Privacy-preserving smart meter control strategy including energy storage losses

Pri v ac y-preserving smart meter control strategy including energy storage losses Ramana R. A vula, T obias J. Oechtering and Daniel M ˚ ansson School of Electrical Engineering and Computer Science KTH Royal Institute of T echnology , Stockholm, Sweden Abstract —Privacy-pr eserving smart meter control strategies proposed in the literature so far make some ideal assumptions such as instantaneous control without delay , lossless energy storage systems etc. In this paper , we present a one-step-ahead predicti ve control strategy using Bayesian risk to measure and control privacy leakage with an energy storage system. The controller estimates energy state using a three-cir cuit energy storage model to account for steady-state ener gy losses. With numerical experiments, the controller is evaluated with real household consumption data using a state-of-the-art adversarial algorithm. Results show that the state estimation of the energy storage system significantly affects the contr oller’ s performance. The r esults also sho w that the privacy leakage can be effectively reduced using an energy storage system but at the expense of energy loss. Index T erms —Smart meter privacy , Bayesian hypothesis test- ing, partially observable Markov decision process (PO-MDP), energy storage losses, dynamic programming I . I N T RO D U C T I O N A smart grid (SG) is a next-generation energy network with capabilities to improve grid reliability and efficienc y of power generation and distribution with smooth integration of renew able energy sources. In this automated network, a smart meter (SM) is a crucial component which measures the ener gy consumption of the user and transmits the readings to the utility provider at re gular intervals of time. This raises priv acy concerns [1] since high-resolution readings can allow anyone who has access to this data to infer about consumer’ s behavior . Since its introduction in [2], non-intrusive load monitoring (NILM) techniques are known to be quite effecti ve in disag- gregating the smart meter readings and thereby detecting the states of most of the general types of household appliances [3]. A comparativ e study was done in [3], which shows that the existing state of the art NILM algorithms are capable of achieving detection accuracy up to 99% for certain appliance types, which is quite concerning in the priv acy context. Addressing this issue, sev eral priv acy-preserving techniques hav e been proposed in the literature, which are surveyed in [4], [5]. Secure communication and cryptographic approaches [6]– [8] may succeed in prev enting the unauthorized third party access, b ut they would fail to protect the consumer pri vacy from a greedy authorized or compromised utility provider . A promising physical layer priv acy approach is load signature moderation (LSM), where an energy storage system (ESS) is used to moderate the consumer’ s load profile in order to hide appliances’ usage information. LSM using rechargeable Grid Smart Meter Adversary AC-DC DC-AC Battery Z k House EMU Y k Ĥ k X k H k-1 D k D k ESS * Fig. 1: Schematic of the proposed smart metering system where the energy management unit controls priv acy leakage to an adversary by using energy storage system with a model describing its losses and one-step-ahead predictiv e control. battery has previously been in vestigated in [9]–[14] to obtain optimal control strategy under dif ferent priv acy settings. Ho w- ev er, all the works so far make some ideal assumptions such as instantaneous control without delay , lossless ESS etc. These idealized strategies may provide theoretic performance bounds but the feasibility of such strategies in practical situations must be further inv estigated. In this paper, we present a one- step-ahead predicti ve control scheme modeled in a PO-MDP framew ork using an ESS. Similar to [13], we use a priv acy metric based on Bayesian risk. The ov ervie w of the proposed system is sho wn in Fig. 1. In this work, we restrict our analysis to the electrochemical battery as an ener gy storage technology . Nonetheless, the same approach can be followed for other storage technologies by modeling them