Efficient and Secure Wireless Communications for Advanced Metering Infrastructure in Smart Grids

1540 IEEE TRANSACTIONS ON SMART GRID, VOL. 3, NO. 3, SEPTEMBER 2012

Efficient and Secure Wireless Communications forAdvanced Metering Infrastructure in Smart GridsHusheng Li, Member, IEEE, Shuping Gong, Lifeng Lai, Member, IEEE, Zhu Han, Senior Member, IEEE,

Robert C. Qiu, Senior Member, IEEE, and Depeng Yang

Abstract—An experiment is carried out to measure the powerconsumption of households. The analysis on the real measurementdata shows that the significant change of power consumption ar-rives in a Poisson manner. Based on this experiment, a novel wire-less communication scheme is proposed for the advanced meteringinfrastructure (AMI) in smart grid that can significantly improvethe spectrum efficiency. The main idea is to transmit only when asignificant power consumption change occurs. On the other hand,the policy of transmitting only when change occurs may bring a se-curity issue; i.e., an eavesdropper can monitor the daily life of thehouse owner, particularly the information of whether the owner isat home. Hence, a defense scheme is proposed to combat this vul-nerability by adding artificial spoofing packets. It is shown by nu-merical results that the defense scheme can effectively prevent thesecurity challenge.

Index Terms—Smart grid, smart meters, wireless communica-tions.

I. INTRODUCTION

A DVANCED metering infrastructure (AMI) [3] is a keytask in the smart grid [6], [4]. In such a system, each

power user is equipped with a smart meter with the capabilityof two-way communications, which can monitor the power ac-tivities, report the power consumption and receive power price.The power consumption report can be used to achieve the bal-ance of power demand and supply by setting the correct powerprice [8], [9], [12], [14], [17].Due to the importance of AMI, more and more studies are

paid to the mechanism of communications for AMI. Amongmany communication technologies, wireless communication isa promising one due to its inexpensive devices and fast deploy-ment. Various schemes have been proposed for the AMI com-munications, such asWorldwide Interoperability forMicrowave

Manuscript received December 08, 2011; revised April 10, 2012; acceptedMay 20, 2012. Date of publication July 24, 2012; date of current version Au-gust 20, 2012. This work was supported by the National Science Foundationunder Grants CNS-0910461, CNS-0905556, CNS-0953377, ECCS-1028782,CCF-0830451, ECCS-0901425, CNS-1116826, CCF-1054338, DMS-11-18822and CNS-11-16534. Paper no. TSG-00676-2011.H. Li, S. Gong, and D. Yang are with the Department of Electrical Engi-

neering and Computer Science, the University of Tennessee, Knoxville, TN37996 USA (e-mail: [email protected]).L. Lai is with the Department of Systems Engineering, University of

Arkansas, Little Rock, AR 72204 USA (e-mail: [email protected]).Z. Han is with the Department of Electrical and Computer Engineering, Uni-

versity of Houston, Houston, TX 77004 USA (e-mail: [email protected]).R. C. Qiu is with the Department of Electrical and Computer Engineering,

Tennessee Technological University, Cookeville, TN 38505 USA (e-mail:[email protected]).Color versions of one or more of the figures in this paper are available online

at http://ieeexplore.ieee.org.Digital Object Identifier 10.1109/TSG.2012.2203156

Access (WiMAX) [2], 4G Long Term Evolution (LTE) [16],IEEE 802.11 [18], or even compressive sensing based multipleaccess [10]. However, most existing studies are more focusedon the basic designs of communication such as link budget orsignal processing algorithms, but did not take the fundamentalcharacteristics of AMI data into account.In the viewpoint of the authors, the major challenges of wire-

less communications in smart grid include:• Efficiency: Since frequency spectrum is a very expensiveresource, it is desirable to utilize the spectrum efficiently.This requires a thorough study on the information source,i.e., the power consumption data, in order to avoid unnec-essary redundancy in the transmissions.

• Security: The power consumption report in AMImay carrymuch private information of the power users [11]. Even ifthe packets are protected by encryptions, the data transmis-sion pattern may still disclose some important information,if the data transmission times are dependent on the powerconsumption activities.

To address the above two challenges, in this paper we carryout a measurement experiment for household power consump-tion using a power clamp, as shown in Fig. 1. Using the col-lected power consumption data, we have found that the powerconsumption stays constant for the majority of the time andthe change of power consumption arrives in an approximatelyPoissonmanner. Hence, we propose to let smart meters transmitonly when there is a significant change in the power consump-tion, which is coined the policy of Change and Transmit (CAT),thus significantly saving the spectrum requirement. We will alsoanalyze the performance of various multiple access schemesusing the policy of CAT. However, the policy of CAT incursa vulnerability to the AMI system, i.e., an eavesdropper caneasily obtain the power consumption information by monitoringthe radio activity of smart meter. Particularly, an eavesdroppercan detect whether the household owner is at home or not, whichis called Presence Privacy Attack (PPA). Hence, in this paper,we propose a scheme of spoofing the eavesdropper by sendingartificial dummy packets, which is coined Artificial SpoofingPacket (ASP). Using the real measurement data, wewill demon-strate the effectiveness of the ASP scheme. In summary, in thispaper we address both the efficiency and security issues of wire-less AMI by proposing both CAT and ASP schemes, which canprovide significant insights to guide the detailed design of wire-less communications for AMI.Note that there have been many studies on the power con-

sumption of users, which is of key importance for the pricing inpower market. However, in traditional studies, most of them arefocused on the modeling of long-term power consumptions,

1949-3053/$31.00 © 2012 IEEE

LI et al.: EFFICIENT AND SECURE WIRELESS COMMUNICATIONS FOR ADVANCED METERING INFRASTRUCTURE IN SMART GRIDS 1541

Fig. 1. Measurement using AEMC CL601 clamp.

e.g., the hourly or daily or weekly consumption. An excellentsurvey can be found in [19]. In recent years, due to the de-mand of study on smart meters, there have been some studieson short-term power consumptions [13], [15]. However, to theauthors’ best knowledge, there have not been any studies usingthe same modeling as that in this paper. It should also be notedthat the conclusions obtained in this paper is valid to only themeasurements obtained by the authors. We will use more mea-surements from more power consumers to verify the conclu-sions in our future study.The remainder of this paper is organized as follows. In

Section II, we describe the measurement experiment of powerconsumption and model the changes in power consumption.In Sections III and IV, we discuss the efficient and securemultiple access schemes, namely the CAT and ASP schemes.The conclusions are drawn in Section V.

