# Privacy-Preserving Energy Storage Sharing with Blockchain and Secure Multi-
Party Computation

Nan Wang<EMAIL_ADDRESS>School of ComputingAustralian National
University ,  Sid Chi-Kin Chau<EMAIL_ADDRESS>School of
ComputingAustralian National University and  Yue Zhou<EMAIL_ADDRESS>School of ComputingAustralian National University

###### Abstract.

Energy storage provides an effective way of shifting temporal energy demands
and supplies, which enables significant cost reduction under time-of-use
energy pricing plans. Despite its promising benefits, the cost of present
energy storage remains expensive, presenting a major obstacle to practical
deployment. A more viable solution to improve the cost-effectiveness is by
sharing energy storage, such as community sharing, cloud energy storage and
peer-to-peer sharing. However, revealing private energy demand data to an
external energy storage operator may compromise user privacy, and is
susceptible to data misuses and breaches. In this paper, we explore a novel
approach to support energy storage sharing with privacy protection, based on
privacy-preserving blockchain and secure multi-party computation. We present
an integrated solution to enable privacy-preserving energy storage sharing,
such that energy storage service scheduling and cost-sharing can be attained
without the knowledge of individual users’ demands. It also supports auditing
and verification by the grid operator via blockchain. Furthermore, our
privacy-preserving solution can safeguard against a majority of dishonest
users, who may collude in cheating, without requiring a trusted third-party.
We implemented our solution as a smart contract on real-world Ethereum
blockchain platform, and provided empirical evaluation in this paper111This
article is an updated and extended version of the conference paper (Wang et
al., 2021)..

Privacy-Preserving, Energy Storage Sharing, Blockchain, Secure Multi-Party
Computation

††copyright: none

##  1\. Introduction

Figure 1. An illustration of the stages of our solution for privacy-preserving
energy storage sharing.

Energy storage can buffer energy in a storage medium, which is useful for
temporal shifting of energy demands and supplies. In addition to absorbing
excessive renewable energy, energy storage can effectively reduce the
consumption cost under dynamic time-of-use (ToU) energy pricing plans by
storing energy during off-peak periods and discharging during peak periods.
But the present cost of energy storage systems remains considerably expensive.
Energy storage also incurs significant maintenance cost over time, with only
limited life cycles. There is a possibility of a future technological
breakthrough that may significantly reduce the current cost of energy storage
in the near future. Hence, despite its benefits, the current users are
reluctant to immediately adopt energy storage at a wide scale. However, rather
than postponing the use of energy storage, a more viable solution to improve
the cost-effectiveness of present energy storage is by sharing energy storage
among multiple users or out-sourcing to a third-party energy storage operator.
In fact, time-sharing and out-sourcing have been popular concepts,
particularly in cloud computing. Energy storage may also become an out-
sourcible resource in a similar fashion.

Currently, there are multiple possible paradigms of energy storage sharing.
First, in community sharing (Lee et al., 2018), a group of local users, who do
not own individual energy storage, can connect to a shared energy storage
facility. The shared energy storage will be utilized by the users based on a
coordination mechanism. The associated cost will be split among the users in a
fair manner. Second, a non-local third-party energy storage operator can
provide an outsourcing service as cloud energy storage (Liu et al., 2017). The
energy storage operator can offset the energy consumption of remote users by
exporting energy from its energy storage facility. Third, the users, who have
their own energy storage, can pool their energy storage resources together to
support each other in peer-to-peer sharing (Chau et al., 2019).

All of these energy storage sharing paradigms can be effectively supported by
the notion of virtual net metering (VNM) (Shaw-Williams and Susilawati, 2020;
Gas and Company, 2018), which is a flexible bill crediting system for
transferring the credits or debits of a user’s energy account to another, even
though they do not share the same physical metering infrastructure. By VNM,
energy storage operators can possibly transfer the credits of their energy
export to offset the debits of energy import of other users. VNM has been used
to enable community solar energy sharing in practice (Gelman and Bird, 2014).
It can also enable energy storage sharing among a group of geographically
distributed users and energy storage operators.

Although sharing can improve the cost-effectiveness, there is a heightened
concern of user privacy nowadays. Users may need to disclose private energy
demand data to a third-party energy storage operator in order to schedule the
use of shared energy storage. This may reveal sensitive personal data (e.g.,
working patterns, number of occupants, and vacation periods). Potential
misuses and breaches of personal data may lead to serious undesirable
consequences. To bolster user privacy, stricter privacy protection
legislations are being introduced in various countries to restrict personal
information revelations to a third-party (e.g., GDPR in Europe). Because of
these privacy concerns and privacy-related legislations, we are motivated to
ensure proper privacy protection in energy storage sharing with a third-party
operator.

In this paper, we introduce the concept of “privacy-preserving energy storage
sharing”, by which a third-party energy storage operator should be given only
minimal information for its energy storage service operations without being
able to compromise personal data for other unintended purposes. But the key
challenge is how to design an effective solution to enable proper energy
storage service scheduling and cost-sharing among users, without the knowledge
of individual users’ energy demands, and yet that can still be verified and
audited to eliminate any fraud.

We provide a feasible solution to enable privacy-preserving energy storage
sharing, by drawing on several recent technologies. First, blockchain (e.g.,
Bitcoin, Ethereum) is a disruptive paradigm that enables decentralized
verifiable applications without trusted intermediaries by integrating a
tampering-resistant ledger with a distributed consensus protocol. Blockchain
is an effective platform to support transparent energy storage sharing and
auditable VNM with grid operators. But blockchain by default does not ensure
privacy, and transaction data is entirely disclosed on the ledger. Recently,
there is a new trend of supporting privacy on blockchain. For example, there
are privacy-oriented cryptocurrencies, like ZCash, Monero (Ben-Sasson et al.,
2014; Monero, 2021), that utilize zero-knowledge proofs for privacy-preserving
digital asset management, without revealing them. In this paper, we utilize
privacy-preserving blockchain to conceal the private data in cost-sharing and
VNM for energy storage sharing.

Second, secure multi-party computation (or simply called multi-party
computation) has been a subject of extensive research (Cramer et al., 2015),
which provides a general framework to allow multiple parties to jointly
compute a function while concealing the private inputs. Recently, efficient
multi-party computation protocols based on secret-sharing (e.g., SPDZ) have
been applied to many practical applications like privacy-preserving machine
learning (Chen et al., 2018). In this paper, we apply multi-party computation
to energy storage service scheduling with concealed individual users’ demands.
Moreover, we integrate multi-party computation with privacy-preserving
blockchain to support confidential cost-sharing and verifiable VNM settlement.

In summary, this paper presents an integrated solution to enable privacy-
preserving energy storage sharing in all the stages, as outlined in the
following (and also illustrated in Figure 1):

  1. (a)

Multi-party Computation for Energy Storage Scheduling: First, the users can
compute their aggregate day-ahead demands by secure multi-party computation,
without revealing individual demands. Then, they can derive the optimal energy
storage service schedule subject to energy storage service constraints.

  2. (b)

Privacy-preserving Cost-sharing Payment: The users can split the cost of
energy storage service based on a fair cost-sharing scheme in a privacy-
preserving manner. The users can make energy storage service payments via
privacy-preserving blockchain, without disclosing individual transactions.
After receiving the payments, the energy storage operator will issue
verifiable receipts on blockchain ledger.

  3. (c),(d)

Energy Storage Operation & Virtual Net Metering Settlement: The users and
energy storage operator will follow the energy storage service schedule. They
do not need to exchange energy directly, and the energy flows through the
grid. They will settle their energy accounts via VNM. With verifiable receipts
on blockchain ledger, the users can offset their energy consumption by the
energy export from energy storage, which will be audited by the grid operator.

Particularly, we should ensure privacy protection throughout the integrated
process of scheduling, cost-sharing, payment and auditing, without requiring a
trusted third-party. While it may be easier to ensure privacy in individual
processes separately, it is challenging to ensure privacy in the integrated
process. For example, one can schedule a service, or make a payment separately
in a privacy-preserving manner. However, it is harder to verify the payment
with respect to the scheduled service with privacy protection.

Furthermore, privacy also poses a significant challenge to the correctness and
integrity of operations. Because of concealing their demands, dishonest users
may attempt to cheat by paying less to energy storage service or claim more in
VNM than what they ought to. These dishonest users may even collude to
coordinate their actions in cheating. Hence, it is critical to safeguard
against the presence of dishonest users. Remarkably, our privacy-preserving
solution is able to safeguard against a majority of dishonest users (namely,
more than 50% of users may be dishonest).

This paper is organized as follows. We first review the related work and
background in Section 2. We then formulate the problem and models in Section
3, and present the basics of cryptographic components and multi-party
computation in Sections 4-5. The privacy-preserving solution is presented in
Section 6. We next provide an empirical evaluation of our implementation on
Ethereum blockchain platform in Section 7. We also discuss several extensions
as well as the limitations of our solution in Section 8. We conclude this work
with future work in Section 9.

##  2\. Related Work and Background

###  2.1. Energy Storage Sharing

Optimizing energy storage under dynamic pricing plans has been a popular
research topic (Hajiesmaili et al., 2017; Edalat et al., 2014; Mishra et al.,
2012). Recent studies proposed various paradigms for energy storage sharing
among multiple users, for instance, cloud energy storage (Liu et al., 2017),
virtual community sharing (Lee et al., 2018) and peer-to-peer sharing (Chau et
al., 2019). Notably, there are many studies about privacy in smart grid in
other aspects. For example, (Laforet et al., 2016; Huang et al., 2016)
employed energy storage to hide private consumption behavior by mixing random
energy storage charging and discharging to mask the consumption patterns. (Shi
et al., 2011) presents privacy-preserving data aggregation for smart meters
that aggregates users demands. None of these studies addressed the privacy
aspect in energy storage sharing. To the best of our knowledge, this is the
first paper to address the issue of privacy-preserving energy storage sharing
and its cost-sharing.

###  2.2. Virtual Net Metering

To enable energy consumers to share physically disconnected energy storage
from energy storage operators, one can rely on Virtual Net Metering (VNM)
(Shaw-Williams and Susilawati, 2020; Gas and Company, 2018) for transferring
the credits or debits of a user’s energy account to another. When energy
consumers import energy from the grid, they will incur debits in their energy
accounts. On the other hand, when energy storage operators export energy to
the grid, they will earn credits in their energy accounts based on feed-in
tariffs. However, simultaneous exporting energy from energy storage operators
and importing energy from energy consumers with the same amount of energy
should be able to offset each other.

In practice, the credits of energy export of energy storage operators may be
transferred to offset the partial debits of energy import of energy consumers.
In this case, it may not require simultaneous energy export and energy import
in VNM. However, maintaining instantaneous energy balance at VNM is still
important to ensure the stability in power distribution network. While there
may be additional costs in power distribution network such as power
transmission cost, balancing the energy generation and consumption should be
the major component in VNM. Note that VNM is entirely an account balancing
process, without the need to configure the energy flow in the power
distribution network. VNM has been proposed to enable novel applications, such
as transactive energy transfer in an energy exchange market, community solar
energy and shared energy storage (Gelman and Bird, 2014).

###  2.3. Blockchain Technology

There is an increasing number of applications of blockchain technology to
energy systems. For example, the study (Gorenflo et al., 2019) applied
blockchain to mitigate trust in peer-to-peer electric vehicle charging.
Blockchain has been applied to microgrid energy exchange and wholesale markets
by prosumers (Mengelkamp et al., 2018). Renewable energy credits and emissions
trading are also applications of blockchain (Knirsch et al., 2020). In these
applications, the goal of blockchain is to improve transparency and reduce
settlement times, since blockchain system can ensure integrity and consistency
of transactions and settlement on an open ledger. See (Andoni et al., 2019)
for a recent survey about blockchain applications to energy systems.

Note that none of these studies have considered the privacy on blockchain,
even though the transaction data on the ledger is entirely disclosed to the
public. Our work is one of the first studies to explicitly address privacy in
blockchain applications of energy systems. Supporting privacy on blockchain is
a crucial research topic in cryptography and security. There have been several
privacy-preserving blockchain platforms with support of privacy (e.g. ZCash,
Monero, Zether (Ben-Sasson et al., 2014; Monero, 2021; Bunz et al., 2020)).
Our work draws on similar concepts from privacy-preserving blockchain, but
also integrates specifically with the application of energy storage sharing,
for example, to support auditable VNM. Our solution is implemented as a smart
contract on permissionless Ethereum blockchain platform, but it can also be
implemented on a permissioned blockchain platform.

###  2.4. Privacy-Preserving Solutions

We briefly survey and compare various approaches of privacy-preserving
solutions in the literature. There are two major approaches: (1) data
obfuscation that masks private data with random noise, (2) secure multi-party
computation that hides private data while allowing the data to be computed
confidentially. Differential privacy (Dwork et al., 2006), a main example of
data obfuscation, is often used in privacy-preserving data mining to extract
certain data properties in a relatively large dataset. There is an intrinsic
trade-off between the accuracy and privacy of differential privacy. On the
other hand, secure multi-party computation (Goldreich, 1998; Du and Atallah,
2001) traditionally employed garbled circuits (Hazay and Lindell, 2010) and
homomorphic cryptosystems (Cramer et al., 2001; Lyu et al., 2020), which have
a high computational complexity. Recently, information-theoretical secret-
sharing (e.g., SPDZ (Cramer et al., 2015; Damgård et al., 2013)) has been
utilized for secure multi-party computation, which provides high efficiency.
This work employs secure multi-party computation for privacy-preserving energy
storage operation scheduling and cost-sharing computations without disclosing
private energy demands.

##  3\. Models and Formulation

In the following, we first formulate the energy storage sharing model without
considering privacy. In the subsequent sections, we will incorporate privacy
protection in the model.

###  3.1. Problem Setup

First, we describe several key components in the model (and list some key
notations in Table 1):

Table 1. Table of key symbols and notations. $N$ |  Total number of users
---|---
$U_{i}$ |  The $i$-th user
$p(t)$ |  Energy price of time-varying pricing scheme at timeslot $t$
${\tt B}(t)$ |  Capacity of energy storage at timeslot $t$
${\tt p}_{\tt s}$ |  Per-unit service fee of energy storage at each timeslot
${b}(t)$ |  State-of-charge of energy storage at timeslot $t$
${\tt e}_{\tt c},{\tt e}_{\tt d}$ |  Charging and discharging efficiency ratios
${\tt r}_{\tt c},{\tt r}_{\tt d}$ |  Charging and discharging rate constraints
${x}^{+}(t)$ |  Charging rate from the grid to the energy storage
${x}^{-}_{i}(t)$ |  Discharging rate from the energy storage to $U_{i}$
${y}_{i}(t)$ |  $U_{i}$’s residual consumption rate from the grid at $t$
${y}(t)$ |  Total residual consumption rate of all users at timeslot $t$
${\tt Cost}_{\tt ess}$ |  Total cost of energy storage service
${\tt Cost}_{i}$ |  $U_{i}$’s partial original cost without energy storage service
$P_{i}^{\tt pp}$ |  $U_{i}$’s payment under proportional cost-sharing scheme
$P_{i}^{\tt ega}$ |  $U_{i}$’s payment under egalitarian cost-sharing scheme
$\Delta_{i}$ |  $(={\tt Cost}_{i}-P_{i})$ $U_{i}$’s saving from energy storage service

  1. (1)

Time-Varying Energy Pricing Plan: We consider discrete timeslots, indexed by
$t\in\\{1,...,T\\}$, where $T$ is the number of timeslots in a day. The energy
price of a time-varying time-of-use (ToU) pricing plan at timeslot $t$ is
denoted by $p(t)$. We suppose that the next-day ToU prices $(p(t))_{t=1}^{T}$
are announced before the end of today to all users and energy storage
operator, such that they can plan their consumption in a day-ahead manner.

  2. (2)

Energy Users: There are $N$ ($\geq 3$)222Our protocols can safeguard against
at most $N-2$ dishonest users. users, each denoted by $U_{i}$ where
$i\in\\{1,...,N\\}$. $U_{i}$ has certain energy demand over time, represented
by a non-negative demand function $a_{i}(t)>0$ for all $t$. The users aim to
reduce their energy costs by utilizing a third-party energy storage service
that stores energy at lower energy prices beforehand. We consider day-ahead
energy storage scheduling, whereby $U_{i}$ forecasts her planned energy demand
$a_{i}(t)$ in advance, and requests energy storage service in a day-ahead
manner. If the energy from energy storage service is insufficient, $U_{i}$
will need to acquire additional energy from the grid for the residual
consumption rate denoted by ${y}_{i}(t)$ at the respective price $p(t)$.

