Smart Meter Privacy with Renewable Energy and an Energy Storage Device

TL;DR

This paper investigates how renewable energy sources and rechargeable batteries can enhance smart meter privacy by reducing information leakage, with theoretical analysis and numerical results demonstrating privacy gains and the importance of storage capacity.

Contribution

It provides a novel information-theoretic framework for quantifying smart meter privacy considering renewable energy and storage, including explicit expressions for extreme cases and numerical analysis for finite capacity.

Findings

Privacy improves with more renewable energy availability.

Larger storage capacity enhances privacy gains.

Infinite storage capacity achieves minimal information leakage.

Abstract

A smart meter (SM) measures a consumer's electricity consumption and reports it automatically to a utility provider (UP) in almost real time. Despite many advantages of SMs, their use also leads to serious concerns about consumer privacy. In this paper, SM privacy is studied by considering the presence of a renewable energy source (RES) and a rechargeable battery (RB), which can be used to partially hide the consumer's energy consumption behavior. Privacy is measured by the information leakage rate, which denotes the average mutual information between the user's real energy consumption and the energy requested from the grid, which the SM reads and reports to the UP. The impact of the knowledge of the amount of energy generated by the RES at the UP is also considered. The minimum information leakage rate is characterized as a computable information theoretic single-letter expression in the two extreme cases, that is, when the battery capacity is infinite or zero. Numerical results are presented for the finite battery capacity case to illustrate the potential privacy gains from the existence of an RB. It is shown that, while the information leakage rate decreases with increasing availability of an RES, larger storage capacity is needed to fully exploit the available energy to improve the privacy.

Figures

Tables

Table 1. Table I: Specifications of some currently available residential batteries.

Residential Battery	Capacity (kWh)	RB Charging Peak Power (kW)	RB Discharging Peak Power (kW)
Sunverge SIS-6848 [35]	$7.7$, $11.6$, $15.5$, $19.4$	$6.4$	$6$
SonnenBatterie eco [36]	$4-16$	$3-8$	$3-8$
Tesla Powerwall [37]	$13.5$	$5$	$5$
LG RESU 48V [38]	$2.9$, $5.9$, $8.8$	$3$, $4.2$, $5$	$3$, $4.2$, $5$
Panasonic Battery System LJ-SK84A [39]	$8$	$2$	$2$
Powervault G200-LI-2/4/6KWH [40]	$2$, $4$, $6$	$0.8$, $1.2$	$0.7$, $1.4$
Orison Panel [41]	$2.2$	$1.8$	$1.8$
Simpliphi PHI 3.4 - 48V [42]	$3.4$	$1.5$	$1.5$

Table 2. Table II: Distribution of average household power consumption (resolution refers to the measurement frequency). Values in each column indicate the percentage of time the average consumption falls into the corresponding interval.

Source	Location	Resolution	Time Frame	# of Houses	$[\mathrm{𝟎},0.5]$ kW	$(0.5,\mathrm{𝟏}]$ kW	$(\mathrm{𝟏},\mathrm{𝟐}]$ kW	$(\mathrm{𝟐},\mathrm{𝟑}]$ kW	$(\mathrm{𝟑},\mathrm{𝟒}]$ kW	$(\mathrm{𝟒},+\infty )$ kW
[43]	Texas	$60$ mins	01/01/2016 - 31/05/2016	$512$	$38$	$30$	$20$	$7$	$3$	$2$
			01/01/2015 - 31/12/2015	$703$	$36$	$26$	$20$	$9$	$5$	$4$
			01/01/2014 - 31/12/2014	$720$	$39$	$25$	$20$	$8$	$4$	$4$
			01/01/2013 - 31/12/2013	$419$	$35$	$25$	$21$	$9$	$5$	$5$
			01/01/2012 - 31/12/2012	$182$	$31$	$26$	$24$	$10$	$5$	$5$
[44]	UK	$2$ mins	01/05/2010 - 31/07/2011	$251$	$18$	$24$	$47$	$11$	$0$	$0$
[45]	Netherlands	$1$ sec	05/07/2015 - 05/12/2015	$1$	$98$	$1.8$	$0.4$	$0$	$0$	$0$
[46]	France	$1$ min	16/12/2006 - 26/11/2010	$1$	$47$	$9$	$28$	$8$	$4$	$2$

Table 3. Table III: Distribution of average power generated by residential photovoltaic systems. Values in each column indicate the percentage of time the average generation falls into the corresponding interval.

Source	Location	Resolution	Time Frame	# of Houses	$\mathrm{𝟎}$ kW	$(\mathrm{𝟎},0.5]$ kW	$(0.5,\mathrm{𝟏}]$ kW	$(\mathrm{𝟏},\mathrm{𝟐}]$ kW	$(\mathrm{𝟐},\mathrm{𝟑}]$ kW	$(\mathrm{𝟑},\mathrm{𝟒}]$ kW	$(\mathrm{𝟒},+\infty )$ kW
[43]	Texas	$60$ min	01/01/2012 - 31/05/2016	$351$	$49$	$17$	$7$	$9$	$7$	$6$	$5$
[47]	UK	$30$ min	01/01/2015 - 31/12/2015	$100$	$51.7$	$36.4$	$9.8$	$2$	$0.1$	$0$	$0$

Table 4. Table IV: Specifications of the solar panels studied in [ 47 ] . The values in each column indicate the percentage of solar panels that satisfy the corresponding property.

Solar Panel Area ($m^2$)					Solar Panel Cell Type		Nominal Installed Capacity (kWp)
$(0,15]$	$(15,20]$	$(20,25]$	$(25,30]$	$(30,+\infty )$	Monocrystalline	Polycrystalline	$(0,2]$	$(2,3]$	$(3,4]$	$(4,\infty )$
$5$	$35$	$44$	$15$	$1$	$93$	$7$	$4$	$36$	$59$	$1$

Table 5. Table V: Tuples and transition probabilities for the battery-independent policy when 𝒳 = ℰ = 𝒴 = { 0 , 1 } 𝒳 ℰ 𝒴 0 1 \mathcal{X}=\mathcal{E}=\mathcal{Y}=\{0,1\} .

${𝐁}_{𝐭}$	${𝐗}_{𝐭}$	${𝐄}_{𝐭}$	${𝐕}_{𝐭}$	${𝐘}_{𝐭}$	${𝐁}_{𝐭+\mathrm{𝟏}}$	Transition Probability
$B_t=0$	$0$	$0$	$0$	$0$	$0$	$\left(1-q_x\right)\left(1-p_e\right)$
	$0$	$1$	$0$	$0$	$1$	$\left(1-q_x\right)p_e$
	$1$	$0$	$0$	$1$	$0$	$q_x\left(1-p_e\right)$
	$1$	$1$	$0$	$1$	$1$	$q_x{p}_e\left(1-p_v\right)$
	$1$	$1$	$1$	$0$	$0$	$q_x{p}_e{p}_v$
	$0$	$0$	$0$	$0$	$B_t$	$\left(1-q_x\right)\left(1-p_e\right)$
	$0$	$1$	$0$	$0$	$\min \{B_t+1,B_{\max }\}$	$\left(1-q_x\right)p_e$
	$1$	$0$	$0$	$1$	$B_t$	$q_x\left(1-p_e\right)\left(1-p_v\right)$
	$1$	$0$	$1$	$0$	$B_t-1$	$q_x\left(1-p_e\right)p_v$
	$1$	$1$	$0$	$1$	$\min \{B_t+1,B_{\max }\}$	$q_x{p}_e\left(1-p_v\right)$
	$1$	$1$	$1$	$0$	$B_t$	$q_x{p}_e{p}_v$

