This article has been accepted for publication in a future issue of this journal, but has not been
fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TSG.2016.2585963, IEEE
Transactions on Smart Grid
JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2015
Cost-friendly Differential Privacy for Smart Meters:
Exploiting the Dual Roles of the Noise
Zijian Zhang, Member, IEEE, Zhan Qin, Member, IEEE, Liehuang Zhu, Member, IEEE Jian Weng, Member, IEEE
and Kui Ren Fellow, IEEE
AbstractSmart meters have been widely installed to monitor
residential electricity usage worldwide. This brings a serious
privacy challenge for the customers, because the meter readings
are possible to expose their activities in the house. To address
this privacy issue, battery-based privacy preserving schemes have
already been studied for several years. In these schemes, a
rechargeable battery can both prevent the meter readings from
leaking the customers energy consumption and play a role of
saving the cost. However, to the best of our knowledge, none of
the existing schemes can achieve differential privacy and cost
saving simultaneously. In this article, we first propose a battery-
based differential privacy-preserving (BDP) scheme. We further
present two cost-friendly differential privacy-preserving (CDP)
schemes by extending BDP scheme. Simulation analyses show
that the privacy loss of both CDP schemes are smaller than the
existing work. Meanwhile, both CDP schemes stably save the cost
under multiple pricing policies.
Index TermsDifferential Privacy, Cost Saving, Smart Meter,
Battery, Pricing Policy.
I. I NTRODUCTION
LECTRIC companies have been installing smart meters
E all around the world, with the development of smart grid.
In the United States, more than eight million smart meters
have already been installed [1]. In Europe, at least 80% of
all consumers are estimated to install smart meters by 2020,
according to the current national roll-out plans [2]. These
smart meters monitor residential electricity usage information
at minute-level or second-level incessantly [3]. On one hand,
this information is necessary for the electricity companies to
provide a secure and efficient power supply. For example, it is
useful to notify outage [4] and reckon the total amount of ener-
gy consumption [5]. On the other hand, this information causes
a serious threat to the customers [6] at the same time. The
meter readings are possible to expose what types of electrical
appliances are being used, thereby inferring the customers
behavior in the house [7]. The threat has led the customers to
boycott smart meters. In California, nine cities have voted to
make smart meters illegal in their communities [8].
To address the privacy issue, a rechargeable battery is
installed to prevent the meter readings from leaking the
customers real energy consumption [9]. Specifically, after
the battery is installed in the house, the meter readings only
represent the total energy consumption from the electrical
appliances and the battery. Since the charge-discharge rate of
the battery is adjustable, the meter readings can be flatten [10]
[12] or randomized [13], [14] by selecting an appropriate rate.
Manuscript received April 19, 2005; revised August 26, 2015.
1949-3053 (c) 2016 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
1
Therefore, the real energy consumption is hidden from the
meter readings.
Besides privacy protection, the battery can also play a
role of saving the customers cost under Time-of-Use (TOU)
pricing policy. Specifically, TOU pricing policy has been used
to alleviate the electricity production and transmission pressure
for the electricity companies [15]. The main idea of TOU
pricing policy is to set the unit price at peaks time higher
than that at the other times, in order to encourage customers
to reduce the electricity demand at peak times. There are two
kinds of pricing policies in smart grid. One is to stipulate
all the unit prices in advance. Since the unit price at each
time period is nonadjustable, it is named as static policy.
The other just publicizes the lowest and highest unit price to
the customer [16]. The electricity company can autonomously
adjust the unit price at any time, due to the total energy
consumption. This policy is regarded as dynamic policy [17].
Obviously, customers bill can be reduced when the battery
charges under a lower unit price and discharges under a higher
unit price. Following this principle, several schemes have
been proposed to save the cost for both static and dynamic
policies [16], [18].
In recent years, the method of differential privacy is applied
to define the customers privacy in smart grid [13], [14]. This
method supports formal proof to the privacy, when compared
with the traditional information-theoretical methods, such as
relative entropy [19] or mutual information [20]. In addition,
customers privacy can be guaranteed at about the same level
if differential privacy is achieved. Unfortunately, to the best
of our knowledge, none of the existing battery-based privacy
preserving schemes can achieve differential privacy and save
the cost simultaneously.
We summarize our contributions as described below:
(1) We propose a battery-based differential privacy-
preserving (BDP) scheme and formally prove its privacy.
(2) By extending BDP scheme, we present two cost-friendly
differential privacy-preserving (CDP) schemes under static and
dynamic pricing policies. Both CDP schemes are formally
proved to achieve differential privacy and cost saving simul-
taneously.
(3) Using REDD dataset, we quantitatively evaluate the
privacy leakage and cost for both CDP schemes under static
and dynamic pricing policies in the experiments.
The rest of this paper is organized as follows. Section 2
