[PPT] - Privacy-friendly Forecasting for the Smart Grid using Homomorphic PowerPoint Presentation

SLIDE 1

Privacy-friendly Forecasting for the Smart Grid using Homomorphic Encryption

J. Bos1, W. Castryck2,3, I. Iliashenko2 and F

. Vercauteren2,4

1NXP Semiconductors 2COSIC, KU Leuven and imec 3Université de Lille-1 4Open Security Research

AfricaCrypt 2017 Dakar, Senegal

SLIDE 2

The Smart-Grid

1 / 24

SLIDE 3

The Smart-Grid

load consumption weather conditions bills structure of a local utility grid . . .

1 / 24

SLIDE 4

The Smart-Grid

Benefits control of consumption

ptimization of utility production

improved logistics source of research data

1European Commission. Benchmarking smart metering deployment in the

EU-27 with a focus on electricity. Technical report 365, June 2014.

2 / 24

SLIDE 5

The Smart-Grid

Benefits control of consumption

ptimization of utility production

improved logistics source of research data “The Third Energy Package requires Member States to ensure implementa- tion of intelligent metering systems for the long-term benefit of consumers. [. . . ] For electricity, there is a target of rolling out at least 80% by 2020, of the positively assessed cases.1”

1European Commission. Benchmarking smart metering deployment in the

EU-27 with a focus on electricity. Technical report 365, June 2014.

2 / 24

SLIDE 6

Privacy Concerns in the Smart-Grid

Update rate of smart-meters: ≤ 15 min (EU recommendation)

3 / 24

SLIDE 7

Privacy Concerns in the Smart-Grid

Update rate of smart-meters: ≤ 15 min (EU recommendation) Power step changes due to individual appliance events. G.W. Hart. Nonintrusive appliance load monitoring. Proceedings of the IEEE, 80(12):1870-1891, 1992

3 / 24

SLIDE 8

Homomorphic Encryption

Enc(x) Enc(f(x))

4 / 24

SLIDE 9

Homomorphic Encryption

Enc(x) Enc(f(x)) Partially HE: Somewhat HE: Fully HE:

+ or× + and up to some consecutive× + and×

4 / 24

SLIDE 10

Homomorphic Encryption

Enc(x) Enc(f(x)) Partially HE: Somewhat HE: Fully HE:

+ or× + and up to some consecutive× + and×

Complexity

4 / 24

SLIDE 11

Prediction for the Smart-Grid

1,000 2,000 3,000 4,000 1 2 3 time, min load demand, kW

actual load

5 / 24

SLIDE 12

Prediction for the Smart-Grid

1,000 2,000 3,000 4,000 1 2 3 time, min load demand, kW

actual load fitting function

5 / 24

SLIDE 13

Prediction for the Smart-Grid

1,000 2,000 3,000 4,000 1 2 3 time, min load demand, kW

actual load fitting function

MSE = 1

n n

i=1

(yforecast

i

− yactual

i

)2, MAPE = 100

n n

i=1
yforecast

i

−yactual

i

yactual

i

5 / 24

SLIDE 14

Prediction for the Smart-Grid

Time period ARIMA BATS NNET PERSIST TBATS 30 min 91 57 49 75 72 60 min 51 59 52 60 63

MAPE for varying periods and algorithms

Source: Veit et al. Household electricity demand forecasting: benchmarking

state-of-the-art methods. In Proceedings of e-Energy ’14. 2014.

ANNs are the best choice, but . . .

6 / 24

SLIDE 15

Prediction for the Smart-Grid

Time period ARIMA BATS NNET PERSIST TBATS 30 min 91 57 49 75 72 60 min 51 59 52 60 63

MAPE for varying periods and algorithms

Source: Veit et al. Household electricity demand forecasting: benchmarking

state-of-the-art methods. In Proceedings of e-Energy ’14. 2014.

ANNs are the best choice, but . . . . . . they contain highly non-linear sigmoids as activation functions.