  3. (3)

Energy Storage Service: The energy storage service is provided by an energy
storage operator, who has energy storage characterized by capacity ${\tt
B}(t)$, which is time-varying for modeling dynamic energy storage capacity.
The energy storage is constrained by charging efficiency ratio ${\tt e}_{\tt
c}\leq 1$ and discharging efficiency ratio ${\tt e}_{\tt d}\geq 1$, charge
rate (i.e., ramp-up) constraint ${\tt r}_{\tt c}$ and discharge rate (i.e.,
ramp-down) constraint ${\tt r}_{\tt d}$. Let $b(t)$ be the current state-of-
charge in the energy storage at time $t$, and ${x}^{+}(t)$ be the charging
rate from the grid to the energy storage, whereas ${x}^{-}_{i}(t)$ be the
discharging rate from the energy storage to $U_{i}$. When the energy storage
is utilized, there is a per-unit service fee at each timeslot, ${\tt p}_{\tt
s}$, which allows the energy storage operator to cover the wear-and-tear and
maintenance cost.

Next, we will describe energy storage service scheduling in Section 3.2 and
fair energy storage service cost-sharing in Section 3.3. We will present the
blockchain model in Section 3.4, and incorporate privacy protection in the
security and threat models in Section 3.5.

###  3.2. Energy Storage Service Scheduling

The energy storage service requires reservations from the users. The energy
storage service operations will then be scheduled accordingly to minimize the
overall energy cost. We formulate the optimization problem of energy storage
service scheduling in ${\tt(P1)}$.

(1) $\displaystyle{\tt(P1)}\ $ $\displaystyle\
\min\sum_{t=1}^{T}\Big{(}p(t)\cdot\big{(}{x}^{+}(t)+\sum_{i=1}^{N}{y}_{i}(t)\big{)}+{\tt
p}_{\tt s}\cdot{x}^{+}(t)\Big{)}$ (2) s.t. $\displaystyle b(t+1)-b(t)={\tt
e}_{\tt c}{x}^{+}(t)-{\tt e}_{\tt
d}\Big{(}\sum_{i=1}^{N}{x}^{-}_{i}(t)\Big{)},$ (3) $\displaystyle 0\leq
b(t)\leq{\tt B}(t),b(0)=0,b(T+1)=0,$ (4) $\displaystyle{x}^{+}(t)\leq{\tt
r}_{\tt c},$ (5) $\displaystyle\sum_{i=1}^{N}{x}^{-}_{i}(t)\leq{\tt r}_{\tt
d},$ (6) $\displaystyle{x}^{-}_{i}(t)+{y}_{i}(t)=a_{i}(t),$ (7) var.
$\displaystyle b(t)\geq 0,{x}^{-}_{i}(t)\geq 0,{y}_{i}(t)\geq 0,{x}^{+}(t)\geq
0$ $\displaystyle\forall t\in\\{1,...,T\\},\forall i\in\\{1,...,N\\}$

The objective of ${\tt(P1)}$ is the total cost, including energy storage
charging ${x}^{+}(t)$ and residual consumption ${y}_{i}(t)$ at the respective
energy price $p(t)$ of timeslot $t$, as well as the energy storage service fee
${\tt p}_{\tt s}\cdot{x}^{+}(t)$. Constraint (2) updates the state-of-charge
considering charging and discharging efficiency ratios. Constraint (3) ensures
feasible state-of-charge. We assume that the initial and final state-of-charge
are 0. Constraints (4)-(5) ensure the charging and discharging rates within
the respective rate constraints. Constraint (6) ensures the balance of
demands, such that each user’s demands are satisfied completely. Note that we
do not consider the cost of energy distribution in power distribution network.
This is sufficient to certain scenarios, for example, when the users are close
to the energy storage operator.

We note that ${\tt(P1)}$ however relies on the knowledge of individual user’s
demand $a_{i}(t)$. Hence, we present an alternate problem ${\tt(P2)}$.

(8) $\displaystyle{\tt(P2)}\ $ $\displaystyle\
\min\sum_{t=1}^{T}\Big{(}p(t)\cdot\big{(}{x}^{+}(t)+{y}(t)\big{)}+{\tt p}_{\tt
s}\cdot{x}^{+}(t)\Big{)}$ (9) s.t. $\displaystyle b(t+1)-b(t)={\tt e}_{\tt
c}{x}^{+}(t)-{\tt e}_{\tt d}{x}^{-}(t),$ (10) $\displaystyle 0\leq
b(t)\leq{\tt B}(t),b(0)=0,b(T+1)=0,$ (11) $\displaystyle{x}^{+}(t)\leq{\tt
r}_{\tt c},$ (12) $\displaystyle{x}^{-}(t)\leq{\tt r}_{\tt d},$ (13)
$\displaystyle{x}^{-}(t)+{y}(t)=a(t),$ var. $\displaystyle b(t)\geq
0,{x}^{-}(t)\geq 0,{y}(t)\geq 0,{x}^{+}(t)\geq 0$ $\displaystyle\forall
t\in\\{1,...,T\\}$

${\tt(P2)}$ considers the total demand ${a}(t)=\sum_{i=1}^{N}a_{i}(t)$, total
discharging rate ${x}^{-}(t)\triangleq\sum_{i=1}^{N}{x}^{-}_{i}(t)$ and total
consumption rate ${y}(t)=\sum_{i=1}^{N}{y}_{i}(t)$, as well as the balance of
the total demand in Constraint (13). By Theorem 1, energy storage service
scheduling can be solved by ${\tt(P2)}$, instead of ${\tt(P1)}$, involving no
individual demand ${a}_{i}(t)$.

######  Theorem 1.

If $\big{(}{x}^{-}(t),{y}(t)\big{)}_{t=1}^{T}$ is an optimal solution of
${\tt(P2)}$, then
$\big{(}({x}^{-}_{i}(t),{y}_{i}(t))_{i=1}^{N}\big{)}_{t=1}^{T}$, where
${x}^{-}_{i}(t)=\frac{a_{i}(t)}{a(t)}\cdot{x}^{-}(t)$ and
${y}_{i}(t)=\frac{a_{i}(t)}{a(t)}\cdot{y}(t)$, is an optimal solution of
${\tt(P1)}$.

See Appendix. A for the proof.

Remarks: Note that when the energy storage discharges at rate ${x}^{-}(t)$, it
can simultaneously compensate the users’ consumption at the same rate. This
can be attained via VNM. We assume that the energy storage operator announces
the parameters ${\tt p}_{\tt s},{\tt e}_{\tt c},$ ${\tt e}_{\tt d},{\tt
r}_{\tt c},{\tt r}_{\tt d},(p(t),$
${\tt B}(t))_{t=1}^{T}$ in advance. Everyone can compute the solution to
${\tt(P2)}$ with the knowledge of $(a(t))_{t=1}^{T}$.

###  3.3. Fair Cost-sharing of Energy Storage Service

After scheduling the energy storage service, the users are supposed to share
and pay the associate cost to the energy storage operator. Next, we formulate
how the cost of energy storage service should be shared among users in a fair
manner. In ${\tt(P2)}$, in addition to the cost that is paid directly by the
users to the grid (i.e., $\sum_{t=1}^{T}p(t)\cdot{y}(t)$), there is a cost
incurred by the energy storage service as follows:

(14) ${\tt Cost}_{\tt ess}\triangleq\sum_{t=1}^{T}\big{(}p(t)+{\tt p}_{\tt
s}\big{)}\cdot{x}^{+}(t)$

${\tt Cost}_{\tt ess}$ should be split fairly among the users. There are
several possible ways of dividing the energy storage service cost ${\tt
Cost}_{\tt ess}$. Particularly, we are interested in the fair ways that take
into consideration the individual rationality of each user.

We note that without energy storage service, each user should originally pay
the following cost:

(15)
$\sum_{t=1}^{T}p(t)\cdot{a}_{i}(t)=\sum_{t=1}^{T}p(t)\cdot\big{(}{x}^{-}_{i}(t)+{y}_{i}(t)\big{)}$

Let ${\tt Cost}_{i}\triangleq\sum_{t=1}^{T}p(t)\cdot{x}^{-}_{i}(t)$ be the
partial original cost of $U_{i}$ in Eqn. (15) that would have been covered by
energy storage service, which provides a basis on how to split ${\tt
Cost}_{\tt ess}$. Note that the other part in Eqn. (15) (i.e.,
$\sum_{t=1}^{T}p(t)\cdot{y}_{i}(t)$) will be paid regardless of energy storage
service. Noteworthily, if a user does not get any benefit from energy storage
service (i.e., ${a}_{i}(t)>0$ only when $p(t)$ is the lowest), then we have
${x}^{-}_{i}(t)=0$ in $({\tt P1})$ and ${\tt Cost}_{i}=0$.

Suppose that each $U_{i}$ contributes payment $P_{i}$ to cover the energy
storage service cost ${\tt Cost}_{\tt ess}$. A cost-sharing scheme denoted by
$(P_{i})_{i=1}^{N}$ is called budget-balanced, if $\sum_{i=1}^{N}P_{i}={\tt
Cost}_{\tt ess}$, whereas it is called weakly budget-balanced, if
$\sum_{i=1}^{N}P_{i}\geq{\tt Cost}_{\tt ess}$. A cost-sharing scheme
$(P_{i})_{i=1}^{N}$ is called individually rational, if ${\tt Cost}_{i}\geq
P_{i}$ for all $i\in\\{1,...,N\\}$. Evidently, each user would prefer an
individually rational cost-sharing scheme. Otherwise, some users would rather
not to utilize energy storage service, as it will cost more.

We define two fair cost-sharing schemes, which are based on similar ideas in
(Chau et al., 2019; Chau and Elbassioni, 2018), and show them to be
individually rational by Theorem 2.

####  3.3.1. Proportional Cost-sharing Scheme

One simple fair way is that each $U_{i}$ should pay proportionally to ${\tt
Cost}_{i}$. Namely,

$P_{i}^{\tt pp}\triangleq{\tt Cost}_{\tt ess}\cdot\frac{{\tt
Cost}_{i}}{\sum_{i=1}^{N}{\tt Cost}_{i}}=\sum_{t=1}^{T}\big{(}p(t)+{\tt
p}_{\tt s}\big{)}\cdot{x}^{+}(t)\cdot\frac{\sum_{t=1}^{T}{x}^{-}_{i}(t)\cdot
p(t)}{\sum_{t=1}^{T}{x}^{-}(t)\cdot p(t)}$

Thus, each user has the same ratio of payment over individual cost (i.e.,
$\frac{P_{i}^{\tt pp}}{{\tt Cost}_{i}}=\frac{{\tt Cost}_{\tt
ess}}{\sum_{i=1}^{N}{\tt Cost}_{i}}$). It is easy to check that proportional
cost-sharing is budget-balanced (i.e., $\sum_{i=1}^{N}P_{i}^{\tt pp}={\tt
Cost}_{\tt ess}$). Note that the payments are always non-negative (i.e.,
$P_{i}^{\tt pp}\geq 0$).

####  3.3.2. Egalitarian Cost-sharing Scheme

Given a payment to energy storage service $P_{i}$, define the user’s saving of
utilizing energy storage service by $\Delta_{i}\triangleq{\tt
Cost}_{i}-P_{i}$. Another fair cost-sharing scheme is that each user should
split ${\tt Cost}_{\tt ess}$ in a way that attains the same saving for every
user. Namely,

(16) $\displaystyle P_{i}^{\tt ega}$ $\displaystyle\triangleq{\tt
Cost}_{i}-\frac{\sum_{i=1}^{N}{\tt Cost}_{i}-{\tt Cost}_{\tt ess}}{N}$
$\displaystyle=\sum_{t=1}^{T}{x}^{-}_{i}(t)\cdot
p(t)-\frac{\sum_{t=1}^{T}{x}^{-}(t)\cdot p(t)-\sum_{t=1}^{T}\big{(}p(t)+{\tt
p}_{\tt s}\big{)}\cdot{x}^{+}(t)}{N}$

Thus, each $U_{i}$ attains the same saving as: $\Delta_{i}^{\tt
ega}\triangleq\frac{\sum_{i=1}^{N}{\tt Cost}_{i}-{\tt Cost}_{\tt ess}}{N}$. It
is easy to check that egalitarian cost-sharing is also budget-balanced (i.e.,
$\sum_{i=1}^{N}P_{i}^{\tt ega}={\tt Cost}_{\tt ess}$).

As a comparison, proportional cost-sharing guarantees the same percentage of
savings (i.e., $\frac{\Delta_{i}}{{\tt Cost}_{i}}$) among users, whereas
egalitarian cost-sharing guarantees the same savings (i.e., ${\Delta_{i}}$)
among users.

######  Theorem 2.

If $\big{(}{x}^{+}(t),{x}^{-}(t)\big{)}_{t=1}^{T}$ is an optimal solution of
${\tt(P2)}$ and let ${x}^{-}_{i}(t)=\frac{a_{i}(t)}{a(t)}\cdot{x}^{-}(t)$ and
${y}_{i}(t)=\frac{a_{i}(t)}{a(t)}\cdot{y}(t)$, then proportional and
egalitarian cost-sharing schemes are individually rational.

Let $\hat{\tt p}(t)\triangleq\frac{{x}^{-}(t)\cdot p(t)}{a(t)}$ and ${\tt
Cost}_{\tt org}\triangleq\sum_{t=1}^{T}{x}^{-}(t)\cdot p(t)$. The proportional
and egalitarian cost-sharing payments are given as follows:

(17) $\begin{cases}P_{i}^{\tt pp}=\frac{{\tt Cost}_{\tt ess}}{{\tt Cost}_{\tt
org}}\cdot\sum_{t=1}^{T}a_{i}(t)\cdot\hat{\tt p}(t),\\\ P_{i}^{\tt
ega}=\sum_{t=1}^{T}a_{i}(t)\cdot\hat{\tt p}(t)-\frac{{\tt Cost}_{\tt org}-{\tt
Cost}_{\tt ess}}{N}\end{cases}$

See Appendix. A for the proof.

Remarks: Egalitarian cost-sharing may have negative payments (i.e.,
$P_{i}^{\tt ega}<0$), when ${\tt Cost}_{i}<\Delta_{i}^{\tt ega}$. Namely, a
user may be paid by other users who have larger original costs, in order to
maintain equal savings among all users. In this case, such a user is not
benefited sufficiently from energy storage service because of the presence of
other users and capacity constraint, and hence, will be compensated by other
users in egalitarian cost-sharing.

One may argue whether proportional cost-sharing is better than egalitarian
cost-sharing, because it rules out negative payments. Here, we provide a
solution to support both cost-sharing schemes. We will leave the decision of
adopting which scheme to the users.

###  3.4. Blockchain Model

In this section, we describe a blockchain model for payments of energy storage
service. We consider an account-based blockchain model like Ethereum (which is
a general-purpose blockchain platform (Paper, 2014)), whereas Bitcoin operates
with a different transaction-output-based model for cryptocurrency
transactions only. Smart contracts are programming code on a blockchain that
can provide customized computation tasks to each transaction (e.g.,
verification, data processing). Our payment system can be implemented as a
smart contract.

The payment and auditing of energy storage service are carried out on a
blockchain. Each user has an account on the blockchain. Users can top-up their
accounts in advance. For cost-sharing, the users can initiate a joint payment
transaction to the energy storage operator. The transaction records on the
blockchain will also be used to verify VNM settlement by the grid operator.

Our blockchain model is based on a common model in the cryptography literature
(e.g., Zether (Bunz et al., 2020) that was built on Ethereum), which can be
incorporated with privacy protection to conceal the transaction records. The
blockchain consists of several components:

  1. (1)

Ledger: An append-only ledger on a blockchain holds the records of all
accounts and transactions. Note that by default, there is no privacy
protection to the ledger, such that the account details and transaction
histories are visible to the public. On Ethereum, one can create tokens on the
ledger to represent certain digital assets. Our payment system is implemented
by tokens, which allows us to incorporate privacy protection. To pay for
energy storage service, users are required to purchase tokens that will be
subsequently transfered to the energy storage operator and redeemed.

  2. (2)

Accounts: An account is identified by a public key $K^{\tt p}$ and an address
${\tt ad}$, which is the hash of the public key: ${\tt
ad}={\mathcal{H}}(K^{\tt p})$, where ${\mathcal{H}}(\cdot)$ is a cryptographic
hash function. The user manages the account by a private key $K^{\tt s}$. Each
account holds a balance of tokens, denoted by ${\tt Bal}({\tt ad})$, which by
default is a publicly visible plaintext. Each $U_{i}$ has an account
associated with a tuple $({\tt ad}_{i},K^{\tt p}_{i},K^{\tt s}_{i},{\tt
Bal}({\tt ad}_{i}))$. We denote the energy storage operator’s account address
by ${\tt ad}_{\tt ess}$.

  3. (3)

Transactions: To initiate a transaction of tokens from ${\tt ad}_{i}$ to ${\tt
ad}_{i^{\prime}}$ with transaction value ${\tt val}$, the user submits a
transaction request to the blockchain: ${\tt tx}=({\tt ad}_{i},{\tt
ad}_{i^{\prime}},{\tt val})$, along with a signature ${\tt sign}_{K^{\tt
s}_{i}}({\tt tx})$ using the private key $K^{\tt s}_{i}$ associated with ${\tt
ad}_{i}$. The transaction request will be executed333We skip some practical
issues of a blockchain transaction, like nonce to prevent replay attack,
account-locking against front-running attack, etc. But our model can easily
incorporate the solutions from the security literature (e.g., (Bunz et al.,
2020)) to address these issues. if ${\tt Bal}({{\tt ad}_{i}})\geq{\tt val}$. A
multi-transaction can also be requested. Let ${\tt mtx}=({\tt ad}_{i},{\tt
ad}_{i^{\prime}},{\tt val}_{i})_{i=1}^{N}$. ${\tt mtx}$ will be executed, only
if ${\tt Bal}({\tt ad}_{i})\geq{\tt val}_{i}$ for all $i$ and multi-signature
${\tt sign}_{(K^{\tt s}_{i})_{i=1}^{N}}({\tt mtx})$ is present. Depending on
the cost-sharing scheme, a user will pay either $P_{i}^{\tt pp}$ or
$P_{i}^{\tt ega}$ to the energy storage operator. Each transaction request by
default is a plaintext visible to the public. We will subsequently conceal the
transaction records.