reviews the related work. Section 3 briefly recalls the definition
of differential privacy and multi-armed bandit problem. In
section 4, we describes the system model and the formal goal.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TSG.2016.2585963, IEEE
JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2015
Section 5 proposes the BDP scheme and two CDP schemes
under static and dynamic pricing policies. In section 6 both
CDP schemes are proved to achieve differential privacy and
cost saving simultaneously. Section 7 evaluates the privacy
loss and cost saving for both CDP schemes and the existing
work. Section 8 draws the conclusion.
II. R ELATED W ORK
Some studies focus on the battery-based privacy protection
in smart grid. Kalogridis et al. [10] are first to propose a
best effort (BE) scheme. This scheme tries to set the meter
readings as a fixed value. In this scheme, the rechargeable
battery is used to bridge the gap between the customers real
energy consumption and the fixed value. Unfortunately, BE
scheme is inevitable to expose the customers privacy, because
all the batteries have limited capacity and charge-discharge
rate [11]. For example, the meter reading has to equal the
energy consumption, when the energy left in the battery is too
low or too high to make up the gap [11].
To resolve the problem, McLaughlin et al. [11] present a
non-intrusive load leveling (NILL) scheme. In this scheme,
the battery is set to charge/discharge when the capacity is too
low/high to keep the fixed value. Yang et al. [12] introduce
three lazy stepping (LS) schemes. The meter reading can be
flexibly adapted, when the battery cannot keep the fixed value.
Although NILL and LS schemes alleviate the exposure for the
customers energy consumption, both schemes cannot achieve
differential privacy or cost saving [13].
Koo et al. [18] propose a wallet friendly privacy protection
(PRIVATUS) scheme. This scheme uses dynamic program-
ming to preserve privacy and reduce the bill under static
policy. Yang et al [16] design an optimal privacy preserving
energy management (OPPEM) scheme. In OPPEM scheme,
the variance of all the meter readings is minimized by using
Lyapunov optimization. This scheme protects privacy and
reduces the bill under dynamic policy [16]. However, both
OPPEM and PRIVATUS schemes cannot achieve differential
privacy [14].
Recently, Zhao et al. propose a multitasking-BLH-exp3
(MBE) scheme. This scheme is proved to achieve differential
privacy [13]. However, the proof is not complete when the
limited capacity and charge-discharge rate of the battery are
considered. In addition, MBE scheme cannot cut down the
bill.
III. T HE P RELIMINARIES
A. Differential Privacy
We follow the definition of differential privacy in [21] as
below.
Definition 1. A randomized function gives (, ) differential
privacy, if for all datasets D1 and D2 differing on at most
one element, and all S Range( ) ,
Pr[ ( D1 ) S] exp( ) Pr[ ( D2 ) S] +
where Range( ) denoted the range of the function .
1949-3053 (c) 2016 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
Transactions on Smart Grid
2
Roughly, and are two parameters that quantitatively
represent the privacy loss. The closer and approach to
0, the better privacy preserves.
Differential privacy can be achieved by adding a stochastic
noise drawn from a Laplace distribution to the result of the
query function [21]. Here the probabilistic density function of
Laplace distribution is as follows [22].
1 |x|/
pdf (x) =
e , x (, +) (2)
2
Here the parameter is often set to 0, and parameter
has to be determined by the sensitivity which stands for the
biggest impact of any element in the dataset on the result of
the query function f [21]. The sensitivity is formally defined
as below [22]:
Definition 2. For f : D Rd , the sensitivity of f is
f = max f ( D1 ) f ( D2 ) (3)
D1 ,D2
for all D1 and D2 differing in at most one element.
To achieve differential privacy, should be no more than
f / [21].
B. Multi-Armed Bandit Problem
Multi-armed bandit (MAB) problem has been widely s-
tudied in game theory, machine learning and economics.
This problem formulates a strategy that allocates a sequential
actions (arms) to maximize the total payoff in a series of
experiments [23]. A famous dilemma in MAB problem is how
a player chooses a proper arm to balance the exploitation and
the exploration in the experiment, because the former performs
well in the past, while the latter could bring more profit in
the future [24]. To resolve this dilemma, the design of regret
mechanism is critical and indispensable [23]. This mechanism
evaluates the distance between the chosen arm and the optimal
one. Formally, assume there are K arms. The payoff of each
arm at time i is defined by Xj,i , where j {1, ..., m}. If the
arm Ij is chosen at time i, the corresponding profit XIj ,i can
be earned. After we choose an arm for n times, the regret is
defined as:
n n
Rn = max Xj,i XIj ,i (4)
j{1,...,m}
i=1 i=1
IV. M ODELS AND G OALS
A. System Model
The system model comprises (1) a smart meter, (2) a
rechargeable battery, (3) a power controller that connects the
smart meter, the battery and the electrical appliances such as
television, microwave or refrigerator in the house, and (4) a
TOU pricing policy.
Here the notations of all the parameters in the system model
are summarized in Table I. For the smart meter, i represents the
time when the ith report is sent. o(i) is denoted as the meter
(1) reading at time i. For the rechargeable battery, the charge-
discharge rate and the capacity of the battery at time i are
represented by n(i) and c(i), respectively. Here n(i) ,
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TSG.2016.2585963, IEEE
Transactions on Smart Grid
JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2015 3