Equations

$$0\le Y_t\le X_t,\forall t,$$

$$X_t-Y_t\le B_t+E_t,\forall t.$$

$$0\le X_t-Y_t\le \hat{P},\forall t,$$

$$\bar{\mathcal{Y}}(x_{t},e_{t},b_{t})\triangleq\\ \Big{\{}y_{t}\in\mathcal{Y}:[x_{t}-\min\{b_{t}+e_{t},\hat{P}\}]^{+}\leq y_{t}\leq x_{t}\Big{\}},$$

$$\displaystyle B_{t+1}=\min\Big{\{}B_{t}+E_{t}-(X_{t}-Y_{t}),B_{\max}\Big{\}},\quad\forall t.$$

$$f_t:{\mathcal{X}}^t\times {\mathcal{E}}^t\times {\mathcal{B}}^t\times {\mathcal{Y}}^{t-1}\to \mathcal{Y},\forall t,$$

$${\mathcal{I}}_f^i(B_{\max },\hat{P})\triangleq \underset{n\to \infty }{\lim }\frac{1}{n}I\left(X^n;Y^n\right),$$

$${\mathcal{I}}^i(B_{\max },\hat{P})\triangleq \underset{f\in \mathcal{F}}{\inf }\underset{n\to \infty }{\lim }\frac{1}{n}I(X^n;Y^n).$$

$$\mathcal{I}(\bar{P},\hat{P})=\underset{p_{Y|X}\in \mathcal{P}}{\inf }I\left(X;Y\right),$$

$${\tilde{p}}_{Y|X,B+E}:\mathcal{X}\times (\mathcal{B}+\mathcal{E})\to \mathcal{Y}.$$

$${\tilde{p}}_{Y|X,B+E}(y|x,b+e)=\{\begin{array}{ll}{p}_{Y|X}^{\ast }(y|x),& \text{if }x-y^{\ast }\le b+e\text{ and }{y}^{\ast }\ne x,\\ p_{Y|X}^{\ast }(y|x)+{\sum }_{\{y^{\prime }\in \mathcal{Y}:x-y^{\prime }>b+e\}}{p}_{Y|X}^{\ast }(y^{\prime }|x),& \text{if }{y}^{\ast }=x,\\ 0,& \text{if }x-y^{\ast }>b+e.\end{array}$$

$$\sum _{t=1}^n(X_t-Y_t)\le \sum _{t=1}^n{E}_t,\forall n.$$

$${\mathcal{I}}^i(\infty ,\hat{P})=\mathcal{I}({\bar{P}}_E,\hat{P}).$$

$$\displaystyle\frac{1}{n}I(X^{n};Y^{n})=\frac{1}{n}\Big{[}H(X^{n})-H(X^{n}|Y^{n})\Big{]}$$

$$\displaystyle=\frac{1}{n}\Bigg{[}\sum_{t=1}^{n}H(X_{t})-H(X_{t}|X^{t-1},Y^{n})\Bigg{]}$$

$$\displaystyle\geq\frac{1}{n}\Bigg{[}\sum_{t=1}^{n}H(X_{t})-H(X_{t}|Y_{t})\Bigg{]}$$

$$\displaystyle=\frac{1}{n}\Bigg{[}\sum_{t\in\mathcal{T}^{C}}I(X_{t};Y_{t}=Y^{*}_{t})+\sum_{t\in\mathcal{T}}I(X_{t};Y_{t}=X_{t})\Bigg{]}$$

$$\ge \frac{n-m}{n}{\mathcal{I}}^i(\infty ,\hat{P})+\frac{m}{n}H(X)\stackrel{n\to \infty }{\to }{\mathcal{I}}^i(\infty ,\hat{P}),$$

$${\bar{\mathcal{I}}}^i(\infty ,\hat{P})\triangleq \underset{f\in \mathcal{F}}{\inf }\underset{n\to \infty }{\lim }\frac{1}{n}I(X^n;Y^n|E^n).$$

$$\underset{n\to \infty }{\lim }$$

$$=\underset{n\to \infty }{\lim }\frac{1}{n}[I(X^n;Y^n)+I(E^n;X^n|Y^n)]$$

$$\ge \underset{n\to \infty }{\lim }\frac{1}{n}I(X^n;Y^n),$$

$${\mathcal{I}}^i(0)\triangleq \underset{\begin{array}{c}{p}_{Y|X}:p_{Y|X}={\sum }_{e\in \mathcal{E}}{p}_{Y|X,E}(y|x,e);\\ p_{Y|X,E}\in {\mathcal{P}}^i\end{array}}{\inf }I\left(X;Y\right),$$

$$\frac{1}{n}I(X^n;Y^n)=\frac{1}{n}\left[H(X^n)-H(X^n|Y^n)\right]$$

$$=\frac{1}{n}\left[\sum _{t=1}^{n}H(X_t)-\sum _{t=1}^{n}H(X_t|X^{t-1},Y^n)\right]$$

$$\ge \frac{1}{n}\left[\sum _{t=1}^{n}H(X_t)-H(X_t|Y_t)\right]$$

$$=\frac{1}{n}\sum _{t=1}^{n}I\left(X_t;Y_t\right)\ge \frac{1}{n}\sum _{t=1}^n{\mathcal{I}}^i(0)={\mathcal{I}}^i(0),$$

$${\bar{\mathcal{I}}}^i(0)=\underset{p_{Y|X,E}\in {\mathcal{P}}^i}{\inf }I\left(X;Y|E\right)=\text{mathbbm}{E}_E[\mathcal{I}(E,E)],$$

$$\frac{1}{n}$$

$$=\frac{1}{n}\left[H(X^n|E^n)-H(X^n|Y^n,E^n)\right]$$

$$\displaystyle=\frac{1}{n}\Bigg{[}\sum_{t=1}^{n}H(X_{t}|X^{t-1},E^{n})-H(X_{t}|X^{t-1},Y^{n},E^{n})\Bigg{]}$$

$$\ge \frac{1}{n}\left[\sum _{t=1}^{n}H(X_t|E_t)-H(X_t|Y_t,E_t)\right]$$

$$=\frac{1}{n}\sum _{t=1}^n\sum _{k=1}^{|\mathcal{E}|}{p}_E(E=e_k)I\left(X_t;Y_t|E_t=e_k\right)$$

$$\ge \frac{1}{n}\sum _{t=1}^n\sum _{k=1}^{|\mathcal{E}|}{p}_E(E=e_k)\mathcal{I}\left(e_k,e_k\right)$$

$$=\sum _{k=1}^{|\mathcal{E}|}{p}_E(E=e_k)\mathcal{I}\left(e_k,e_k\right)=\text{mathbbm}{E}_E\left[\mathcal{I}(E,E)\right],$$

$$I(X;Y,E)$$

$$\begin{gathered} {\mathcal{I}}^i(\infty ,1)=\mathcal{I}(p_e,1)= \\ \{\begin{array}{ll}{p}_e\log p_e-q_x\log q_x& \\ -(1-q_x+p_e)\times \log (1-q_x+p_e),& \text{if }{p}_e\le q_x,\\ 0,& \text{otherwise},\end{array} \end{gathered}$$

Full text

I Introduction

The transition from the legacy power distribution network to the new power grid paradigm, the so-called smart grid (SG), is rapidly ongoing. An SG provides many advantages for energy generation, transmission, distribution and consumption thanks to the use of information and communication technologies that enable SGs to monitor and control the power network more effectively [2]. In addition, an SG eases the integration of renewable energy sources (RESs), which is a fundamental factor in reducing our dependence on fossil fuels and moving on to a low carbon economy. A key feature of an SG is the advanced metering infrastructure, and in particular smart meters (SMs), which record and report the electricity consumption of a household. SMs that are currently being rolled out in the United Kingdom send measurements every $30$ minutes [3], whereas those in Texas send every $15$ minutes [4]. The frequency of SM measurements is expected to increase drastically in the near future when renewable energy integration increases and the energy market becomes more efficient by incorporating time-of-usage pricing and demand shifting [5].

The installation of SMs is rapidly advancing worldwide. For example, all European Union countries are required to have 80% SM adoption by 2020 and 100% by 2022 [6]. On the other hand, the information that is collected by SMs may be potentially used for other purposes, thereby raising the question of data privacy. By using nonintrusive appliance load monitoring (NILM) techniques, power consumption load profiles can reveal sensitive information, such as the users’ habits, presence at home and working hours, potential illnesses or disabilities, equipment being used, and even which TV channel is being watched [7]. First NILM devices were built in the 80s and were already able to detect the activity of some appliances by knowing their power signature [8]. Molina-Markham et al. [9] showed that it is possible to detect users’ activity by simply using off-the-shelf clustering and pattern recognition methods, even without any a priori knowledge of the appliances’ power signature. The current state of the art is to consider a factorial hidden Markov model to model the total consumption of various household appliances, whose solution is, however, NP hard. To solve this issue, [10] describes a computationally efficient method based on a semidefinite relaxation combined with randomized rounding.

