This document proposes a privacy-friendly load scheduling infrastructure for smart grids. It includes domestic appliances, home gateways, schedulers, and a configurator. Appliances generate scheduling requests that gateways anonymize and route to schedulers using secret sharing techniques. Schedulers attribute starting times to requests while preserving privacy through secure multi-party computation. The approach provides anonymity for users and appliances while allowing efficient energy balancing compared to optimal solutions. Numerical tests over a year of data show the privacy-preserving approach introduces only modest extra delays.

1. Privacy-Friendly Appliance Load Scheduling
in Smart Grids
Cristina Rottondi and Giacomo Verticale
Politecnico di Milano, Dipartimento di Elettronica, Informazione e Bioingegneria

2. Outline






2
Load Scheduling
Privacy Issues in the Smart Grid
The Privacy-Preserving Scheduling Infrastructure
Attacker model and security properties
Performance assessment
Conclusions
Cristina Rottondi

3. Energy Balancing Issues in Smart Grids
4
 Distributed Renewable Energy Sources (RESes) are
variable over time
 Massive introduction of RESes makes it more difficult
worsens to manage the balancing of energy production
and consumption
 Different approaches to increase flexibility in energy
utilization, among which:
• Introduction of high capacity storage banks
• Consumption profile undirect shaping by means of time
variable tariffs
• Consumption profile direct shaping by means of
scheduling deferrable domestic appliances
Cristina Rottondi

4. Load Scheduling in Smart Grid
5
 Assumptions
 RESes inject at will
 Consumption by deferrable, uninterruptible appliances
must be satisfied by available RESes
 Households communicate service requests and the
centralized scheduler communicates the starting delay
 Goal
 scheduling of the starting times of deferrable domestic
appliances in a set of houses according to the
availability of RES
Cristina Rottondi

5. Load Scheduling in Smart Grid
Cristina Rottondi
6

6. Privacy issues in load scheduling
7
 User must communicate to the schedulers:
• The appliance time of use
– Discloses information about personal habits
• The appliance load profile
– Makes the system prone to Non-Intrusive Load
Monitoring attacks (NILM)
 We describe a privacy-friendly scheduling architecture for
deferrable appliances within a neighborhood ensuring
• Anonymity of the users generating the scheduling requests
• Non-disclosure of the appliances’ energy consumption
patterns
Cristina Rottondi

7. The privacy-friendly load scheduling
infrastructure
8
 Includes:
• Set A of domestic
deferrable
Appliances
• Set G of home
Gateways
• Set I of w
Schedulers
• Configurator
Cristina Rottondi

8. The privacy-friendly load scheduling
infrastructure
9
 Includes:
• Set A of domestic
deferrable
Appliances
• Set G of home
Gateways
• Set I of w
Schedulers
• Configurator
Appliances: generate
the scheduling
requests
Cristina Rottondi

9. The privacy-friendly load scheduling
infrastructure
10
 Includes:
• A set A of
domestic
deferrable
Appliances
• A set G of home
Gateways
• A set I of w
Schedulers
• A Configurator
Gateways: provide
communication and
encryption capabilities
Cristina Rottondi

10. The privacy-friendly load scheduling
infrastructure
11
 Includes:
• Set A of domestic
deferrable
Appliances
• Set G of home
Gateways
• Set I of w
Schedulers
• Configurator
Schedulers: attribute
a starting time to
each service request
Cristina Rottondi

11. The privacy-friendly load scheduling
infrastructure
12
 Includes:
• Set A of domestic
deferrable
Appliances
• Set G of home
Gateways
• Set I of w
Schedulers
• Configurator
Configurator:
provides to the nodes
the PKI parameters
Cristina Rottondi

12. Attacker model and security properties
13
 Gateways and Schedulers are honest-but-curious:
• They execute the protocol correctly
• They try to infer the identities of the users initiating service
requests and the corresponding Appliance type
• They can create collusions
 Security properties:
• Obliviousness: a collusion of any number of Gateways
obtains no information about the load pattern of non-local
Appliances
• t-blindness: a collusion of less than t Schedulers obtains
no information about the load pattern of the Appliances
• c-sender anonymity: a collusion of at most c Gateways
and any number of Schedulers cannot associate a request
to the identity of the user whose Appliance generated it
Cristina Rottondi