as their equi valent electrical circuits [15]. For a battery system, we present a model describing its losses in power conv ersion, losses due to internal resistance and self-dissipation. T o the best of our knowledge, this is the first work to consider the non-idealities in ESSs in the context of smart meter priv acy . The rest of the paper is organized as follows. In Section II, we present a model for ESS considering the steady state energy losses. W e also present the charge and discharge bounds of ESS and also quantify the energy loss associated with a discrete control action. In Section III, we present an ov erview of the system along with the control strategy . In Section IV, we e valuate the performance of the controller with real household data using a state-of-the-art NILM algorithm. Lastly , we conclude the paper in Section V. 978-1-5386-4505-5/18/$31.00 c  2018 IEEE I I . E N E R G Y S T O R AG E S Y S T E M M O D E L Since batteries stores the energy as chemical potential in their electrodes, it can only be interfaced with a DC (Direct Current) system. Hence, power con verters are needed to inte- grate the battery with an A C (Alternating Current) system. The battery along with the power con verters form the ESS. In this work, we model the ESS using three simple electrical circuits as shown in Fig. 2 to account for the steady state energy losses. Even though several other processes of the ESS such as capacity fade, increase in internal resistance, temperature dependence etc., can also be considered, as a first step, we restrict our focus to the steady state energy losses. In the following, we present our analysis of the three-circuit model in more detail. I bat R V OC r Converter I bat Load DC-AC A C- D C I bat (a) Self dissipation loss (b) Intern al resistive loss (c) Converter loss C Q Fig. 2: Three-circuit energy storage system model A. Losses due to self-dissipation Self-dissipation occurs e ven if the ESS is not connected to any load. Similar to [16], we model this phenomenon using an RC circuit as shown in Fig. 2(a). The capacitor C holds the charge content, Q of the battery and dissipates through a parallel resistor R. In this circuit, the po wer conv erter and load are together represented as a current source controlled by the current flowing in the second circuit sho wn in Fig. 2(b). Giv en the self-discharge rate γ and a constant current I bat flowing into the battery , the charge content of the battery is updated as Q t +∆ t = (1 − γ ) · Q t + β · I bat (1) where, γ = 1 − exp  − ∆ T RC  ; β = − γ ∆ T log(1 − γ ) (2) B. Losses due to internal r esistance Similar to [16], the losses that occur in battery during its charging and dischar ging operations are modeled using a series resistor r , as shown in Fig. 2(b). The open circuit voltage of the battery , V OC is represented as a voltage source controlled by the capacitor charge Q in the first circuit shown in Fig. 2(a). For an input power of P from the power con verter , the current flowing into the battery is giv en as I bat = q V 2 OC + 4 rP − V OC 2 r (3) C. Losses due to power con verters As shown in Fig. 2(c), we model power con verters as ele- ments with a constant ef ficiency factor within their operating region. For an input power of D from the load, the power at the battery terminals can be written as P = D ·  η c 1 { D ≥ 0 } + η − 1 d 1 { D < 0 }  = D · δ ( D ) (4) where η c , η d are the efficiency factors of A C-DC and DC-A C con verters respectively and 1 { A } is equal to 1 if A is true, and 0 otherwise. δ ( D ) is the common factor for both operations. D. Thr ee-cir cuit ESS model Integrating the three circuits by combining (1), (3) and (4), the controller updates the energy state of the battery ev olving ov er time using the equation giv en as Z t +∆ t = (1 − γ ) Z t + β V OC 2 r  q V 2 OC + 4 rD t δ t − V OC  (5) where γ , r are time-in variant parameters, β depends on the time step ∆ t and δ t depends on the control variable D t . By limiting the battery current to I max , from (3), we have the control space limited as D max = 1 4 r η d  ( V OC + 2 rI max ) 2 − V 2 OC  (6) D min = η c 4 r  V 2 OC − ( V OC − 2 rI max ) 2  (7) Due to the finite energy capacity of the battery Z max , from (5) we hav e the following constraints on D t : D t,max = V 2 OC 4 r η d   2 r  Z max − (1 − γ ) Z t  β V 2 OC + 1 ! 