II. MEASUREMENT AND MODELING

In this section, we introduce the measurement that we havecarried out and the corresponding modeling for the data ofpower consumption.

A. Measurement

We have carried out a measurement experiment to obtain thereal power consumption data. An AEMC CL601 clamp is usedto measure the current flowing through the main cable of thehouse/office, as shown in Fig. 1. Since the voltage is 110 V, thepower consumption is proportional to the current (we assumethat the power factor1 is approximately constant). The powerclamp can sample the current every 500 ms2 and record thecorresponding value in the memory. When the measurement iscompleted, the data can be downloaded to a computer using aUSB cable. The quantization step of the current is 0.1 Arms.The measurement lasts for 33 days. The 24 h measurement forthe first author’s house on Oct. 22, 2010 is shown in Fig. 2. Aninterval of 25 min is shown in Fig. 3.

1Power factor means the ratio between the average real power and apparentpower and equals the cosine of the phase difference between voltage and current.It measures the capability of the load converting the electricity into real power.2This sampling time period is such smaller than necessary for smart meters;

however, it can be used to analyze the activities of household appliances.

Fig. 2. Measurement report for 24 h on Oct. 22, 2010.

Fig. 3. Measurement spanning 25 min.

From the measurement, we observe the following features ofthe power consumption data:• For most of the time, the power consumption keepsconstant. Changes could occur randomly (e.g., the electricoven is turned on). From the viewpoint of communica-tions, only the change implies information. There is noneed for the smart meter to send messages when the powerconsumption does not change.

• There are also some periodic power consumption changes,as shown in Fig. 2, which is due to the on and off of re-frigerator. However, the change is sporadic (once per morethan 10 min), which does not cause much impact on thecommunications.

• The probability of power consumption change changes indifferent time intervals. Here we define a change as theevent that the difference of two successive measurementsis more than a threshold (Arms). For the measurementin Fig. 2, we have obtained the probability of change indifferent hours, which is shown in Fig. 4 for different ’s.Note that the probability of change is defined as the proba-bility that the difference of the current between the currentand the next time slots is larger than , which is obtainedfrom the statistics in the measurements. We observe thatthe change probability achieves the maximum during thedinner time, which is due to the use of electric oven. Thisimplies that, if the smart meter sends data only when thepower consumption experiences a significant change, the


Fig. 4. The probability of change in different hours.

communication requirement changes in different periodsof the day. Hence, a dynamic spectrum allocation may im-prove the efficiency of spectrum (e.g., in the midnight, thespectrum allocated to the smart meter network can be re-duced).3

Note that the above observation is dependent on the measure-ment data and the setup of the threshold . For measurement inother locations such as office, the power activity may not havethe pattern of households power consumption. When we choosemuch higher threshold or choosemuch longer time scales suchas minutes (in this paper the time scale is subseconds), the distri-bution of the power consumption changes may be significantlychanged. In our future study, we will obtain more measurementsfrom more households or from other types of power users suchas offices, thus obtaining more general characteristics of powerconsumption process.

B. Modeling

From the viewpoint of communications, the power consump-tion dynamics data is the source of information. To compressthe information source, or equivalently achieving an efficientsource coding, we need to study the characteristics of the powerconsumption dynamics. For a general information source, weshould model it as a random process and then measure the en-tropy rate, which indicates how many bits are needed to encodethe information source. However, the optimal source codingcould be very complicated, particularly when the informationsource is not Markovian. Hence, in this paper, we adopt thefollowing policy: the smart meter transmits the report onlywhen there is a significant power consumption change, whilethe source coding is independent among different time slots(i.e., we do not consider the time correlation in the informationsource), which is called the CAT policy.Due to the CAT policy, we focus on the modeling of the ar-

rivals of significant power consumption changes. In many ar-rival random processes, such as customer arrivals to a shop or

3This observation may motivate the application of dynamics spectrum accessfor AMI. However, this is out of the scope of this paper.

Fig. 5. Comparison of CDF of the change probability.

packet arrivals at an Internet router, the process can be mod-eled by a Poisson process, which has many elegant mathemat-ical properties, i.e., the number of arrivals within a unit timesatisfies the following distribution:

(1)

where is the average number of arrivals within a unit time.Then, can the arrival process of power consumption changes bemodeled as a Poisson process? Fortunately, the answer is yes!1) Comparison of CDF Curves: To verify the Poisson

process modeling, we first plot the cumulative distributionfunction (CDF) curves of the empirical distribution and thePoisson distribution with an estimated average arrival numberin Fig. 5. Note that the CDF curves are obtained from the timeinterval 6 pm–8 pm on two successive days and the time unit isfixed as 100 s. We observe that the CDFs match very well andthe CDFs on different days are also very close to each other,which implies that the distribution may be predicted from thehistory (not necessarily a good prediction).2) Kolmogorov-Smirnov Test: To be more rigorous, we used

the Kolmogorov-Smirnov test (K-S test) for the hypothesis thatthe power consumption change satisfies the Poisson distribution(more details are provided in Appendix A). The metric of theK-S test is defined as

(2)

where and are the CDFs to be tested and the empirical dis-tribution obtained from data, respectively. Note that we used

instead of sup in the definition since the distribution isdiscrete. We used the measurement of the first author’s homefor three days. Since the distribution could change with time,as shown in Fig. 4, we estimate different for every 2 h ineach day, by assuming that the point process is stationary. Weused Arms for detecting the change of power con-sumption. The metrics in the K-S test are shown for differenttime periods (each spans 2 h) in Fig. 6. We observe that the dif-ference between the two CDFs is small, which implies that the


Fig. 6. The metric of Kolmogorov-Smirnov test for different time periods inthree days.