  4. (4)

Receipts: The recipient of a transaction can attach a receipt on the ledger,
which may include additional information for further verification and auditing
by a third-party. In VNM settlement, the grid operator will need to audit the
amount of energy that a user can be offset from energy storage service, which
can be verified from the receipts associated with transaction records.

Note that there may be a negative flow of payment in egalitarian cost-sharing,
such that ${\tt val}_{i}<0$. Hence, we need to ensure the corresponding
transaction on a blockchain still functions correctly.

######  Theorem 3.

Consider a multi-transaction ${\tt mtx}=({\tt ad}_{i},{\tt ad}_{\tt ess},$
${\tt val}_{i})_{i=1}^{N}$, where ${\tt val}_{i}$ may be negative. Namely,
every ${\tt ad}_{i}$ pays to the energy storage operator ${\tt ad}_{\tt ess}$.
If $\sum_{i=1}^{N}{\tt val}_{i}>0$, then ${\tt mtx}$ can be handled on a
blockchain by the following transaction operations:

(18) $\displaystyle{\tt Bal}({\tt ad}_{i})\leftarrow$ $\displaystyle{\tt
Bal}({\tt ad}_{i})-{\tt val}_{i},\mbox{for all\ }i$ (19) $\displaystyle{\tt
Bal}({\tt ad}_{\tt ess})\leftarrow$ $\displaystyle{\tt Bal}({\tt ad}_{\tt
ess})+\sum_{i=1}^{N}{\tt val}_{i}$

See Appendix. A for the proof.

###  3.5. Security & Threat Models

In the previous sections, we have not considered privacy protection. We define
privacy protection in our problem. We assume synchronously authenticated
communications among the parties, including users, blockchain, energy storage
operator and grid operator, where the protocols proceed in several rounds and
the parties can authenticate each other properly so that there is no man-in-
the-middle attack.

####  3.5.1. Security Requirements

Our system aims to satisfy the following security requirements:

  1. (S1)

Demand Concealment: The user’s demand $\big{(}a_{i}(t)\big{)}_{t=1}^{T}$ is
private information, which should not be revealed to other users or energy
storage operator in energy storage service scheduling, cost-sharing and
payment. But the parameters, such as ${\tt p}_{\tt s},{\tt e}_{\tt c},{\tt
e}_{\tt d},$ ${\tt r}_{\tt c},{\tt r}_{\tt d},\big{(}p(t),{\tt
B}(t)\big{)}_{t=1}^{T}$, are publicly known to all users. We need to ensure
the operations of scheduling, cost-sharing and payment can be achieved
correctly without leaking any information about
$\big{(}a_{i}(t)\big{)}_{t=1}^{T}$ to others. Specifically, given
$\Big{(}\big{(}a_{i}(t)\big{)}_{t=1}^{T}\Big{)}_{i=1}^{N}$, we need a privacy-
preserving summation function for the aggregate demand:

${\tt Sum}_{\tt
prv}\Big{[}\Big{(}\big{(}a_{i}(t)\big{)}_{t=1}^{T}\Big{)}_{i=1}^{N}\Big{]}=\big{(}a(t)\big{)}_{t=1}^{T}.$

No user should learn any information from ${\tt Sum}_{\tt prv}[\cdot]$ other
than her own inputs and the final outputs.

  2. (S2)

Zero-knowledge Cost-Sharing & Payment: With $\big{(}a(t)\big{)}_{t=1}^{T}$,
one can compute the energy storage service schedule $\big{(}({x}^{+}(t),$
${x}^{-}(t),{y}(t)\big{)}_{t=1}^{T}$ by Theorem 1. Then, each $U_{i}$ can
compute and make her payment $P_{i}(=P_{i}^{\tt pp}\mbox{\ or\ }P_{i}^{\tt
ega})$ by Theorem 2. Since $a_{i}(t)$ is only known to $U_{i}$, we need
verifiable “zero-knowledge” proofs in the payment transactions to show the
following properties without revealing $a_{i}(t)$ or $P_{i}$:

     * (S2.1)

Non-negativity of user demands: $a_{i}(t)\geq 0$ for all $t$. s

     * (S2.2)

Correctness of payment: $P_{i}$ is computed correctly according to Theorem 2
for each $U_{i}$.

     * (S2.3)

Sufficient balance of payment: ${\tt Bal}({\tt ad}_{i})\geq P_{i}$, where
${\tt ad}_{i}$ is the account address of $U_{i}$.

     * (S2.4)

Budget balance of energy storage service: $\sum_{i=1}^{N}P_{i}={\tt Cost}_{\tt
ess}$.

These zero-knowledge proofs will be crucial to safeguard against dishonest
users in cost-sharing payments.

  3. (S3)

Auditing for Virtual Net Metering: The grid operator needs to verify the
agreed energy flows from the energy storage operator to users, namely,
$\Big{(}\big{(}{x}^{-}_{i}(t)\big{)}_{t=1}^{T}\Big{)}_{i=1}^{N}$ and
$\big{(}{x}^{-}(t)\big{)}_{t=1}^{T}$. To enable auditing, the energy storage
operator needs to provide a receipt for each $U_{i}$ to certify her
corresponding schedule $\big{(}{x}^{-}_{i}(t)\big{)}_{t=1}^{T}$, but without
the knowledge of $\big{(}{x}^{-}_{i}(t)\big{)}_{t=1}^{T}$.

We emphasize that privacy protection is considered throughout the integrated
process of scheduling, cost-sharing, payment and VNM auditing, without
requiring a trusted third-party.

####  3.5.2. Threat Model

Any users may be dishonest, who may try to cheat by paying less to energy
storage service or claim more in VNM than what they ought to. These dishonest
users may collude to coordinate their actions. We aim to ensure the privacy of
honest users and the correctness of scheduling, cost-sharing and payment in
the presence of an adaptive adversary who may corrupt a majority of up to
$N-2$ dishonest users. The adaptive adversary model provides a stronger
security guarantee than the static one, where the adversary may corrupt users
at any time during the protocols rather than before the protocols. A malicious
adversary is more challenging than a classical semi-honest user due to her
ability of deliberately deviating from the protocols for prying into others’
privacy or sabotage the protocols. In case of any dishonest actions being
detected, our system will abort and notify all the users.

Note that our system is not required to identify individual dishonest user and
it is fundamentally impossible (Ben-Or et al., 1988) to identify a dishonest
user in multi-party computation with a majority of dishonest users. There are
secure multi-party computation protocols (Cramer et al., 2001) that can
identify a dishonest user, but requiring a majority of honest users and
considerable computational overhead. On the other hand, we can impose further
measures to mitigate dishonesty. For example, requiring proper user
authentication to prevent shilling. Or, we can require each user to pay a
deposit in advance, which will be forfeited if any dishonesty is detected.

##  4\. Cryptographic Components

Our privacy-preserving solution relies on several basic components from
cryptography. We briefly explain them in this section. More details can be
found in a standard cryptography textbook (e.g., (Buchanan, 2017)).

Denote by ${\mathbb{Z}}_{p}=\\{0,...,p-1\\}$ the set of integers modulo $p$,
for encrypting private data. For brevity, we simply write “$x+y$” and “$x\cdot
y$” for modular arithmetic without explicitly mentioning“${\tt mod\ }p$”. We
consider a usual finite group ${\mathbb{G}}$ of order $p$. We pick $g,h$ as
two generators of ${\mathbb{G}}$, such that they can generate every element in
${\mathbb{G}}$ by taking proper powers, namely, for each $e\in{\mathbb{G}}$,
there exist $x,y\in{\mathbb{Z}}_{p}$ such that $e=g^{x}=h^{y}$. The classical
discrete logarithmic assumption states that given $g^{x}$, it is
computationally hard to obtain $x$, which underlies the security of many
cryptosystems.

###  4.1. Cryptographic Commitments

A cryptographic commitment allows a user to hide a secret (e.g., to hide the
balances and transactions on a blockchain). We use Pedersen commitment, which
is perfectly hiding (i.e., a computionally unbounded adversary cannot unlock
the secret) and computationally binding (i.e., an adversary cannot associate
with another secret in polynomial time). To commit secret value
$x\in{\mathbb{Z}}_{p}$, a user first picks a random number ${\tt
r}\in{\mathbb{Z}}_{p}$ to mask the commitment. Then, the user computes the
commitment by:

(20) ${\tt Cm}(x,{\tt r})=g^{x}\cdot h^{\tt r}\ (\mbox{mod\ }p)$

where $g$ is a generator of a multiplicative group ${\mathbb{Z}}_{p}^{*}$,
$h=g^{k}\ (\mbox{mod\ }p)$, $k$ is a secret value and $p$ is a large prime
number.

Note that Pedersen commitment satisfies homomorphic property: ${\tt
Cm}(x_{1}+x_{2},{\tt r}_{1}+{\tt r}_{2})={\tt Cm}(x_{1},{\tt r}_{1})\cdot{\tt
Cm}(x_{2},{\tt r}_{2})$. Sometimes, we simply write ${\tt Cm}(x)$ without
specifying random ${\tt r}$. Next, we use $\Sigma$-protocol to construct zero-
knowledge proofs for several useful properties of cryptographic commitments.

###  4.2. Zero-knowledge Proofs (ZKP)

In a zero-knowledge proof (of knowledge), a prover convinces a verifier of the
knowledge of a secret without revealing the secret. For example, to show the
knowledge of $(x,{\tt r})$ for ${\tt Cm}(x,{\tt r})$ without revealing
$(x,{\tt r})$. A zero-knowledge proof of knowledge should satisfy completeness
(i.e., the prover always can convince the verifier if knowing the secret),
soundness (i.e., the prover cannot convince a verifier if not knowing the
secret) and zero-knowledge (i.e., the verifier cannot learn the secret).

####  4.2.1. $\Sigma$-Protocol

$\Sigma$-Protocol is a general approach to construct zero-knowledge proofs.
Given a computationally non-invertible function $f(\cdot)$ that satisfies
homomorphic property $f(a+b)=f(a)+f(b)$ and $f(x)=y$, one can prove the
knowledge of the concealed $x$:

  1. (1)

First, the prover sends a commitment $y^{\prime}=f(x^{\prime})$, for a random
$x^{\prime}$, to the verifier.

  2. (2)

Next, the verifier replies with a random challenge $\beta$.

  3. (3)

The prover replies with $z=x^{\prime}+\beta\cdot x$ (which does not reveal
$x$).

  4. (4)

Finally, the verifier checks whether $f(z)\overset{?}{=}y^{\prime}+\beta\cdot
y$.

####  4.2.2. $\Sigma$-Protocol Based Zero-knowledge Proofs

Next, we present four crucial instances of zero-knowledge proofs based on
$\Sigma$-protocol:

  * •

ZKP of Commitment (zkpCm): Given ${\tt Cm}(x,r)$, a prover can convince a
verifier of the knowledge of $x$ without revealing $(x,r)$. Denote the
corresponding zero-knowledge proof by ${\tt zkpCm}[x]$.

  * •

ZKP of Summation (zkpSum): Given a set of commitments $\big{(}{\tt
Cm}(x_{i},{\tt r}_{i})\big{)}_{i=1}^{n}$ and $y$, a prover can convince a
verifier of the knowledge of $y=\sum_{i=1}^{n}x_{i}$ without revealing
$(x_{i})_{i=1}^{n}$. Denote the corresponding zero-knowledge proof by ${\tt
zkpSum}[y,(x_{i})_{i=1}^{n}]$.

  * •

ZKP of Membership (zkpMbs): Given a set ${\mathcal{X}}=\\{x_{1},...,x_{n}\\}$
and ${\tt Cm}(x,{\tt r})$, a prover can convince a verifier of the knowledge
of $x\in{\mathcal{X}}$ without revealing $x$. Denote the corresponding zero-
knowledge proof by ${\tt zkpMbs}[x,{\mathcal{X}}]$.

  * •

ZKP of Non-Negativity (zkpNN): Given ${\tt Cm}(x,{\tt r})$, a prover can
convince a verifier of the knowledge of $x\geq 0$ without revealing $x$.
Denote the corresponding zero-knowledge proof by ${\tt zkpNN}[x]$.

The detailed constructions of these zero-knowledge proofs can be found in
Appendix. B.

###  4.3. Non-interactive Zero-knowledge Proofs

An interactive zero-knowledge proof that requires a verifier-provided
challenge can be converted to a non-interactive one by Fiat-Shamir heuristic
to remove the verifier-provided challenge.

Let ${\mathcal{H}}(\cdot)\mapsto{\mathbb{Z}}_{p}$ be a cryptographic hash
function. Given a list of commitments (${\tt Cm}_{1},...,{\tt Cm}_{r}$), one
can map to a single hash value by ${\mathcal{H}}({\tt Cm}_{1}|...|{\tt
Cm}_{r})$, where the input is the concatenated string of (${\tt
Cm}_{1},...,{\tt Cm}_{r}$). In a $\Sigma$-protocol, one can set the challenge
by $\beta={\mathcal{H}}({\tt Cm}_{1}|$$...|{\tt Cm}_{r})$, where (${\tt
Cm}_{1},...,{\tt Cm}_{r}$) are all the commitments generated by the prover
prior to the step of verifier-provided challenge (Step 2 of
$\Sigma$-protocol). Hence, the prover does not wait for the verifier-provided
random challenge, and instead generates the random challenge himself. The
verifier will generate the same challenge following the same procedure for
verification. We denote the non-interactive versions of the previous zero-
knowledge proofs by nzkpCm, nzkpSum, nzkpMbs, nzkpNN, respectively.

###  4.4. Public-Private Key Signatures

Cryptographic signatures are a standard tool to verify the authenticity of
some given data. Suppose that a signer has a pair of public and private keys
$(K^{\tt p},K^{\tt s})$ for an asymmetric key cryptosystem (e.g., RSA). To
sign a message $m$, the signer first maps $m$ by a cryptographic hash function
${\mathcal{H}}(m)$ (e.g., SHA-3). Then the signature of $m$ is the encryption
${\tt sign}_{K^{\tt s}}[m]={\tt Enc}_{K^{\tt s}}[{\mathcal{H}}(m)]$. Given
$(m,K^{\tt p})$, anyone can verify the signature ${\tt sign}_{K^{\tt s}}[m]$
by checking whether the decryption ${\tt Dec}_{K^{\tt p}}[{\tt sign}_{K^{\tt
s}}[m]]\overset{?}{=}{\mathcal{H}}(m)$.

##  5\. Multi-party Computation Protocol

Our privacy-preserving solution also relies on a multi-party computation
protocol called SPDZ (Cramer et al., 2015; Damgård et al., 2013), which allows
multiple parties to jointly compute a function while concealing the private
inputs. SPDZ can safeguard against a majority of dishonest users (i.e., all
but one party can be dishonest), and does not require a trusted dealer for
setup. For clarity, this section presents a simplified version of SPDZ.
Readers can refer to (Cramer et al., 2015; Damgård et al., 2013) for the
detailed description.

###  5.1. Information-theoretical Secret Sharing

SPDZ relies on the notion of information-theoretical secret-sharing, whereby
private data will be distributed to multiple parties, such that each party
only knows a share of the data, without complete knowledge of other shares.
Hence, computation of individual shares of data will not reveal the original
data, unless all shares are revealed for output or verification. Several
distributed computation operations can be performed locally via SPDZ, while
preserving the secret sharing property.

We consider the computation of a function of an arithmetic circuit consisting
of only additions and multiplications. Suppose a private number $x$ is
distributed to $n$ parties, such that each party $i$ knows a share $x_{i}$
only, where $x=\sum_{i=1}^{n}x_{i}$, but not knowing other shares $x_{j}$,
where $j\neq i$. Note that a party is unable to construct $x$, without knowing
all the shares. In the following, we write $\langle x\rangle$ as a secretly
shared number, meaning that there is a vector $(x_{1},...,x_{n})$, such that
each party $i$ knows only $x_{i}$. Given secretly shared $\langle x\rangle$
and $\langle y\rangle$, and a public known constant $c$, the following
operations can be attained by local computation at each party, and then the
outcome can be assembled from the individual shares:

  1. A1)

$\langle x\rangle+\langle y\rangle$ can be computed by
$(x_{1}+y_{1},...,x_{n}+y_{n})$.

  2. A2)

$c\cdot\langle x\rangle$ can be computed by $(c\cdot x_{1},...,c\cdot x_{n})$.