2 − 1   (8) D t,min = η c V 2 OC 4 r    − (1 − γ )2 rZ t β V 2 OC + 1  + ! 2 − 1   (9) where [ x ] + is equal to x if x ≥ 0 , and 0 otherwise. In comparision to (5), the energy state of an ideal lossless battery ev olves ov er time as Z t +∆ t,ideal = Z t + D t · ∆ t (10) Using (5) and (10), the energy loss associated with a discrete control action can be giv en as E loss ( Z t , D t ) = Z t + D t · ∆ t − Z t +∆ t (11) I I I . S Y S T E M OV E RV I E W A N D C O N T RO L S T R A T E G Y The proposed smart metering system uses an ESS for load signature moderation. The ESS can be placed either in series or in parallel configurations, in between the SM and house as shown in Fig. 3. Both these configurations have been used in the literature for SM priv acy . Under ideal assumptions, the two configurations are equiv alent. Howe ver , considering the energy losses, we have the following proposition. Grid House YX AC-DC DC-AC Battery (b) Parallel configura tion (a) Series configuration Grid AC-DC House YX DC-AC Battery Fig. 3: Placement of ESS between smart meter and house. Proposition 1. The average ener gy loss in the parallel con- figuration is strictly less than that of series configuration. Pr oof. Let X be the average energy demand by the house and Y be the average energy request from the grid. Assuming that the ener gy from the battery is not discharged back into the grid, only ( Y − X ) flo ws through the ESS components in parallel configuration, howe ver , the total energy Y from the grid flows through the ESS components in series configuration, leading to higher energy losses. In order to reduce the energy losses, we consider a system with ESS in the parallel configuration as shown in Fig. 1. The discrete time system is controlled for ev ery time slot k within a finite time horizon { 1 , 2 , . . . , N } . Each time slot k is of a fixed time duration T . Let e and q be the resolution of energy and power measurements respectively . In the following analysis, we use the capital letters to denote random variables, their realizations by the lower -case letters and the range space by calligraphic letters. For each time slot k , X k denotes the aggregate po wer drawn by all the appliances in the house and is defined on X = { 0 , q , 2 q, . . . , x max } . Z k defined on Z = { 0 , e, 2 e, . . . , z max } denotes the energy available in the battery . The power drawn by the ESS is denoted as D k and it is the control variable which is defined on D = {− d min , . . . , − q , 0 , q, . . . , d max } , where d min and d max are the maximum discharge and charge power of the ESS respectively , given in (6) and (7). D ∗ k defined on D denotes the desired battery power consumption scheduled by the energy management unit (EMU). In the presence of an ESS, the SM records the aggregate power demands of consumer and ESS. In this work, we allow the energy from the battery to be discharged to the grid resulting in negati ve v alues of SM measurements. It is represented by the random variable Y k = X k + D k which is defined on Y = {− d min , . . . , − q , 0 , q, . . . , x max + d max } . H k defined on H denotes the n -ary joint hypothesis of all the appliances in the house and ˆ H k defined on H denotes the hypothesis detected by the adversary having access to the consumer’ s statistical and real-time data as well as the control strategy employed by the EMU. A. Bayesian risk Similar to [13], we use detection-theoretic approach by for- mulating the smart meter priv acy problem into an adversarial Bayesian hypothesis testing where an adversary having access to the consumer’ s statistical and real-time data tries to make a guess on the hypothesis state using a decision strategy . In the Bayesian formulation, each of the hypothesis test outcomes is assigned a cost and the decision strategy that minimizes the av erage decision-making cost will be employed by the adversary [17]. The av erage cost or Bayesian risk function, R , is giv en as R k = X i,j ∈H 2 C i,j · P ( ˆ H k = i | H k = j ) · P ( H k = j ) (12) where C i,j is the cost of deciding ˆ H k = i when H k = j is true. By setting the cost of