6 / 24

SLIDE 16

Prediction for the Smart-Grid

−1.5 −1 −0.5 0.5 1 1.5 −1 1

7 / 24

SLIDE 17

Prediction for the Smart-Grid

−1.5 −1 −0.5 0.5 1 1.5 −1 1

tanh x − 1

3x3

x − 1

3x3 + 2 15x5

x − 1

3x3 + 2 15x5 − 17 315x7 7 / 24

SLIDE 18

Prediction for the Smart-Grid

−1.5 −1 −0.5 0.5 1 1.5 −1 1

tanh x − 1

3x3

x − 1

3x3 + 2 15x5

x − 1

3x3 + 2 15x5 − 17 315x7 7 / 24

SLIDE 19

Polynomial Neural Networks

ANNs with polynomial activation functions: x2 pattern recognition (Microsoft’s CryptoNets) GMDH forecasting

8 / 24

SLIDE 20

Polynomial Neural Networks

ANNs with polynomial activation functions: x2 pattern recognition (Microsoft’s CryptoNets) GMDH forecasting Published by Alexei Ivakhnenko in 1970. Originally used for wheat harvest prediction in Ukraine.

8 / 24

SLIDE 21

Polynomial Neural Networks

ANNs with polynomial activation functions: x2 pattern recognition (Microsoft’s CryptoNets) GMDH forecasting Published by Alexei Ivakhnenko in 1970. Originally used for wheat harvest prediction in Ukraine. Applied for load forecasting:

comparable with conventional ANNs MAPE ≈ 2%

8 / 24

SLIDE 22

Polynomial Neural Networks

ANNs with polynomial activation functions: x2 pattern recognition (Microsoft’s CryptoNets) GMDH forecasting Published by Alexei Ivakhnenko in 1970. Originally used for wheat harvest prediction in Ukraine. Applied for load forecasting:

comparable with conventional ANNs MAPE ≈ 2% over a town, a big city district or a region

8 / 24

SLIDE 23

Group Method of Data Handling

Approximation by truncated Wiener series a0 +

n

i=1

aixi +

n

i=1

n

j=i

aijxixj +

n

i=1

n

j=i

n

k=j

aijkxixjxk + . . . n is the number of previous states of a system.

9 / 24

SLIDE 24

Group Method of Data Handling

Approximation by truncated Wiener series a0 +

n

i=1

aixi +

n

i=1

n

j=i

aijxixj +

n

i=1

n

j=i

n

k=j

aijkxixjxk + . . . n is the number of previous states of a system. Find coefficients {ai}, {aij}, {aijk}, . . .

9 / 24

SLIDE 25

Group Method of Data Handling

Approximation by truncated Wiener series a0 +

n

i=1

aixi +

n

i=1

n

j=i

aijxixj +

n

i=1

n

j=i

n

k=j

aijkxixjxk + . . . n is the number of previous states of a system. Find coefficients {ai}, {aij}, {aijk}, . . . Can be replaced by a composition of quadratic polynomials {bij0 + bij1xi + bij2xj + bij3xixj + bij4x2

i + bij5x2 j }.

9 / 24

SLIDE 26

Group Method of Data Handling

A neural network with the structure 4 – 4 – 3 – 2 – 1. Input variables Output value

10 / 24

SLIDE 27

Group Method of Data Handling

bij0 + bij1xi + bij2xj + bij3xixj + bij4x2

i + bij5x2 j

Neuron xi xj

utput

11 / 24

SLIDE 28

Group Method of Data Handling

bij0 + bij1xi + bij2xj + bij3xixj + bij4x2

i + bij5x2 j

Neuron xi xj

utput

Learning Define coefficients of a quadratic polynomial from Y = bX + e, where X = (1, xi, xj, xixj, x2

i , x2 j )⊺,

b = (bij0, bij1, bij2, bij3, bij4, bij5), Y is the expected output, e is a random noise. Can be done by the least-squares method.

