## 3 Privacy-Preserving Aggregation with Authentication
In [PERSON] et al. (2017); [PERSON] et al. (2017); [PERSON] et al. (2017), independent smart meters generate and send encryption of the metering data under a public homomorphic encryption key to the gateway, after which the gateway performs a homomorphic evaluation without knowledge of the underlying metering data. The central controller receives the resulting value in encrypted form from the gateway and takes an action proper to the results, after decrypting homomorphic ciphertext. On the other hand, [PERSON] et al. [PERSON] et al. (2017); [PERSON] et al. (2017); [PERSON] et al. (2017) examined an environment where smart meters are organized in a hierarchical manner (incremental aggregation) such that a smart meter sends encrypted metering data to another until the aggregated data reaches the central controller. It is noteworthy that [PERSON] et al. [PERSON] et al. (2017) designed a lightweight additive homomorphic encryption based on modular arithmetic that achieved much faster aggregation performance than others adopting variations of the Paillier encryption algorithm. Recently, [PERSON] and [PERSON] [PERSON] and [PERSON] (2017) adopted a lightweight lattice-based encryption algorithm where aggregation is performed by smart appliances instead of smart meters, gateways, or central controller. [PERSON] and [PERSON] [PERSON] and [PERSON] (2017) used a homomorphic signature that allowed the aggregator to check the correctness of the aggregated data in order to address the malleability of the Paillier encryption. [PERSON] et al. [PERSON] et al. (2017) adopted authentication of the control message in downlinks to guarantee the identity of the central controller when aggregated data is not considered to be the target of integrity verification. On the other hand, [PERSON] et al. [PERSON] and [PERSON] (2017); [PERSON] et al. (2017) put their main focus on the integrity of aggregated metering data by identifying the source of received metering data. To do so, integrity verification is performed at each smart meter, and the signature of verified aggregated data is again signed by the verifying smart meter before sending it to the parent node in the tree. For efficiency in authentication, various approaches have been taken such as the short signature scheme [PERSON] et al. (2016) for communication overhead and the batch signature scheme [PERSON] et al. (2017), which looks to shorten computation time. [PERSON] et al. [PERSON] et al. (2017) presented a modified Paillier encryption in which they pack multiple measurements into a single ciphertext of a smart meter, which then signs the ciphertext and sends it to the local gateway aggregating ciphertext measurements. After validation of the signatures, the aggregation is computed and the results are sent to the supplier. Other criteria in smart grid systems include identity anonymization as a way to conceal users' real identities by exploiting zero knowledge proof, pseudonyms, and various kinds of signature schemes [PERSON] et al. (2017); [PERSON] et al. a trusted third party to guarantee privacy protection with the aid of the Paillier homomorphic encryption algorithm. Very interesting research is also being conducted in various other directions. For example, [PERSON] et al. [62] introduced a concept of incentive by proposing a demand response program in the smart grid system that allows the demand response provider to compute individual demand curtailments and demand response rewards in a privacy-preserving manner. [PERSON] et al. [63] presented an anonymization mechanism supporting fine-grained data analysis in a comprehensive manner.