  3. A3)

$c+\langle x\rangle$ can be computed by $(c+x_{1},x_{2},...,x_{n})$.

To reveal $\langle x\rangle$, each party $i$ broadcasts $x_{i}$ to other
parties. Then each party can reconstruct $x=\sum_{i=1}^{n}x_{i}$. See an
illustration in Figure 2.

Figure 2. An example of information-theoretical secret-sharing. Let us compute
$x+y$, without revealing $x$ or $y$. Party 1 splits $x$ into
$(x_{i})_{i=1}^{4}$ and secretly shares each with one party. So is party 2 for
$y$. Next, each party $i$ computes $z_{i}=x_{i}+y_{i}$ locally. Then, we can
obtain the sum $x+y=\sum_{i=1}^{4}z_{i}$, when $(z_{i})_{i=1}^{4}$ are
revealed to everyone, which however does not leak either $x_{i}$ or $y_{i}$.

Multiplications can also be computed by SPDZ, and the detailed description can
be found in Appendix. D. With additions and multiplications, one can construct
a large class of computation functions (including comparison and branching
conditions).

However, some parties may be dishonest, who may not perform the correct local
computation. To safeguard against dishonest parties, an information-
theoretical message authentication code (MAC) can be used for verification.
Every secretly shared number is encoded by a MAC as $\gamma(x)$, which is also
secretly shared as $\langle\gamma(x)\rangle$. The basic idea is that if a
dishonest party wants to modify her share $x_{i}$, then he also needs to
modify $\gamma(x)_{i}$ consistently. This allows dishonesty to be detectable
by checking the corresponding MAC in the final output. The detailed
description of MAC can be found in Appendix. D. In the following, we write
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}x\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$
meaning that both $\langle x\rangle$ and the respective MAC
$\langle\gamma(x)\rangle$ are secretly shared among users.

###  5.2. Overview of SPDZ Protocol

The SPDZ consists of three phases, as outlined as follows:

  1. (1)

Pre-processing Phase: In this phase, a collection of shared random numbers
will be constructed to mask the private input numbers. For each private input
number of party $i$, there needs a shared random number
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}r^{i}\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$,
where $r^{i}$ is revealed to party $i$ only, but not to other parties.

  2. (2)

Online Phase: To secretly shares a private input number $x^{i}$ using
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}r^{i}\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$,
without revealing $x^{i}$, it proceeds as follows:

    1. 1)

Party $i$ computes and reveals $z^{i}=x^{i}-r^{i}$ to all parties.

    2. 2)

Every party sets
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}x^{i}\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}\leftarrow
z^{i}+\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}r^{i}\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$
(see A3).

Any computation circuit with additions or multiplications can be computed by
local computations (e.g., A1-A3). The MACs are updated accordingly to preserve
the consistency.

  3. (3)

Output and Validation Phase: All MACs will be revealed for validation. If
there is any inconsistency in MACs, then abort.

The details of SPDZ protocol can be found in Appendix. C.

##  6\. Privacy-Preserving Solution for Energy Storage Sharing

This section presents an integrated solution for privacy-preserving energy
sharing, based on blockchain, zero-knowledge proofs and multi-party
computation protocol SPDZ.

###  6.1. Privacy-Preserving Ledger

First, we incorporate privacy protection to hide the transaction records on
the ledger, while still allowing proper verifications for cost-sharing and
VNM. As in other privacy-preserving blockchain platforms (e.g., Zether (Bunz
et al., 2020)), we conceal the balances and transaction values in the ledger
by the respective cryptographic commitments instead of plaintext values. The
accounts in the ledger will become as follows:

Table 2. Accounts in the privacy-preserving ledger ${\tt ad}_{i}$ | $K^{\tt p}_{i}$ | ${\tt Cm}({\tt Bal}({\tt ad}_{i}))$
---|---|---
${\tt ad}_{j}$ | $K^{\tt p}_{j}$ | ${\tt Cm}({\tt Bal}({\tt ad}_{j}))$
… | … | …

A multi-transaction will be concealed as ${\tt mtx}=({\tt ad}_{i},{\tt
ad}_{i^{\prime}},{\tt Cm}({\tt val}_{i}))_{i=1}^{N}$.

Because of concealed balances and transaction values, each user must provide
${\tt nzkpNN}[{\tt Bal}({\tt ad}_{i})-{\tt val}_{i}]$ along with each
transaction request to prove the non-negativity of the resultant balance.
Otherwise, the transaction request will be denied by the ledger without the
correct ${\tt nzkpNN}$.

###  6.2. Privacy-Preserving Protocol $\Pi_{\tt pess}$

We design a protocol, denoted by $\Pi_{\tt pess}$, to coordinate the users for
privacy-preserving energy storage service scheduling, cost-sharing, payment
and VNM settlement. We denote the energy storage operator and grid operator by
${\sf Opr}_{\sf es}$ and ${\sf Opr}_{\sf gr}$ respectively.

Before presenting the details of the protocol, we first outline some high-
level ideas:

  1. (1)

First, the users need to secretly share private individual demands
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}a_{i}(t)\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$.
Then, they can compute aggregate demand
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}a(t)\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$
via SPDZ in a privacy-preserving manner.

  2. (2)

To enable subsequent verification of the payment transactions and VNM, $U_{i}$
also needs to announce commitment ${\tt Cm}(a_{i}(t))$ to each other. However,
a dishonest user may use inconsistent commitment ${\tt Cm}(a_{i}(t))$ with
respect to the secretly shared
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}a_{i}(t)\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$.
To show the consistency between ${\tt Cm}(a_{i}(t))$ and
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}a_{i}(t)\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$,
all users need to create zero-knowledge proof of commitment ${\tt
zkpCm}[a_{i}(t)]$ via SPDZ using secretly shared
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}a_{i}(t)\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$.
If ${\tt zkpCm}[a_{i}(t)]$ is verified to be correct, then ${\tt
Cm}(a_{i}(t))$ and
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}a_{i}(t)\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$
are consistent. Each user also creates a zero-knowledge proof of non-
negativity ${\tt nzkpNN}[a_{i}(t)]$.

  3. (3)

After verifying ${\tt zkpCm}[a_{i}(t)]$ and ${\tt nzkpNN}[a_{i}(t)]$, the
users reveal
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}a(t)\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$
and verify the corresponding MAC to ensure the integrity of $a(t)$. Then, the
users compute the energy storage service schedule with the knowledge of
$\big{(}a(t)\big{)}_{t=1}^{T}$.

  4. (4)

Next, $U_{i}$ can make her payment $P_{i}(=P_{i}^{\tt pp}\mbox{\ or\
}P_{i}^{\tt ega})$ by Theorem 2. The users jointly compute the total payments
$\sum_{i}^{N}P_{i}$ via SPDZ in a privacy-preserving manner to ensure that the
difference between ${\tt Cost_{\tt ess}}$ and $\sum_{i}^{N}P_{i}$ is within a
negligible rounding error $\varepsilon$, such that $|{\tt Cost_{\tt
ess}}-\sum_{i}^{N}P_{i}|<\varepsilon$. The users agree and set ${\tt Cost_{\tt
ess}}=\sum_{i}^{N}P_{i}$.

  5. (5)

To make cost-sharing payments for energy storage service on the ledger, the
users need to create a zero-knowledge proof that $\sum_{i=1}^{N}P_{i}={\tt
Cost}_{\tt ess}$ via SPDZ. $U_{i}$ also creates ${\tt nzkpNN}[{\tt Bal}({\tt
ad}_{i})-P_{i}]$ locally. Then, the users submit a multi-transaction request
with relevant zero-knowledge proofs to the ledger.

  6. (6)

After the completion of multi-transaction of payments, the energy storage
service schedule is executed. Afterwards, ${\sf Opr}_{\sf es}$ signs ${\tt
Cm}\big{(}x^{-}_{i}(t)\big{)}$ as a receipt on the ledger for each user. Note
that ${\tt Cm}\big{(}x^{-}_{i}(t)\big{)}$ can be generated based on ${\tt
Cm}\big{(}a_{i}(t)\big{)}$ and the energy storage service schedule.

  7. (7)

The users request VNM settlement with ${\sf Opr}_{\sf gr}$, who will verify
$x^{-}_{i}(t)$ from the signed ${\tt Cm}\big{(}x^{-}_{i}(t)\big{)}$ on the
ledger.

Next, we present the details of the privacy-preserving protocol $\Pi_{\tt
pess}$, consisting of four stages (Initialization, Pre-operation Scheduling,
Cost-sharing Payment & Operation and Post-operation VNM Settlement), as
follows:

#### Stage 0: Initialization

In this stage, the system parameters are chosen and the pre-processing phase
of SPDZ is executed among the users. See Appendix. C for detailed SPDZ pre-
processing phase.

[border-break-style=none,border-color=#bbbbbb,background-
color=#eeeeee,breakable=true,,width=] Initialization:

  1. (1)

Choose and announce a multiplicative group ${\mathbb{Z}}_{p}^{*}$, two
generators $g,h\in{\mathbb{Z}}_{p}^{*}$ and hash function
${\mathcal{H}}(\cdot)\mapsto{\mathbb{Z}}_{p}$ as public information to all
users. Note that $g$ and $h$ can be obtained via a coin-tossing protocol
(Quantiki, 2020) among the users such that $\log_{g}h$ is unknown due to the
hardness of discrete logarithm.

  2. (2)

The energy storage operator announces ${\tt p}_{\tt s},{\tt e}_{\tt c},{\tt
e}_{\tt d},{\tt r}_{\tt c},{\tt r}_{\tt d},$ $\big{(}p(t),$
${\tt B}(t)\big{)}_{t=1}^{T}$ as public information to all users.

  3. (3)

Initialize SPDZ pre-processing phase among all users.

#### Stage 1: Pre-operation Scheduling

In this stage, the users will compute their aggregate day-ahead demands via
SPDZ. The users also need to make commitments of their individual demands
$\big{(}a_{i}(t)\big{)}_{t=1}^{T}$, which will be used for auditing in VNM. We
ensure that the individual demands shared via SPDZ match the ones being
committed. This can be accomplished by computing zero-knowledge proof of
commitment ${\tt zkpCm}[a_{i}(t)]$ using the secretly shared
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}a_{i}(t)\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$.
Next, the users will compute the optimal energy storage service schedule in
$({\tt P2})$ based on aggregate demands $\big{(}a(t)\big{)}_{t=1}^{T}$.

[border-break-style=none,border-color=#bbbbbb,background-
color=#eeeeee,breakable=true,,width=] Protocol $\Pi_{\tt pess}^{(1)}$:

  1. (1)

$U_{i}$ commits $C_{i}(t)={\tt Cm}\big{(}a_{i}(t),{\tt r}_{i}(t)\big{)}$ for
all $t$ and announces $\big{(}C_{i}(t)\big{)}_{t=1}^{T}$ to all users with
$\big{(}{\tt nzkpNN}[a_{i}(t)]\big{)}_{t=1}^{T}$, where ${\tt r}_{i}(t)$ is a
random masking number. All users verify ${\tt nzkpNN}[a_{i}(t)]$. If
verification of ${\tt nzkpNN}[a_{i}(t)]$ fails, announce Abort.

  2. (2)

$U_{i}$ secretly shares
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}a_{i}(t)\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$
and
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}{\tt
r}_{i}(t)\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$
via SPDZ for all $t$.

  3. (3)

To show the equality of $a_{i}(t)$ in
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}a_{i}(t)\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$
and $C_{i}(t)$, $U_{i}$ constructs an ${\tt zkpCm}[a_{i}(t)]$ distributedly
via SPDZ:

    1. (a)

$U_{i}$ randomly generates $\big{(}a^{\prime}_{i}(t),{\tt
r}^{\prime}_{i}(t)\big{)}\in{\mathbb{Z}}_{p}$ and secretly shares as
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}a^{\prime}_{i}(t)\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$
and
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}{\tt
r}^{\prime}_{i}(t)\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$.
Then $U_{i}$ announces $C^{\prime}_{i}(t)={\tt
Cm}\big{(}a^{\prime}_{i}(t),{\tt r}^{\prime}_{i}(t)\big{)}$ to all users. Note
that all the users must complete this step before proceeding to the next step
to produce a common random challenge $\beta(t)$.

    2. (b)

All the users conduct a coin-tossing protocol to obtain a random challenge
$\beta(t)$. Firstly, each user announces a commitment
$C^{\prime\prime}_{i}(t)$ of a randomly generated number ${\tt
r}^{\prime\prime}_{i}(t)\in{\mathbb{Z}}_{p}$. Then all the users reveal ${\tt
r}^{\prime\prime}_{i}(t)$ and compute a random challenge
$\beta(t)=\sum_{i=1}^{N}{\tt r}^{\prime\prime}_{i}(t)$.

    3. (c)

All users compute and reveal
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}z_{a_{i}(t)}\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}=\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}a^{\prime}_{i}(t)\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}+\beta(t)\cdot\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}a_{i}(t)\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$
and
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}z_{{\tt
r}_{i}(t)}\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}=\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}{\tt
r}^{\prime}_{i}(t)\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}+\beta(t)\cdot\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}{\tt
r}_{i}(t)\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$
for $U_{i}$.

    4. (d)

This creates ${\tt zkpCm}[a_{i}(t)]=\\{C^{\prime}_{i}(t),z_{a_{i}(t)},z_{{\tt
r}_{i}(t)}\\}$. All users verify ${\tt zkpCm}$ by checking

$g^{z_{a_{i}(t)}}\cdot h^{z_{{\tt
r}_{i}(t)}}\overset{?}{=}C^{\prime}_{i}(t)\cdot{\tt Cm}\big{(}a_{i}(t),{\tt
r}_{i}(t)\big{)}^{\beta(t)}$

    5. (e)

If the verification of ${\tt zkpCm}$ fails, announce Abort.

  4. (4)

The users compute
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}a(t)\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}\leftarrow\sum_{i=1}^{N}\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}a_{i}(t)\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$
for all $t$ via SPDZ. Reveal
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}a(t)\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$
to all users. Check MAC of
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}a(t)\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$.
If the MAC check fails, announce Abort.

  5. (5)

The users solve $({\tt P2})$ using $\big{(}{a}(t)\big{)}_{t=1}^{T}$ for
$\big{(}{x}^{+}(t),{x}^{-}(t),{y}(t)\big{)}_{t=1}^{T}$

  6. (6)

All users compute ${\tt Cost}_{\tt
ess}\triangleq\sum_{t=1}^{T}\big{(}p(t)+{\tt p}_{\tt s}\big{)}\cdot{x}^{+}(t)$
and ${\tt Cost}_{\tt org}\triangleq\sum_{t=1}^{T}p(t)\cdot{x}^{-}(t)$,
$\hat{\tt p}(t)\triangleq\frac{{x}^{-}(t)\cdot p(t)}{a(t)}$.

#### Stage 2: Cost-sharing Payment & Operation

In this stage, the users will split the cost of energy storage service based
on proportional or egalitarian cost-sharing scheme via SPDZ. The users compute
the payment commitments and verify the validity of ${\tt Cost}_{\tt ess}$ by
comparing with $\sum_{i=1}^{N}P_{i}$. Before issuing the multi-transaction,
the users compute ${\tt nzkpSum}[{\tt Cost}_{\tt ess},(P_{i})_{i=1}^{N}]$ to
satisfy Theorem 3. The users then make energy storage service payments via
privacy-preserving blockchain. After receiving the payments, the energy
storage operator will issue verifiable receipts on the ledger.

[border-break-style=none,border-color=#bbbbbb,background-
color=#eeeeee,breakable=true,,width=] Protocol $\Pi_{\tt pess}^{(2)}$:

  1. (1)

$U_{i}$ computes $P_{i}=P_{i}^{\tt pp}$ (or $P_{i}^{\tt ega}$) by Theorem 2,
and announces commitment ${\tt Cm}(P_{i},{\tt r}_{i})$ to all users, and
secretly shares
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}{\tt
r}_{i}\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$
via SPDZ.

  2. (2)

The users also compute the total payments via SPDZ by

(21) $\sum_{i=1}^{N}P_{i}=\begin{cases}\displaystyle\sum_{i=1}^{N}P_{i}^{\tt
pp}=\sum_{t=1}^{T}\big{(}\frac{{\tt Cost}_{\tt ess}\cdot\hat{\tt p}(t)}{{\tt
Cost}_{\tt
org}}\cdot\sum_{i=1}^{N}\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}a_{i}(t)\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}\big{)},\\\
\displaystyle\sum_{i=1}^{N}P_{i}^{\tt
ega}=\sum_{t=1}^{T}\Big{(}\sum_{i=1}^{N}\big{(}\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}a_{i}(t)\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}\cdot\hat{\tt
p}(t)-\frac{{\tt Cost}_{\tt org}-{\tt Cost}_{\tt
ess}}{N}\big{)}\Big{)}\end{cases}$

and check if satisfying $|{\tt Cost}_{\tt
ess}-\sum_{i=1}^{N}P_{i}|<\varepsilon$, where $\varepsilon$ is a small fault-
tolerant factor, which restricts the rounding error, arising from computing
$\frac{{\tt Cost}_{\tt ess}}{{\tt Cost}_{\tt org}}$ or $\hat{\tt p}(t)$. If
satisfied, the users let ${\tt Cost}_{\tt ess}\leftarrow\sum_{i=1}^{N}P_{i}$.
Otherwise, announce Abort.