Fig. 7. in different time periods and different days.

point process of power consumption change can be well approx-imated by a Poisson distribution.3) Time-Varying Parameters: We also plotted the estimatedfor different time periods and different days in Fig. 7. We

observe that, in all three days, the expected arrival rate (per 100s) has a peak during the dinner time, which coincides the obser-vation in Fig. 4. Hence, the approximation of Poisson processis valid only within a short period of time. We also notice thatthere are some fluctuations in the parameter for the same timeperiod and different days. For example, is very large at mid-night for day 1, which is due to a “midnight meal” of the firstauthor.

III. EFFICIENT MULTIPLE ACCESS SCHEME

In this section, we analyze the efficiency of different schemesof multiple access for the wireless smart metering.We first com-pare the different schemes. Then, analytical results are shownfor the performance. Finally we provide the numerical results.

TABLE ICOMPARISON BETWEEN DIFFERENT MULTIPLE ACCESS SCHEMES

Note that the performance is based on the mathematical modelfor the power consumption changes proposed in Section III.

A. Comparison of Different Schemes

We consider two types of multiple access schemes for thewireless smart metering:• Dedicated channel based: In this case, each smart meteris assigned a dedicated channel, either in time or in fre-quency. The scheme could be either time division multipleaccess (TDMA) or orthogonal frequency division multipleaccess (OFDMA). In TDMA case, each smart meter is al-located a time slot. In OFDMA case, the dedicated channelcould be one or more sub-carriers.

• Contention based: In this case, there is no dedicatedchannel for each smart meter. When a smart meter findsa change in the power consumption and needs to transmita packet for reporting the change, it senses the channelfor transmission and then transmits if the channel is idle(CSMA), or directly goes ahead to transmit (time slottedAloha). If collision occurs, it chooses a random backofffor retransmission.

The comparison between the two types of multiple accessschemes in the context of smart meter communication is sum-marized in Table I.

B. Performance Analysis

We use the metrics of delay and packet loss rate to mea-sure the performance in a smart meter network. We con-sider TDMA and OFDMA for the dedicated channel case andconsider binary exponential backoff slotted Aloha for the con-tention based scheme. Note that the delay and packet loss arecaused by the following reasons:• Delay: For TDMA, a delay is incurred when the assignedtime slot has not arrived. For OFDMA, the packet can betransmitted immediately; however, it takes more time toaccomplish the transmission than the TDMA case, sincethe bandwidth allocated to each smart meter becomessmaller. For the random access case, the delay is causedby collisions.


• Packet loss: In practice, a packet could be lost due to badchannel quality. For simplicity, we assume that the channelquality is always good enough such that we do not considerthe packet loss caused by a bad channel. We assume that,if an old packet has not been transmitted successfully, ithas to be discarded when a new packet arrives. This is rea-sonable since the system always demands the newest in-formation about power consumption. In practical systems,it is also possible to use a buffer to store untransmittedpackets if the out-of-date information is also needed (e.g.,for analyzing the power consumption patterns). The corre-sponding analysis will be much more complicated and willbe studied in the future.

Although the analysis is simple and does not include manypractical factors such as fading and thermal noise, it can providea preliminary estimation on the delay and packet loss rate ofvarious multiple access schemes.1) Assumptions: Throughout the performance analysis, we

use the following assumptions in order to simplify the analysis:• We assume that all smart meters are perfectly synchronizedboth in time and frequency.

• We assume that the time is slotted, and denote by thetime duration of each time slot. We assume that, in bothTDMA and time slotted Aloha schemes, a message can betransmitted within one time slot. For OFDMA, we assumethat the bandwidth is uniformly allocated to different smartmeters; therefore, the time needed to transmit a message is, i.e., time slots.

• We ignore the transmission failures due to noise or fading.Transmission failure occurs only when two or more smartmeters transmit simultaneously in the Aloha case.

• Each message contains the new value of the power con-sumption. We do not consider the compression of the mes-sage itself although it is possible to incorporate the timeredundancy into the source coding.

2) TDMA: Since the smart meter needs to wait until its owntime slot for transmitting and the change could occur at any timeslot, the expected delay is . It is easy to verify that thepacket loss rate is given by

(3)

where we utilized the fact that the probability that there are stilltime slots before the assigned time slot is , for an arbi-

trary time slot.