I-A Privacy-Aware SM Techniques

To date, there are two main families of approaches that have been investigated to provide privacy to consumers. The first family includes approaches that process SM data before sending it to the UP, while approaches in the second family aim at modifying the actual user energy demand. Considered within the first family are methods such as data obfuscation, data aggregation and data anonymization. Data obfuscation, i.e., the perturbation of metering data by adding noise, is a classic method, and has been adapted to SGs in [11] and [12]. Among these methods, differential privacy [13], a well-established concept in the data mining literature based on distorting data to protect the privacy of individuals, is applied to SMs in [14]. Along these lines, authors in [15] provide a framework that measures the trade-off between altering data (privacy) and sharing them (utility). Data aggregation, proposed in [12], [16] and [17], considers aggregating power measurements over a group of households so that the UP is prevented from knowing individual consumptions. The aggregation can be performed with or without the help of a trusted third party. Data anonymization mainly considers resorting to pseudonyms rather than the real identities, as in [18] and [19].

The first family of approaches, however, suffer from a further privacy risk. In fact, the energy consumed by a user is provided directly from the grid, which is fully controlled by the distribution system operator (DSO), i.e., the entity that manages the power grid; and hence, the DSO can embed additional sensors to monitor the energy requested by a household or a business, without fully relying on SM readings. Moreover, any attacker, e.g., a thief or an intelligence agency, may decide to install a sensor for directly monitoring a specific household or business. Another disadvantage of data obfuscation methods is the mismatch between the reported values and the real energy consumption. This prevents the DSO from accurately monitoring the grid states and rapidly reacting to outages, energy theft or other problems. To address these problems, the second family of privacy-preserving approaches directly modifies the actual energy consumption profile of the user, called the input load rather than simply modifying the data sent to the UP. This can be done, for example, by filtering the energy via an energy storage device, i.e., a rechargeable battery (RB), as in [20, 21, 22, 23, 24, 25, 26], or by using an RES, as originally proposed in [24]. If we denote the energy received from the grid as the output load, the idea is to physically differentiate the output load with respect to the input load. Different heuristic algorithms have been proposed, such as the best-effort water-filling algorithm in [21] that aims at keeping the output load at its most recent value, or the stepping algorithm in [22] that quantizes the power demand into a step function. In [25] the problem is solved in the offline setting by taking the energy cost into account, while the online privacy problem is formulated as a Markov decision process in [26], and solved numerically in general, while a “single-letter” expression is provided for an independent and identically distributed (i.i.d.) input load. In [27] Fisher information is used as a measure of privacy and, by using the Cramér-Rao bound, the variance of the estimation error of any unbiased estimator of the household consumption is maximized by minimizing the trace of the Fisher information matrix. When considering also the presence of an RES, a single-letter solution is given for this problem in [28, 29, 30] under average and peak power constraints on the available RES. In [31] model predictive control is adopted to jointly optimize cost and and privacy in the presence of a battery and local energy generation.

In this paper, we adopt the latter approach, and focus on providing privacy by considering the presence of both an RES and an RB. We study privacy from an information theoretic point of view, and, for some scenarios, provide closed-form expressions for the best privacy performance achievable. A similar model, studied in [30], imposes only average and peak power constraints on the RES, which can be a microgrid, capable of providing any amount of energy at each time instant. However, the energy produced by an RES at each time instant is typically random, and its statistics depend on the energy source (e.g., solar, wind) and the energy generator specifications. In addition, the finite-capacity battery imposes further limitations on the available energy. Thus, in this paper we study the minimum amount of user’s energy consumption information leaked to the UP by taking into account instantaneous power constraints, as initially proposed in [1]. While the analysis in [1] is limited to the two extreme scenarios of zero and infinite battery capacity with a discrete-alphabet input load, here we also study the more practical scenario with a finite-capacity storage device, as well as a continuous-alphabet input load.

Following up on [23], [24] and [30], we model user’s energy consumption profile as a randomly generated time series whose statistics are known by the UP, and measure the user’s information leakage by the average mutual information between the input and output load vectors, i.e., between the real energy consumption profile of the appliances and the SM readings, which is called the information leakage rate. Mutual information between random variables $X$ and $Y$, $I(X;Y)$, is as a measure of dependence between $X$ and $Y$, which is equal to zero if and only if $X$ and $Y$ are independent. We can also interpret mutual information as the reduction in the uncertainty of the UP about the real energy consumption of the appliances, $X^{n}$, after receiving the SM measurements, $Y^{n}$. Thus, minimizing mutual information can be interpreted as a way of improving privacy for SM users. Moreover, mutual information as a privacy measure does not depend on the technological implementation of load monitoring algorithms, and therefore, provides statistical privacy guarantees independent of the computational power of the attacker or the particular monitoring algorithm employed. Mutual information as a measure of privacy leakage has also been considered in other domains, see for example [32, 33, 34].

I-B Current Home Batteries and Typical Household Input Loads

In this section we briefly summarize the specifications of residential batteries available in the market and the general statistics of household energy consumption and generation to illustrate the feasibility of privacy-protection through energy management. Table I lists the storage capacity and peak power for some of the currently available batteries for residential use. It is noteworthy that the capacities are in the range of few kWh. A typical household’s average energy consumption also lies within the same range, as shown in Table II, where we report the distribution of the average user power consumption over different years obtained from various databases, with different time resolutions. From the Dataport database [43] we observe that, independently from the period considered, the average user demand is less than $2$ kWh for $80-90\%$ of the time. Current batteries charged at full capacity would then be able to satisfy the demand for a few hours only.

In Table III we have also included information about the amount of average power generated via a rooftop solar panel. Locations, technology as well as inclinations and sizes of panels vary, as shown in Table IV for one of the databases considered, where kWp denotes the kilowatt peak, i.e., the output power achieved by a panel under full solar radiation. As expected, around $50\%$ of time, i.e., at night, no energy is generated at all, while there are differences in the distribution of the average values for the two databases considered, due to the different areas considered. If we compare these values with those in Table I, we can see that the capacities of current batteries are sufficient to store many hours of average solar energy generated by the solar panels most of the time, for which the infinite battery assumption may be an accurate model.

I-C Main Contributions

The main contributions of this paper can be summarized as follows:

We provide computable closed-form single-letter expressions for the minimum information leakage rate when the battery capacity is zero and infinite. We provide detailed proofs for these results, which have been stated in [1] without proofs. These two asymptotic performance results can also be considered as upper and lower bounds on the achievable privacy performance for a more practical SM system with a finite-capacity battery. 2. 2.

For these scenarios, we study the information leakage rate also considering the availability of the RES information at the UP, which provides additional side information to the UP. 3. 3.

For a finite-capacity battery scenario, we propose a suboptimal parameterized energy management policy, and optimize the policy parameters using a policy search technique that exploits stochastic gradient descent. We show numerically that the performance of the proposed energy management policy approaches the one with an infinite battery even with a relatively small battery size. This shows the efficacy of the proposed privacy preservation scheme. 4. 4.

We show that the information leakage rate decreases with the rate of the available RES, and that a larger RB is needed to fully exploit the available energy to improve the privacy.

The remainder of the paper is organized as follows. In Section II the system model is introduced. In Section III an ideal system with an infinite-capacity battery is studied, while in Section IV another extreme case with no energy storage is considered. For both scenarios, we also study the case in which the UP knows the realizations of the renewable energy process. In Section V we study the binary scenario, while in Section VI we propose achievable schemes for the generic finite battery capacity scenario, and present the corresponding numerical results. In Section VII a continuous input load is considered, while conclusions are drawn in Section VIII.

I-D Notation

Random variables (RVs) are denoted by capital letters $X,Y$, their realizations by lower-case letters $x,y$, and the corresponding alphabets by calligraphic letters $\mathcal{X},\mathcal{Y}$. The probability distribution of a RV $X$ taking values in $\mathcal{X}$ is denoted by $p_{X}$. For integers $0<a<b$, $X_{a}^{b}$ denotes the sequence $(X_{a},X_{a+1},\ldots,X_{b})$, while $X^{b}\triangleq X_{1}^{b}$. All logarithms and exponentials are in base $2$, unless specified otherwise.