TABLE I: Summary of notations Algorithm 1 The specification of BDP scheme

Smart Meter Input: , , , , C, c(i 1), {dij |j [1, M ]}.
i Time point. Output: n(i).
o(i) Meter readings at time i. M
Rechargeable Battery 1. (Di ) = j=1 (dij )  
n(i) Charge-discharge rate of battery at time t 2. For all k, l [1, M ], f = max dik dil 
Maximal discharge rate of battery.
Maximal charge rate of battery.
3. = 0, = f /
+(Di ) +(Di )
C Capacity of the battery 4. T = 12 e + 12 e 1
c(i) Energy left in the battery at time i.
|x|
Power Controller 5. pdf (x) = e 2T
j The sequence number for each electricity appliance. 6. Do
dij The energy consumption for the j th appliance at time i.
(Di ) Customers electricity consumption at time i.
7. n(i) pdf (x)
The minimal consumption in all the electricity appliances. 8.While(n(i) + c(i 1) > C||n(i) + c(i 1) < 0)
The maximal consumption in all the electricity appliances. 9. c(i) = n(i) + c(i 1)
Pricing Policy
10. Return n(i)
p(i) Unit electricity price at time i.
pmax The highest unit electricity price.
pmin The lowest unit electricity price.
Goal 2. For all i, develop
a scheme that achieves differ-
i ential privacy, and E( i (p(i) n(i))) 0, due to , , ,
0 c(i) C, and c(i) = c(0) + j=0 n(j). For the power , C, c(i 1), (Di ), pmin , and pmax .
controller, j stands for the sequence number of each electricity
appliance in the house. Since each appliance may consume V. C OST- FRIENDLY D IFFERENTIAL P RIVACY- PRESERVING
different energy at different time, dij means the specific energy S CHEMES
consumption for the j th appliance at time i. (Di ) denotes the
In this section, we first design a battery-based differential
customers real energy consumption, and (Di ) . In
privacy-preserving (BDP) scheme, when considering the limit-
general, 0, because (Di ) is 0, when all the appliances
ed charge-discharge rate and capacity of battery. By extending
are turned off. For the pricing policy, p(i) represents the unit
BDP scheme, we further propose two cost-friendly differential
price at time i. pmax and pmin denotes the highest and lowest
privacy-preserving (CDP) schemes under static and dynamic
unit price respectively. pmin p(i) pmax . Finally, we have
policies, respectively.
o(i) = (Di ) + n(i).
A. The Battery-based Differential Privacy-preserving Scheme
B. Adversarial Model
Since the charge-discharge rate and capacity of the battery
The adversary is curious-but-honest. More precisely, adver- are limited ( n(i) , 0 c(i) C), the range of n(i)
saries can obtain all the smart meter readings by eavesdrop- cannot be drawn from the Laplace distribution, because the do-
ping. With curiosity piqued, the adversary will attempt to infer main of Laplace distribution is (, +), due to Equation 2.
customers behavior through analyzing the meter readings. But Thus, we have to design a new distribution to replace Laplace
the adversary will not insert, delete or modify those readings, distribution in smart grid. Formally, the probability density
because of the honesty. Furthermore, the adversary is assumed function of the new distribution is presented as follows:
to get , , , , p(i), pmax and pmin . |x|
e
pdf (x) = , + (Di ) x + (Di )
C. System Goals 2T
0 , Otherwise
Our goal is to design cost-friendly privacy-preserving (5)
schemes which can protect the customers privacy and reduce where
the cost simultaneously under static and dynamic policies, 1 +(Di ) 1 +(Di )
respectively. T = e + e 1 (6)
2 2
For static policy, the unit electricity price during each time
We prove that pdf (x) is always nonnegative, and its integral
period is announced by the electricity company in advance. In
from to equals 1 in the Appendix. Hence, Equation 5
this case, our first goal is defined as Goal 1.
satisfies the mathematical requirements for the probability
Goal 1. For all i, develop
a scheme that achieves differ- density function. In addition, by choosing an appropriate
ential privacy, and E( i (p(i) n(i))) 0, due to , , , battery, we have + < 0 and + > 0.
, C, c(i 1), (Di ), and p(i). Assume that there are M electricity appliances in the house.
We now propose the specification of BDP scheme as below.
For dynamic policy, only the maximal and minimal unit
electricity prices are publicized, and the electricity company
can adjust this unit price autonomously, according to the global B. The Cost-friendly Differential Privacy-preserving Scheme
energy usage. Therefore, the real-time unit price is uncertain under Static Pricing Policy
for the customer [16], [17]. In this case, our goal is shown as Since the unit electricity price during each time period is
Goal 2. fixed, an intuitive method to save the cost is charge the battery

1949-3053 (c) 2016 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TSG.2016.2585963, IEEE
Transactions on Smart Grid
JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2015 4

Algorithm 2 The specification of CDP1 scheme

Noise
Input:, , , , C, c(i 1), {dij |j [1, M ]}, {p(i)}. Turning back after getting Turning back after getting
local maximal price local minimal price
Output: n(i).
M
1. (Di ) = j=1 (dij )   Price
2. For all k, l [1, M ], f = max dik dil  Local Maximal Price
3. If(p(i) > p(i + 1)) Local Minimal Price
4. tmp1 = tmp2 = i 0 Time
5. While(p(tmp1 ) > p(tmp1 + 1)){+ + tmp1 }
6. p(tl ) = p(tmp1 )
7. While(p(tmp2 ) <= p(tmp2 1)){ tmp2 } Discharge b + g - k ( Di ) (
a +h ) + ( b + g )
2
- k ( Di ) a + h - k ( Di ) Charge
8. p(th ) = p(tmp2 ) 
9. Else If(p(i) <= p(i + 1)) Fig. 1: Charge-discharge Rate of Battery under Static Policy
10. tmp1 = tmp2 = i
11. While(p(tmp1 ) < p(tmp1 + 1)){+ + tmp1 }
12. p(th ) = p(tmp1 ) Equation 7 cannot be used to save the cost any more. Since the
13. While(p(tmp2 ) >= p(tmp2 1)){ tmp2 } customer cannot predict whether the unit price during the next
14. p(tl ) = p(tmp2 ) time period will be higher or lower than the current unit price,
15. = w ((p(i) p(tl )) (+)(+)
p(th )p(tl ) + + (Di ))
we cannot decide to charge or discharge the battery for saving
16. = f / the cost. Here we apply the regret mechanism from MAB
+(Di ) +(Di ) problem to settle this problem. To attain our goals, privacy pre-
17. T = 21 e + 21 e 1 serving and cost saving can be regarded as two kinds of profits.
|x|