3) OFDMA: Obviously, the delay is fixed and equals forthe OFDMA case. It is easy to verify that the packet loss rate isgiven by

(4)

4) Slotted Aloha: The analysis on the slotted Aloha schemeis much more complicated [7], [20]. Here we consider onlythe case in which the retransmission is rare, i.e., collision hap-pens very rarely. We denote by the initial backoff window.Then, the backoff window size of the -th retransmission isgiven by , where is themax-imum window size and the window size is a binary exponentialbackoff one. Then, given that the message is successfully trans-mitted, the delay is given by

(5)

where is the number of retransmissions and is the delay ofthe -th retransmission. The random variable here is the numberof retransmissions, namely . Due to the assumption that the re-transmission is rare, we can assume that all collisions are fromthe initial transmissions of other smart meters. Hence, the dis-tribution of is approximated by

(6)

where is the probability that the retransmission is successful,which is given by

(7)

Note that the second equation is due to the assumption that col-lision occurs only when a new packet arrives at another smartmeter, while the last equation is because is the probabilitythat no new packet arrives at a certain smart meter.Meanwhile, the distribution of is given by

(8)

By combining the above expressions, we can obtain the distri-bution of , which is that of the sum of independent randomvariables.The event of packet loss is that a new message is generated

before the success of transmission of the current message. Wedenote by that the packet is discarded during the -th


retransmission. Then, it is easy to verify that the distribution isgiven by

(9)

where the explanation is given by:• is the probability that the transmission is un-successful in the first times, thus necessitating the-th transmission.

• , where is the actual backoff time in the-th retransmission, is the probability that there is no newpacket given the backoff times in the retransmissions.

• is the probability that the backoff times aregiven by .

• is the summation of all possible backofftimes.

• is the probability that one or more packet isgenerated in the -th retransmission.

Then, the packet loss rate is given by

(10)

C. Numerical Results

We use numerical simulations to demonstrate the perfor-mance of the different multiple access schemes. Unfortunately,we do not have sufficient data for the power consumptions. Weconsider the power consumptions of the same location (the firstauthor’s home, as mentioned before) on different days as thoseof different power users on the same day. Totally, we have

, i.e., 33 smart meters from the 33 days’ measurements.Although it is still far away from practical case in which therecould be a large number of smart meters, we scale the band-width such that the bandwidth allocated to each smart meter isreasonable. The simulation results can also provide insights forfuture studies. Unless noted otherwise, we set the duration oftime slot to be 100 ms, i.e., the transmission of each packetneeds 100 ms.4 If each packet contains 1 k bits (including theheader, payload and digital signature), the 33 smart metersare assigned a bandwidth of approximately 10 kbps, which isreasonable when the number of smart meters is large. We alsotest different thresholds of power consumption change, i.e., ,to trigger the report of smart meters.Note that the time slot of 100 ms does not mean that each

smart meter needs to report every 100 ms, which may be un-necessary since the power dynamics are usually in a larger timescale. When there are 1000 power users, the report will be onceper 100 s, which could be possible since the incorporation of

4Note that the transmission time 100 ms may be too large for a modern com-munication system. However, when there are a large number of smart meters(e.g., thousands of meters), the average bandwidth that can be allocated to eachmeter will not be large; hence, the transmission time may be larger than manyexisting communication services.

Fig. 8. Average delays in different time periods when ms,and .

Fig. 9. Packet loss rates in different time periods when ms,and .

many renewable energy generations such as solar panel orwind turbine has significantly increased the variance of powergenerations.The average delay and packet loss rate are shown in Figs. 8

and 9, respectively, when ms, and .Weobserve that the slotted Aloha significantly outperforms TDMAand OFDMA. Within the dedicated channel case, TDMA out-performs OFDMA due to the long average delay of OFDMA(the long delay also incurs packet loss). When is smaller, i.e.,more bandwidth for each smart meter, the performance gain ofslotted Aloha is even larger.The average delay and packet loss rate are shown in Figs. 10

and 11, respectively, when ms, and. Compared with the previous simulation results, the mes-

sage arrival rate is significantly increased. We observe that theperformance of slotted Aloha is significantly impaired due to thecongestion. However, with this configuration, the performanceis intolerable for practical systems.In Figs. 12 and 13, we changed to 70 ms by increasing the

communication bandwidth ( is still set to 0), thus decreasingcongestion level. We observe that slotted Aloha could be better


Fig. 10. Average delays in different time periods when ms,and .

Fig. 11. Packet loss rates in different time periods when ms,and .

than or worse than TDMA in different time periods in the sameday. This implies that the multiple access could be adaptive:upon congestions, the system can be switched to TDMA orOFDMA; on the other hand, it can switch to the contentionbased one. The switch can be either adaptive to the currentsystem situation or be predetermined using historic data.Note that we only considered the simplest model for these

multiple access schemes. We ignored many details, e.g., thecyclic prefix in OFDMA and the possible time synchroniza-tion error in TDMA. We will use more practical softwares likeQualnet for obtaining more concrete simulation results with themeasurement data.

IV. SECURE MULTIPLE ACCESS SCHEME

In this section, we study the security issues of the proposedCAT scheme for smart metering. Essentially, we consider thePPA attack in which an eavesdropper determines whether thehousehold owner is at home or not. We will propose the ASP

Fig. 12. Average delays in different time periods when ms, ,and .

Fig. 13. Packet loss rates in different time periods when ms, ,and .

scheme which can efficiently spoof the eavesdropper and beatthe counterstroke of K-S test by the attacker, as will be demon-strated by numerical simulations. The arms race between theattacker and smart meter is illustrated in Fig. 14.Note that there have intensive studies on traffic analysis at-

tack [5], [21], into which the attack proposed in this paper maybe categorized. The insertion of dummy packets is also widelyused to mitigate the traffic analysis [1]. However, in many ofthese studies, the attack and defense are focused on the corre-lation analysis in order to identify the source-destination pairs,instead of the presence of certain entity. Hence, the detailed al-gorithms in this paper are different from the existing studies. Itshould also be noted that, if a periodic transmission scheme isused, regardless of the power consumption situation, there willbe no security issues. To combat the PPA attack, extra communi-cation resources are needed for the spoofing packets. However,compared with the periodic transmission scheme, the commu-nication of the proposed scheme is still efficient, even thoughthe overhead of spoofing packets is added.


Fig. 14. The arms race between the attacker and smart meter.