II System Model

A discrete time system model is adopted as depicted in Figure 1. $X_{t}\in\mathcal{X}$ is the total amount of power demanded by a user in time slot $t$, where $\mathcal{X}=[0,\ldots,X_{\max}]$, while $Y_{t}\in\mathcal{Y}$ is the energy received from the UP at time $t$, where $\mathcal{Y}=[0,\ldots,Y_{\max}]$. We call $X_{t}$ as the input load and $Y_{t}$ as the output load to simplify the terminology. For simplicity, we assume that the entries of the input load sequence $\{X_{t}\}_{t=1}^{\infty}$ are i.i.d. with distribution $p_{X}$. In time slot $t$, $E_{t}\in\mathcal{E}$ units of energy are generated from the RES, which becomes available to the energy management unit (EMU) at the beginning of time slot $t$. The entries of the renewable energy sequence $\{E_{t}\}_{t=1}^{\infty}$ are also i.i.d. with distribution $p_{E}$ and alphabet $\mathcal{E}=[0,\ldots,E_{\max}]$, while the average renewable energy rate is denoted by $\bar{P}_{E}\triangleq\mathbbm{E}[E]$. We further consider the presence of an RB in which the renewable energy can be stored for future use. The state of charge (SOC) of the battery at time $t$ is $B_{t}\in[0,\ldots,B_{\max}]$, and its capacity is $B_{\max}$. We assume no losses in the battery charging and discharging processes.

The EMU always satisfies user’s energy demands by drawing energy from either the UP or the RB; that is, outages or demand shifting are not allowed. As a consequence, we have $X_{\max}\geq Y_{\max}\geq X_{\max}-B_{\max}$. We do not allow extra energy to be drawn from the grid and then wasted. This could provide additional privacy, albeit at a significantly higher energy cost. Also, the battery is exclusively for storing the generated renewable energy, and it cannot be recharged with grid energy. While storing grid energy in the battery to be supplied later to the appliances can provide additional privacy [23], here we limit the use of the battery to renewable energy storage to isolate and understand the privacy benefits of RESs. Hence, we impose

[TABLE]

while $X_{t}-Y_{t}$ is the amount of energy obtained from the RB in time slot $t$. The energy retrieved from the battery must be smaller than the energy available in it, i.e.,

[TABLE]

We also consider a peak power constraint $\hat{P}$ on the amount of energy that can be requested at any time from the RB, i.e.,

[TABLE]

and for the rest of the paper we assume that $\bar{P}_{E}\leq\hat{P}$.

Given $(X_{t},E_{t},B_{t})=(x_{t},e_{t},b_{t})$ and the constraints (1), (2), and (3), the set of feasible energy requests at time $t$ is

[TABLE]

where $[a]^{+}=a$ if $a>0$, and [math] otherwise.

The battery update equation can be written as

[TABLE]

We aim at designing energy management policies $f=(f_{1},f_{2},\ldots)$ that decide on the amount of energy to request from the UP at each time $t$, given the previous values of input load $X^{t}$, renewable energy $E^{t}$, battery SOCs $B^{t}$, and output load $Y^{t-1}$, i.e.,

[TABLE]

while satisfying (4) and (5), where $f\in\mathcal{F}$ and $\mathcal{F}$ denotes the set of feasible policies, i.e., which produce output load values that satisfy the RB and RES constraints at any time, as well as the battery update equation.

We measure privacy via the information leakage rate, defined as the average mutual information rate between the actual user energy consumption and the energy received from the grid, which also corresponds to the reported SM data, i.e.,

[TABLE]

where the subscript $f$ denotes the specific energy management policy employed, and the superscript $i$ stresses the fact that we are considering instantaneous power constraints. Thus, the optimization problem can be written as the minimization of (6) over all feasible policies $f\in\mathcal{F}$, i.e.,

[TABLE]

A single-letter expression for the information leakage rate is provided in [28, 29, 30] when the EMU is constrained only by the average and peak power constraints. In general, because of the memory effects introduced by the RB and the RES, satisfying the input load from the RB or the RES at some time period may come at the expense of revealing more information about the energy consumption at future time periods. For this reason, the information theoretic analysis typically focuses on the average performance, measured over a period of $n$ time slots, and aims at understanding the fundamental performance bounds by letting this time period go to infinity, i.e., $n\rightarrow\infty$, as in (6). However, the definition of the information leakage rate in (6) involves $n$-length sequences $X^{n}$ and $Y^{n}$, and the asymptotic performance limit corresponds to an infinite-dimensional optimization problem, which cannot be solved numerically. On the contrary, characterizing a single-letter expression allows the optimal solution to be to described as an optimization problem in terms of the single-letter random variables, which can be a finite-dimensional optimization problem when the involved random variables are defined over finite alphabets. Therefore, a single-letter characterization of the information theoretic privacy is desirable to be able to evaluate the minimum possible information leakage rate.

In [29] the privacy-power function $\mathcal{I}(\bar{P},\hat{P})$ is defined as the minimum information leakage rate that can be achieved when the energy management policy satisfies the average power constraint \mathbbm{E}\big{[}\sum_{t=1}^{n}(X_{t}-Y_{t})\big{]}\leq\bar{P}, as well as the peak power constraint $0\leq X_{t}-Y_{t}\leq\hat{P}$, $\forall t$. The privacy-power function has the single-letter characterization provided by the following theorem.

Theorem 1**.**

[29, Theorem 1]** The privacy-power function $\mathcal{I}(\bar{P},\hat{P})$ for an i.i.d. input load vector $X$ with distribution $p_{X}(x)$ and output load vector $Y$, when the average and peak values of the power provided by the RES are limited by $\bar{P}$ and $\hat{P}$, respectively, is given by

[TABLE]

where $\mathcal{P}\triangleq\{p_{Y|X}:y\in\mathcal{Y},\mathbbm{E}[(X-Y)]\leq\bar{P},0\leq X-Y\leq\hat{P}\}$.

Lemma 1**.**

[29, Lemma 1]** The privacy-power function $\mathcal{I}(\bar{P},\hat{P})$, given above, is a non-increasing convex function of $\bar{P}$ and $\hat{P}$.

It is shown in [30] that, when the input load alphabet is discrete, i.e., $\mathcal{X}=\{0,1,\ldots,X_{\max}\}$, the output load alphabet $\mathcal{Y}$, which is not necessarily discrete, can be restricted to the input load alphabet, i.e., $\mathcal{Y}=\mathcal{X}$, without loss of optimality. Given this restriction and the convexity of the privacy-power function, $\mathcal{I}(\bar{P},\hat{P})$ can be numerically evaluated, e.g., by the efficient Blahut-Arimoto (BA) [48] algorithm. The following lemma states that this property holds also in our setting for the various battery capacities we analyze in the following. Thus, in the discrete case, we can assume that all the involved random processes are defined over finite alphabets and that there is a minimum quantum of energy such that all the aforementioned quantities are integer multiples of this quantum.

Lemma 2**.**

If the input alphabet $\mathcal{X}$ is discrete, the output alphabet $\mathcal{Y}$ can be constrained to the input alphabet without loss of optimality.

Proof.

The proof is similar to that of [30, Theorem 2]. Let $\mathcal{X}$ be the discrete input load alphabet and let $X(y)=\min_{x\in\mathcal{X}}\{x\geq y\}$. Then, for any given energy management policy, and the resultant output load $Y^{n}$, we define a new output load as $\hat{Y}(t)=X(Y(t))$, that is, $\hat{Y}$ is a post-processed version of $Y$, and $\hat{\mathcal{Y}}=\mathcal{X}$. By construction, we have that $X(t)\geq\hat{Y}(t)\geq Y(t),\forall t$, i.e., the power demanded by the battery cannot have a larger peak value than the original demanded power. Similarly, the new output load satisfies all the instantaneous power constraints as well. This proves that the policy is feasible. Also, the information leakage rate is not increased as $\hat{Y}$ is a deterministic function of $Y$, and thus $X-Y-\hat{Y}$ forms a Markov chain, and $I(X,Y)\geq I(X,\hat{Y})$ by the data processing inequality. ∎

Here we introduce a generic energy management policy, which we later specialize to the different scenarios we consider. This is a stationary and memoryless policy that generates $Y_{t}$ randomly using a conditional probability distribution that is based only on the current input load $X_{t}$ and the available total renewable energy $B_{t}+E_{t}$, i.e.,

[TABLE]

Note that, in the presence of an RB, in which the generated renewable energy is stored and used for privacy, a memoryless energy management policy is suboptimal in general, as it ignores the history. However, in the following we show that a memoryless policy is able to achieve the minimum information leakage rate in the two extreme scenarios of $B_{\max}=\infty$ and $B_{\max}=0$.