a correct decision to zero and the cost of an error to unity , the risk function gives the average error probability of an adversarial detection strategy . In this work, the accumulated minimum Bayesian risk (AMBR) is chosen as a priv acy metric, which is gi ven as AMBR = N X k =1 R ∗ k (13) where R ∗ k = min {R k } . The AMBR is a good choice for measuring priv acy due to its operational meaning. It explicitly characterizes the best possible detection performance achie v- able by any adversary . B. Contr ol strate gy Ideally , the controller uses all the information available until time k (denoted as I k ) to choose an action d k +1 . Howe ver , as described in [18], since I k is increasing in dimension with k , its sufficient statistic giv en by the posterior distribution of the Markov chain H k conditioned on I k (denoted as π k ) is used instead of I k to choose the action d k +1 . For a given initial battery state z 0 , this posterior distribution forms a information state or belief state at time k , giv en as π k ( i ) = P ( H k = i | I k ) = P ( H k = i | π k − 1 , x k ) (14) where I k = { z 0 , π 0 , x 1 , y 1 , π 1 , . . . , π k − 1 , x k } . The control system is modeled as a PO-MDP controlled sensor, as shown in Fig. 4, by making the following assumptions: • The hypothesis of the house H k ev olves over time fol- lowing a first-order Markov chain with a time-in variant transition probability P H k | H k − 1 . • The controller observ es the Markov chain H k only through a noisy measurement X k made with a time- in variant observ ation probability P X k | H k . • The control signal D ∗ k is generated by the controller using time-dependent control strategy P Y k | X k − 1 ,Z k − 1 , Π k − 1 . House Noisy sensor Controller + Smart meter D k H k X k Y k Controlled sensor Fig. 4: EMU modelled as a PO-MDP controlled sensor . Giv en the initial energy state, z 0 , the controller estimates the state of ESS at any time k using the equation z k = f ( z k − 1 , d k ) (15) where d k = y k − x k and f is a deterministic function of ESS model gi ven by (5). As described in [17], the minimum Bayesian risk function based on our assumptions is giv en as R ∗ k ( π k − 1 , z k − 1 , µ k ) = X y ∈Y min ˆ h ∈H n X g ,h,x ∈H 2 ×X C ( ˆ h, h ) · P Y k | X k − 1 ,Z k − 1 ( y | x, z ) · P X k − 1 | H k − 1 ( x | g ) · P H k | H k − 1 ( h | g ) · P H k − 1 ( g ) o For the finite time horizon, the optimal control strategy is the solution to the nonlinear optimization problem with objective function giv en as µ ∗ = argmax { µ 1 , ··· ,µ N } N X k =1 R ∗ k ( π k − 1 , z k − 1 , µ k ) (16) subject to the constraints giv en as P Y k | Z k − 1 ( y k | z k − 1 ) = 0 if      y k < d k,min or y k > d k,max + x max The belief state space (denoted as Π ) is a |H | − 1 di- mensional unit simplex. Solving this optimization problem requires discretization of Π in order to get a finite set. The optimization v ariable in (16) is of dimension N × |Y | × |X | and solving it in its original form is computationally complex as the dimensionality of the the problem increases with N . This can be formulated into a recursiv e dynamic programming problem as giv en in the following proposition, the proof of which follows from [18]. Proposition 2. F or the finite horizon PO-MDP with model given in Section III, the optimal control str ate gy µ ∗ = { µ ∗ 1 , µ ∗ 2 , . . . , µ ∗ N } is the solution to the following backwar d recur sion: Initialize V N ( π , z ) and then for k = N − 1 , . . . , 1 iterate L k ( π k − 1 , z k − 1 , µ k ) = R ∗ k ( π k − 1 , z k − 1 , µ ) + X x k ,y k ∈X ×Y V k +1 ( π k , z k ) · P ( x k , y k ) V k ( π k − 1 , z k − 1 ) = max µ k n L k ( π k − 1 , z k − 1 , µ k ) o δ ∗ k ( π k − 1 , z k − 1 ) = argmax µ k n L k ( π k − 1 , z k − 1 , µ k ) o W ith the designed optimal strategy µ ∗ , a real-time PO-MDP controller is implemented as shown in the follo wing algorithm. Algorithm 1 Realtime PO-MDP controller Initialisation : π 0 , z 0 1: for k = 1 to N do Pr e-process : 2: Choose action y ∗ k = µ ∗ k ( π k − 1 , z k − 1 ) ESS contr ol : 3: if ( y ∗ k < x k + d k,min ) then 4: Limit y k = x k + d k,min 5: else if ( y ∗ k > x k + d k,max ) then 6: Limit y k = x k + d k,max 7: else 8: Allow y k = y ∗ k 9: end if P ost-pr ocess : 10: Update the belief state π k = T ( π k − 1 , x k ) 11: Update the ESS state z k = f ( z k − 1 , y k − x k ) 12: end for I V . N U M E R I C A L E X P E R I M E N T S The simulation experiments to validate our control scheme are implemented in MA TLAB using real household con- sumption data from ECO reference dataset [19]. The control strategy is obtained by solving the optimization problem using the nonlinear programming solver based on interior point algorithm [20]. W e simulate a scenario where the controller is tasked to protect the ev ents of a water kettle e very day between 8 AM and 9 AM. The controller chooses an action every minute by observing the real-time appliance consumption data. For this objectiv e, a 12V 100Ah lithium-ion battery is selected, which can sufficiently satisfy the power requirements of the kettle. T o simplify the problem, we assume a fixed V OC equal to the nominal battery voltage. The parameters used in the simulation are listed in T able I. The Marko v chain probabilities of the PO-MDP control model are estimated from 30 days of labeled training data and listed in the T able II. A. V isualization of control actions W ith this setup, the control actions for different initial states of the battery are simulated and are shown in Fig. 5. Due to the measurement quantization, switching ev ents are noticed as peaks in the smart meter measurements as shown in Fig. 6. These residual peaks are informative to an adversary operating with high precision measurements. Howe ver , the cardinality of the state space increases with measurement precision, which increases the dimensionality of the optimization problem by O ( n 2 ) . Fig. 7 shows the ev olution of the state of charge (SOC) of the battery due to control actions. It is interesting to notice that without any design objecti ve on the battery state, the control scheme is steering the battery to wards the full charge state. This result in the de gradation of controller’ s performance which is discussed in the following. T ABLE I: Simulation parameters Parameter Symbol V alue Max. appliance power demand x max (W) 1700 T ime slot duration T (s) 60 T ime horizon length N 60 Power measurement resolution q (W) 500 Energy measurement resolution e (Wh) 5 Battery nominal voltage V nom (V) 12 Battery capacity Q max (Ah) 100 Max. allowed battery charging current I max (A) 80 Max. allowed battery discharging current I min (A) 80 Battery internal resistance r ( Ω ) 0.006 Battery self-discharge rate γ (%/month) 3 Power con verter efficienc y η c , η d (%) 95 Cardinality of X |X | 4 Cardinality of Y |Y | 8 Cardinality of Z |Z | 241 Cardinality of H |H| 2 Cardinality of Π | Π | 11 Max. allowed battery input power D max +2q Min. allowed battery input power D min -2q ESS model parameter β 0.017 T ABLE II: PO-MDP control parameters Parameter V alue C i,j  0 1 1 0  π 0  0 . 95 0 . 05  T P ( H k | H k − 1 )  0 . 98 0 . 34 0 . 02 0 . 65  P ( X k | H k )  1 0 0 0 0 0 . 17 0 . 14 0 . 17  T B. Evaluation of contr oller’s performance T o ev aluate the performance of the controller , we simulate an adversary using NILM algorithm. In particular, we simu- lated W eiss’ algorithm [21] which extracts switching ev ents from the aggregate smart meter data and assigns each event to the appliance with the best match in a signature database. This algorithm is implemented using NILM toolbox dev eloped by [19]. W e use 30 days of labeled training data to create the signature database. W eiss algorithm utilizes three-dimensional consumption data (i.e., real, reactive, and distortion powers) in order to match an ev ent signature. W e tested its detection performance by injecting the controlled battery current in- phase to the supply voltage resulting in corrupted real power measurements. The accuracy of the adversarial detection is measured using F-score, which is giv en as F-score = 1 1 + ( FN + FP ) / (2 TP ) (17) where FN, FP and TP denote false negati ve, false postive and true positiv e respectively . The F-score lies between 0 and 1, where F-score = 0 indicates no detection and F-score = 1 indicates complete detection. The W eiss’ s algorithm is simulated under different test conditions using 30 days of v alidation data and the obtained av erage F-scores, ener gy losses and the AMBR are listed in T a- ble III. It can be seen from the results that the AMBR and the F-score are correlated. The test case without a battery resulted 8:00 AM 8:10 AM 8:20 AM 8:30 AM 8:40 AM 8:50 AM 9:00 AM -1000 -500 0 500 1000 1500 Power (W) Appliance consumption Battery consumption 8:00 AM 8:10 AM 8:20 AM 8:30 AM 8:40 AM 8:50 AM 9:00 AM -1000 -500 0 500 1000 1500 Power (W) Appliance consumption Battery consumption Control action with initial battery of 100 % SOC Control action with initial battery of 50 % SOC Fig. 5: Control actions of battery . 