Fig. 15. Comparison of power consumption between 02:00–02:30 and18:00–18:30.

A. PPA Attack

In the PPA attack, an eavesdropper can monitor the radio ac-tivity of a certain power consumer. It does not need to decodeand decypher the packets (we assume that the smart meter hasa perfect encryption mechanism); it simply needs to count thenumber of packets within each time unit, e.g., by employing anenergy detector. As we have explained, when the power con-sumption activity is more intensive, the power consumptionchange will also be increased, which results in more packetsdue to the CAT policy of transmission. Hence, the eavesdroppercan easily determine the current power consumption intensity.Then, for a typical period of intensive power consumption suchas dinner cooking time, if the eavesdropper finds that the numberof packets is significantly lower than the normal level, it ishighly possible that the house owner is not at home. This isparticularly a good news to the community of thieves and thusbrings significant jeopardy to the power user.Fig. 15 shows the comparison between the power consump-

tion changes in the midnight (which can be considered as thetime when the house owner is not at home) and those during thecooking time. We observe a substantial difference, which im-plies that the eavesdropper can detect the presence of the ownerwith a high confidence.

B. ASP Defense

The philosophy of combating the PPA attack is: when theowner is not at home, add spoofing packets to the transmissionwhen the power consumption is typically intensive. When thehouse owner leaves the house, he/she can trigger the ASP de-fense scheme, which will automatically generate more packetsduring the cooking time even though there is actually no powerconsumption change. This scheme can spoof the eavesdropperat the cost of some bandwidth waste. An illustration of the ASPscheme is illustrated in Fig. 16.The key challenge of the ASP scheme is how to add the

spoofing packets. As will be seen below, we can have twoapproaches for generating the spoofing packets, namely thePoisson packet generation and history template (HT) basedgeneration. A memory, illustrated in Fig. 16, is used to storethe previous time pattern of data transmission during differenttime periods. A sliding window could be used to discard theold data and avoid the overflow of memory.

Procedure 1 Procedure of the ASP Defense Scheme

1: if The owner is at home then2: Set the mode as “at home”3: else4: Set the mode as “on leave”5: end if6: for Each time slot do7: if The mode is “at home” then8: Transmit when a power consumption change arrives.9: Store the arrival interval in the memory.10: else11: Use a random generator to generate spoofing packets

or use one HT stored in the memory.12: Transmit if there is a power consumption change or

there is a spoofing packet.13: end if14: end for

1) Poisson Generation of Spoofing Packets: As we havementioned, the arrivals of power consumption changes canbe approximated by a Poisson process. Hence, the memorycan store the average number of power consumption changeswithin unit time in different time intervals. Then, when thehouse owner leaves, the smart meter can generate the spoofingpackets using a Poisson process generator and the corre-sponding arrival rates stored in the memory. An advantage ofthis scheme is that only a small memory is needed to store theaverage arrival rates.2) HT Based Generation of Spoofing Packets: Another ap-

proach is to generate the spoofing packets according to the his-tory record in the memory. There are two approaches for uti-lizing the history record: a) repeat the same arrivals of packetsin the history; e.g., we can repeat the whole transmission historyduring a busy dinner time; b) randomly generate the spoofingpackets according to the empirical distribution of the time inter-vals between significant power consumption changes. Hence,the previous observations are used as the HTs; i.e., the time is


Fig. 16. An illustration of the ASP defense scheme.

divided into different time frames (e.g., 30 min) and the ob-servation within each frame is one HT. The advantage of thisapproach is that it does not rely on the assumption of Poissonprocess of the power consumption changes. However, it requiresmore memory since it needs to record the history of powerconsumptions.

C. Countermeasures of Eavesdropper

When the smart meter uses spoofing packets, it is difficult forthe attacker to determine whether the house owner is at homeby simply counting the number of packets. However, since thedefense scheme of ASP is public and the attacker knows howthe spoofing packets are generated, it can detect whether thepackets are triggered by real power consumption changes, or arespoofing packets. Once the attacker finds that packets actuallycontain many spoofing ones, it can determine that the houseowner is on leave and the smart meter is in the “on leave” mode.We discuss both cases in which the attacker either knows the HTor not.1) Case of Known HT: We first assume that the attacker

knows the set of HTs of the smart meter. For example, theattacker can also store the radio activities in a memory. Thegeneral procedure of detecting the spoofing packets is given inProcedure 2.• If the spoofing packets are generated as a Poisson process,the attacker can detect the spoofing packets by checkingwhether the packets follow a Poisson process. A K-S testcan be used for the detection by comparing the sampleswith a Poisson distribution whose expectation can be esti-mated from the samples. Actually, in this scenario, the at-tacker does not need to have the HT since it only needs todetermine whether the spoofing packets satisfy a Poissonprocess. However, the knowledge of HT helps to determinethe parameter of the Poisson process, thus accelerating thedetection.

• If the spoofing packets are generated by using HTs that arealso known to the attacker, the attacker can also carry outthe K-S test to judge whether the empirical distribution ofthe packet arrival times is close to that of one of the HTs.

Procedure 2 Procedure for Detecting Spoofing Packetswith Known HT

1: Collect different frames and compute the empiricaldistribution of packet arrivals.

2: if The spoofing packets are generating with Poissonprocess then

3: Estimate the expectation of the Poisson distribution.4: Carry out the K-S test between the empiricaldistribution and Poisson distribution.

5: else6: Carry out the K-S test for the reference CDFsobtained from HTs.

7: end if8: if The error in the K-S is sufficiently small then9: Claim that spoofing packets are detected.10: end if

Three methods are applied for generating the empirical distri-bution function (EDF) and reference CDFs in the K-S test. Thedifference among these three methods is in the first two stepsabout how to construct the EDF of observations and referenceCDFs of HTs in order to calculate the minimum distance be-tween thes EDF and all CDFs:• For method 1, only data samples from one frame is used toconstruct the EDF. The data source of each reference CDFis from one HT.

