits, output size of general hash function is 256 bits, and size of timestamp is 32 bits. Then, we have the communication cost comparison in Table 3. We can see that our scheme and Ref. [13] have the least communication cost, i.e., 1024 bits than the other three literatures. Therefore, our scheme needs the least communicational bandwidth.
Above all, the proposed scheme has better security properties than Bütün and Demirer’s [13] although performing two more modular inversions and has better computational costs with the same security properties of Verma et al.’s scheme.
9. Conclusion
Our scheme provided values of theory and application to some extent. On the one hand, the proposed untraceable blind signature is constructed under the noted MDSA algorithm and proof of which gave theoretical insurance of blindness and unforgeability. On the other hand, we put forward a new credential-based privacy-preserving power request model for smart grid. In this system model, the user’s daily schedule could not leak outside with the help of blind signature since blinded factors hide the real signed message for the signer and verifiers cannot identify the real sources of messages. Moreover, it was shown that this scheme has better security or computational costs compared with other blind signatures under the same background or cryptographic infrastructure.
Data Availability
The data used to support the findings of this study are available from the corresponding author upon request.
Conflicts of Interest
The authors declare that they have no conflicts of interest.