12:00 AM 4:00 AM 8:00 AM 12:00 PM 4:00 PM 8:00 PM 12:00 AM -500 0 500 1000 1500 2000 Power (W) House consumption Smart meter measurement 12:00 AM 4:00 AM 8:00 AM 12:00 PM 4:00 PM 8:00 PM 12:00 AM -500 0 500 1000 1500 2000 Power (W) House consumption Smart meter measurement Reduced peak with initial battery of 100% SOC Reduced peak with initial battery of 50% SOC Fig. 6: Smart meter readings vs household consumption. 8:00 AM 8:10 AM 8:20 AM 8:30 AM 8:40 AM 8:50 AM 9:00 AM 0.5 0.6 0.7 0.8 0.9 1 SOC initialized with 50 % SOC initialized with 100% SOC Fig. 7: Evolution of SOC of battery due to control actions. in the highest F-score. While using a battery , the controller is able to reduce the F-score significantly . Ho wev er , it can be observed that the ability of the controller to preserve priv acy depends on the initial state of the battery . For this simulation setup, the controller performed better when initialized with a battery of 25%-50% SOC compared to full charge. This indicates that if the battery state is steered towards 25%-50% SOC by the end of the control time horizon, it would result in better performance for the next control horizon. Howe ver , this improved performance is achiev ed at the cost of increased energy loss. T ABLE III: Ev aluation of controller against NILM algorithm with different initial battery states Initial battery SOC (%) F-score Ener gy loss (Wh) AMBR 0 0.1333 40.421 152.57 25 0.0357 36.217 153.51 50 0.0357 36.230 153.51 75 0.2667 26.770 153.50 90 0.4833 14.174 153.49 100 0.6333 9.779 148.89 W ithout battery 0.7931 0 0 C. ESS model comparision For the simulated battery , Fig. 8 shows the difference between the % change in the state of charge of the battery estimated by three-circuit model and an ideal lossless model for different input powers. The model difference is particularly significant at high po wer lev els. Due to v ery lo w γ for electrochemical batteries, the difference in state estimation is negligible when comparing three-circuit models with and with- out considering self-dissipation. Howe ver , for energy storage systems with high self-dissipation rate such as flywheels, the self-dissipation phenomenon cannot be neglected. -10 -8 -6 -4 -2 0 2 4 6 8 10 Input power to energy storage system (in KW) -40 -30 -20 -10 0 10 20 30 % change in state of charge Lossless model Three-circuit model Three-circuit model without self dissipation 7.99998 8 8.00002 17.18845 17.18855 Fig. 8: Comparision of ESS models at 50% SOC. V . C O N C L U S I O N In this paper, we presented a priv acy-preserving control scheme based on Bayesian risk and a three-circuit model to estimate the energy loss associated with a control action. The controller is modeled as a PO-MDP controlled sensor to maximize the Bayesian risk function of an adversarial hypothesis testing and the resulting nonlinear optimization ob- jectiv e is solved in a backward recursion. Extensiv e numerical experiments were carried out to ev aluate the performance of the controller thoroughly . Especially , we tested the controller’ s performance against a state-of-the-art NILM algorithm using real energy consumption data. W e in vestigated the effect of the initial state of the energy storage system on the controller’ s performance. An important conclusion from this work is that the priv acy leakage can be reduced by using an energy storage system but at the expense of energy loss. W ithout an accurate model, the error in state estimation propagates and if not corrected, leads to suboptimal priv acy control. Future work will focus on the trade-of f between the priv acy and energy loss, time