III Infinite Battery Capacity

In this section we relax the constraint on the battery capacity and consider $B_{\max}=\infty$. This is an extreme situation that may model a battery with a relatively large capacity compared to the average generation rate of renewable energy, $\bar{P}_{E}$, and the average input load. This scenario provides useful insights on the best achievable privacy performance, and also serves as a bound on the performance achievable with a finite-capacity RB.

In each time slot, the EMU is limited by both the peak power constraint (3) and the energy available in the RB, which is the difference between the total renewable energy generated and the total energy that has been requested from the battery up to that time, i.e.,

[TABLE]

III-A Generated Renewable Energy not Known by the UP

In this section $E^{n}$ is treated as a random sequence whose realization is known only to the consumer in a causal manner. This scenario may occur if the renewable energy originates from sources which could be extremely difficult, if not impossible, for the UP to track.

The following theorem states that the minimum information leakage rate when $B_{\max}=\infty$ is equivalent to the average and peak power-constrained scenario, as in [29]; that is, the cumulative constraints on the EMU policy do not reduce the achievable privacy if the battery capacity is sufficiently large.

Theorem 2**.**

If $B_{\max}=\infty$ and the peak power constraint on the amount of energy taken from the RB is $\hat{P}$, then the minimum information leakage rate for an i.i.d. input load $X$ and a renewable energy generation process with average power $\bar{P}_{E}$, is

[TABLE]

$\mathcal{I}(\bar{P}_{E},\hat{P})$ is a trivial lower bound on $\mathcal{I}^{i}(\infty,\hat{P})$. In the following section an energy management policy that achieves $\mathcal{I}^{i}(\infty,\hat{P})$ is presented. The proposed policy is a specialization of the generalized memoryless policy introduced in (9).

III-B Optimal Energy Management Policy for $B_{\max}=\infty$

Consider the following energy management policy. In each time slot $t$, the EMU, based on the instantaneous input load $X_{t}$, decides on the optimal portion of the input load to be received from the grid, $Y^{*}_{t}$, by using the optimal conditional probability distribution $p^{*}_{Y|X}$ that minimizes (8). If there is enough energy available to fully satisfy the EMU requests, i.e., $B_{t}+E_{t}\geq X_{t}-Y^{*}_{t}$, the EMU uses $X_{t}-Y^{*}_{t}$ units of renewable energy and $Y^{*}_{t}$ units of energy from the grid, i.e., $Y_{t}=Y_{t}^{*}$; otherwise, all the input load is satisfied directly from the grid, i.e., $Y_{t}=X_{t}$, thus leading to the maximum information leakage for that time instant, i.e., the UP learns $X_{t}$ perfectly. The time instants at which such leakage occurs cannot be computed beforehand, since they depend on the realizations of the renewable energy process, input and output loads. Given the nature of this policy, which tries to follow the optimal policy generated by ignoring the current SOC, we name it the best-effort energy management policy. Algorithm 1 summarizes this policy.

Equation (12), shown at the bottom of the page, specializes policy (9) to the best-effort policy. The second case in (12) includes all the instances for which $p^{*}_{Y|X}$ outputs either $y^{*}=x$, or an infeasible output, i.e, for which $x-y^{*}>b+e$.

Since the energy arrival is stochastic, it may seem that very little can be said about the information leakage rate. However, if the condition $\mathbbm{E}[X-Y^{*}]<\bar{P}_{E}$ holds, then it is possible to show that the number of times full leakage of information occurs due to unavailability of energy is relatively small compared to the operating time of the system. This is proved in the following lemma.

Lemma 3**.**

If $\mathbbm{E}[X-Y^{*}]<\bar{P}_{E}$, and the EMU follows the best-effort energy management policy, then almost surely the condition $B_{t}+E_{t}<X_{t}-Y^{*}_{t}$ holds only in finitely many time slots in the limit of infinite horizon.

Proof.

Let $\mathbbm{E}[X-Y^{*}]=\bar{P}_{E}-\epsilon$, for some $\epsilon>0$. The sequence $E-(X-Y^{*})-\epsilon$ has zero mean. By the strong law of large numbers, the sample average of the sequence converges almost surely to its expected value, i.e., the sequence of events $\{\frac{1}{n}\sum_{t=1}^{n}(E_{t}-(X_{t}-Y^{*}_{t})-\epsilon)<-\epsilon\}_{n=1}^{\infty}$, and thus the sequence $\{\frac{1}{n}\sum_{t=1}^{n}(E_{t}-(X_{t}-Y^{*}_{t}))<0\}_{n=1}^{\infty}$ occurs only for finitely many times. This implies that, with $Y^{*}_{t}$ generated according to the best-effort policy, the unavailability of energy at any time, $B_{t}+E_{t}<X_{t}-Y^{*}_{t}$, occurs only for finitely many times. ∎

Lemma 4**.**

If $\mathbbm{E}[X-Y^{*}]<\bar{P}_{E}$, then the minimum information leakage rate of the best-effort policy tends to $\mathcal{I}^{i}(\infty,\hat{P})$, as $n\rightarrow\infty$.

Proof.

Divide the sequence of input and output loads according to the time instants in which a private SM operation is achieved, i.e., the time instants the EMU can fully emulate $p^{*}_{Y|X}$, and time instants in which full leakage occurs. From Lemma 3 we know that as $n\rightarrow\infty$, there is only a finite number of time instants, say $m$, in which the level of privacy induced by $p^{*}_{Y|X}$ is not achieved, i.e., for which the condition $B_{t}+E_{t}<X_{t}-Y^{*}_{t}$ holds, when $Y^{*}_{t}$ is generated based on $p^{*}_{Y|X}$. We remind that the condition $X_{t}-Y^{*}_{t}<\hat{P}$ always holds. Then, we can write

[TABLE]

where $\mathcal{T}$ is the set of instants when full leakage of information takes place, i.e., for which $Y_{t}=X_{t}$, and $\mathcal{T}^{C}$ is the set of time instants in which the output is generated through $p^{*}_{Y|X}$, i.e., $Y_{t}=Y^{*}_{t}$; (13c) follows since conditioning reduces entropy; (13e) follows since $m$ is finite. ∎

III-C Store-and-Hide Energy Management Policy

Here we provide an alternative energy management policy in the case of an infinite-capacity battery. The store-and-hide energy management policy consists of an initial storage phase, during which all the energy requests of the user are satisfied from the grid while all the generated renewable energy is stored in the battery, and a second hiding phase, during which the EMU deploys the optimal policy $p^{*}_{Y|X}$.

More formally, consider $n$ time slots. In the first $s(n)$ time slots, the so-called storage phase, no privacy is achieved because we have $Y_{t}=X_{t}$, for $t=1,2,\ldots,s(n)$. In the remaining $n-s(n)$ time slots, the so-called hiding phase, user demand is satisfied by taking energy from both the grid and the battery according to the optimal policy $p^{*}_{Y|X}$. We assume that $s(n)=o(n)$, with $\lim_{n\to\infty}s(n)=\infty$, and $\lim_{n\to\infty}n-s(n)=\infty$. The initial waiting time $s(n)$ enables the battery to store on average $s(n)\bar{P}_{E}$ units of energy. In the following lemma we show that the energy stored in the initial storage phase is sufficient to let the EMU follow the optimal energy management policy $p^{*}_{Y|X}$ during the hiding phase, without energy outages almost surely. After $s(n)$ units of time, thanks to the energy already stored in the RB, the system is able to overcome the uncertainty in the energy arrival, and is able to adopt the optimal privacy-preserving energy management policy for the remaining time.

Remark 1**.**

It is noteworthy that no information about the recharge process of the battery is required, and all the EMU needs to know is the average power generated by the renewable energy process, $\bar{P}_{E}$.

Lemma 5**.**

With a storage phase of length $s(n)=o(n)$, where $\lim_{n\to\infty}s(n)=\infty$, and $\lim_{n\to\infty}n-s(n)=\infty$, the store-and-hide policy satisfies the energy constraints in (10) almost surely provided that $\mathbbm{E}[X-Y^{*}]<\bar{P}_{E}$.

The proof can be found in Appendix A.

By means of Lemma 5 it is possible to show that the minimum information leakage rate of the store-and-hide policy approaches $\mathcal{I}^{i}(\infty,\hat{P})$ as $n\rightarrow\infty$, as shown in the following lemma, whose proof can be found in Appendix B.