• For method 2, the way to generate the reference CDF isthe same as method 1. However, the way to generate theEDF and calculate the error in the K-S test is different frommethod 1. The procedure is shown in Procedure 3. The ideaof combining data samples from more than one frames isto increase the detection rate when the HT length is short.

• For method 3, the way to construct the EDF is the same asthat for method 2; for the reference CDFs, besides the ref-erence CDF that is obtained from one HT, more referenceCDFs are obtained based on the combination of two HTs.The purpose of combining HTs to generate new referenceCDF is also to increase the detection rate.

Procedure 3 Procedure for Generating the EDF andCalculating The Metric in K-S Test for Method 2

1: for Each frame do2: Randomly select another frame , then combine thedata samples from both frames and to generatethe EDF

3: Calculate the minimum distance betweenand all the reference CDFs

4: end for5: Then the metric of K-S test, , for frame is theminimum of .

2) Case of Unknown HT: When the attacker does not havethe record of HTs (e.g., the attacker does not have a largememory), it cannot use the K-S test since it does not have anytemplate distribution for the comparison. However, since the


number of HTs stored in the smart meter is limited, there isa high probability that one HT is used to generate the spoofpackets for many times. In other words, the EDFs in differenttime frames could be vary similar. This correlation in EDFscan be used to detect whether the data in the time frame isgenerated from real change of power consumption or from theASP defense scheme. The general procedure is vary similarto that of the case of known HTs. The only difference is thatreference CDFs in the K-S test are generated from online mea-surements (in the case of known HTs, the reference CDFs areobtained from the historical records). The detection procedurefor method 1 with unknown HTs is given in Procedure 4. Weomit the counterparts for methods 2 and 3 due to the similarityand limited space.

Procedure 4 Procedure of Method 1 with Unknown HTs

1: Obtain the EDFs of time frames2: for each time frame do3: Carry out the K-S test by calculating the minimumdistance between the EDF of frame and those of allother frames

4: Claim that spoofing packets are detected if theminimum distance is less than a threshold.

5: end for

D. Numerical Results

Now we use numerical simulations to demonstrate the de-fense and attack schemes proposed above. The measurementdata collected by the power clamp in 480 h is used in the simula-tion. We set the number of HTs to eight; i.e., there are eight tem-plates for the traffic pattern in busy times stored in the memory.The total length of data obtained during the time of busy powerconsumptions is 100 h. The number of emulated frames duringthe status of “on leave” is 500, over which we obtain the perfor-mance of the attacker.Note that the main concern of the attacker is the false alarm

since a false alarm may cause significant damage to the attacker.In this paper, we assume that a false alarm rate of 0.05 is accept-able. Then, we need to check the detection rate at this false alarmrate.1) KnownHTS: Figs. 17 and 18 show the Receiver Operating

Characteristic (ROC) of different methods when the spoofingpackets generated from Poisson process and HTs, respectively,when HTs are known by the attacker. Here the false alarm ratemeans the probability that the attacker claims that the owneris on leave while the owner is actually at home, while the thedetection rate is the probability that the attacker successfullydetects the on leave state of the owner. In both figures, we ob-serve that, the longer each frame is, the better the detection per-formance is. This motivates the smart meter to use reasonablyshort HTs for the generation of spoofing packets. We also ob-serve that method 3 achieves the best performance among thethree proposed methods of detection. More importantly, the at-tacker can detect the “on leave” state of the owner with a highdetection probability when the smart meter uses the generationof Poisson process. When the smart meter uses the HT based

Fig. 17. The ROC of different detection methods with known HTs when thesmart meter generates the spoofing packets using Poisson process.

Fig. 18. The ROC of different detection methods with known HTs when thesmart meter generates the spoofing packets using HTs.

Fig. 19. The ROC of different detection methods with unknown HTs when thespoof packets are generated in a Poisson manner.

generation of spoofing packet, the detection performance of theattack becomes unreliable. Using the criterion of false alarmrate equaling 0.05, the detection rate in Fig. 17 (using Poissonprocess) is fairly high (more than 80%), which means that thedetection performance is good for the attacker; meanwhile, thedetection rate in Fig. 18 (using HT) is less than 0.5 for the worstcase, which is not good for the attacker.2) Unknown HTs: Figs. 19 and 20 show the ROCs of dif-

ferent attackmethods when theHTs are unknown to the attacker.Compared with the cases when HTs are known, the performanceof the attacker is worse due to the unknown HTs. However,when the Poisson distribution is used for generating the spoofing


Fig. 20. The ROC of different detection methods with unknown HTs when thespoof packets are generated using HTs.

packets, the attacker can still achieve a reasonable performance.For example, when attack method 2 is used, the attacker canachieve a detection rate of 80% at the cost of false alarm rate5%. When the empirical distributions obtained from HTs areused to generate the spoofing packets, the performance of theattacker is significantly decreased, or equivalently the securityof the power user is enhanced. Again, it is more desirable to usethe HTs to generate the spoofing packets. Again, using the cri-terion of false alarm rate equaling 0.05, the detection rate is lessthan 0.1, which means that the detection performance is bad.

V. CONCLUSION

In this paper, we have discussed the reliable and secure wire-less communications for advanced metering infrastructure insmart grid. We have carried out a measurement experiment forhousehold power consumption, based on which we have builta mathematical model for the packet arrival process. Then, wehave studied various schemes of multiple access, particularlythe schemes of dedicated channels and random access. Theperformance is analyzed both analytically and numerically. Wehave also studied the security of the wireless communications,mainly preventing attackers from analyzing the presence ofhouse owner by counting the number of packets. A schemeof transmitting spoofing packets is proposed for mitigatingthe attack, which has been demonstrated to be effective forcombating several types of countermeasures of the attack.