  3. (3)

The users compute ${\tt nzkpSum}[{\tt Cost}_{\tt ess},(P_{i})_{i=1}^{N}]$ via
SPDZ distributely:

    1. (a)

$U_{i}$ randomly generates and secretly shares
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}{\tt
r}^{\prime}_{i}\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}\in{\mathbb{Z}}_{p}$
before announcing ${\tt Cm}(0,{\tt r}^{\prime}_{i})$.

    2. (b)

All users compute $C^{\prime}=\prod_{i=1}^{N}{\tt Cm}(0,{\tt r}^{\prime}_{i})$
and obtain a random challenge $\beta={\mathcal{H}}(C^{\prime})$. Then all
users compute
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}z_{\tt
r}\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}=\sum_{i=1}^{n}\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}{\tt
r}^{\prime}_{i}\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}+\beta\cdot\sum_{i=1}^{n}\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}{\tt
r}_{i}\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$.
Then reveal
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}z_{\tt
r}\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$.

    3. (c)

This creates ${\tt nzkpSum}[{\tt Cost}_{\tt
ess},(P_{i})_{i=1}^{N}]=\\{C^{\prime},z_{{\tt r}}\\}$. All users verify ${\tt
nzkpSum}$ by checking:

$g^{\beta\cdot{\tt Cost}_{\tt ess}}\cdot h^{z_{\tt
r}}\overset{?}{=}C^{\prime}\cdot\prod_{i=1}^{n}{\tt Cm}(P_{i},{\tt
r}_{i})^{\beta}$

If the verification of ${\tt nzkpSum}$ fails, announce Abort.

  4. (4)

$U_{i}$ computes ${\tt nzkpNN}[{\tt Bal}({\tt ad}_{i})-P_{i}]$ based on ${\tt
Cm}(P_{i})$.

  5. (5)

Let the account address of ${\sf Opr}_{\sf es}$ be ${\tt ad}_{\tt ess}$. The
users submit a multi-transaction request

${\tt mtx}=\big{(}{\tt ad}_{i},{\tt ad}_{\tt ess},{\tt
Cm}(P_{i})\big{)}_{i=1}^{N}$

to the ledger, along with

$\qquad\ \ {\tt nzkpSum}[{\tt Cost}_{\tt ess},(P_{i})_{i=1}^{N}]\mbox{\ and\
}{\tt nzkpNN}[{\tt Bal}({\tt ad}_{i})-P_{i}]_{i=1}^{N}$

  6. (6)

The ledger verifies ${\tt nzkpSum}$ and ${\tt nzkpNN}$ before proceeding the
transaction. If the verification fails, announce Abort.

  7. (7)

The users provide the schedule
$\big{(}{a}(t),{x}^{+}(t),{x}^{-}(t),{y}(t)\big{)}_{t=1}^{T}$ to ${\sf
Opr}_{\sf es}$. After the transaction completes, ${\sf Opr}_{\sf es}$ will
execute the schedule.

#### Stage 3: Post-operation VNM Settlement

In this stage, ${\sf Opr}_{\sf es}$ will sign the receipts of individual
energy storage service $\big{(}x^{-}_{i}(t)\big{)}_{t=1}^{T}$. The receipts
will be stored on the ledger. When the users request VNM settlement with ${\sf
Opr}_{\sf gr}$, ${\sf Opr}_{\sf gr}$ will verify their claims by the receipts
on the ledger.

[border-break-style=none,border-color=#bbbbbb,background-
color=#eeeeee,breakable=true,,width=] Protocol $\Pi_{\tt pess}^{(3)}$:

  1. (1)

The users upload $\big{(}{\tt Cm}(a_{i}(t))_{t=1}^{T}\big{)}_{i=1}^{N}$ (from
Stage 1) to the ledger.

  2. (2)

${\sf Opr}_{\sf es}$ computes commitment ${\tt Cm}(x^{-}_{i}(t))$ $={\tt
Cm}(a_{i}(t))^{\frac{x^{-}(t)}{a(t)}}$ (according to Theorem 2) for all $t$
and $i$.

  3. (3)

Let the public-private keys of ${\sf Opr}_{\sf es}$ be $(K^{\tt p}_{\tt
ess},K^{\tt s}_{\tt ess})$. ${\sf Opr}_{\sf es}$ signs ${\tt sign}_{K^{\tt
s}_{\tt ess}}[$ ${\tt Cm}(x^{-}_{i}(t))]$ along with ${\tt Cm}(x^{-}_{i}(t))$
to be stored on the ledger.

  4. (4)

${\sf Opr}_{\sf es}$ prepares VNM and provides energy export profile
$\big{(}x^{-}(t)\big{)}_{t=1}^{T}$ to ${\sf Opr}_{\sf gr}$.

  5. (5)

$U_{i}$ submits a claim for reimbursement by referring to receipt ${\tt
Cm}(x^{-}_{i}(t))$ and ${\tt sign}_{K^{\tt s}_{\tt ess}}[{\tt
Cm}(x^{-}_{i}(t))]$ on the ledger. $U_{i}$ also reveals $x^{-}_{i}(t)$ to
${\sf Opr}_{\sf gr}$ to prove the validity.

  6. (6)

${\sf Opr}_{\sf gr}$ verifies ${\tt sign}_{K^{\tt s}_{\tt ess}}[{\tt
Cm}(x^{-}_{i}(t))]$ by public key $K^{\tt p}_{\tt ess}$, and compares the
energy demand profile $\big{(}a_{i}(t)\big{)}_{t=1}^{T}$ with
$\big{(}x^{-}_{i}(t)\big{)}_{t=1}^{T}$. If the verification is consistent,
${\sf Opr}_{\sf gr}$ will deduct the amount $\sum_{t=1}^{T}x^{-}_{i}(t)\cdot
p(t)$ from $U_{i}$’s total payment.

Remarks: In protocol $\Pi_{\tt pess}$, each user is required to input her
privacy demand $\big{(}a(t)\big{)}_{t=1}^{T}$ in two privacy-preserving ways:
(1) commitment ${\tt Cm}(a_{i}(t))$, and (2) secretly shared value in SPDZ
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}a_{i}(t)\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$.
While the commitment ${\tt Cm}(a_{i}(t))$ is used to generate other zero-
knowledge proofs for payments and VNM, the secretly shared
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}a_{i}(t)\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$
is used to compute service scheduling and cost-sharing. Both inputs should be
consistent (i.e., checked by ${\tt zkpCm}[a_{i}(t)]$ that is constructed via
SPDZ). Also, ${\tt Cm}(a_{i}(t))$ can be used to construct ${\tt Cm}(P_{i})$
and ${\tt Cm}(x^{-}_{i}(t))$ without the knowledge of $a_{i}(t)$, because of
its homomorphic property for these constructions.

See Appendix. D for the security analysis of $\Pi_{\tt pess}$ for satisfying
security requirements S1-S3.

Figure 3. Data trace of energy storage service schedule.

(a) Computational overhead

(b) Communication overhead

(c) Gas cost of executeTransaction()

Figure 4. System performance and smart contract gas costs.

##  7\. Evaluation

In this section, we present an evaluation study of our solution, including the
effectiveness of energy storage sharing, multi-party computation protocol
performance and the incurred cost of smart contract implementation on a
practical blockchain platform.

###  7.1. Energy Storage Service Scheduling

We first evaluate the effectiveness of energy storage sharing. We selected 120
users from the Smart* microgrid dataset (Barker et al., 2012). We consider a
single 24-hour period, from midnight to next midnight.

In particular, we present the temporal data trace of scheduled energy storage
services for 4 users. We observe that each of the user can utilize energy
storage discharging during peak-hour. Most users acquire energy from the grid
during off-peak-hour, and partially during shoulder-hour. Next, we study the
saving ($\Delta_{i}$) of each user. In Figure 3, we study different cost-
sharing schemes of energy storage service for 4 users. We observe that
proportional cost-sharing gives each user at the same percentage of saving of
28.78% when energy storage $B$ is 400 kWh, whereas different user has
different percentage of saving with egalitarian cost-sharing, but with the
same amount of saving of $37.90.

###  7.2. SPDZ Performance

Next, we evaluate the performance of SPDZ in stages 1-2 of
$\Pi_{\text{pess}}$. We skip stage 3 due to its negligible performance
compared with stages 1-2. We consider 144 time slots in a single 24-hour
period. All the results were averaged over 20 instances.

####  7.2.1. Computational Overhead

We scaled the number of users from 5 to 25. Figure 4(a) displays the average
running time incurred at each user in the stage 1. The running time shows a
linearly growing trend with the increased number of users. The running time
starts from about 0.91 seconds with 5 users to around 4.32 seconds with 25
users. We skip the displaying of the stage 2 due to the negligible
computational overhead of only several milliseconds.

####  7.2.2. Communication Overhead

Figure 4(b) shows the average total volume of the transmission data in stages
1 and 2. It is evident that the total transmission amount scale linearly with
the growing number of users in both stages. The data volume increases from
3.62 MB with 5 users to about 26.89 MB with 25 users in stage 1. In contrast,
the data volume in stage 2 starts from a merely 5 KB with 5 users to about 40
KB with 25 users. Thus, the total data volume in stage 1 dominates the entire
protocol.

###  7.3. Ethereum Smart Contract Gas Costs

We implemented the payment systems as a smart contract on real-world Ethereum
blockchain platform. The smart contract is specified by Solidity programming
language (Language, 2020). We outline some implementation components as
follows:

  1. (1)

Pedersen. This component aims to realize the underlying Pedersen commitment
scheme.

  2. (2)

ESToken. We created a Ethereum-based cryptocurrency ESToken for our energy
sharing scenario, whereby users are able to pay the energy cost without
revealing the true payments.

  3. (3)

MultiSignature. This component allows the users to submit a multi-transaction
request, where the transaction will proceed unless all the involved users
validate the transaction. There are three main methods: submitTransaction(),
confirmTransaction() and executeTransaction().

Distributed miners will execute the compiled bytecode of the smart contracts
in Ethereum Virtual Machine. Miners will charge additional Ether/ETH (Ethereum
native crytocurrency) called gas costs, because the extra computational tasks
incurred by smart contracts will be broadcast throughout the blockchain. Gas
costs are used to measure the amount of computational resources to execute the
operations required by a transaction. We measured the incurred gas costs by
our smart contracts and used a 255-bit prime number $q$ for Pedersen
commitment since Solidity supports at most 256-bit numbers. We employed
Truffle Suite (Suite, 2020) as the Ethereum development framework to test and
measure the average gas costs444The actual gas costs may vary based on the
random generated parameters of the zero-knowledge proofs. Here, we show the
average gas costs. of Multi-Signature methods, shown in Table 3, where $N$ is
the number of users and $N_{b}$ indicates the number of bits to represent the
plaintext payment in the ${\tt nzkpMbs}$. A transaction initiator must pay
sufficient amount of gas costs to the miner, who creates transaction blocks on
the network. The gasPrice in a transaction allows the transaction initiator to
set the gas price that she is willing to pay. The higher the gas prices, the
higher probability the transaction will be chosen by the miner in a block. We
use the standard gas price 54 Gwei and Ether price555The Ether price quote was
obtained on 25 Oct 2021. $4068 USD/ETH to estimate the equivalent transaction
cost in Ether (see (Station, 2020) and (CoinDesk, 2021)).

Table 3. Table of gas costs for multi-signature methods | Gas Cost | Ether | USD (as on 25 Oct 21) | —Input— (bytes)
---|---|---|---|---
submit() | 106k | 0.0057 | $ 23.2 | 64 + 64 $\times N$
confirm() | 3600k | 0.1944 | $ 790.8 | 128 + 180 $\times N_{b}$

Figure 4(c) presents the gas cost of executeTransaction() function. We observe
that the gas cost is linearly proportional to the number of involved users,
starting from 1437k (0.0776 ether, $ 315.7) with 5 users to 5986k (0.3232
ether, $ 1314.8) with 25 users, since the verification of ${\tt nzkpSum}$
depends on the number of users. Overall, we observe only moderate incurred
costs by our smart contract, which are comparable to other privacy-preserving
smart contract studies in the literature.

##  8\. Extensions and Limitations

In this section, we discuss some possible extensions to enhance our privacy-
preserving energy storage sharing solution. We also discuss some limitations
of our current solution.

###  8.1. Flexible Demands and Hour-ahead Scheduling

Our current energy storage service scheduling is designed to operate in a day-
ahead manner. There is a limitation that users are not supposed to alter their
requested demand (at least, for the part of demand that is allocated to be
satisfied by scheduled energy storage discharging). A more flexible approach
is desirable to incorporate both day-ahead and hour-ahead scheduling
processes, which is called dual service scheduling. The hour-ahead scheduling
process allows the users to request energy storage service in a much shorter
time-window.

The dual service scheduling can be achieved by dividing the capacity of energy
storage into two parts: (1) ${\tt B}_{\tt d}(t)$ as the capacity for day-ahead
service scheduling and (2) ${\tt B}_{\tt h}(t)$ for hour-ahead service
scheduling, such that ${\tt B}_{\tt d}(t)+{\tt B}_{\tt h}(t)={\tt B}(t)$. Both
service scheduling processes can run separately, with hour-ahead scheduling
running before each hour. Our privacy-preserving service scheduling process
can be extended straightforwardly to operate the two parts of service
scheduling in tandem.

###  8.2. Virtual Net Metering Service Fees

In our current privacy-preserving service scheduling process, we assume that
the energy storage operator can transfer the credits as a result of exporting
energy through discharging energy storage via virtual net metering to the
users, with no additional service fees from the grid operator. Namely, the
energy storage operator can always transfer the full credits of
${x}^{-}(t)\cdot p(t)$ to compensate the users’ consumption at each timeslot
$t$.

However, the grid operator may charge additional fees to attain virtual net
metering, in particular, when the energy storage operator is not located in
the same local grid network as the users. For instance, the grid operator
charges fees as ${\tt s}_{\tt vnm}$ percent of the credits transferred in
virtual net metering. Namely, when the energy storage operator transfers the
credits of ${x}^{-}(t)\cdot p(t)$ to the users, the users actually receives
$(1-{\tt s}_{\tt vnm})\cdot{x}^{-}(t)\cdot p(t)$.

One possible approach to incorporate in our privacy-preserving service
scheduling process is to modify Cons. (2) as

(22) $b(t+1)-b(t)={\tt e}_{\tt c}{x}^{+}(t)-{\tt e}_{\tt d}\tfrac{1}{(1-{\tt
s}_{\tt vnm})}\Big{(}\sum_{i=1}^{N}{x}^{-}_{i}(t)\Big{)}$

That is, we reduce the actual amount of discharged energy from the energy
storage as to incorporate the additional service fees for virtual net metering
from the grid operator.

###  8.3. Reducing Gas Cost on Ethereum

Although our current solution incurs a moderate gas cost on Ethereum, this is
still considerable when the Ether price has increased significantly in the
recent years. High Ether price has deterred many real-world smart contract
projects from operation. We seek to improve the gas cost of our smart contract
solution. There are a number of possible improvements. First, rather than
storing the receipts on the ledger, which can take up a considerable storage
space and costs extra gas cost, we can store a small hash pointer instead on
the ledger. The users can verify the contents of the receipts by matching with
the hash pointer. Second, there should be more efficient zero-knowledge proofs
that can be executed on smart contract. One possible option is Bulletproofs
(Bunz et al., 2018), which are more succinct zero-knowledge proofs than
$\Sigma$-protocol. Bulletproofs have been employed in certain privacy-
preserving blockchain platforms (e.g. Monero, Zether (Monero, 2021; Bunz et
al., 2020)). Third, even though we implemented our solution as a smart
contract on permissionless Ethereum blockchain platform, our solution can also
be implemented on a permissioned blockchain platform, on which the gas cost is
not a major concern.

##  9\. Conclusion

In this paper, we provide a novel approach to support third-party energy
storage sharing without compromising the privacy of individual users. In our
privacy-preserving solution, an energy storage operator is only revealed the
minimal information to schedule energy storage operations, without knowing
users’ private demands. At the same time, the users can divide the cost of
energy storage service fairly among themselves without knowing each other’s
demands. Our solution can effectively safeguard against a majority of
dishonest users, without requiring trusted third-parties. We implemented our
solution as a smart contract on Ethereum blockchain platform, which incurs
moderate overhead and gas costs in practice.

In future work, we will support robustness against potentially dishonest
energy storage operators. For instance, we can require an energy storage
operator to prove that her energy export profile matches the service schedules
in order to receive the payments from users. We will also explore the support
for peer-to-peer energy storage sharing by distributing service scheduling and
cost-sharing computation among the end users themselves.

