1. TRUST Fall Meeting November 10 - 11, 2010 │Stanford, California A Privacy-Aware Architecture For Demand Response Systems Steve Wicker, Bob Thomas School of Electrical and Computer Engineering Cornell University

2. 2 TRUST Fall Meeting – November 10-11, 2010 – Stanford, CA Demand Response Goal: flatten consumption curve, minimize number of generators being taken on and off line Method: Alter consumption behavior through fine- grained pricing. – Automatic: Utility controls high-consumption residential devices. – Manual: Consumer behavior is altered by presenting pricing data to consumer Fine-grained pricing requires fine-grained consumption data – Advanced metering infrastructure. TRUST Physical Infrastructures, S. Wicker

3. 3 TRUST Fall Meeting – November 10-11, 2010 – Stanford, CA Substantial Potential Savings TRUST Physical Infrastructures, S. Wicker “A National Assessment of Demand Response Potential,” Staff Report, Federal Energy Regulatory Commission, June 2009.

4. 4 TRUST Fall Meeting – November 10-11, 2010 – Stanford, CA User Scenarios TRUST Physical Infrastructures, S. Wicker Note that the “full participation” requires “mandatory” participation. Potential savings creates substantial pressure for utilities/municipalities to require AMI.

5. 5 TRUST Fall Meeting – November 10-11, 2010 – Stanford, CA Power consumption data can reveal activities within the home – Mikhail Lisovich, Deirdre Mulligan, and Stephen B. Wicker, “Inferring Personal Information from Demand-Response Systems,” IEEE Security and Privacy Magazine; January/February 2010 TRUST Physical Infrastructures, S. Wicker Privacy Concerns

6. 6 TRUST Fall Meeting – November 10-11, 2010 – Stanford, CA Current Plans are for Central Collection with Reuse “Advanced Metering Infrastructure,” Electric Power Research Institute, Available at http://www.ferc.gov/ eventcalendar/Files/20070423091846- EPRI – Advanced Metering.pdfhttp://www.ferc.gov/ eventcalendar/Files/20070423091846- EPRI – Advanced Metering.pdf TRUST Physical Infrastructures, S. Wicker

7. 7 TRUST Fall Meeting – November 10-11, 2010 – Stanford, CA 1. Provide full disclosure of data collection 2. Require consent to data collection 3. Minimize collection of personal data – Distributed Processing Requirement 4. Minimize identification of data with individuals 5. Minimize and secure retained data. S. B. Wicker and D. E. Schrader, “Privacy-Aware Design Principles For Information Networks’” Proceedings of the IEEE, ~ December 2010 TRUST Physical Infrastructures, S. Wicker Privacy-Aware Design

8. 8 TRUST Fall Meeting – November 10-11, 2010 – Stanford, CA Desired behavioral changes are local and distributed. Required computation can be distributed – Consumption data is local – Pricing can be distributed to local areas – Monthly cost is aggregated before collection Emphasis on distributed, local processing of fine- granularity data – Collected data never leaves the neighborhood – Collected data is not stored TRUST Physical Infrastructures, S. Wicker Privacy-Aware DR Design

9. 9 TRUST Fall Meeting – November 10-11, 2010 – Stanford, CA TRUST Physical Infrastructures, S. Wicker Privacy-Aware DR Architecture Fully functional DR without centralized collection of fine-grained power consumption data. TPM-type protection of data at the AMI PKI provides protection for data leaving the AMI. Anonymization at neighborhood aggregator.

10. 10 TRUST Fall Meeting – November 10-11, 2010 – Stanford, CA Conclusions Current DR systems use AMI to collect fine- grained power consumption data. – Substantial privacy problem. – Utilities run the risk of having their DR systems shut down due to privacy concerns. Privacy-aware design rules point to distributed processing that eliminates privacy concern. TRUST Physical Infrastructures, S. Wicker