Lemma 6**.**

If $\mathbbm{E}[X-Y^{*}]<\bar{P}_{E}$, then the information leakage rate of the store-and-hide policy with $s(n)$ as specified in Lemma 5 approaches $\mathcal{I}^{i}(\infty,\hat{P})$ as $n\rightarrow\infty$.

Remark 2**.**

Even though the two schemes described above achieve the same privacy performance as $n\rightarrow\infty$, they do have some conceptual differences. During the initial phase of energy saving, the store-and-hide policy satisfies all the user demands from the grid leaking full information. Therefore, the SM readings reveal user’s activity completely in this period. While the impact of this on the information leakage rate vanishes as $n\rightarrow\infty$, this might not be preferable in practice. Therefore, we believe that the best-effort policy is more appropriate for practical applications.

III-D Generated Renewable Energy Known by the UP

Here we assume that the UP knows the realization of the renewable energy process $E^{n}$, as highlighted in Figure 2. This scenario can occur if, for example, we consider solar energy as the RES, and the UP can accurately estimate the renewable energy produced from its own observations in nearby locations, weather forecast of the area, and the specifications of the solar panel. This is a worst-case situation and we expect the amount of leaked information in this case to be greater than or equal to that of the previous scenario, in which only the EMU knows the current state of the renewable energy produced. In this setting, the information leakage rate is defined as

[TABLE]

The following theorem states that $E^{n}$ does not necessarily provide more information to the UP compared to the scenario where the UP does not have access to this information.

Theorem 3**.**

If $B_{\max}=\infty$, the minimum information leakage rates for the cases in which $E^{n}$ is either known or not known to the UP are the same, i.e., $\bar{\mathcal{I}}^{i}(\infty,\hat{P})=\mathcal{I}^{i}(\infty,\hat{P})$.

Proof.

We have the following chain of inequalities:

[TABLE]

where (15a) follows as $X$ and $E$ are independent from each other, and (15c) is due to the non negativity of mutual information. Thus, we have $\bar{\mathcal{I}}^{i}(\infty,\hat{P})\geq\mathcal{I}^{i}(\infty,\hat{P})$.

The inequality in (15c) becomes an equality if $I(E^{n};X^{n}|Y^{n})=0$. This condition can be achieved by the store-and-hide policy. In fact, at the end of the storage phase the battery is filled up with an infinite amount of energy, and, as a consequence, the optimal policy during the hiding phase $p^{*}_{Y|X}$ does not need to take the information about the RES into account. This implies that $\lim_{n\rightarrow\infty}I(E^{n};X^{n}|Y^{n})=0$; and therefore, $\lim_{n\rightarrow\infty}\frac{1}{n}I(X^{n};Y^{n}|E^{n})=\lim_{n\rightarrow\infty}\frac{1}{n}I(X^{n};Y^{n})$, and that $\bar{\mathcal{I}}^{i}(\infty,\hat{P})=\mathcal{I}^{i}(\infty,\hat{P})$. ∎

IV SM System Without Energy Storage

In this section we focus on another extreme scenario in which there is no RB for storing extra renewable energy, i.e., $B_{\max}=0$. The renewable energy available at time slot $t$, $E_{t}$, can be considered as an i.i.d. state information, and could be known, or not, to the UP. Given $E_{t}$ and $X_{t}$, the EMU decides on the amount of energy to use from the grid and from the RES. In each time slot $t=1,\ldots,n$ the energy that can be obtained from the RES, $X_{t}-Y_{t}$, is limited by the energy generated in time slot $t$, $E_{t}$, i.e., $0\leq X_{t}-Y_{t}\leq E_{t}$. Thus, this is an SM system with a stochastic peak power constraint on the energy that the EMU can obtain from the RES. Therefore, this section can be considered as a generalization of [30], where the authors consider a fixed peak power constraint.

Remark 3**.**

We note that a peak power constraint other than $E_{t}$ can be easily incorporated to the model, as this would simply correspond to a new instantaneous power constraint of $X_{t}-Y_{t}\leq\min\{E_{t},\hat{P}\}$. Therefore, for the brevity of the presentation we do not consider a peak power constraint in this section.

Note that, as opposed to the infinite-capacity battery scenario, here the past has no influence on the energy constraint, since there is no battery, and thus, no memory, in the system.

To analyze this scenario, we first consider the minimum information leakage rate when the generated renewable energy is constant in every time slot, i.e., $\mathcal{E}=\{e\}$, which is known by both the EMU and the UP. The privacy-power function is obtained by considering only a peak power constraint, which can be obtained as a special case of Theorem 1.

Lemma 7**.**

If $B_{\max}=0$ and $\mathcal{E}=\{e\}$, the privacy-power function for an i.i.d. input load $X$ is given by $\mathcal{I}(e,e)$.

IV-A Generated Renewable Energy not Known by the UP

As in Section III-A, here the realization of the renewable energy process is assumed to be known only by the EMU, while the UP only knows the probability distribution $p_{E}$.

Theorem 4**.**

If $B_{\max}=0$, and the renewable energy produced by the RES is i.i.d. with distribution $p_{E}$, the optimal information leakage rate, denoted by $\mathcal{I}^{i}(0)$, is given by

[TABLE]

where $\mathcal{P}^{i}\triangleq\{p_{Y|X,E}:p_{Y|X,E}(y|x,e)=0\text{ if }y>x\text{ or }y<x-e\}$.

Proof.

Achievability. We consider a conditional probability distribution $p_{Y|X,E}(y|x,e)$ that satisfies the conditions of Theorem 4. At each time instant, for given $x_{t}$ and $e_{t}$, $y_{t}$ is generated independently using the conditional distribution $p_{Y|X,E}(y_{t}|X_{t}=x_{t},E_{t}=e_{t})$. Since the input and output load sequences are generated i.i.d. with the induced joint distribution $p_{X}(x)p_{Y|X}(y|x)$, the information leakage rate is given by $I(X;Y)$, whereas the instantaneous peak power constraint is satisfied for all conditional distributions in $\mathcal{P}^{i}$.

Converse. We assume that there is an energy management policy that satisfies the instantaneous peak power constraints, i.e., $x_{t}-y_{t}\leq e_{t},\forall t$. Then, the information leakage rate satisfies the following chain of inequalities:

[TABLE]

where (17b) follows since $X$ is i.i.d.; (17c) follows since conditioning reduces entropy; and (17d) follows from the definition of $\mathcal{I}^{i}(0)$ in (16). ∎

IV-B Generated Renewable Energy Known by the UP

Here we assume the UP also knows the state $E_{t}$, $\forall t$.

Theorem 5**.**

If $B_{\max}=0$, the input load is i.i.d. with distribution $p_{X}$, and the amount of generated renewable energy is also known by the UP at each time $t$, then the optimal information leakage rate $\bar{\mathcal{I}}^{i}(0)$ is given by

[TABLE]

where $\mathcal{P}^{i}\triangleq\{p_{Y|X,E}:p_{Y|X,E}(y|x,e)=0\enspace\textit{if}\enspace y>x\enspace\textit{or}\enspace y<x-e\}$.

Proof:

Achievability of (18) follows trivially by employing the optimal $p_{Y|X,E}$ that minimizes (18) at each time slot. To prove the converse, we show that any energy management policy that satisfies the stochastic peak power constraint at each time instant satisfies the following chain of inequalities:

[TABLE]

where (19c) follows because $X$ and $E$ are independent of each other and across time, and conditioning reduces entropy; (19d) follows by explicitly considering all the states of $E_{t}$; and (19e) follows from Lemma 7. ∎

From the chain rule of mutual information, we have

[TABLE]

where (20a) follows since $X$ and $E$ are independent of each other. From (20a) and (20b), we get $I(X;Y)\leq I(X;Y|E)$. Hence, from Theorems 4 and 5, we have $\mathcal{I}^{i}(0)\leq\bar{\mathcal{I}}^{i}(0)$, as expected.

V Binary Scenario

In order to provide further insights into the behavior of the information leakage rate, here we consider a simple scenario with binary energy demands, binary energy generation and binary output load, i.e., $\mathcal{X}=\mathcal{E}=\mathcal{Y}=\{0,1\}$. This scenario may represent appliances that are either on or off/standby. $X$ and $E$ follow independent Bernoulli distributions with $\Pr\{X=1\}=q_{x}$ and $\Pr\{E=1\}=p_{e}$, respectively. We compare the minimum information leakage rates for the infinite and zero battery scenarios.