## References

  * (1)
  * Andoni et al. (2019) Merlinda Andoni, Valentin Robu, David Flynn, Simone Abram, Dale Geach, David P. Jenkins, Peter McCallum, and Andrew Peacock. 2019\.  Blockchain technology in the energy sector: A systematic review of challenges and opportunities.  _Renewable and Sustainable Energy Reviews_ 100 (2019), 143–174.
  * Barker et al. (2012) Sean Barker, Aditya Mishra, David Irwin, Emmanuel Cecchet, Prashant Shenoy, and Jeannie Albrecht. 2012\.  Smart*: An Open Data Set and Tools for Enabling Research in Sustainable Homes. In _SustKDD_.
  * Ben-Or et al. (1988) Michael Ben-Or, Shafi Goldwasser, and Avi Wigderson. 1988\.  Completeness Theorems for Non-Cryptographic Fault-Tolerant Distributed Computation. In _Annual ACM Symposium on Theory of Computing (STOC)_.
  * Ben-Sasson et al. (2014) Eli Ben-Sasson, Alessandro Chiesa, Christina Garman, Matthew Green, Ian Miers, and Eran Tromerand Madars Virza. 2014.  Zerocash: Decentralized Anonymous Payments from Bitcoin. In _IEEE Symposium on Security and Privacy_.
  * Buchanan (2017) William J. Buchanan. 2017\.  _Cryptography_.  River Publishers.
  * Bunz et al. (2020) Benedikt Bunz, Shashank Agrawal, Mahdi Zamani, and Dan Boneh. 2020\.  Zether: Towards Privacy in a Smart Contract World. In _Financial Cryptography and Data Security (FC)_.
  * Bunz et al. (2018) B. Bunz, J. Bootle, D. Boneh, A. Poelstra, P. Wuille, and G. Maxwell. 2018\.  Bulletproofs: Short proofs for confidential transactions and more. In _IEEE symposium on security and privacy (SP)_.
  * Chau and Elbassioni (2018) Chi-Kin Chau and Khaled Elbassioni. 2018.  Quantifying Inefficiency of Fair Cost-Sharing Mechanisms for Sharing Economy.  _IEEE Trans. Control of Network System_ 5 (Dec 2018), 1809–1818.  Issue 4.
  * Chau et al. (2019) Sid Chi-Kin Chau, Jiajia Xu, Wilson Bow, and Khaled Elbassioni. 2019.  Peer-to-Peer Energy Sharing: Effective Cost-Sharing Mechanisms and Social Efficiency. In _ACM Intl. Conf. on Future Energy Systems (e-Energy)_.
  * Chen et al. (2018) Valerie Chen, Valerio Pastro, and Mariana Raykova. 2018\.  Secure Computation for Machine Learning With SPDZ. In _Annual Conference on Neural Information Processing Systems (NeurIPS)_.
  * CoinDesk (2021) CoinDesk. 2021.  https://www.coindesk.com/price/ethereum. (2021).
  * Cramer et al. (2001) Ronald Cramer, Ivan Damgård, and Jesper B Nielsen. 2001\.  Multiparty computation from threshold homomorphic encryption. In _Intl. conference on the theory and applications of cryptographic techniques_.
  * Cramer et al. (2015) Ronald Cramer, Ivan Bjerre Damgård, and Jesper Buus Nielsen. 2015\.  _Secure Multiparty Computation and Secret Sharing_.  Cambridge University Press.  Cambridge Books Online.
  * Damgård et al. (2013) Ivan Damgård, Marcel Keller, Enrique Larraia, Valerio Pastro, Peter Scholl, and Nigel P. Smart. 2013\.  Practical Covertly Secure MPC for Dishonest Majority - or: Breaking the SPDZ Limits. In _European Symposium on Research in Computer Security (ESORICS)_.
  * Du and Atallah (2001) Wenliang Du and Mikhail J Atallah. 2001.  Secure multi-party computation problems and their applications: a review and open problems. In _the Workshop on New Security Paradigms_.
  * Dwork et al. (2006) Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. 2006.  Calibrating noise to sensitivity in private data analysis. In _Theory of cryptography conference_. Springer.
  * Edalat et al. (2014) Neda Edalat, Mehul Motani, Jean Walrand, and Longbo Huang. 2014.  Control of systems that store renewable energy. In _ACM Intl. Conf. on Future Energy Systems (e-Energy)_.
  * Gas and Company (2018) Pacific Gas and Electric Company. 2018.  Understanding the Virtual Net Energy Metering Program A guide for statements and bills.  (2018).
  * Gelman and Bird (2014) J. Heeter R. Gelman and L. Bird. 2014.  _Status of Net Metering: Assessing the Potential to Reach Program Caps_.  Technical Report.
  * Goldreich (1998) Oded Goldreich. 1998\.  Secure multi-party computation.  _Manuscript. Preliminary version_ 78 (1998).
  * Gorenflo et al. (2019) Christian Gorenflo, Lukasz Golab, and Srinivasan Keshav. 2019\.  Using a Blockchain to Mitigate Trust in Electric Vehicle Charging. In _ACM Intl. Conf. on Future Energy Systems (e-Energy)_.
  * Hajiesmaili et al. (2017) Mohammad H. Hajiesmaili, Minghua Chen, Enrique Mallada, and Chi-Kin Chau. 2017.  Crowd-Sourced Storage-Assisted Demand Response in Microgrids. In _ACM Intl. Conf. on Future Energy Systems (e-Energy)_.
  * Hazay and Lindell (2010) Carmit Hazay and Yehuda Lindell. 2010.  _Efficient Secure Two-Party Protocols - Techniques and Constructions_.  Springer.
  * Huang et al. (2016) Zhichuan Huang, Ting Zhu, Yu Gu, and Yanhua Li. 2016\.  Shepherd: sharing energy for privacy preserving in hybrid AC-DC microgrids. In _ACM Intl. Conf. on Future Energy Systems (e-Energy)_.
  * Knirsch et al. (2020) Fabian Knirsch, Clemens Brunner, Andreas Unterweger, and Dominik Engel. 2020.  Decentralized and permission-less green energy certificates with GECKO.  _Energy Informatics_ 3, 2 (2020).
  * Laforet et al. (2016) Fabian Laforet, Erik Buchmann, and Klemens Bohm. 2016\.  Towards provable privacy guarantees using rechargeable energy-storage devices. In _ACM Intl. Conf. on Future Energy Systems (e-Energy)_.
  * Language (2020) Solidity Programming Language. 2020\.  https://docs.soliditylang.org. (2020).
  * Lee et al. (2018) Stephen Lee, Prashant Shenoy, Krithi Ramamritham, and David Irwin. 2018.  vSolar: Virtualizing Community Solar and Storage for Energy Sharing. In _ACM Intl. Conf. on Future Energy Systems (e-Energy)_.
  * Liu et al. (2017) Jingkun Liu, Ning Zhang, Chongqing Kang, Daniel Kirschen, and Qing Xia. 2017.  Cloud energy storage for residential and small commercial consumers: A business case study.  _Applied Energy_ 188 (2017), 226–236.
  * Lyu et al. (2020) Lingjuan Lyu, Sid Chi-Kin Chau, Nan Wang, and Yifeng Zheng. 2020\.  Cloud-based Privacy-Preserving Collaborative Consumption for Sharing Economy.  _IEEE Trans. Cloud Computing_ (2020).
  * Mengelkamp et al. (2018) Esther Mengelkamp, Johannes Garttner, Kerstin Rock, Scott Kessler, Lawrence Orsini, and Christof Weinhardt. 2018.  Designing microgrid energy markets: A case study: The Brooklyn Microgrid.  _Applied Energy_ 210 (2018), 870–880.
  * Mishra et al. (2012) Aditya Mishra, David Irwin, Prashant Shenoy, Jim Kurose, and Ting Zhu. 2012.  SmartCharge: cutting the electricity bill in smart homes with energy storage. In _ACM Intl. Conf. on Future Energy Systems (e-Energy)_.
  * Monero (2021) Monero. 2021.  http://getmonero.org. (2021).
  * Paper (2014) The Ethereum Yellow Paper. 2014\.  https://ethereum.github.io/yellowpaper/paper.pdf. (2014).
  * Quantiki (2020) Quantiki. 2020.  https://quantiki.org/wiki/coin-tossing. (2020).
  * Shaw-Williams and Susilawati (2020) Damian Shaw-Williams and Connie Susilawati. 2020.  A techno-economic evaluation of Virtual Net Metering for the Australian community housing sector.  _Applied Energy_ 261 (2020).
  * Shi et al. (2011) Elaine Shi, HTH Chan, Eleanor Rieffel, Richard Chow, and Dawn Song. 2011.  Privacy-preserving aggregation of time-series data. In _Annual Network & Distributed System Security Symposium (NDSS)_.
  * Station (2020) ETH Gas Station. 2020\.  https://ethgasstation.info. (2020).
  * Suite (2020) Truffle Suite. 2020\.  https://www.trufflesuite.com. (2020).
  * Wang et al. (2021) Nan Wang, Sid Chi-Kin Chau, and Yue Zhou. 2021.  Privacy-Preserving Energy Storage Sharing with Blockchain. In _Proc. of ACM e-Energy_.

## Appendix

##  Appendix A Proofs

######  Theorem 1.

If $\big{(}{x}^{-}(t),{y}(t)\big{)}_{t=1}^{T}$ is an optimal solution of
${\tt(P2)}$, then
$\big{(}({x}^{-}_{i}(t),{y}_{i}(t))_{i=1}^{N}\big{)}_{t=1}^{T}$, where
${x}^{-}_{i}(t)=\frac{a_{i}(t)}{a(t)}\cdot{x}^{-}(t)$ and
${y}_{i}(t)=\frac{a_{i}(t)}{a(t)}\cdot{y}(t)$, is an optimal solution of
${\tt(P1)}$.

###### Proof.

Since $\big{(}{x}^{-}(t),{y}(t)\big{)}_{t=1}^{T}$ is an optimal solution of
${\tt(P2)}$, it satisfies the condition ${x}^{-}(t)+{y}(t)=a(t)$.

We let ${x}^{-}_{i}(t)=\frac{a_{i}(t)}{a(t)}\cdot{x}^{-}(t)$ and
${y}_{i}(t)=\frac{a_{i}(t)}{a(t)}\cdot{y}(t)$, then
$\big{(}{x}^{-}_{i}(t),{y}_{i}(t)\big{)}_{t=1}^{T}$ satisfies
${x}^{-}_{i}(t)+{y}_{i}(t)=a_{i}(t)$ for all $i\in\\{1,...,N\\}$ and
$t\in\\{1,...,T\\}$, and hence, is a feasible solution of ${\tt(P1)}$.

Next, we argue that
$\big{(}({x}^{-}_{i}(t),{y}_{i}(t))_{i=1}^{N}\big{)}_{t=1}^{T}$ is an optimal
solution of ${\tt(P1)}$ by contradiction. Suppose that there exists a better
solution
$\big{(}({x^{\prime}}^{-}_{i}(t),{y^{\prime}}_{i}(t))_{i=1}^{N}\big{)}_{t=1}^{T}$
with a lower total cost in ${\tt(P2)}$. Then
$\big{(}{x}^{-}(t),{y}(t)\big{)}_{t=1}^{T}$ is not an optimal solution,
because we can find another better solution by considering
$\big{(}\sum_{i=1}^{N}{x^{\prime}}^{-}_{i}(t),\sum_{i=1}^{N}{y^{\prime}}_{i}(t)\big{)}_{t=1}^{T}$
instead, which is also a feasible solution of ${\tt(P2)}$. This will violate
the optimality of $\big{(}{x}^{-}(t),{y}(t)\big{)}$. ∎

######  Theorem 2.

If $\big{(}{x}^{+}(t),{x}^{-}(t)\big{)}_{t=1}^{T}$ is an optimal solution of
${\tt(P2)}$ and let ${x}^{-}_{i}(t)=\frac{a_{i}(t)}{a(t)}\cdot{x}^{-}(t)$ and
${y}_{i}(t)=\frac{a_{i}(t)}{a(t)}\cdot{y}(t)$, then proportional and
egalitarian cost-sharing schemes are individually rational.

Let $\hat{\tt p}(t)\triangleq\frac{{x}^{-}(t)\cdot p(t)}{a(t)}$ and ${\tt
Cost}_{\tt org}\triangleq\sum_{t=1}^{T}{x}^{-}(t)\cdot p(t)$. The proportional
and egalitarian cost-sharing payments are given as follows:

(23) $\begin{cases}P_{i}^{\tt pp}=\frac{{\tt Cost}_{\tt ess}}{{\tt Cost}_{\tt
org}}\cdot\sum_{t=1}^{T}a_{i}(t)\cdot\hat{\tt p}(t),\\\ P_{i}^{\tt
ega}=\sum_{t=1}^{T}a_{i}(t)\cdot\hat{\tt p}(t)-\frac{{\tt Cost}_{\tt org}-{\tt
Cost}_{\tt ess}}{N}\end{cases}$

###### Proof.

For proportional cost sharing, $U_{i}$’s saving will be

(24) $\displaystyle\Delta_{i}^{\tt pp}=$
$\displaystyle\sum_{t=1}^{T}{x}^{-}_{i}(t)\cdot
p(t)-\sum_{t=1}^{T}\big{(}p(t)+{\tt p}_{\tt
s}\big{)}\cdot{x}^{+}(t)\cdot\frac{\sum_{t=1}^{T}{x}^{-}_{i}(t)\cdot
p(t)}{\sum_{t=1}^{T}{x}^{-}(t)\cdot p(t)}$ (25) $\displaystyle=$
$\displaystyle\Big{(}\sum_{t=1}^{T}{x}^{-}(t)\cdot
p(t)-\sum_{t=1}^{T}\big{(}p(t)+{\tt p}_{\tt
s}\big{)}\cdot{x}^{+}(t)\Big{)}\cdot\frac{\sum_{t=1}^{T}{x}^{-}_{i}(t)\cdot
p(t)}{\sum_{t=1}^{T}{x}^{-}(t)\cdot p(t)}$

Next, we show $\sum_{t=1}^{T}{x}^{-}(t)\cdot
p(t)\geq\sum_{t=1}^{T}\big{(}p(t)+{\tt p}_{\tt s}\big{)}\cdot{x}^{+}(t)$ by
contradiction. Suppose $\sum_{t=1}^{T}{x}^{-}(t)\cdot
p(t)<\sum_{t=1}^{T}\big{(}p(t)+{\tt p}_{\tt s}\big{)}\cdot{x}^{+}(t)$, then
$\big{(}{x}^{+}(t),{x}^{-}(t)\big{)}_{t=1}^{T}$ is not an optimal solution of
${\tt(P2)}$ because one can always find a better solution by not charging
energy storage according to ${x}^{+}(t)$. Instead, drawing energy at the time
it is needed will only cost $\sum_{t=1}^{T}{x}^{-}(t)\cdot p(t)$, which is
cheaper than the cost of charging and subsequently discharging from energy
storage ($\sum_{t=1}^{T}\big{(}p(t)+{\tt p}_{\tt s}\big{)}\cdot{x}^{+}(t)$).
Hence, we conclude that $\sum_{t=1}^{T}{x}^{-}(t)\cdot
p(t)\geq\sum_{t=1}^{T}\big{(}p(t)+{\tt p}_{\tt s}\big{)}\cdot{x}^{+}(t)$ and
$\Delta_{i}^{\tt pp}\geq 0$.

For egalitarian cost sharing, $U_{i}$’s saving will be

(26) $\Delta_{i}^{\tt ega}=\frac{\sum_{t=1}^{T}{x}^{-}(t)\cdot
p(t)-\sum_{t=1}^{T}\big{(}p(t)+{\tt p}_{\tt s}\big{)}\cdot{x}^{+}(t)}{N}$

Following a similar approach by contradiction, we can similarly show that
$\Delta_{i}^{\tt ega}\geq 0$. ∎

######  Theorem 3.

Consider a multi-transaction ${\tt mtx}=({\tt ad}_{i},{\tt ad}_{\tt ess},$
${\tt val}_{i})_{i=1}^{N}$, where ${\tt val}_{i}$ may be negative. Namely,
every ${\tt ad}_{i}$ pays to the energy storage operator ${\tt ad}_{\tt ess}$.
If $\sum_{i=1}^{N}{\tt val}_{i}>0$, ${\tt mtx}$ can be handled on a blockchain
by the following transaction operations:

(27) $\displaystyle{\tt Bal}({\tt ad}_{i})\leftarrow$ $\displaystyle{\tt
Bal}({\tt ad}_{i})-{\tt val}_{i},\mbox{for all\ }i$ (28) $\displaystyle{\tt
Bal}({\tt ad}_{\tt ess})\leftarrow$ $\displaystyle{\tt Bal}({\tt ad}_{\tt
ess})+\sum_{i=1}^{N}{\tt val}_{i}$

###### Proof.

It is straightforward to see that Eqn. (27) applies to the case when ${\tt
val}_{i}$ is negative. As long as $\sum_{i=1}^{N}{\tt val}_{i}>0$, there is no
net out-going payment from ${\tt ad}_{\tt ess}$. Therefore, ${\tt mtx}$ can be
handled properly. ∎

##  Appendix B Zero-knowledge Proofs of Knowledge

###  B.1. Zero-knowledge Proof of Commitment (zkpCm)

Given ${\tt Cm}(x,{\tt r})$, a prover wants to convince a verifier of the
knowledge of $(x,{\tt r})$. We can apply $\Sigma$-protocol as follows:

  1. (1)

The prover randomly generates $(x^{\prime},{\tt
r}^{\prime})\in{\mathbb{Z}}^{2}_{p}$ and sends the commitment ${\tt
Cm}(x^{\prime},{\tt r}^{\prime})$ to the verifier.