18. pdf (x) = e 2T From the point of privacy preserving, the optimal strategy is to
19. Do set = 0, because is 0 [22]. The privacy loss is the smallest
20. n(i) pdf (x) in this case. From the point of cost saving, greedy strategy has
21.While(n(i) + c(i 1) > C||n(i) + c(i 1) < 0) to be used as the price cannot be predicted. Following this
22. c(i) = n(i) + c(i 1) strategy, chooses the maximal discharge rate from all the
23. Return n(i) possible arms. Then we set a weight w, (w [0, 1]) to balance
the privacy preserving and cost saving. Finally, the regret Rn
is shown as Rn = w |Armj | + (1 w) (Armj Arm0 ).
in the lower price and discharge it in the higher price. But this Here Armj represents the j th arm, and Arm0 is the arm that
method violates the definition of differential privacy, because has the maximal possible discharge rate.
the charge-discharge rate has to be stochastic. To settle this Assume that all the charge-discharge rates are divided into
problem, we choose to charge the battery with a higher prob- m parts, and there are M appliances. We design the cost-
ability for the lower unit price, and discharge the battery with a friendly differential privacy-protection scheme under dynamic
higher probability for the higher unit price. More specifically, policy (CDP2 scheme, for short), as shown in Algorithm 3.
in order to charge battery with higher probability, is moved
towards + (Di ), till the price reaches a local minimal Algorithm 3 The specification of CDP2 scheme
price p(tl ). Similarly, is moved towards + (Di ) to Input: , , , , C, c(i 1), {dij |j [1, M ]}, pmin , pmax
discharge battery with higher probability, till the price arrives Output: n(i).
M
at a local maximal price p(th ), as shown in Figure 1. Besides 1. (Di ) = j=1 (dij )  
cost, privacy has also to be considered under static pricing 2. For all k, l M , f = max dik dil 
policy. The parameter of Laplace distribution is best equal 3. For all j m
to 0, in order to preserve privacy [21], [22]. Therefore, we 4. Armj = + (Di ) + j(+)
assume that the weight of cost is set to w, (0 w 1). Then 5. Pr[Armj ] = 1/m, Rj = 0
m

we have 6. Armi {Pr[Armi ]|i [1, m]}

( + ) ( + ) 7. = Armi , = f /
= w((p(i)p(tl )) ++(Di )) (7)
p(th ) p(tl )
+(Di ) +(Di )
8. T = 12 e + 12 e 1
|x|

Assume there are M appliances. We design the cost-friendly 9. pdf (x) = e 2T
differential privacy-protection scheme under static pricing pol- 10. Do
icy (CDP1 scheme, for short). The specification of CDP1 11. n(i) pdf (x)
scheme is shown in Algorithm 2. 12.While(n(i) + c(i 1) > C||n(i) + c(i 1) < 0)
13. c(i) = n(i) + c(i 1)
C. The Cost-friendly Differential Privacy-preserving Scheme 14. Ri = w|Arm
m i | + (1 w)|Armi Arm0 |
under Dynamic Pricing Policy 15. T R = j=1 (Rj )
16. For all j m, Pr[Armj ] = (T R Rj )/T R
The real-time unit electricity price is uncertain to the
17. Return n(i)
customer under dynamic pricing policy [16], [17]. Hence,

1949-3053 (c) 2016 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TSG.2016.2585963, IEEE
Transactions on Smart Grid
JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2015 5

VI. T HEORETICAL A NALYSIS Therefore, (, ) differential privacy is achieved in this case.

In this section, we prove the BDP scheme achieves differen- Step 2. For all i, we show that the probability of c(i) <
tial privacy, and prove both CDP1 and CDP2 schemes achieve or c(i) > (C ) is bounded.
differential privacy and save the cost simultaneously. (1) For the probability of c(i) < :
Since n(i) = c(i) c(i 1) and 0 c(i 1) C, we
have Pr[c(i) < ] = Pr[n(i) < c(i 1) ] Pr[n(i)
A. Privacy Analysis D(n(i))
E(n(i)) < E(n(i))] [+E(n(i))] 2