If $B_{\max}=\infty$, the minimum information leakage rate can be characterized explicitly as

[TABLE]

where we set the peak power constraint to $\hat{P}=1$.

When $B_{\max}=0$, there are two scenarios. If the generated renewable energy is known only by the EMU, the minimum information leakage rate for this scenario is given by

[TABLE]

where $h(\cdot)$ is the binary entropy function defined as $h(p)\triangleq-p\log p-(1-p)\log(1-p)$, $q_{x}$ is fixed, and $p_{v}$ is the probability of using the energy available in the battery whenever $X=1$ and $E=1$.

Proposition 1**.**

For every $p_{e}$ and $q_{x}$, the information leakage rate $\mathcal{I}^{i}(0;p_{e},p_{v},q_{x})$ is minimized with $p_{v}=1$.

Proof:

The proof follows from observing that $\frac{\mathrm{d}\mathcal{I}^{i}(0,p_{v})}{\mathrm{d}p_{v}}\leq 0,\forall p_{e},q_{x}$. Thus, the minimum of $\mathcal{I}^{i}(0;p_{e},p_{v},q_{x})$ is reached when $p_{v}$ takes its maximum value, i.e., $p_{v}=1$. ∎

When $E_{t}$ is known also by the UP, if the peak power constraint is $e=1$, no information is leaked, whereas if $e=0$, the input load is known perfectly by the UP, leading to a leakage of $H(X)$. Hence, the minimum information leakage rate when the state information is known by the UP is

[TABLE]

Numerical comparison of the information leakage rate for zero and infinite battery capacities in the binary scenario will be presented in the next section together with the results corresponding to a finite battery capacity.

VI Finite Battery Capacity

A closed-form expression for the finite-capacity battery scenario is elusive as the presence of a finite battery brings memory into the system, and the future energy usage depends on how much renewable energy has been generated in the previous time slots, how much of that energy has already been used by the EMU, and how much is available in the RB. Instead, we propose a low-complexity energy management policy and compare it to the two previous scenarios, which represent upper and lower bounds on the system performance for the finite battery scenario.

VI-A Binary Alphabet: $\mathcal{X}=\mathcal{E}=\mathcal{Y}=\{0,1\}$

In this setting $X$, $E$ and $Y$ have binary alphabets and we consider a discrete-time system, modeled via a finite state machine. As in Section V, we set $\Pr\{X=1\}=q_{x}$ and $\Pr\{E=1\}=p_{e}$, while $V^{n}\triangleq X^{n}-Y^{n}$ represents the energy taken by the EMU from the battery, with $\mathcal{V}=\{0,1\}$.

VI-A1 Battery-independent Policy

Here we consider a time-invariant policy according to which the evolution of the battery state can be modeled as the Markov chain of Figure 3, where the $4$-tuples $(x,e,v,y)$ represent the realization at time $t$ of the input load $X$, the renewable energy $E$, the energy taken from the battery by the EMU $V$, and the output load $Y$, respectively. At every time, the RB can be charged, discharged or remain in the current SOC, depending on the transition probabilities. We note that a similar model has been adopted in [24], with the difference that in [24] the RB can also store energy from the grid. We define $p_{v}$ as the probability that the energy is taken from the battery provided that the user is asking for energy and that there is energy available for use, i.e., p_{v}\triangleq\Pr\{V=1\big{|}X=1,E+B\geq 1\}. Since the value of $p_{v}$ does not change according to the current battery state, we name this policy battery-independent policy. Table V lists all the possible states and transition probabilities for this scenario. In particular, the table shows for each transition from $B_{t}$ to $B_{t+1}$ and each combination of the tuple $(X_{t},E_{t},V_{t},Y_{t})$ the corresponding transition probability.

To compute the information leakage rate, all the distributions are considered to be Bernoulli. For $B_{\max}=\infty$ and $B_{\max}=0$ we use the single-letter expressions derived in Section V, and set $\hat{P}=1$ for $B_{\max}=\infty$. For a finite-capacity battery, we implement the achievable scheme described above, and by means of the algorithm in [49] we simulate the system for very long sequences and evaluate the information leakage between the input and the output loads numerically and for different battery capacities. Moreover, for each $p_{e}$, we find the value of $p_{v}$ that achieves the minimum information leakage rate by searching over a discretized set of $p_{v}$ values. As an example, Figure 4 represents the optimal $p_{v}$ values for each $p_{e}$, when the input load is uniformly distributed and $B_{\max}=\{1,2,5,10\}$. In the figure, $p_{e}=0$ is not represented because, regardless of $p_{v}$, the leakage when $p_{e}=0$ is always equal to the entropy of the input load. Also, the figure shows that for higher $p_{e}$ values, the minimum leakage is achieved for $p_{v}=1$, i.e., it is better to always use the energy when available.

VI-A2 Battery-conditioned Policy

Here we consider a policy, in which $p_{v}$, as defined before, can differ for different battery SOCs, i.e., the policy is characterized by a specific $p_{v_{i}}$ for each battery SOC $B_{t}=i$, for $i=\{0,\ldots,B_{\max}\}$. Thus, we now have the vector

[TABLE]

To find the optimal $\bar{p}_{v}$ for each $p_{e}$ and $B_{\max}$ we deploy a stochastic gradient descent algorithm, specifically we use the least square-based finite difference method to approximate the gradient [50]. Briefly, the algorithm works as follows. At any step, small perturbations are applied to each $p_{v_{i}}$ according to a uniform distribution over a predefined interval, and the leakage corresponding to the resulting perturbed vector $\bar{p}_{v}$ is computed. The gradient of the leakage function can thus be approximated numerically by employing the leakage corresponding to a number of different perturbations. A new $\bar{p}_{v}$ is finally computed using the gradient estimate and a predefined learning rate, and its corresponding leakage is determined and compared with that of the previous step. If the difference between the two leakage rates is below a certain threshold, the algorithm stops. Otherwise, the algorithm keeps on iterating.

Figure 5 shows the information leakage rate with respect to the renewable energy generation rate $p_{e}$, for different battery capacities. For $B_{\max}=\{1,2,5,10\}$, we adopt the battery-conditioned policy, which has only a small gain with respect to the battery-independent policy. In particular, this gain is focused around smaller $p_{e}$ values. As expected, the least information leakage rate is achieved when $B_{\max}=\infty$ and $\hat{P}=1$, while the maximum leakage occurs when $B_{\max}=0$ and the UP knows the renewable energy process realizations. When $B_{\max}=0$ the information leakage rate reduces significantly if the state is not known by the UP and, more interestingly, we observe that the performance of the proposed suboptimal memoryless scheme approaches that of the infinite-capacity battery with relatively small battery sizes. In addition, we can see that the gain from the battery is much higher when the renewable generation rate is higher, i.e., when $p_{e}$ is high. This is expected because when $p_{e}$ is low, there is less energy to be stored for future time slots.

VI-B Larger Alphabets: $|\mathcal{X}|=|\mathcal{Y}|=|\mathcal{E}|>2$

Here we consider larger alphabets for $X$, $E$ and $Y$. As the alphabet sizes grow, so does the complexity of searching for the optimal policy. Instead, we consider the following suboptimal policy. At each time instant, the policy chooses among using all of the available energy, half of it, or no energy at all and we model the probability $p_{v}$ as in the following:

[TABLE]

The probability pairs in (25) refer to the probability of using all the available energy and the probability of using half of it. Therefore, we have $0\leq p_{i}\leq 1$, for $i=1,\ldots,6$, and $p_{i}+p_{i+3}\leq 1$, for $i=1,2,3$. For example, if $B_{t}+E_{t}<X_{t}$, all of the available energy is used with probability $p_{1}$, half of it, or the nearest integer value lower than that, is used with probability $p_{4}$, and none of it is used with probability $1-p_{1}-p_{4}$.

Figure 6 shows the results for the scenario for $|\mathcal{X}|=|\mathcal{E}|=|\mathcal{Y}|=5$ when $B_{\max}=\{0,1,2,\infty\}$. The input load is uniformly distributed over the alphabet $\mathcal{X}$, while the renewable energy generation follows a binomial distribution with parameters $|\mathcal{X}|$ and $p_{e}$. The information leakage rate for the infinite and zero battery scenarios is computed by using the single-letter expressions which are evaluated by efficient numerical algorithms, specifically the BA algorithm [48] and the CVX package [51]. In particular, for $B_{\max}=\infty$ we set $\hat{P}=X_{\max}$. For the finite battery scenario, we adopt the aforementioned policy and optimize the performance by trying different combinations of the probabilities $p_{i}$, $1\leq i\leq 6$. Similar considerations to that of Figure 5 can be drawn for Figure 6 as well.