  2. (2)

The verifier sends a random challenge $\beta\in{\mathbb{Z}}_{p}$ to the
prover.

  3. (3)

The prover replies with $z_{x}=x^{\prime}+\beta\cdot x$ and $z_{\tt r}={\tt
r}^{\prime}+\beta\cdot{\tt r}$.

  4. (4)

The verifier checks whether $g^{z_{x}}\cdot h^{z_{\tt r}}\overset{?}{=}{\tt
Cm}(x^{\prime},{\tt r}^{\prime})\cdot{\tt Cm}(x,{\tt r})^{\beta}$.

Denote a zero-knowledge proof of commitment for ${\tt Cm}(x,{\tt r})$ by ${\tt
zkpCm}[x]$.

###  B.2. Zero-knowledge Proof of Summation

Given commitments $\big{(}{\tt Cm}(x_{1},{\tt r}_{1}),...,{\tt Cm}(x_{n},{\tt
r}_{n})\big{)}$ and $y$, a prover wants to convince a verifier of the
knowledge of $y=\sum_{i=1}^{n}x_{i}$ without revealing $(x_{1},...,x_{n})$. We
can apply $\Sigma$-protocol as follows:

  1. (1)

The prover randomly generates ${\tt r}^{\prime}\in{\mathbb{Z}}_{p}$ and sends
the commitment ${\tt Cm}(0,{\tt r}^{\prime})$ to the verifier.

  2. (2)

The verifier sends a random challenge $\beta\in{\mathbb{Z}}_{p}$ to the
prover.

  3. (3)

The prover replies with $z_{\tt r}={\tt
r}^{\prime}+\beta\cdot\sum_{i=1}^{n}{\tt r}_{i}$.

  4. (4)

The verifier checks whether $g^{\beta y}\cdot h^{z_{\tt r}}\overset{?}{=}{\tt
Cm}(0,{\tt r}^{\prime})\cdot\prod_{i=1}^{n}{\tt Cm}(x_{i},{\tt
r}_{i})^{\beta}$

Denote a zero-knowledge proof of summation for $\big{(}{\tt Cm}(x_{i},{\tt
r}_{i})\big{)}_{i=1}^{n}$ by ${\tt zkpSum}[y,(x_{i})_{i=1}^{n}]$.

###  B.3. Zero-knowledge Proof of Membership

Given a set ${\mathcal{X}}=\\{x_{1},...,x_{n}\\}$ and ${\tt Cm}(x,{\tt r})$, a
prover wants to convince a verifier of the knowledge of $x\in{\mathcal{X}}$
without revealing $x$. We can apply $\Sigma$-protocol as follows:

  1. (1)

Suppose $x=x_{i}\in{\mathcal{X}}$. The prover first randomly generates
$(x^{\prime}_{j},{\tt r}^{\prime}_{j})\in{\mathbb{Z}}_{p}$ and computes the
commitment ${\tt Cm}(x^{\prime}_{j},{\tt r}^{\prime}_{j})$ for all
$j\in\\{1,...,n\\}$. Then, the prover randomly generates
$\beta_{j}\in{\mathbb{Z}}_{p}$ for each $j\in\\{1,...,n\\}\backslash\\{i\\}$,
and computes

$z_{x_{j}}=\begin{cases}x^{\prime}_{j}+(x_{i}-x_{j})\beta_{j},&\mbox{if\
}j\in\\{1,...,n\\}\backslash\\{i\\}\\\ x^{\prime}_{i},&\mbox{if\ }j=i\\\
\end{cases}$

Next, the prover sends $({\tt Cm}(x^{\prime}_{j},{\tt
r}^{\prime}_{j}),z_{x_{j}})_{j=1}^{n}$ to the verifier.

  2. (2)

The verifier sends a random challenge $\beta\in{\mathbb{Z}}_{p}$ to the
prover.

  3. (3)

The prover sets $\beta_{i}=\beta-\sum_{j\neq i}\beta_{j}$, then computes
$z_{{\tt r}_{j}}={\tt r}^{\prime}_{j}+{\tt r}\cdot\beta_{j}$ for all
$j\in\\{1,...,n\\}$, and sends $(\beta_{j},z_{{\tt r}_{j}})_{j=1}^{n}$ to the
verifier.

  4. (4)

The verifier checks whether $\beta\overset{?}{=}\sum_{i=1}^{n}\beta_{j}$ and

$g^{z_{x_{j}}}\cdot h^{z_{{\tt r}_{j}}}\overset{?}{=}{\tt
Cm}(x^{\prime}_{j},{\tt r}^{\prime}_{j})\cdot\Big{(}\frac{{\tt Cm}(x,{\tt
r})}{g^{x_{j}}}\Big{)}^{\beta_{j}}\mbox{for all\ }j\in\\{1,...,n\\}$

Denote a zero-knowledge proof of membership for $x\in{\mathcal{X}}$ by ${\tt
zkpMbs}[x,{\mathcal{X}}]$.

###  B.4. Zero-knowledge Proof of Non-Negativity

Given ${\tt Cm}(x,{\tt r})$, a prover wants to convince a verifier of the
knowledge of $x\geq 0$ without revealing $x$. Suppose $x<2^{m}$. We aim to
prove there exist $(b_{1},...,b_{m})$ such that $b_{i}\in\\{0,1\\}$ for
$i\in\\{0,...,m\\}$ and $\sum_{i=1}^{m}b_{i}\cdot 2^{i-1}=x$. We can apply
$\Sigma$-protocol as follows:

  1. (1)

The prover sends $({\tt Cm}(b_{i},{\tt r}_{i}))_{i=1}^{m}$ to the verifier,
and provides ${\tt zkpMbs}[b_{i},\\{0,1\\}]$ for each $b_{i}$ to prove that
$b_{i}\in\\{0,1\\}$. Also, the prover randomly generates ${\tt
r}^{\prime}\in{\mathbb{Z}}_{p}$ and sends the commitment ${\tt Cm}(0,{\tt
r}^{\prime})$ to the verifier.

  2. (2)

The verifier sends a random challenge $\beta\in{\mathbb{Z}}_{p}$ to the
prover.

  3. (3)

The prover replies with $z_{\tt r}={\tt
r}^{\prime}+\beta\cdot(\sum_{i=1}^{m}{\tt r}_{i}\cdot 2^{i-1}-{\tt r})$.

  4. (4)

The verifier checks whether $h^{z_{\tt r}}\overset{?}{=}{\tt Cm}(0,{\tt
r}^{\prime})\cdot{\tt Cm}(x,{\tt r})^{-\beta}\cdot\prod_{i=1}^{m}{\tt
Cm}(b_{i},{\tt r}_{i})^{\beta\cdot 2^{i-1}}$.

Denote a zero-knowledge proof of $x\geq 0$ by ${\tt zkpNN}[x]$.

###  B.5. Security Proof

It is straightforward to prove the completeness of these protocols. We will
provide detailed proofs on their soundness and honest-verifier zero-knowledge
properties below.

####  B.5.1. Soundness Proof

Proving soundness is equivalent to showing that there exists a knowledge
extractor who makes the prover successfully answer two random given challenges
$\beta_{1}$ and $\beta_{2}$:

  * •

(zkpCm) For $x$, we have $(z_{x}^{\prime}=x^{\prime}+\beta_{1}\cdot x$,
$z_{x}^{\prime\prime}=x^{\prime}+\beta_{2}\cdot x)$. For $r$, we have
$(z_{r}^{\prime}=r^{\prime}+\beta_{1}\cdot r$,
$z_{r}^{\prime\prime}=r^{\prime}+\beta_{2}\cdot r)$. Then we obtain
$x=\dfrac{z_{x}^{\prime}-z_{x}^{\prime\prime}}{\beta_{1}-\beta_{2}}$ and
$r=\dfrac{z_{r}^{\prime}-z_{r}^{\prime\prime}}{\beta_{1}-\beta_{2}}$. Finally,
we can check that $g^{x}h^{r}={\tt Cm}(x,r)$.

  * •

(zkpSum) Let $z_{1}=r^{\prime}+\beta_{1}\cdot\sum_{i=1}^{N}r_{i}$ and
$z_{2}=r^{\prime}+\beta_{2}\cdot\sum_{i=1}^{N}r_{i}$. Then we have
$\sum_{i=1}^{N}r_{i}=\dfrac{z_{1}-z_{2}}{\beta_{1}-\beta_{2}}$. Finally, we
can check that $g^{y}h^{\sum_{i=1}^{N}r_{i}}=\prod_{i=1}^{n}{\tt
Cm}(x_{i},{\tt r}_{i})$ to prove that $y=\sum_{i=1}^{N}x_{i}$.

  * •

(zkpMbs) Let $z^{\prime}_{r_{j}}=r^{\prime}_{j}+\beta_{1}\cdot r$ and
$z^{\prime\prime}_{r_{j}}=r^{\prime}+\beta_{2}\cdot r$. Then we have
$r=\dfrac{z^{\prime}_{r_{j}}-z^{\prime\prime}_{r_{j}}}{\beta_{1}-\beta_{2}}$.
Finally, we can check for each $j$ that $g^{z_{x_{j}}}h^{r}=\dfrac{{\tt
Cm}(x,{\tt r})}{g^{x_{j}}}$ to prove that $x\in{\mathcal{X}}$.

  * •

(zkpNN) Let $z^{\prime}_{r}=r^{\prime}+\beta_{1}\cdot(\sum_{i=1}^{m}{\tt
r}_{i}\cdot 2^{i-1}-{\tt r})$ and
$z^{\prime\prime}_{r}=r^{\prime}+\beta_{2}\cdot(\sum_{i=1}^{m}{\tt r}_{i}\cdot
2^{i-1}-{\tt r})$. Then we have $(\sum_{i=1}^{m}{\tt r}_{i}\cdot 2^{i-1}-{\tt
r})=\dfrac{z^{\prime}_{r_{j}}-z^{\prime\prime}_{r_{j}}}{\beta_{1}-\beta_{2}}$.
Finally, we can check that $h^{\sum_{i=1}^{m}{\tt r}_{i}\cdot 2^{i-1}-{\tt
r}}=\prod_{i=1}^{m}{\tt Cm}(b_{i},{\tt r}_{i})^{2^{i-1}}\cdot{\tt Cm}(x,{\tt
r})^{-1}$ to prove that $x=\sum_{i=1}^{N}b_{i}\cdot 2^{i-1}\geq 0$.

####  B.5.2. Honest-verifier Zero-knowledge Proof

It suffices to show that there exists a simulator who can produce another set
of zero-knowledge proofs that are computationally indistinguishable from a
given set of zero-knowledge proofs:

  * •

(zkpCm) ${\tt Cm}(x^{\prime},r^{\prime})=g^{z_{x}}\cdot h^{z_{r}}\cdot{\tt
Cm}(x,r)^{-\beta}$.

  * •

(zkpSum) ${\tt Cm}(0,{\tt r}^{\prime})=g^{\beta y}\cdot h^{z_{\tt
r}}\cdot\prod_{i=1}^{N}{\tt Cm}(x_{i},{\tt r}_{i})^{-\beta}$.

  * •

(zkpMbs) ${\tt Cm}(x^{\prime}_{j},{\tt r}^{\prime}_{j})=g^{z_{x_{j}}}\cdot
h^{z_{{\tt r}_{j}}}\cdot\Big{(}\frac{{\tt Cm}(x,{\tt
r})}{g^{x_{j}}}\Big{)}^{-\beta_{j}}\mbox{for all\ }j\in\\{1,...,n\\}$.

  * •

(zkpNN) ${\tt Cm}(0,{\tt r}^{\prime})=h^{z_{\tt r}}\cdot{\tt Cm}(x,{\tt
r})^{\beta}\cdot\prod_{i=1}^{m}{\tt Cm}(b_{i},{\tt r}_{i})^{-\beta\cdot
2^{i-1}}$.

##  Appendix C SPDZ Protocol

In the following, we present a simplified version of SPDZ for the clarity of
exposition. The full version can be found in (Cramer et al., 2015; Damgård et
al., 2013).

There are three phases in SPDZ protocol: (1) pre-processing phase, (2) online
phase, and (3) output and validation phase. We write $\langle x\rangle$ as a
secretly shared number, meaning that there is a vector $(x_{1},...,x_{n})$,
such that each party $i$ knows only $x_{i}$. To reveal secretly shared number
$\langle x\rangle$, each party $i$ broadcasts $x_{i}$ to other parties. Then
each party can reconstruct $x=\sum_{i=1}^{n}x_{i}$. We write
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}x\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$
meaning that both $\langle x\rangle$ and the respective MAC
$\langle\gamma(x)\rangle$ are secretly shared.

###  C.1. Online Phase

In the online phase, the parties can jointly compute an arithmetic circuit,
consisting of additions and multiplications with secretly shared input
numbers.

####  C.1.1. Addition

Given secretly shared $\langle x\rangle$ and $\langle y\rangle$, and a public
known constant $c$, the following operations can be attained by local
computation at each party, and then the outcome can be assembled from the
individual shares:

  1. A1)

$\langle x\rangle+\langle y\rangle$ can be computed by
$(x_{1}+y_{1},...,x_{n}+y_{n})$.

  2. A2)

$c\cdot\langle x\rangle$ can be computed by $(c\cdot x_{1},...,c\cdot x_{n})$.

  3. A3)

$c+\langle x\rangle$ can be computed by $(c+x_{1},x_{2},...,x_{n})$.

####  C.1.2. Multiplication

Given secretly shared $\langle x\rangle$ and $\langle y\rangle$, computing the
product $\langle x\rangle\cdot\langle y\rangle$ involves a given
multiplication triple. A multiplication triple is defined by $(\langle
a\rangle,\langle b\rangle,\langle c\rangle)$, where $a,b$ are some unknown
random numbers and $c=a\cdot b$, are three secretly shared numbers already
distributed among the parties. The triple is assumed to be prepared in a pre-
processing phase. To compute $\langle x\rangle\cdot\langle y\rangle$, it
follows the below steps of operations (A4):

  1. A4.1)

Compute $\langle\epsilon\rangle=\langle x\rangle-\langle a\rangle$ (by A1).
Then, reveal $\langle\epsilon\rangle$, which does not reveal $x$.

  2. A4.2)

Compute $\langle\delta\rangle=\langle y\rangle-\langle b\rangle$. Then, reveal
$\langle\delta\rangle$.

  3. A4.3)

Finally, compute $\langle x\rangle\cdot\langle y\rangle=\langle
c\rangle+\epsilon\cdot\langle b\rangle+\delta\cdot\langle
a\rangle+\epsilon\cdot\delta$ (by A1-A3).

####  C.1.3. Message Authentication Code

To safeguard against dishonest parties, who may perform incorrect computation,
an information-theoretical message authentication code (MAC) can be used for
verification. We write a MAC key as a global number $\widetilde{\alpha}$,
which is unknown to the parties, and is secretly shared as
$\langle\widetilde{\alpha}\rangle$. Every secretly shared number is encoded by
a MAC as $\gamma(x)=\widetilde{\alpha}x$, which is secretly shared as
$\langle\gamma(x)\rangle$. For each $\langle x\rangle$, each party $i$ holds a
tuple $(x_{i},\gamma(x)_{i})$ and $\widetilde{\alpha}_{i}$, where
$x=\sum_{i=1}^{n}x_{i}$,
$\widetilde{\alpha}=\sum_{i=1}^{n}\widetilde{\alpha}_{i}$ and
$\gamma(x)=\widetilde{\alpha}x=\sum_{i=1}^{n}\gamma(x)_{i}$. If any party
tries to modify her share $x_{i}$ uncoordinatedly, then he also needs to
modify $\gamma(x)_{i}$ accordingly. Otherwise, $\gamma(x)$ will be
inconsistent. However, it is difficult to modify $\gamma(x)_{i}$ without
coordination among the parties, such that
$\widetilde{\alpha}x=\sum_{i=1}^{n}\gamma(x)_{i}$. Hence, it is possible to
detect incorrect computation (possibly by dishonest parties) by checking the
MAC.

To check the consistency of $x$, there is no need to reveal
$\langle\widetilde{\alpha}\rangle$. One only needs to reveal $\langle
x\rangle$, and then reveals $\widetilde{\alpha}_{i}-x\cdot\gamma(x)_{i}$ from
each party $i$. One can check whether
$\sum_{i=1}^{n}(\widetilde{\alpha}_{i}-x\cdot\gamma(x)_{i})\overset{?}{=}0$
for consistency. To prevent a dishonest party from modifying her share $x_{i}$
after learning other party’s $x_{j}$. Each party needs to commit her share
$x_{i}$ before revealing $x_{i}$ to others.