Theorem 1. BDP scheme achieves differential privacy. (2) For the probability of c(i) > (C ):
Pr[c(i) > (+)] Pr[n(i) > C +(C )] = Pr[n(i)
Proof. The proof contains two steps. The first step is to prove D(n(i))
the BDP scheme achieves (, ) differential privacy at time i, E(n(i)) > E(n(i))] [+E(n(i))] 2
D(n(i)) D(n(i))
when c(i) (C ). In this case, the energy left in We set = [+E(n(i))]2 + [+E(n(i))]2

the battery c(i) must meet the requirement of all the possible In the Appendix, we prove that E(n(i)) and D(n(i)) are
charge/discharge rates, because n(i) . Then we prove two fixed numbers, given ,,,,, and (Di ).
the probability of c(i) < or c(i) > (C ) is bounded In sum, we have
for all i. Pr[o(i) = (Di ) + n(i)] = (1 ) Pr[o(i) = (Di ) + n(i)]
Step 1. For c(i) (C ): + Pr[o(i) = (Di ) + n(i)]
Assume that Di and Di consist of all appliances where only
one appliance is different. Since o(i) = (Di )+n(i), we have (1 ) (e Pr[o(i) = (Di ) + n (i)] + ) + 1
e Pr[o(i) = (Di ) + n (i)] + ( + )
Pr[o(i) = (Di ) + n(i)]
Pr[o(i) = (Di ) + n (i)] Therefore, (, + ) differential privacy is achieved in this
o(i)(Di )+x e |x 1|
case.

o(i)(Di ) 2T1 dx
= lim , We next prove both CDP schemes achieve differential
x0 o(i)(Di )+x |x2 |
e privacy.
o(i)(Di ) 2T2 dx
Theorem 2. CDP1 and CDP2 schemes achieve differential
where
privacy.
1 +(Di )1 1 +(Di )1
T1 = e e 1 Proof. The only difference between CDP1/CDP2 scheme and
2 2
1 +(Di )2 1 +(Di )2 BDP scheme is the selection of . Owing to the Equation 7,
T2 = e e 1 is always bounded in CDP1 and CDP2 schemes, because
2 2
Here l 1 = 2 = 0 u , and l is the minimum of (Di ) is bounded. Consequently, the proof for BDP scheme
is also valid for the CDP1 and CDP2 schemes as well.
all the  . u is the maximum of all the . f =
 possible
max dik dil  for all the possible k, l and i, = f /, and
B. Cost Saving Analysis
T1 , T2 > 0. Since = |1 2 | = 0 |l h |, we have
We first prove CDP1 scheme saves the cost in this section.
o(i)(Di )+x e
|x1 |
e
|o(Di )1 |

dx
lim
o(i)(Di ) 2T1
= 2T1 Theorem 3. Given ,,,, C, c(i 1), (Di ), and {p(i)}
x0 o(Di )+x e
|x2 |

|o(D )2 |
i CDP1 scheme satisfies E( i (p(i) n(i))) 0 for all i.
dx e


o(i)(Di ) 2T2 2T2
Proof. Since + < 0 and (Di ) 0, we have E( i (p(i)
T2 |(Di )(Di )+2 1 | T2 |(Di )(Di )|+|2 1 |
= e e n(i))) i {p(i) w ((p(th ) p(tl )) (+)(+)
p(th )p(tl ) + +
T1 T1
+l (Di ))} = i {p(i) w ( + (Di ))} 0
1 +
1
u
T2 2e
+ 21 e
ee e e We then indicate that CDP2 scheme also saves the cost.
T1 1 l 1
1
u
2e + 2e

Note that which arm is chosen does not rely on the price,
Since because Ri is independent with p(i), for all i.
+
1 +
1
u l
+ 12 e Theorem 4. Given ,,,,C,c(i1),(D
i ), pmin and pmax ,
2e

1 l 1
ee CDP2 scheme satisfies E( t (p(i) n(i))) 0 for all i.
+ 2e 1
u
2e
1 + u
+ 12 e
+l

Proof. m expectation of cost is E( i (p(i)
The math n(i))) =
2e 1


=e + e ( l e 1) E( i (p(i) j=1 ((1 Rj /T R) Armj )) E( i (p(i)
u
1
2e + 12 e 1 Armj )) = E( i p(i)) E(Armj )
For Armj 0, Rj = w|Armj |+(1w)(Armj Arm0 ) =
we assume that = Pr[o(i) = (Di ) + n (i)], where
(Armj Arm0 ) + w Arm0 , so Rj is the minimum when
1 + u
+ 12 e
+l
1 Armj = 0. Additionally, for Armi < 0, Rj = (Armj
2e

= e( u
e 1) (8) Arm0 )w(2Armj Arm0 ), thus Rj is the minimum when
1 l
2e + 12 e 1 Armj = Arm0 0. Since the probability to chose Armj
We have Pr[o(i) = (Di ) + n(i)] = e Pr[o(i) = (Di ) + is based on Ri and E(Armj ) 0, we have E( i (p(i)
n (i)] + . n(i))) 0.