Remark 4**.**

We remark here that, in order to isolate the privacy benefits of RESs, we do not allow charging the battery directly from the grid, which can potentially reduce the information leakage. It is known that modulating grid energy intake by employing a storage device provides privacy even in the absence of an RES [23, 26], or jointly with an RES [52]. The additional privacy benefits of allowing charging of the RB from the grid will depend on the battery capacity. When $B_{\max}=\infty$, perfect privacy can be achieved by charging the battery initially, and using the battery throughout the operation. In the other extreme scenario, that is, when $B_{\max}=0$, obviously it is not possible to charge a non-existent battery from the grid. We leave a more detailed study of a finite-capacity storage device that can be charged by both the RES and the grid as a future work.

VII Continuous Input Loads

In the simulation results presented above, we have considered discrete alphabets for all the involved random variables. A set of fixed discrete values for the energy demands may not be an accurate model for all the appliances in the real world. However, as discussed in Section II, such hypothesis enables to constrain the output alphabet to the input alphabet without loss of optimality and to apply efficient algorithms to find the minimum amount of information leakage.

For continuous input loads, the optimal alphabet is also continuous. Thus, low-complexity numerical algorithms, such as the BA algorithm, cannot be applied. However, one can provide a lower bound on the privacy-power function by using the Shannon lower bound (SLB) [53, 54], which has been introduced by Shannon, and widely used in the literature to provide a computable lower bound to the rate-distortion function. Although it is not always a tight bound, it is shown in [30] that the SLB provides a tight bound for the information leakage rate for an exponentially distributed input load. The SLB for the rate distortion function $R(D)$ is defined as $H(X)-\phi(D)$ where $\phi(D)=\max_{\begin{subarray}{c}p:\sum_{i=1}^{m}p_{i}d_{i}\leq D\end{subarray}}H(p)$. The truncated exponential distribution maximises the entropy for a given mean value $\bar{P}$ and a peak power constraint $0\leq X\leq\hat{P}$ [53] and has the form [29]

[TABLE]

where $\lambda_{0}\geq 0$ and $\lambda_{1}\geq 0$ are chosen to satisfy the constraints on the moments. Thus, the SLB for the privacy-power function introduced in Theorem 1 is given by

[TABLE]

Authors in [29] show that the SLB is indeed achievable for peak and average power constraints, by finding the conditional distribution $f_{Y|X}(y|x)$ that satisfies the SLB with equality, provided that the energy coming from the battery $X-Y$ is distributed according to a truncated exponential distribution with mean $\bar{P}$ and peak $\hat{P}$.

Authors in [30] provide the SLB for the average power constraint, which, as we have shown, is equivalent to the infinite-capacity battery scenario.

VII-A No Battery - Renewable Energy not Known by the UP

Here only a peak power constraint is considered, i.e., $X-Y$ is constrained by $0\leq X-Y\leq\hat{P}$. The distribution that maximises the entropy over an interval is the uniform distribution

[TABLE]

For a fixed $\hat{P}$, the differential entropy of this distribution is $\log(\hat{P})$. Then, the SLB in the case of zero capacity battery is

[TABLE]

where $\hat{P}$ is a RV with a certain known distribution.

VII-B No Battery - Renewable Energy Known by the UP

As in the previous scenario, only peak power constraints are considered and thus the entropy maximising distribution is still the uniform distribution (28). The privacy-power function is given by the expected value over the distribution of the states of the privacy-power function related to every state. Hence, the SLB is

[TABLE]

VIII Conclusions

We have studied information leakage in an SM system by considering an RES along with an RB. For infinite and zero battery capacities, we have provided single-letter information theoretic expressions for the minimum information leakage rate, which can be efficiently evaluated when the input load has a discrete alphabet. For these scenarios, we have also studied the information leakage rate when the UP knows the exact amount of renewable energy generated in each time slot. In addition, for the finite-capacity battery scenario, we have proposed a suboptimal low-complexity energy management policy, and evaluated the corresponding privacy performance using a stochastic gradient descent algorithm. Our results show that the privacy achieved by the proposed low-complexity policy approaches the theoretical lower bound obtained by assuming an infinite-capacity battery with a relatively small battery capacity, especially when the generation rate of the RES is low or high.

Appendix A Proof of Lemma 5

Proof.

During the hiding phase, the random variable $Q=E-X+Y^{*}$ is i.i.d., as $E$ and $X$ are i.i.d and $Y^{*}$ is generated from $X$ through a memoryless policy. $Q$ can assume both positive and negative values with positive probability. The stochastic process

[TABLE]

is a random walk based on $Q$ that moves along the battery SOC axis. Since by hypothesis $\mathbbm{E}[E]=\bar{P}_{E}>\mathbbm{E}[X-Y^{*}]$, then $\mathbbm{E}[Q]=\mathbbm{E}[E-X+Y^{*}]>0$, meaning that the random walk $S_{t}$ has a positive drift, i.e., as $t\rightarrow\infty$, $S_{t}$ drift towards the positive values of the SOC axis.

By the law of large numbers, when $s(n)\rightarrow\infty$ the amount of energy stored in the battery at the end of the storage phase is $s(n)\bar{P}_{E}$, almost surely. Let $\alpha\triangleq-s(n)\bar{P}_{E}$. When $s(n)\rightarrow\infty$, $\alpha\rightarrow-\infty$. At $s(n)+1$, when the hiding phase begins, the energy in the battery is used according to the optimal privacy-preserving policy $p^{*}_{Y|X}$ and the random walk state is $S_{1}=Q_{1}=E_{1}-X_{1}+Y^{*}_{1}$. For any $t$, $s(n)\bar{P}_{E}+S_{t}$ represents the battery SOC at time $t$. Our objective is to prove that the battery is never emptied, i.e., that the probability of crossing the threshold $\alpha$ for any time $t$ is zero:

[TABLE]

This scenario is represented in Figure 7. We recall a corollary of Wald’s Identity [55, Chapter 7.5, Corollary 2], which is applied to find exponential bounds on the probability of threshold crossing. In particular, the corollary states that if we consider $Q$ as having a finite moment-generating function $\gamma(r)=\ln\{\mathbbm{E}[\exp(rQ)]\}$ over an interval $(r_{-},r_{+})$, a negative drift $\mathbbm{E}[Q]<0$ and $r^{*}$ being the positive root of $\gamma(r)$, then the probability of crossing threshold $\alpha>0$ by the random walk $S_{t}=Q_{1}+Q_{2}+\ldots+Q_{t}$ is

[TABLE]

where $\tau$ is the minimum $t$ for which the threshold $\alpha$ is crossed. Having a finite moment generating function means that $Q$ must have moments of all orders and the tails of its distribution function must decay at least exponentially in $q$ as $q\rightarrow\infty$ and $q\rightarrow-\infty$. In our specific setting, $\mathbbm{E}[Q]>0$, $\alpha<0$, and $r^{*}<0$. We can still apply Wald’s identity by changing the signs of $r^{*}$ and $\alpha$ and by considering the probability of crossing a negative threshold. Thus, we have

[TABLE]

where $\alpha<0$ and $r^{*}<0$. When $\lim_{n\rightarrow\infty}n-s(n)=\infty$ and $\lim_{n\rightarrow\infty}s(n)=\infty$, $\alpha\rightarrow-\infty$ and $\exp(-r^{*}\alpha)\rightarrow 0$. Thus, we obtain

[TABLE]

∎

Appendix B Proof of Lemma 6

Proof.

Split the sequence of input and output symbols into the storage and hiding phases of duration $s(n)$ and $n-s(n)$, respectively and let $s(n)=o(n)$. Then, it is possible to write

[TABLE]

where (36b) follows because $X$ is i.i.d. and conditioning reduces entropy; (36d) follows since in the first $s(n)$ time instants leakage of full information $H(X)$ takes place, while in the following $n-s(n)$ time slots private operation is assured via the optimal strategy of Theorem 2.

If we take the limit $n\rightarrow\infty$, since $s(n)=o(n)$ and $H(X)$ is finite, we obtain the leakage rate

[TABLE]

∎