dependency of the model parameters as well as control strategy and including more energy storage technologies. R E F E R E N C E S [1] P . McDaniel and S. McLaughlin, “Security and priv acy challenges in the smart grid, ” IEEE Security & Privacy , vol. 7, no. 3, 2009. [2] G. W . Hart, “Nonintrusiv e appliance load monitoring, ” Pr oceedings of the IEEE , vol. 80, no. 12, pp. 1870–1891, 1992. [3] A. Zoha, A. Gluhak, M. A. Imran, and S. Rajasegarar , “Non-intrusive load monitoring approaches for disaggre gated ener gy sensing: A surve y , ” Sensors , vol. 12, no. 12, pp. 16 838–16 866, 2012. [4] M. R. Asghar, G. D ´ an, D. Miorandi, and I. Chlamtac, “Smart meter data priv acy: A surve y , ” IEEE Communications Surve ys & T utorials , v ol. 19, no. 4, pp. 2820–2835, 2017. [5] G. Giaconi, D. Gunduz, and H. V . Poor, “Privac y-aware smart metering: Progress and challenges, ” arXiv preprint , 2018. [6] M. LeMay , G. Gross, C. A. Gunter , and S. Garg, “Unified architecture for large-scale attested metering, ” in System Sciences, 2007. HICSS 2007. 40th Annual Hawaii International Conference on . IEEE, 2007, pp. 115–115. [7] M. Jawurek, M. Johns, and K. Rieck, “Smart metering de- pseudonymization, ” in Pr oceedings of the 27th Annual Computer Se- curity Applications Confer ence . A CM, 2011, pp. 227–236. [8] A. Rial and G. Danezis, “Priv acy-preserving smart metering, ” in Pr o- ceedings of the 10th annual ACM workshop on Privacy in the electr onic society . A CM, 2011, pp. 49–60. [9] G. Kalogridis, C. Efthymiou, S. Z. Denic, T . A. Lewis, and R. Cepeda, “Priv acy for smart meters: T owards undetectable appliance load signa- tures, ” in Smart Grid Communications (SmartGridComm), 2010 F irst IEEE International Confer ence on . IEEE, 2010, pp. 232–237. [10] D. V arodayan and A. Khisti, “Smart meter priv acy using a rechar geable battery: Minimizing the rate of information leakage, ” in Acoustics, Speech and Signal Pr ocessing (ICASSP), 2011 IEEE International Confer ence on . IEEE, 2011, pp. 1932–1935. [11] O. T an, D. Gunduz, and H. V . Poor , “Increasing smart meter priv acy through energy harvesting and storage devices, ” IEEE Journal on Selected Areas in Communications , vol. 31, no. 7, pp. 1331–1341, 2013. [12] M. Backes and S. Meiser, “Differentially priv ate smart metering with battery recharging, ” in Data Privacy Management and Autonomous Spontaneous Security . Springer , 2014, pp. 194–212. [13] Z. Li, T . J. Oechtering, and M. Skoglund, “Priv acy-preserving energy flow control in smart grids, ” in Acoustics, Speech and Signal Processing (ICASSP), 2016 IEEE International Conference on . IEEE, 2016, pp. 2194–2198. [14] J.-X. Chin, T . T . De Rubira, and G. Hug, “Privac y-protecting energy management unit through model-distribution predictiv e control, ” IEEE T ransactions on Smart Grid , 2017. [15] C.-T . Pham and D. M ˚ ansson, “On the physical system modelling of energy storages as equivalent circuits with parameter description for variable load demand (part i), ” Journal of Energy Storage , vol. 13, pp. 73–84, 2017. [16] M. Chen and G. A. Rincon-Mora, “ Accurate electrical battery model capable of predicting runtime and iv performance, ” IEEE transactions on energy con version , vol. 21, no. 2, pp. 504–511, 2006. [17] P . K. V arshne y , Distributed detection and data fusion . Springer Science & Business Media, 2012. [18] V . Krishnamurthy , P artially Observed Markov Decision Pr ocesses . Cambridge University Press, 2016. [19] C. Beckel, W . Kleiminger, R. Cicchetti, T . Staake, and S. Santini, “The eco data set and the performance of non-intrusive load monitoring algorithms, ” in Pr oceedings of the 1st ACM International Conference on Embedded Systems for Energy-Efficient Buildings (BuildSys 2014). Memphis, TN, USA . A CM, Nov . 2014, pp. 80–89. [20] R. H. Byrd, J. C. Gilbert, and J. Nocedal, “ A trust region method based on interior point techniques for nonlinear programming, ” Mathematical Pr ogramming , vol. 89, no. 1, pp. 149–185, 2000. [21] M. W eiss, A. Helfenstein, F . Mattern, and T . Staake, “Le veraging smart meter data to recognize home appliances, ” in P ervasive Computing and Communications (P erCom), 2012 IEEE International Conference on . IEEE, 2012, pp. 190–197.