## 4 Security Notions  
### Security Proof  
In this section, we mainly elaborate the security properties of our scheme. In particular, based on the security requirement and attack model discussed in Section 2.6, we prove our scheme can ensure the confidentiality of fine-grained meterings for an individual user and the aggregation integrity that the local aggregation, and total aggregation cannot tampered by malicious individual user nodes or the aggregator. We firstly construct the Individual Metering Indistinguishable (IMI) security game to represent the adversary's actions. **Definition 1**. : _(IMI security game). Setup: the challenger runs the initialization algorithm and first initializes a group of size \(n\), then generates the system parameter \(k\) to the adversary._Queries: the adversary can not only capture meters' encrypted report but also acquire the encryption and compromise queries until meeting the constraints. Encrypt: The adversary \(A\) chooses user\({}_{i}\) and specifies \(x_{d}^{i}\) to ask for the ciphertext. The challenger returns it the ciphertext \(E(x_{d}^{i})\). Compromise: The adversary \(A\) specifies an integer \(q\in\{0,1,\cdots,n\}\). If \(q=0\), the challenger returns the adversary the aggregator' capability, else returns user\({}_{q}\)'s message. Challenge. We denote with \(\{\overline{C}\}\) the set of the uncompromised users. The adversary selects randomly two metergings \(x_{d}^{i_{0}}\) and \(x_{d}^{i_{1}}\)\((i\in\{\overline{C}\})\) at the timestamp \(d\). The challenger flips a random bit \(b\in\{0,1\}\) uniformly and returns the adversary \(E(x_{d}^{i_{b}})\). Guess: The adversary outputs a guess \(b^{\prime}\in\{0,1\}\), and \(A\) wins if \(b=b^{{}^{\prime}}\) with unignorable advantage. Definition 2: (IMI security)  
The proposed temporal and spatial aggregation scheme is IMI if no probabilistic polynomial-time adversaries \(A\) have more than an ignorable advantage in the IMI security game. The ignorable function for \(A\) is as follows:  
\[Adv_{A}=|\Pr[b=b^{\prime}]-\frac{1}{2}|=0 \tag{13}\]  
Theorem 1: _The proposed encryption scheme is IMI._  
The intuition behind the theorem is any adversary cannot distinguish the encrypted individual metering and the scheme cannot leak any individual user consumption at the \(d^{\text{th}}\) timestamp. Proof: **Setup**: The challenger initiates the whole system. The challenger generates a group of scale n and pairs number k, and then gives the parameters (n, k) to the adversary. Queries:  
1. [label=(0)]
2. Spatial aggregation
3. Encrypt: A issues the encryption query with \((i,d,x_{d}^{i})\) to the challenger. The challenger generates the pairwise key \(r_{(j,d)}^{i}(j\in ind_{i}[s])\) between the pairwise nodes, and imposes it on the randomly partitioned data \(x_{(j,d)}^{i}(j\in ind_{i}[s])\) to generate the encrypted measure formed as \(E(x_{d}^{i})=x_{(j,d)}^{i}+r_{(j,d)}^{i}\text{mod }M(j\in ind_{i}[s])\). Compromise: A may compromise the aggregator or up to n-1 users in any pairwise set in order to acquire more messages for object users. However, the compromise will encounter restriction when meeting with uncompromised users. Challenge. For simplifying the proof process and not losing the generalization, we consider the extreme circumstance that \(|\overline{c}|=2\). If the theorem holds for this circumstance, then it holds for \(|\overline{c}|>2\). We assume the user j is the only uncompromised user in \(ind_{i}[s](1\leq s\leq k)\). The adversary selects the two metergings and gives \((i,j,d,x_{d}^{i_{0}},x_{d}^{i_{1}})\) to the challenger, the challenger flips a random bit \(b\in\{0,1\}\) uniformly and returns the adversary \(E(x_{d}^{i})\) when \(b=0\), and returns \(E(x_{d}^{i})\) when \(b=1\), and then  
\[ \begin{array}{ll}E(x_{d}^{i})&=\sum\limits_{l\in ind_{i}[s]}\left(x_{(l,d)}^ {i}+r_{(l,d)}^{i}\right)\text{ mod }M(1\leq s\leq k)\\ &=(x_{(j,d)}^{i}+r_{(j,d)}^{i}+\sum\limits_{c\in ind_{i}[s]-j}\left(x_{(c,d)}^ {i}+r_{(c,d)}^{i}\right)\text{ mod }M\\ \end{array}  \tag{14}\]  
\[