APPENDIX AINTRODUCTION TO KOLMOGOROV-SMIRNOV TEST

K-S statistic is widely used in K-S test as a measure of dis-tance between two EDFs of samples or between the EDF ofsample and the CDF of distribution function.The EDF for i.i.d. observations is

defined as

(11)

Then, the K-S statistic for a given CDF of a distributionand given EDF is

(12)

where is the supremum of distance. The K-S statistic fortwo EDF and is

(13)

The reason we use K-S statistic as a measure of distance is dueto the Glivenko-antelli theorem which shows that convergesto 0 almost surely as if the samples comes fromdistribution .

REFERENCES[1] T. Abraham and M. Wright, “Selective cross correlation in passive

timing analysis attacks against low-latency mixes,” in Proc. IEEEConf. Global Commun. (Globecom), 2009.

[2] M. Anderson, “WiMAX for smart grids,” IEEE Spectr., vol. 47, no. 7,p. 14, Jul. 2010.

[3] C. Bennett and S. Wicker, “Decreased time delay and security en-hancement recommendations for AMI smart meter networks,” in Proc.Innov. Smart Grid Technol. Conf., 2010.

[4] S. Borenstein, M. Jaske, and A. Rosenfeld, “Dynamic pricing, ad-vanced metering, and demand response in electricity markets,” UCBerkeley: Center for the Study of Energy Markets, 2002.

[5] Y. Fan, Y. Jiang, H. Zhu, and X. Shen, “An efficient privacy-preservingscheme against traffic analysis attacks in network coding,” in Proc.IEEE Conf. Comput. Commun. (Infocom), 2009.

[6] ISO New England Inc., “Overview of the smart grid: Policies, initia-tives and needs,” Feb. 17, 2009.

[7] L. Kleinrock and F. A. Tobagi, “Packet switching in radio channels:Part I—Carrier sensemultiple access modes and their throughput-delaycharacteristics,” IEEE Trans. Commun., vol. 23, pp. 1400–1416, Dec.1975.

[8] F. Li, “Continuous locational marginal pricing (CLMP),” IEEE Trans.Power Syst., vol. 22, pp. 1638–1646, Nov. 2007.

[9] F. Li and R. Bo, “Congestion and price prediction under load varia-tion,” IEEE Control Syst. Mag., vol. 19, pp. 59–70, Oct. 2009.

[10] H. Li, R. Mao, L. Lai, and R. C. Qiu, “Compressed meter reading fordelay-sensitive and secure load report in smart grid,” in Proc. 1st IEEEConf. Smart Grid Commun., 2010.

[11] M. A. Lisovich, D. K. Mulligan, and S. B. Wicker, “Inferring personalinformation from demand-response systems,” IEEE Security Privacy,vol. 8, no. 1, pp. 11–20, Jan./Feb. 2010.

[12] E. Litvinov, T. Zheng, G. Rosenwald, and P. Shamsollahi, “Marginalloss modeling in LMP calculations,” IEEE Trans. Power Syst., vol. 19,pp. 880–888, May 2004.

[13] X. Ma, H. Li, and S. Djouadi, “Stochastic modeling of short-termpower consumption for smart grid: A state space approach and realmeasurement demonstration,” in Proc. Conf. Inf. Sci. Syst. (CISS),2011.

[14] M. Roozbehani, M. Dahleh, and S. Mitter, “Dynamic pricing and sta-bilization of supply and demand in modern electric power grids,” inProc. 1st IEEE Conf. Smart Grid Commun., 2010.

[15] D. D. Silva, X. Yu, D. Alahakoon, and G. Holmes, “Incremental patterncharacterization learning and forecasting for electricity consumptionusing smart meters,” in Proc. IEEE Ind. Electron., 2011.

[16] M. R. Souryal and N. Golmie, “Analysis of advanced metering over awide area cellular network,” in Proc. IEEE Conf. Smart Grid Commun.(SmartGridComm), 2011.

[17] S. Stoft, Power System Economics—Designing Markets for Elec-tricity. New York: IEEE–Wiley, 2002.

[18] M. Tanaka et al., “New throughput analysis of long-distance IEEE802.11 wireless communication system for smart grid,” in IEEE Conf.Smart Grid Commun. (SmartGridComm), 2011.

[19] R. Weron, Modeling and Forecasting Electricity Loads and Prices: AStatistical Approach. Hoboken, NJ: Wiley, 2006.

[20] Y. Yang and T. P. Yun, “Delay distributions of slotted Aloha andCSMA,” IEEE Trans. Commun., vol. 51, pp. 1846–1855, Nov. 2003.

[21] Y. Zhu, X. Fu, B. Gramham, R. Bettati, and W. Zhao, “Correlation-based traffic analysis attacks on anonymity networks,” IEEE Trans.Parallel Distrib. Syst., vol. 21, no. 7, pp. 954–967, Jul. 2010.


Husheng Li (S’00–M’05) received the B.S. andM.S. degrees in electronic engineering from Ts-inghua University, Beijing, China, in 1998 and2000, respectively, and the Ph.D. degree in electricalengineering from Princeton University, Princeton,NJ, in 2005.From 2005 to 2007, he worked as a Senior

Engineer at Qualcomm Inc., San Diego, CA. In2007, he joined the EECS department of the Uni-versity of Tennessee, Knoxville, as an AssistantProfessor. His research is mainly focused on wireless

communications and smart grid.Dr. Li is the recipient of the Best Paper Award of the EURASIP Journal of

Wireless Communications and Networks, 2005 (together with his Ph.D. advisor,Prof. H.V. Poor), the best demo award of Globecom 2010 and the Best PaperAward of ICC 2011.