13. Background: Shamir Secret Sharing scheme
14
 Shamir Secret Sharing scheme (SSS) allows to split a
secret among parties
 The secret is split in w shares and can be recovered if at
least t ≤ w parties cooperate
 Thanks to its homomorphic properties, some arithmetic
operations can be performed directly on the shares
 Depending on the type of operation, intermediate
interactions among the parties might be required
• Addition can be performed locally (cheap)
• Comparison to constant requires multiple rounds
(expensive)
Cristina Rottondi

14. Basic principles – Anonymous routing of
scheduling requests
15
 Appliance a sends to the local Gateway a vector V(t) of its
sampled load profile
 The Gateway divides the vector in w vectors Si (1≤i ≤ w)
using SSS
 Each vector is associated to a random tag r, encrypted
with the public key ki of Scheduler i and conveyed to it by
means of the anonymous routing protocol Crowds
• With probability p the Gateway
forwards its request to another
Gateway, otherwise to the
Scheduler
Cristina Rottondi

15. Basic principles – privacy preserving load
scheduling
16
 The Schedulers know a vector T(t) of the energy supply
pattern for the scheduling horizon
 The i-th Scheduler keeps a vector Pi of shares of the
cumulative energy usage of the scheduled appliances
 Upon reception of a message, each Scheduler get Si,
attributes a starting time Γ to the service request,
computes Pi’=Pi+Si and collaboratively compare Pi’ to T,
operating directly on the shares
• If Pi’>T, the starting time Γ is
shifted and the procedure is
repeated, otherwise Pi is
updated with Pi’
Cristina Rottondi

16. Basic principles – anonymous
communication of starting times
17
 Once Γ is defined, one of the Schedulers broadcasts to all
Gateways the pair Γ,r
 If a Gateway recognizes r as the tag of a local Appliance,
it forwards Γ to the device
Cristina Rottondi

17. Complexity evaluation (I)
20
Number of incoming/outcoming messages per service request
 Messages exchanged by the Gateways depend linearly on w
 Messages exchanged by the Schedulers depend linearly on Γ
and on the number of samples of the vectors V and
superlinearly on w
• w is assumed to be low
• Γ cannot be controlled by the system designer
• The number of elements of V is the only tunable parameter
Cristina Rottondi

18. Complexity evaluation (II)
21
 Lighweight protocol for the Gateways (usually resource
constrained devices)
 Computationally demanding operations supported by the
Schedulers
Cristina Rottondi

19. Performance assessment: benckmark
22
 We define an Integer Linear Programming formulation to
compute the optimal solution minimizing the sum of the
scheduling delays
 Inputs:
• Load profile of each appliance, Va
• Time of arrival of the service request of each appliance
• Total amount of supplied energy, T
 Outputs:
• Starting time of each appliance, Γa
Cristina Rottondi

20. Numerical results
23
 ILP model and privacy-preserving protocol compared over:
• 365 24-h long scheduling periods (1 year)
• 100 service requests per day (SMART* dataset [1])
• dishwashers - peak consumption 1500 W
• washingmachines - peak consumption 750 W
• Energy supplier: windfarm – peak production 50 kW (kaggle
dataset [2])
 The privacy-preserving approach introduces a limited extra
delay w.r.t. the optimal solution
[1] “Smart* data set for sustainability.” http://traces.cs.umass.edu/index.php/Smart/Smart
[2] “Global energy forecasting competition 2012 - wind forecasting” http://www.kaggle.com/c/GEF2012-windforecasting/data
Cristina Rottondi

21. Conclusions
24
 We propose a privacy-preserving framework for the
scheduling of power consumption requests
 Requests generated by smart Appliances are
anonymously conveyed to a set of Schedulers, which
confidentially process them
 Numerical results show only modest gaps in the
scheduling delays with respect to the optimal solutions
obtained by means of an Integer Linear Programming
formulation
Cristina Rottondi

22. 25
THANK YOU
rottondi@elet.polimi.it
vertical@elet.polimi.it
Cristina Rottondi