## 3 Privacy-Preserving Aggregation with Authentication
The majority of studies have adopted the Paillier encryption algorithm [34] as an additive homomorphic encryption, which allows for the addition of metering data in encrypted form, thus reducing the number of computations during encipherment/decipherment. [PERSON] and [PERSON] [35] presented a modified Paillier (additive) homomorphic encryption. In their scheme, though a public decryption key allows everyone to access the aggregated usage, individual consumption cannot be derived because decryption can be done only after the computation of all individual information (in terms of differential privacy). All the participating smart meters must make use of the same random number during the encryption phase, which might be unstable under circumstances where a partial set of smart meters fail to upload their usage information. [PERSON] and [PERSON] [36] used an additive homomorphic encryption in their proposed privacy-preserving transmission of aggregated data, called EPPP4 SMS. In their scheme, the central controller receives encrypted measurements and computes aggregation on them. [PERSON] et al. [37] designed a privacy-preserving selective aggregation scheme in a multi-recipient system model in concert with a bilinear pairing-based BLS short signature, aggregate signature, and additive homomorphic Paillier encryption algorithms. [PERSON] and [PERSON] [38] proposed a privacy-preserving energy metering system based on homomorphic encryption. [PERSON] et al. [39; 40] constructed an aggregation tree, each node in which calculates the sum of electricity usage of constituting smart meters in the subtree, by employing the Paillier homomorphic encryption. [PERSON] et al. [41] used the Paillier's homomorphic encryption and verifiable secret sharing by introducing a trusted third party. [PERSON] et al. [31] presented a lossless data aggregation for machine-to-machine (M2M) networks by packing multiple sensor data in a single output. However, their scheme restricted the number of input data that can be contained in a single output to four at most. [PERSON] et al. [42] proposed a lossless data aggregation scheme with improved reliability, which authenticates transmitted data and diagnoses faults in it by exploiting signature amortization and batch verification. Unfortunately, it does not guarantee data privacy. [PERSON] and [PERSON] [35] introduced collection scenarios of power usage information based on different criteria: space and time. In the spatial aggregation, usage information from a group of smart meters in a certain area is aggregated for a specific time period. [PERSON] et al. [43] proposed a privacy-preserving multi-dimensional data aggregation considering a residential area where multiple users live. Based on [PERSON]'s rule, they constructed a user-level polynomial to store the dimensional values. On the other hand, in the temporal aggregation, the total usage of a single smart meter is aggregated. Furthermore, spatio-temporal aggregation collects total usage information of independent and other smart meters in a neighborhood at the same time [33]. When considering a decentralized (liberalized) electricity market, where electricity and data transmission are provided by different authorities heterogeneously, the subject of aggregation can be differentiated to aggregator and gateway levels. For an aggregator encompassing central controller level aggregation, [PERSON] et al. [PERSON] et al. (2016) considered a multi-recipient model, while [PERSON] and [PERSON] [PERSON] and [PERSON] (2017) examined a single-recipient one. At the gateway level, [PERSON] et al. [PERSON] et al. (2017), [PERSON] et al. [PERSON] et al. (2017), [PERSON] and Yang Deng and [PERSON] (2017), [PERSON] et al. [PERSON] et al. (2017), [PERSON] et al. [PERSON] et al. (2017), and [PERSON] et al. [PERSON] et al. (2017) constructed an aggregation tree for user privacy. In each of these studies, the topology is organized into a tree, and aggregation is performed at the gateway without any knowledge of the resulting value by exploiting homomorphic encryption.