Shuping Gong received the B.S. degree in electricalengineering from Hainan University, Haikou, China,in 2004, and the M.S. degree in electrical engi-neering from University of Electronic Science andTechnology of China, Chengdu, China, in 2007. Heis currently working toward the Ph.D. degree at theUniversity of Tennessee, Knoxville, researching theintegration of wireless communication in smart grid.From 2007 to 2008, he worked as an Assistant En-

gineer at Huawei Inc., Shenzhen, China. In 2012, hedid an internship with Broadcom for six months.

Mr. Gong received the Best Paper Award of ICC 2011 together with his Ph.D.advisor, Dr. H. Li.

Lifeng Lai (M’07) received the B.E. and M.E. de-grees from Zhejiang University, Hangzhou, China in2001 and 2004, respectively, and the Ph.D. degreefrom Ohio State University, Columbus, in 2007.He was a Postdoctoral Research Associate at

Princeton University from 2007 to 2009. He isnow an Assistant Professor at the University ofArkansas, Little Rock. His research interests includewireless communications, information security, andinformation theory.Dr. Lai was a Distinguished University Fellow at

Ohio State University from 2004 to 2007. He is a co-recipient of the Best PaperAward from IEEE Global Communications Conference (Globecom), 2008, theBest Paper Award from IEEE Conference on Communications (ICC), 2011. Hereceived the National Science Foundation CAREER Award in 2011.

Zhu Han (S’01–M’04–SM’09) received the B.S.degree in electronic engineering from TsinghuaUniversity, China, in 1997, and the M.S. and Ph.D.degrees in electrical engineering from the Universityof Maryland, College Park, in 1999 and 2003,respectively.From 2000 to 2002, he was an R&D Engineer of

JDSU,Germantown,MD. From 2003 to 2006, he wasa Research Associate at the University of Maryland.From 2006 to 2008, he was an Assistant Professor inBoise State University, Idaho. Currently, he is an As-

sistant Professor in Electrical and Computer Engineering Department at the Uni-versity of Houston, TX. His research interests include wireless resource alloca-tion and management, wireless communications and networking, game theory,wireless multimedia, security, and smart grid communication.Dr. Han is an Associate Editor of the IEEE TRANSACTIONS ON WIRELESS

COMMUNICATIONS since 2010. He is the winner of IEEE Fred W. EllersickPrize 2011. He is an NSF CAREER award recipient 2010. He is the coauthorfor the papers that won the best paper awards in IEEE International Conferenceon Communications 2009, 7th International Symposium on Modeling and Op-timization in Mobile, Ad Hoc, and Wireless Networks (WiOpt09), and IEEEWireless Communication and Networking Conference, 2012.

Robert Caiming Qiu (S’93–M’96–SM’01) receivedthe Ph.D. degree in electrical engineering from NewYork University (formerly Polytechnic University,Brooklyn, NY).He is currently a Full Professor in the Department

of Electrical and Computer Engineering, Center forManufacturing Research, Tennessee TechnologicalUniversity, Cookeville, where he started as anAssociate Professor in 2003 before he became a FullProfessor in 2008. His current interest is in wirelesscommunication and networking, machine learning

and the Smart Grid technologies. He was Founder-CEO and President ofWiscom Technologies, Inc., manufacturing and marketing WCDMA chipsets.Wiscom was sold to Intel in 2003. Prior to Wiscom, he worked for GTE Labs,Inc. (now Verizon), Waltham, MA, and Bell Labs, Lucent, Whippany, NJ. Hehas worked in wireless communications and network, machine learning, smartgrid, digital signal processing, EM scattering, composite absorbing materials,RF microelectronics, UWB, underwater acoustics, and fiber optics. He holdsover 5 patents in WCDMA and authored over 50 journal papers/book chapters.He contributed to 3GPP and IEEE standards bodies. In 1998 he developed thefirst three courses on 3G for Bell Labs researchers. He served as an adjunctprofessor in Polytechnic University, Brooklyn, New York. He is a coauthorof Cognitive Radio Communication and Networking: Principles and Practice(Wiley, 2012). He is a Guest Book Editor for Ultra-Wideband (UWB) WirelessCommunications (New York: Wiley, 2005), and three special issues on UWBincluding the IEEE JOURNAL ON SELECTED AREAS IN COMMUNICATIONS,IEEE TRANSACTIONS ON VEHICULAR TECHNOLOGY, and IEEE TRANSACTIONSON SMART GRID.Dr. Qiu serves as Associate Editor, IEEE TRANSACTIONS ON VEHICULAR

TECHNOLOGY and other international journals. He serves as a Member of TPCfor GLOBECOM, ICC,WCNC, MILCOM, ICUWB, etc. In addition, he servedon the advisory board of the New Jersey Center for Wireless Telecommunica-tions (NJCWT). He is included in Marquis Who’s Who in America.

Depeng Yang received the B.S. and M.S. degreesin electronic engineering from Huazhong Universityof Science and Technology, Wuhan, China, in 2003and 2006, respectively, and the Ph.D. degree inelectrical engineering at the University of Tennessee,Knoxville, in 2011.His research interests include smart grid, statistical

signal processing, cognitive radio and UWB systems.He has authored/coauthored more than 30 journal/conference papers. He was the recipient of 2011 Uni-versity of Tennessee Chancellors Citation for Extra-

ordinary Professional Promise. He served as the session chair for CISS 2011 andRWS 2011. He has also served as a reviewer for the IEEE TRANSACTIONS ONSIGNAL PROCESSING and the EURASIP Journal on Applied Signal Processing

Documents

Efficient and Secure Wireless Communications for Advanced Metering Infrastructure in Smart Grids