## 1 Introduction
As every node does the \(x^{k}\) polynomial operation before the matrix multiplication operation, the scheme increases greatly the computation overhead. [PERSON] et al. [4] summarized the function requirements during smart metering against internal attackers: calculating billing and obtaining statistics for energy management. We follow the statistic function requirements and the spatial and temporal scenarios in References [8; 23] against malicious MDMS/aggregators or dishonest users:  
1. Spatial aggregation. A neighborhood-wide grid corresponds to a group of householders each equipped with a SG. They submit their encrypted meterings to the MDMS at a timestamp (e.g., 15 min). The latter aggregates homomorphically them before sending the aggregation to the EMS. During this aggregation, the individual data are confidential to the MDMS or the EMS. 2. Temporal aggregation. A single SM submits its power consumption in a series of timestamps to the MDMS for the billing purpose. In this scenario, SBS charges the householders in serial timestamps. Throughout this paper, we refer to the building area network (BAN) region as a neighborhood, and the regional MDMS as the regional gateway (GW), and the regional SBS as the control center (CC), respectively. The main contribution can be summarized as follows:  
1. We design and implement a distributive, temporal and spatial aggregation scheme in the SG, in which every node sends and receives \(k\) encrypted message from \(k\) pairwise nodes distributively. The scheme provides spatial aggregation in a neighborhood at a fine-grained time scale (e.g. 15 min) and an individual temporal aggregation (e.g. monthly) in a series of timestamps for the billing purpose. 2. The proposed encryption scheme minimizes the computation and communication overhead by replacing the costly public key cryptography adopted in most literatures with a combination of modular addition and PRF. 3. The novel feature is that the masking keys are imposed on the partitioned data, and the latter are implemented by traditional modular addition. As the process of modular addition is processed by the node itself, other nodes cannot gain the true partitioned data, the masking key is only known to the pairwise nodes, and the combination ensures the confidentiality of individual data to any node including CC, aggregators, and \(n\)-2 nodes at most in a neighborhood. 4. To detect malicious aggregators or dishonest users, we propose innovatively a publicly verifiable aggregation method. By this way, any user node in a neighborhood can receive the communication flow, and verify the accuracy of local aggregation from other nodes or total aggregation from the aggregator without compromising individual fine-grained data. 5. The publicly available property for the aggregation also facilities householders regulating in time its current consumption module and consumption demand in the next time period, as by comparing their own consumptions with those of other nodes and checking if there is redundant power, householders can decide to store more energy or to sell excess power to the power supplier or other nodes. The scenarios are especially very important for self-sufficient, remote places, particularly, in developing countries, which can only afford renewable energy, such as wind turbines, solar panels, and carbon-based fuels [23]. The paper is organized as follows: in Section 2, we provide related preliminaries and formalize the system and attack models. In Section 3, we introduce our proposed aggregation scheme and correctness analysis. Security notions and proof are given in Section 4, followed by performance evaluation and comparison in Section 5. The conclusion is drawn in Section 6.