1949-3053 (c) 2016 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TSG.2016.2585963, IEEE
Transactions on Smart Grid
JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2015 6

TABLE II: Default value of all the parameters Square Price Sine Price
0.025 0.025
t 0.25 Hours 0.1
6.081 kWh 0 kWh
-8 kW 8 kW 0.02 0.02

Price ($)

Price ($)
C 4 kWh c(0) 0 kWh
w 0.5 m 100 (Arms) 0.015 0.015
pmax 0.02109 $/kWh pmin 0.00704 $/kWh
0.01 0.01

0.005 0.005
VII. E XPERIMENTAL A NALYSIS 0 50 100 0 50 100
Time (0.25 Hour) Time (0.25 Hour)
Although differential privacy maintains the privacy loss Triangle Price Random Price
at about the same level, we still need to quantitatively e- 0.025 0.025
valuate the total privacy loss. Therefore, we first apply the
traditional mutual information metric to compare the global 0.02 0.02

Price ($)

Price ($)
privacy leakage of CDP1 and CDP2 schemes with MBE, 0.015 0.015
PRIVATUS and OPPEM schemes in this section. Since CDP1
and CDP2 scheme achieves differential privacy, we then show 0.01 0.01
the relationship between and for CDP1 and CDP2 scheme.
0.005 0.005
We next compare the cost saving for CDP1 and CDP2 schemes 0 50 100 0 50 100
Time (0.25 Hour) Time (0.25 Hour)
under different pricing policies. Finally, we also compare the
cost saving for different weights of cost in CDP1 and CDP2 Fig. 2: Different pricing policies
schemes.
We first compare the global privacy loss of CDP1 and CDP2
Mutual Information with Square Price Mutual Information with Sine Price
schemes with MBE, PRIVATUS, OPPEM schemes. To show 6 6
the stability of both CDP schemes, multiple experiments are MBE OPPEM PRIVATUS MBE OPPEM PRIVATUS
Mutual Information

Mutual Information
CDP1 CDP2 CDP1 CDP2
conducted with different capacities of battery and different
4 4
TOU pricing policies. Here, we use the dataset REDD [25]
from MIT. We extract the average electricity consumption at
2 2
the interval of 15 minutes for three different houses as the
customers electric consumption information. The minimum
power that the adversary can distinguish is assumed to be 0 0
H1 H2 H3 H1 H2 H3
0.001 kW. The lowest and highest price is from Salt River Houses Houses

Project TOU price plans [16]. The default values of all the Mutual Information with Triangle Price Mutual Information with Random Price
parameters are specified in Table II. 6 6
MBE OPPEM PRIVATUS MBE OPPEM PRIVATUS
Mutual Information

Mutual Information

Since all the delta values of two adjacent meter readings CDP1 CDP2 CDP1 CDP2
and all the values of meter readings are both useful to the 4 4
adversaries [13], we define two kinds of mutual information
M I0 and M I1 as follows. Assume that (Di ) = (Di ) 2 2
(Di1 ), and o (i) = o(i) o(i 1), we have
Pr( (i), o (i)) 0 0
M I0 = Pr( (i), o (i)) log H1 H2 H3 H1 H2 H3

i
Pr( (i) Pr(o (i))) Houses Houses
(i) o (i)
(9) Fig. 3: Maximal privacy loss in three houses
Pr((i), o(i))
M I1 = Pr((i), o(i)) log
i
Pr((i) Pr(o(i)))
(i) o(i)
(10) We then show the relationship between and for CDP1
50 experiments are run to compute the average for all the and CDP2 schemes in Figure 4. We can see that the larger
schemes. Figure 2 shows four pricing policies (square, sine, is, the smaller is. Besides, the value of is always less
triangle and random). The first three pricing policies belong than 0.1 in our schemes. This guarantees that the privacy is
to static policy, while the random pricing policy simulates the protected about the same level in our experiments.
dynamic policy. For each policy, there are 24/0.25 = 96 unit Next, we compare the cost saving of CDP1 and CDP2
prices in a day. schemes with MBE, PRIVATUS and OPPEM schemes. The
Figure 3 shows maximal privacy loss for all the schemes parameters are the same as that in Table II. A negative
in three different houses, respectively. The smaller M I0 and value indicates that the customer earns money by charging or
M I1 are, the less the privacy loss is. Moreover, we choose the discharging the battery. From Figure 5, both CDP1 and CDP2
higher value between M I0 and M I1 as the final privacy loss. schemes truly save the cost during in all the experiments.
From the results, we can see that the privacy loss of CDP1 Finally, the customers cost saving is compared under differ-
and CDP2 schemes are no bigger than that of the other three ent weights for both CDP1 and CDP2 schemes. Specifically,
schemes. the weight of cost changes from 0 to 1, as shown in Figure 6.

1949-3053 (c) 2016 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TSG.2016.2585963, IEEE
Transactions on Smart Grid
JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2015 7

Epsilon and Delta with Square Price Epsilon and Delta with Sine Price Weight and Cost with Square Price Weight and Cost with Sine Price
0.06 0.06 0.4 0.2
CDP1 CDP1 CDP1 CDP1
CDP2 CDP2 CDP2 CDP2
0.2 0.1
0.04 0.04
Delta

Delta

Cost

Cost
0
0.02 0.02 0
0.1
0.2
0 0
0.1 0.2 0.3 0.4 0.5 0.1 0.2 0.3 0.4 0.5 0.2
Epsilon Epsilon 0 0.2 0.4 0.6 0.8 1 0 0.2 0.4 0.6 0.8 1
Weight Weight
Epsilon and Delta with Triangle Price Epsilon and Delta with Random Price
0.06 0.06 Weight and Cost with Triangle Price Weight and Cost with Random Price
CDP1 CDP1 0.2
CDP2 CDP2 CDP1 0.5 CDP1
0.04 0.04 CDP2 CDP2
0.1
Delta