To maintain the consistency of MAC for operations A1-A4, the MAC needs to be
updated accordingly as follows:

  1. B1)

$\langle x\rangle+\langle y\rangle$: Update MAC by
$(\gamma(x)_{1}+\gamma(y)_{1},...,\gamma(x)_{n}+\gamma(y)_{n})$.

  2. B2)

$c\cdot\langle x\rangle$: Update MAC by
$(c\cdot\gamma(x)_{1},...,c\cdot\gamma(x)_{n})$.

  3. B3)

$c+\langle x\rangle$: Update MAC by
$(c\cdot\alpha_{1}+\gamma(x)_{1},...,c\cdot\alpha_{n}+\gamma(x)_{n})$.

  4. B4)

$\langle x\rangle\cdot\langle y\rangle$: Update MAC at each individual step of
A4.1-A4.3 accordingly by B1-B3.

The additions and multiplications of
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}x\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$
and
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}y\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$
follow A1-A4 and the MACs will be updated accordingly by B1-B4.

To verify the computation of a function, it only requires to check the MACs of
the revealed values and the final outcome, which can be checked all
efficiently together in a batch at the final stage by a technique of called
“random linear combination”.

###  C.2. Pre-processing Phase

In the pre-processing phase, all parties need to prepare a collection of
triplets $(\langle a\rangle,\langle b\rangle,\langle c\rangle)$ where
$c=a\cdot b$, each for a required multiplication operation. Assume that the
parties hold secretly shared numbers $a=\sum_{i=1}^{N}a_{i}$ and
$b=\sum_{i=1}^{N}b_{i}$ (which has been generated by local random generation).
Note that $a\cdot b=\sum_{i=1}^{N}a_{i}b_{i}+\sum_{i=1}^{N}\sum_{j=i"i\neq
j}^{N}a_{i}b_{j}$. $a_{i}b_{i}$ can be computed locally. To distribute
$a_{i}b_{j}$, one can use partial homomorphic cryptosystems, with encryption
function ${\tt Enc}[\cdot]$ and decryption function ${\tt Dec}[\cdot]$ using
party $i$’s public and private $(K_{i}^{\tt p},K_{i}^{\tt p})$. First, party
$i$ sends ${\tt Enc}_{K_{i}^{\tt p}}[a_{i}]$ to party $j$, who responds by
$C_{i}=b_{j}{\tt Enc}_{K_{i}^{\tt p}}[a_{i}]-{\tt Enc}_{K_{i}^{\tt
p}}[\tilde{c}_{j}]$, where $\tilde{c}_{j}$ is a random share generated by
party $j$ and is encrypted by party $i$’s public key $K_{i}^{\tt s}$. Then
party $i$ can obtain $\tilde{c}_{j}={\tt Dec}_{K_{i}^{\tt s}}[C_{j}]$. Hence,
$a_{i}b_{j}=\tilde{c}_{i}+\tilde{c}_{j}$, which are secret shares
$a_{i}b_{j}$. The above generation assumes honest parties. To prevent cheating
by dishonest parties, one would need to use proper zero-knowledge proofs
before secret sharing (Cramer et al., 2015; Damgård et al., 2013).

To generate a random mask
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}r^{i}\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$,
each party $j$ needs to generate a random share $r^{i}_{j}$ locally. Then the
parties follow the similar procedure of triplet generation to compute the
secretly shared product $\langle\gamma(r^{i})\rangle$, where
$\gamma(r^{i})=\widetilde{\alpha}r^{i}$.

###  C.3. Output and Validation Phase

We describe random linear combination for batch checking. To check the MACs of
a number of secretly shared numbers
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}x^{1}\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}},...,\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}x^{m}\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$
in a batch, first generate a set of random $({\tt r}^{1},...,{\tt r}^{m})$.
then reveal
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}x^{1}\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}},...,\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}x^{m}\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$.
Each party $i$ computes $\sum_{j=1}^{m}{\tt
r}^{j}(\widetilde{\alpha}_{i}-x^{j}\cdot\gamma(x^{j})_{i})$ and reveals it.
All parties check whether $\sum_{i=1}^{N}\sum_{j=1}^{m}{\tt
r}^{j}(\widetilde{\alpha}_{i}-x^{j}\cdot\gamma(x^{j})_{i})\overset{?}{=}0$ for
consistency in a batch checking.

###  C.4. Protocol

We summarize the SPDZ protocol as follows:

  1. (1)

Pre-processing Phase: In this phase, a collection of shared random numbers
will be constructed that can be used to mask the private input numbers. For
each private input number of party $i$, there is a shared random number
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}r^{i}\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$,
where $r^{i}$ is revealed to party $i$ only, but not to other parties. All
parties also prepare a collection of triplets
$(\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}a\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}},\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}b\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}},\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}c\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}})$
where $c=a\cdot b$, each for a required multiplication operation.

  2. (2)

Online Phase: To secretly shares a private input number $x^{i}$ using
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}r^{i}\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$,
without revealing $x^{i}$, it proceeds as follows:

    1. 1)

Party $i$ computes and reveals $z^{i}=x^{i}-r^{i}$ to all parties.

    2. 2)

Every party sets
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}x^{i}\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}\leftarrow
z^{i}+\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}r^{i}\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$.

To compute an arithmetic circuit, implement the required additions or
multiplications by A1-A4 and the MACs are updated accordingly by B1-B4.

  3. (3)

Output and Validation Phase: All MACs will be checked for all revealed numbers
and the final output value. It can check all in a batch using random linear
combination. If there is any inconsistency in the MACs, then abort.

Note that SPDZ cannot guarantee abort with fairness – dishonest parties may
learn some partial values, even when the protocol aborts. However, this is a
fundamental problem for any multi-party computation protocol with a majority
of dishonest users, where dishonest parties are not identifiable when the
computation is aborted.

##  Appendix D Security Analysis

We adopt the most common approach of security analysis in cryptography, based
on the Ideal/Real-Model Simulation paradigm to prove and formalize the
security achieved by our protocols. We next briefly describe the simulation
paradigm. The detailed explanation can be found in the tutorial
(Lindell2016HowTS).

In the ideal model, all the parties send their private inputs to a trusted
third party, who performs the prescribed computations and outputs the results
to each party. The security requirements are already satisfied in the ideal
model. The real model represents the realistic view of the privacy-preserving
protocol. The security is defined by comparing what an adversary can learn in
the real model to that in the ideal model. If what can be learned by an
adversary in the real world can be totally simulated in the ideal world, then
the adversary cannot learn more information in the real world than in the
ideal world, we can say that a protocol $\Pi$ is as secure as its
corresponding ideal functionality $\mathcal{F}$. We give a formal definition
of the security of our protocol as below:

######  Theorem 4.

Assuming the discrete logarithm problem underlying the Pedersen commitment
scheme is hard and the non-interactive zero-knowledge proofs are secure with
access to a random oracle, in the $\mathcal{F}_{\tt prep}$-hybrid model
(Damgård et al., 2013), the protocol $\Pi_{\tt pess}$ securely implements
${\mathcal{F}_{\tt pess}}$ with abort in the presence of an adaptive, active
adversary in a dishonest-majority setting, if for every probabilistic
polynomial-time (PPT) adversary ${\mathcal{A}}$ in the real model, there also
exists a PPT adversary ${\mathcal{S}}$ in the ideal model, such that for each
$i\in N$:

$\\{{\tt IDEAL}_{{\mathcal{F}_{\tt pess}},{\mathcal{S}}}^{{\mathcal{F}}_{\tt
prep}}\\}\overset{\rm comp}{\equiv}\\{{\tt REAL}_{\Pi_{\tt
pess},{\mathcal{A}}}^{{\mathcal{F}}_{\tt prep}}\\}\\}$

where ${\tt IDEAL}$ and ${\tt REAL}$ respectively refer to the views and
outputs of the corrupted and honest users in both ideal and real worlds.

We sketch the proof of the above theorem. Our aim is to demonstrate a
simulator in the ideal model that can create a computationally
indistinguishable view from that of the adversary in the real model. Even with
a different set of honest-users’ inputs, the adversary should still be unable
to tell computationally indistinguishable differences between the views. The
simulator ${\mathcal{S}}$ externally interacts with the ideal functionality
and internally runs a copy of the protocol $\Pi_{\tt
pess}\diamond\mathcal{F}_{\tt prep}$ feeding messages to the adversary
${\mathcal{A}}$. However, it is a not trivial task for a simulator to emulate
an adaptively malicious adversary, who is able to corrupt users at any time
during the protocol. The challenge lies in the difficulty that it must produce
a consistent view of the corrupted users throughout the protocol without
knowing their inputs. Firstly, we define an ideal functionality
${\mathcal{F}}_{\tt a(t)}^{(1)}$ in the stage 1 Pre-operation Scheduling
computing the total energy demands $a(t)$ before presenting the corresponding
simulator ${\mathcal{S}}_{\tt a(t)}^{(1)}$.

[border-break-style=none,border-color=#bbbbbb,background-
color=#eeeeee,breakable=true,,width=]

Functionality ${\mathcal{F}}_{\tt a(t)}^{(1)}$

Input: On input (input, $U_{i}$, $a_{i}(t)$), the functionality stores
$a_{i}(t)$.

Output: On input (output) from all honest users, the functionality computes
and outputs $a(t)=\sum_{i=1}^{N}a_{i}(t)$ to all the users.

Abort: On input (abort), the functionality outputs $\emptyset$.

Initialize: The simulator ${\mathcal{S}}$ first calls ${\mathcal{F}}_{\tt
prep}$ to generate a sufficient number of multiplication triples and random
numbers. Note that ${\mathcal{S}}$ has access to all the shares of the MAC
key, random numbers and multiplication triples as it knows the decryption keys
of public-key cryptosystem in the preprocessing phase. The adversary
${\mathcal{A}}$ firstly corrupts a set of users, denoted by ${\mathtt{C}}$.
Then the adversary may adaptively make corruptions on other users during the
protocol. Next, ${\mathcal{S}}$ produces $g,h=g^{k}\in{\mathbb{Z}}_{p}^{*}$,
where $k=\log_{g}h$ is the trapdoor to Pedersen commitment, with which
${\mathcal{S}}$ is able to find out two pairs $(m,r),(m^{\prime},r^{\prime})$,
such that ${\tt Cm}(m,r)={\tt Cm}(m^{\prime},r^{\prime})$.

[border-break-style=none,border-color=#bbbbbb,background-
color=#eeeeee,breakable=true,,width=]

Simulator ${\mathcal{S}}_{\tt a(t)}^{(1)}$

  1. (1)

For honest users $i\notin{\mathtt{C}}$, ${\mathcal{S}}$ will simply generates
dummy inputs $\hat{a}_{i}(t)=0,\hat{r}_{i}(t)\in Z_{p}$ and reveals a
commitment $\hat{C}_{i}(t)={\tt
Cm}\big{(}\hat{a}_{i}(t),\hat{r}_{i}(t)\big{)}$ with an ${\tt
nzkpNN}[a_{i}(t)]$. For the corrupted users $i\in{\mathtt{C}}$,
${\mathcal{S}}$ can extract their inputs with the knowledge of all the shares
of
$\mathopen{\hbox{\set@color${\langle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\langle}$}}r\mathclose{\hbox{\set@color${\rangle}$}\kern-1.94444pt\leavevmode\hbox{\set@color${\rangle}$}}$
and verifies the ${\tt nzkpNN}[a_{i}(t)]$.

Remarks: From the perspective of the adversary, the inputs of the honest users
are indistinguishable from those in the real world due to the information-
theoretically hiding properties of SPDZ secret-sharing (unless all the $N$
shares are collected, the inputs cannot be reconstructed), and of the Pedersen
commitment.

  2. (2)

${\mathcal{S}}$ firstly calls ${\mathcal{F}}_{\tt a(t)}^{(1)}$ to obtain the
output $a(t)$. As ${\mathcal{S}}$ already computed an output $\hat{a}(t)$
using dummy inputs of the honest users, it can respectively modify the share
and MAC of a random honest user by adding $a(t)-\hat{a}(t)$ and
$\alpha\big{(}a(t)-\hat{a}(t)\big{)}$ with the MAC key $\alpha$ initialized in
the preprocessing phase. Then ${\mathcal{S}}$ can perform the MAC check to
evaluate and open $a(t)$. If the check passes, ${\mathcal{S}}$ calls
${\mathcal{F}}_{\tt a(t)}^{(1)}$ to output $a(t)$ to all the users. Otherwise,
${\mathcal{S}}$ sends Abort to ${\mathcal{F}}_{\tt a(t)}^{(1)}$.

Remarks: No matter what inputs the adversary generates for the corrupted
users, ${\mathcal{S}}$ can always create a computationally indistinguishable
output distribution in the ideal model from that in the real model from the
view of the adversary ${\mathcal{A}}$. For the evaluation of $a(t)$, each
$i$-th share $\alpha_{i}a(t)-\gamma_{i}\big{(}a(t)\big{)}$ appears uniformly
random to the adversary, which has exactly the same distribution in both ideal
and real models.

After the simulator provided the simulated input
$\big{(}\hat{a}_{i}(t),\hat{r}_{i}(t),\hat{C}_{i}(t)\big{)}$ for
$i\notin{\mathtt{C}}$, the adversary can corrupt an honest user $U_{i}$ at any
time. As aforementioned, the simulator must reveal its entire internal states,
including the inputs, shares of inputs and random values that are consistent
with the commitment $\hat{C}_{i}(t)$ to simulate an adaptive adversary. It is
easy to obtain the input $a_{i}(t)$ from ${\mathcal{F}}_{\tt a(t)}^{(1)}$.
Regarding the random value, the simulator will take advantage of the trapdoor
$k$ of the Pedersen commitment to obtain
$r_{i}(t)=\hat{r}_{i}(t)+\big{(}\hat{a}_{i}(t)-a_{i}(t)\big{)}\cdot k^{-1}$,
such that $\hat{C}_{i}(t)={\tt Cm}\big{(}a_{i}(t),r_{i}(t)\big{)}={\tt
Cm}\big{(}\hat{a}_{i}(t),\hat{r}_{i}(t)\big{)}$. Moreover, $U_{i}$’s share of
her initial dummy input $\hat{a}_{i}(t)$ is $\hat{a}_{i}(t)+r_{i}-r$. Thus, it
is trivial for the simulator to reveal the share
$a_{i}(t)+\hat{a}_{i}(t)-r+r_{i}$ by adding $a_{i}(t)$. (See online phase in
Section C.4).

Next, we give a brief description of the SPDZ-based zero-knowledge proofs
${\tt zkpCm}[a_{i}(t)]$ in $\Pi_{\tt pess}^{(1)}$ and ${\tt nzkpSum}[{\tt
Cost}_{\tt ess},(P_{i})_{i=1}^{N}]$ in $\Pi_{\tt pess}^{(2)}$. For ${\tt
zkpCm}[a_{i}(t)]$, $z_{a_{i}(t)}$ and $z_{r_{i}(t)}$ are collectively computed
by all users and will be evaluated via MAC check to prove their correctness. A
similar simulator to ${\mathcal{S}}_{\tt a(t)}^{(1)}$ can be constructed to
emulate the ideal functionality computing $z_{a_{i}(t)}$ and $z_{r_{i}(t)}$.
The challenge $\beta(t)$ is uniformly random independent of the prover’s input
as it is obtained by summing the random values generated by all the users.
Thus, this zero-knowledge proof is secure given the proof of completeness,
soundness, zero-knowledge properties in Section B.5. The same security
argument applies to ${\tt nzkpSum}[{\tt Cost}_{\tt ess},(P_{i})_{i=1}^{N}]$.

We skip the details for the simulator ${\mathcal{S}}_{\tt Cost_{\tt
ess}}^{(2)}$ emulating ideal functionality computing the total payment ${\tt
Cost}_{\tt ess}=\sum_{i}^{N}P_{i}$ as it is similar to ${\mathcal{S}}_{\tt
a(t)}^{(1)}$ except using a different input $P_{i}$.

##  Appendix E Ethereum Blockchain Platform & Smart Contracts

In this section, we provide a brief description of Ethereum blockchain
platform and Solidity programming language as well as the details on the
implementations of the smart contracts in our protocols.

###  E.1. Background

Bitcoin was the first widely adopted digital currency on a permissionless
distributed ledger. Bitcoin relies on a tampering-resistant ledger based on
cryptographic signatures. Tampering-resistance ensures integrality when the
ledger is maintained by a network of peer-to-peer systems called “miners”. The
miners are incentivized by cryptocurrency rewards for updating and validating
the transaction records. Since the distributed ledger can be modified by
multiple systems simultaneously, it is crucial to ensure consistency by a
distributed consensus protocol among untrusted peer-to-peer systems, based on
proof-of-work (by solving computational puzzles) or proof-of-stake (by
demonstrating ownership of digital assets).

Subsequently, Ethereum was built on the Bitcoin ideas by expanding its
functions to support general computing as smart contracts along with
transactions. Bitcoin operates using a transaction-output-based system, called
unspent transaction outputs (UTXOs), whereas Ethereum operates using accounts
and balances in a manner called state transitions. Smart contracts, which are