11 / 24

SLIDE 29

Group Method of Data Handling

Input variables

12 / 24

SLIDE 30

Group Method of Data Handling

Input variables

12 / 24

SLIDE 31

Group Method of Data Handling

Input variables

12 / 24

SLIDE 32

Group Method of Data Handling

Input variables

12 / 24

SLIDE 33

Group Method of Data Handling

Input variables

12 / 24

SLIDE 34

Group Method of Data Handling

Input variables

12 / 24

SLIDE 35

Group Method of Data Handling

Input variables

12 / 24

SLIDE 36

Group Method of Data Handling

Input variables

12 / 24

SLIDE 37

Group Method of Data Handling

Input variables

12 / 24

SLIDE 38

Group Method of Data Handling

Input variables

12 / 24

SLIDE 39

Group Method of Data Handling

Input variables Output value

12 / 24

SLIDE 40

Sample data

Source: Commission for Energy

Regulation (CER) is the regulator for the electricity and natural gas sectors in Ireland.

Over 5,000 Irish homes and businesses observed. Electricity consumed during 30 minutes intervals. Time frame: July 14 2009 to Dec. 31 2010. Data splits: training set (1 year), test set (half a year).

13 / 24

SLIDE 41

Structure of the GMDH-network

Input layer (51 nodes): previous 48 half-hour load measures, day of the week, month, temperature. Hidden layers: 3 hidden layers of sizes 8, 4, 2. Output node: predicted consumption during the next 30 minutes. Resulting polynomial is of degree 24 = 16.

14 / 24

SLIDE 42

Implementation in the Plain Mode: Floating Point

20 40 60 80 100 20 40 60 80

number of houses

MAPE, % Floating point experiments # houses 1 2 5 10 20 50 100

avg. MAPE(%)

90 55 33 23 15 9 7

15 / 24

SLIDE 43

Implementation in the Plain Mode: Floating Point

20 40 60 80 100 20 40 60 80

number of houses

MAPE, % Floating point experiments # houses 1 2 5 10 20 50 100

avg. MAPE(%)

90 55 33 23 15 9 7

15 / 24

SLIDE 44

Fan-Vercauteren SHE

Ring-LWE based SHE (2012). Parameters: ring R = Z[X]/(f(X)) with f(X) = X d + 1, d = 2n moduli t, q ∈ Z : q ≫ t, plaintext and ciphertext spaces Rt = R/(t), Rq = R/(q), key and error distributions over R: χkey, χerr

discrete Gaussian with small σ.

16 / 24

SLIDE 45

Fan-Vercauteren SHE

Ring-LWE based SHE (2012). Parameters: ring R = Z[X]/(f(X)) with f(X) = X d + 1, d = 2n moduli t, q ∈ Z : q ≫ t, plaintext and ciphertext spaces Rt = R/(t), Rq = R/(q), key and error distributions over R: χkey, χerr

discrete Gaussian with small σ.

Key generation s ← χkey, a ← U(Rq), e ← χerr b = [−(a · s + e)]q pk = (a, b)

16 / 24

SLIDE 46

Fan-Vercauteren SHE

Encryption e1, e2 ← χerr, u ← χkey c0 = ⌊q/t⌋m + b · u + e1, c1 = a · u + e2 c = (c0, c1) Ciphertexts allow homomorphic addition and multiplication.

17 / 24

SLIDE 47

Fan-Vercauteren SHE

Encryption e1, e2 ← χerr, u ← χkey c0 = ⌊q/t⌋m + b · u + e1, c1 = a · u + e2 c = (c0, c1) Ciphertexts allow homomorphic addition and multiplication. Decryption m = t[c0 + s · c1]q q

t

17 / 24

SLIDE 48

Fan-Vercauteren SHE

[c0 + c1s]q = ∆m + e

with ∆ = q

t

.

||e||∞ < ∆/2 → correct decryption.