Delta

Cost

Cost
0.02 0.02 0
0.5
0.1
0 0
0.1 0.2 0.3 0.4 0.5 0.1 0.2 0.3 0.4 0.5 1
Epsilon Epsilon 0.2
0 0.2 0.4 0.6 0.8 1 0 0.2 0.4 0.6 0.8 1
Weight Weight
Fig. 4: The relationship between and in the house 1
Fig. 6: The weight of cost in the house 1
Cost Saving with Square Price Cost Saving with Sine Price
5
MBE OPPEM PRIVATUS MBE OPPEM PRIVATUS
2
CDP1 CDP2 CDP1 CDP2 CDP2 schemes were smaller than that for the existing schemes.
0 Additionally, our schemes supports both static and dynamic
0
Price

Price

pricing policies. Future efforts will focus on investigating

5 the batterys capacity loss and customers electricity usage
2
habit, in order to precisely depict the battery and reduce
4 10 more cost. Besides, more strategies, such as epsilon-greedy or
H1 H2 H3 H1 H2 H3
epsilon-decreasing strategy, of solving multiple-armed bandit
Houses Houses problem [23], [24] will be tried to decrease privacy leakage.
Cost Saving with Triangle Price Cost Saving with Random Price
5
MBE OPPEM PRIVATUS
1
MBE OPPEM PRIVATUS ACKNOWLEDGMENT
CDP1 CDP2 CDP1 CDP2
0 The corresponding author is Liehuang Zhu. This paper
0
is supported by National Science Foundation grants CNS-
Price

Price

5 1 1262275, CNS-1262277 and CNS-1318948, National Natural

2
10
3 R EFERENCES
H1 H2 H3
Houses
Fig. 5: Maximal cost saving in three houses
The trend of cost goes down under all the pricing policies, with
the increasing of the weight. This represents that the customer
will save more money if the weight of cost increases.
VIII. C ONCLUSIONS AND F UTURE W ORK
In this paper, we introduced two cost-friendly differential
privacy-preserving schemes under static and dynamic time-
of-use pricing policies. Theoretical analysis proved that both
schemes attained the goals of preserving privacy and saving
cost simultaneously, when the limited capacity and charge-
discharge rate of the battery was considered. Experimental
analysis showed that the privacy loss for both CDP1 and
Science Foundation of China No.61271512 and No.61300177.
H1 H2 H3
Houses
[1] X. Fang, S. Misra, G. Xue, and D. Yang, Smart grid-the new and
improved power grid: A survey, IEEE Communications Surveys and
Tutorials, vol. 14, no. 4, pp. 944980, 2012.
[2] E. Commission, Cost-benefit analyses and state of play of s-
mart metering deployment in the eu-27, http://eur-lex.europa.eu/legal-
content/EN/TXT/PDF/?uri=CELEX:52014SC0189, 2014.
[3] K. Ehrhardt-Martinez, K. A. Donnelly, and J. A. Laitner, Advanced
metering initiatives and residential feedback programs: A meta-review
of household electricity-saving opportunities. American Council for an
Energy-Efficient Economy, 2010.
[4] F. Hasson, The path of the smart grid, IEEE Power and Energy
Magazine, vol. 8, no. 1, pp. 1828, 2010.
[5] D. Sarah, The effectiveness of feedback on energy consumption,
Working Paper, 2006.
[6] P. McDaniel and S. Mclaughlin, Security and privacy challenges in the
smart grid, IEEE Security and Privacy, vol. 7, no. 3, pp. 7577, 2009.
[7] Z. Michael and K. Roth, Nonintrusive appliance load monitoring:
Review and outlook, IEEE Transactions on Consumer Electronics, pp.
7684, 2011.
[8] D. J. Hess and J. Coley, Wireless smart meters and public acceptance:
The environment, limited choices, and precautionary politics, Public
Understanding of Science, vol. 23, no. 6, pp. 688702, 2014.

1949-3053 (c) 2016 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TSG.2016.2585963, IEEE
Transactions on Smart Grid
JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2015 8

[9] S. R. Rajagopalan, L. Sankar, S. Mohajert, and H. V. Poor, Smart Assume L = + (Di ) and H = + (Di ).
meter privacy: A utility-privacy framework, in Proceedings of the 2nd Given ,,,,, and (Di ), and E(x), the variance D(x) is
IEEE International Conference on Smart Grid Communications, 2011,
pp. 190195. computed as follows:
[10] G. Kalogridis, C. Efthymious, S. Z. Denic, T. A. Lewis, and R. Cepeda, + L
Privacy for smart meters: Towards undetectable appliance load sig- D(x) = (x E(x)) f (x)dx =
2
(x E(x))2 f (x)dx
natures, in Proceedings of the 1st IEEE International Conference on H
Smart Grid Communications, 2010, pp. 232237.  


