## 2 Related Works  
Data aggregation aims to combine and summarize data packets of several sensor nodes so that amount of data transmission is reduced. It enhances the network lifetime because data transmission accounts for 70% of the energy cost of computation and communication [19]. While increasing the network lifetime, data aggregation may negatively affect other performance metrics such as delay, accuracy, fault-tolerance, and security. Hence, it is a challenging task to provide efficient secure data aggregation. The basic method to protect data confidentiality is encryption. The pairwise key establishment protocol proposed in [20] using direct key establishment mechanism for neighboring nodes and path key establishment mechanism for multi-hop nodes. Group key establishment scheme [21] allows a key generation center to broadcast group key information to all group members at one-time, and only authenticated group member can retrieve the group key. However, it usually applied for small scale WSNs. Another existing group key establishment scheme [22] can be implemented in large scale networks, and incurs only \(O(n)\) communication overhead when establishing group keys. A witness-based data aggregation scheme for WSNs is proposed in [23]. The witness nodes of each aggregator also perform data aggregation and compute MACs of the aggregated data. The aggregator collects and forwards the MACs which are sent by witness nodes to the BS. Those MACs are used to verify the correctness of the data aggregated by aggregators. This protocol offers only integrity property to the data aggregation security. In [8], data are encrypted hop-by-hop, and the algorithm forms pairs of sensor nodes such that one computes a MAC and the other one verifies it. In this scheme, data aggregation is not allowed if it requires alterations in the data, and it was improved by [PERSON] and [PERSON] in [9]. The DAA protocol in [9] integrates false data detection with data aggregation and confidentiality. The monitoring nodes of aggregator also perform data aggregation and compute the MACs for data verification. In these protocols, the computation overhead is increased for hop-by-hop encryption. In order to mitigate the drawbacks of the hop-by-hop schemes, some end-to-end protocols are proposed. The mechanism described in [13], based on homomorphic hash and identity-based aggregate signatures, lets the BS and each node share a different key, and then uses weights to verify the authenticity of the aggregated data. Elliptic curve cryptography-based homomorphic encryption is used in [14] to achieve hierarchical data aggregation, data integrity and confidentiality. This scheme is based on asymmetric cryptography which has a larger computation overhead. A secure data aggregation scheme based on homomorphic primitives is proposed in [15]. It applies symmetric cryptography-based privacy homomorphism and homomorphic MAC to protecting data confidentiality and detecting data integrity. It also computes all packets during the process of integrity verification. The comparison of those secure data aggregation protocols is presented in Table 1.  
The most common method to achieve end-to-end confidentiality is privacy homomorphic cryptography. However, this method only deals with limited arithmetic operations on ciphertexts. The optimized method which can evaluate unlimited arithmetic aggregation function on encrypted data is FHE [16, 17, 18]. FHE originally called a privacy homomorphism [16, 17], was introduced by [PERSON], [PERSON] and [PERSON] shortly after the invention of RSA [24]. The first construction of an FHE (based on ideal lattices) was described by [PERSON] in [17]. Currently, research on FHE is mostly concentrated on improving the FHE algorithm, however, its applications are studied rarely and have only investigated its use in the cloud computing environment [25].