18 / 24

SLIDE 49

Fan-Vercauteren SHE

[c0 + c1s]q = ∆m + e

with ∆ = q

t

.

||e||∞ < ∆/2 → correct decryption. Mult(c1, c2): ∆mmult + emult. ||emult||∞ > δ · max{||e1||∞, ||e2||∞}

18 / 24

SLIDE 50

Fan-Vercauteren SHE

[c0 + c1s]q = ∆m + e

with ∆ = q

t

.

||e||∞ < ∆/2 → correct decryption. Mult(c1, c2): ∆mmult + emult. ||emult||∞ > δ · max{||e1||∞, ||e2||∞} 4 network layers Security level 80 bits →            d = 4096 q ≈ 2186 σ = 102 t ≤ 396

18 / 24

SLIDE 51

Fan-Vercauteren SHE

[c0 + c1s]q = ∆m + e

with ∆ = q

t

.

||e||∞ < ∆/2 → correct decryption. Mult(c1, c2): ∆mmult + emult. ||emult||∞ > δ · max{||e1||∞, ||e2||∞} 4 network layers Security level 80 bits →            d = 4096 q ≈ 2186 σ = 102 t ≤ 396 → (c0, c1) 186 kB

18 / 24

SLIDE 52

Fixed-point Representation [DGLLNW15, CSVW16]

FV plaintext space is Rt.

19 / 24

SLIDE 53

Fixed-point Representation [DGLLNW15, CSVW16]

FV plaintext space is Rt. Balanced ternary expansion of y ∈ R. bℓ1−1bℓ1−2 . . . b0 . b−1b−2 . . . b−ℓ2 with bi ∈ {−1, 0, 1}. Back to the floating point y = bℓ1−13ℓ1−1 + . . . + b030 + b−13−1 + . . . + b−ℓ23−ℓ2.

19 / 24

SLIDE 54

Fixed-point Representation [DGLLNW15, CSVW16]

FV plaintext space is Rt. Balanced ternary expansion of y ∈ R. bℓ1−1bℓ1−2 . . . b0 . b−1b−2 . . . b−ℓ2 with bi ∈ {−1, 0, 1}. Back to the floating point y = bℓ1−13ℓ1−1 + . . . + b030 + b−13−1 + . . . + b−ℓ23−ℓ2. Replace 3 → X and use X d ≡ −1 bℓ1−1X ℓ1−1 + . . . + b0X 0 − b−1X d−1 − . . . − b−ℓ2X d−ℓ2 ∈ Rt

19 / 24

SLIDE 55

Fixed-point Representation [DGLLNW15, CSVW16]

Convert g(X) ∈ Rt to R. g(X) = −b−1 −b−2 b1 b0 X d−1 X d−2 . . . . . . X 2 X 1

20 / 24

SLIDE 56

Fixed-point Representation [DGLLNW15, CSVW16]

Convert g(X) ∈ Rt to R. g(X) = −b−1 −b−2 b1 b0 X d−1 X d−2 . . . . . . X 2 X 1 fractional part integer part

20 / 24

SLIDE 57

Fixed-point Representation [DGLLNW15, CSVW16]

Convert g(X) ∈ Rt to R. g(X) = −b−1 −b−2 b1 b0 X d−1 X d−2 . . . . . . X 2 X 1 fractional part integer part Replace X i → −X i−d for the fractional part. h(X) = b−1 b−2 b1 b0 X −1 X −2 . . . . . . X 2 X 1

20 / 24

SLIDE 58

Fixed-point Representation [DGLLNW15, CSVW16]

Convert g(X) ∈ Rt to R. g(X) = −b−1 −b−2 b1 b0 X d−1 X d−2 . . . . . . X 2 X 1 fractional part integer part Replace X i → −X i−d for the fractional part. h(3) = b−1 b−2 b1 b0 3−1 3−2 . . . . . . 32 3 1

20 / 24

SLIDE 59

Fixed-point Representation [DGLLNW15, CSVW16]

Convert g(X) ∈ Rt to R. g(X) = −b−1 −b−2 b1 b0 X d−1 X d−2 . . . . . . X 2 X 1 fractional part integer part Replace X i → −X i−d for the fractional part. h(3) = b−1 b−2 b1 b0 3−1 3−2 . . . . . . 32 3 1 h(3) ∈ R corresponds to y = b1b0.b−1b−2.

20 / 24

SLIDE 60