2
[11] S. McLaughlin, P. McDaniel, and W. Aiello, Protecting consumer e x 
privacy from electric load monitoring, in Proceedings of the 18th ACM = (x 2x + 2)e  E(x)e (x 1)ex  H
2
conference on Computer and Communications Security, 2011, pp. 87 2T

98.   L
 


[12] W. Yang, N. Li, Y. Qi, W. Qardaji, S. McLaughlin, and P. McDaniel, E2 (x)e x 2 e 2 x
Minimizing private data disclosures in the smart grid, in Proceedings + e  (x 2x + 2)e 
of the 16th ACM conference on Computer and Communications Security, 2T H 2T

2012, pp. 415427.  L  L
E2 (x)e x 

[13] J. Zhao, TaehoJung, Y. Wang, and X. Li, Achieving differential privacy 
of data disclosure in the smart grid, in 33rd IEEE Conference on E(x)e (x 1)ex  e 
2T
Computer Communications, 2014, pp. 505512.
[14] M. Backes and S. Meiser, Differentially private smart metering with
battery recharging, Data Privacy Management and Autonomous Spon-
taneous Security, pp. 194212, 2014.
[15] K. Jessoe, D. Rapson, and J. B. Smith, The effect of a mandatory
time-of-use pricing reform on residential electricity use, 2012.
[16] L. Yang, X. Chen, J. Zhang, and H. V. Poor, Optimal privacy-preserving
energy management for smart meters, in Proceedings of the 33rd IEEE Zijian Zhang (zhangzijian@bit.edu.cn) is an assistant professor in the
Conference on Computer Communications, 2011, pp. 513521. Department of Computer Science at Beijing Institute of Technology. He was
[17] X. Liang, X. Li, R. Lu, X. Lin, and X. Shen, Udp: Usage-based dynamic a visiting scholar in the Computer Science and Engineering Department of
pricing with privacy preservation for smart grid, IEEE Transactions on the State University of New York at Buffalo in 2015. His research interests
Smart Grid, vol. 4, no. 1, pp. 141150, 2013. include Smart Grid, Data Privacy and Mobile Security.
[18] J. Koo, X. Lin, and S. Bagchi, Privatus: Wallet-friendly privacy protec-
tion for smart meters, in Proceedings of the 17th European Symposium
on Research in Computer Security, 2012, pp. 343360.
[19] C. E. Shannon, Communication theory of secrecy systems, Bell
Systems Technical Journal, vol. 28, no. 4, pp. 656715, 2008.
[20] C. T. M and T. J. A, Elements of Information Theory. New York, NY,
USA: Wiley-Interscience, 1991. Zhan Qin (zhanqin@buffalo.edu) is currently working toward his Ph.D.
[21] D. Cynthia and L. Jing, Differential privacy and robust statistics, degree at the director of the Ubiquitous Security and Privacy Research
in Proceedings of the 41st Annual ACM Symposium on Theory of Laboratory (UbiSeC) in the Computer Science and Engineering Department
Computing. New York, NY, USA: ACM, 2009, pp. 371380. of the State University of New York at Buffalo, NY, USA. His current research
[22] D. Cynthia, Differential privacy, in Proceedings of the 33rd Interna- interests focus on Data Privacy, Crowdsourcing Security and Smart Grid.
tional Conference on Automata, Languages and Programming - Volume
Part II, ser. ICALP06. Berlin, Heidelberg: Springer-Verlag, 2006, pp.
112.
[23] A. Peter, C.-B. Nicolo, F. Yoav, and S. R. E, Gambling in a rigged
casino: The adversarial multi-armed bandit problem, in Proceedings of
the 36th Annual Symposium on Foundations of Computer Science, 1995,
pp. 322331. Liehuang Zhu (liehuangz@bit.edu.cn) is a professor in the Department of
[24] N. C.-B. Sebastien Bubeck, Regret analysis of stochastic and non- Computer Science at Beijing Institute of Technology. He is selected into the
stochastic multi-armed bandit problems, Foundations and trends in Program for New Century Excellent Talents in University from Ministry of
machine learning, vol. 5, no. 1, pp. 1122, 2012. Education, P.R. China. His research interests include Internet of Things, Cloud
[25] J. Z. Kolter and M. J. Johnson, Redd: A public data set for energy Computing Security, Internet and Mobile Security.
disaggregation research, in Proceedings of the SustKDD Workshop on
Data Mining Applications in Sustainability, 2011.

A PPENDIX A
We first show that pdf (x) is a valid probability density
function here. Since T 0, we have pdf (x) 0. In addition, Jian Weng (cryptjweng@gmail.com) is a professor in College of Information
Science and Technology, Jinan University. He is selected into the Program for
+ +(Di ) |x| New Century Excellent Talents in University from Ministry of Education, P.R.
e T China. His research interests include Cryptography and Information Security.
F (x) = f (x)dx = dx = =1
+(Di ) 2T T
Next, we compute the expected value E(x) of the probabil-
ity distribution, given ,,,,, and (Di ).
+ +(Di )
E(x) = xf (x)dx = xf (x)dx Kui Ren (kuiren@buffalo.edu) is an associate professor and the director of
+(Di ) the Ubiquitous Security and Privacy Research Laboratory (UbiSeC) in the
+(Di ) Computer Science and Engineering Department of the State University of New
x x x x York at Buffalo. His current research interests focus on Data and Computation
= e dx + e dx Outsourcing Security in the context of Cloud Computing, Wireless Systems
+(Di ) 2T 2T
Security inspired by Physical-layer Properties, and Crowdsourcing-based
  +(D i)
  Large-scale Information Infrastructure Building.

e x e x

= (x 1)e  + (x 1)e 
2T +(Di ) 2T

1949-3053 (c) 2016 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.