## 4 Classification of PPDA Protocols
### Homogenous protocols
#### 4.2.2 Shuffling  
In this technique, every sensor node slices its data into the fixed \(J\) number of data pieces and sends a data piece to the selected \(J-1\) number of neighboring sensor nodes. The remaining one piece of data is kept with it. After that, every sensor node assembles the received data pieces including its own  
Figure 5: Hierarchical wireless sensor network.  
piece of data and sends the assembled data to a parent node. SMART and iPDA are two shuffling-based protocols.  
**SMART:** The Slice-Mix-AggRegaTe (SMART) by [PERSON] _et al._[17] achieves privacy-preserving data aggregation by hiding original data before the data transmissions. For this, each sensor node first customizes its private data by slicing it into a fixed number of pieces. Then, it sends data slices to a particular number of neighboring sensor nodes. After the data pieces are received from the neighboring sensor nodes, all sensor nodes calculate the aggregate value of the data slices so that the privacy of the sensor data can be preserved. In the SMART, each sensor node randomly selects a set of sensor nodes, say \(J\), within \(h\) hops. When each sensor node slices its private data randomly into \(J\) pieces, \(J-1\) pieces are encrypted and sent to the randomly selected sensor nodes, keeping one data piece at the same sensor node. All the sensor nodes decrypt the data by using their shared keys and sum all the received slices. Each sensor node sends the sum to its parent. Finally, the root of the network is the ultimate aggregation point of all sensor data. Figure 6 shows an example of the SMART with seven nodes where \(J=3\) and hop \(h=1\). The notation \(d_{ij}\) represents a slice of private data sent from node \(i\) to node \(j\) and \(r_{i}\) represents the sum of sliced data. Although the SMART preserves the privacy of sensor data during their aggregation with low computation overhead, it generates a large number of messages in the network. In addition, like the CPDA, the SMART can tolerate only the collusion to a certain threshold, _i.e._, the sum of out-degree and in-degree minus one.  
**iPDA:** To address both privacy-preservation and integrity-protection for WSNs, [PERSON] _et al._[32] proposed a data aggregation protocol called integrity-Protecting Private Data Aggregation (iPDA). The iPDA resorts to a redundancy check by constructing two disjoint aggregation trees to achieve integrity. Each sensor node needs to send its reading to both aggregation trees and the inputs to both trees are equal. The disjoint aggregation trees perform data aggregation individually. Therefore, data pollution attacks can be detected at the base station by comparing aggregation results along the disjoint aggregation trees. If the aggregation results agree with each other, then the base station will accept the result. Otherwise, it will treat the data to have pollution attacks or node failures, or both and reject it. The iPDA achieves data privacy by using the slicing and assembling technique of the SMART. In this  
Figure 6: Data slices in SMART.  
protocol, each participating sensor node first hides its individual data by slicing the data and sending encrypted data slices to different neighboring aggregators. Then, the aggregators collect and route aggregated results back to the base station. Figure 7 illustrates disjoint aggregation trees composed of sky-blue and grey nodes that are separately rooted at the base station (yellow node). However, the iPDA has a high communication overhead due to the slicing technique and each sensor node has to send its reading to both aggregation trees. In addition, it can tolerate the collusion of up to a certain threshold number of sensor nodes. Although the threshold can be raised by increasing the number of slices, it will further increase communication overhead. Moreover, the accuracy of the aggregated result is decreased because of the high data collision rate due to the large number of messages in the network.