## 4 Classification of PPDA Protocols
### Homogenous protocols
#### 4.2.3 Privacy Homomorphism  
Privacy Homomorphism (PH) has a special feature that allows arithmetic operations to be performed on cipher-text without decryption. This technique is fast and resource-efficient for privacy-preserving data aggregation, but it has a limitation that it performs only addition and multiplication operations. Before sensor data are sent to the aggregators, they are encrypted by using the respective keys of sensor nodes and they are added or multiplied without decryption. The CDA and AH scheme belong to PH-based protocols.  
**CDA:** [PERSON] _et al._[33] proposed Concealed Data Aggregation (CDA) which conceals the process of data aggregation in WSN by using Domingo-Ferrer's (DF) approach [34]. In this protocol, each sensor node splits its data into \(d\) parts (_d_\(\geq\)_2), encrypts them by using a public key and transmits them to the aggregator node. The aggregator node operates on the encrypted data, computes an aggregated value from the data without decryption and sends it to the sink. Next, the sink decrypts the encrypted aggregated value by using a private key to derive accumulated data. This allows the protocol to guarantee the privacy of the sensor nodes against a passive eavesdropper. Figure 8 illustrates data aggregation in the CDA where \(S_{1}\) to \(S_{n}\), \(s_{1}\) to \(s_{n}\), _A, y'_ and \(R\) are sensor nodes, their respective encrypted data, aggregator node, encrypted aggregated value and sink node, respectively. Although the  
Figure 7: Two disjoint aggregation trees rooted at a base station.  
CDA is cheap in terms of computational resources, the CDA does not guarantee the privacy of individually sensed data against other nodes because the entire sensor nodes share the same encryption key with the BS. In addition, it does not protect against replay attacks and malicious aggregation where the contents of encrypted packets can be added as a summand to the aggregation result.  
**AH scheme:** The Additively Homomorphic (AH) encryption technique by [PERSON] _et al._[35] protects privacy against other sensor nodes. The main idea of this approach is to replace the _xor_ (Exclusive-OR) operation typically found in stream ciphers with modular addition _(+)_. In the AH scheme, the encryption, decryption and aggregation processes are as given below where \(c\), \(m\), \(k\) and \(M\) are a cipher-text, a sensor data (message), a key shared with the BS and large integer, respectively.  
_Encryption:_ _c = (m + k) mod M_  
_Decryption:_ _m = (c - k) mod M_  
_Aggregation:_ \(c\)12 = (c + c 2) mod M;_  
The AH scheme assumes that every node \(n_{i}\) shares a key \(k_{i}\) with the BS. Basically, a node \(n_{i}\) adds a random number to its sensed value where the random number is determined by the key \(k_{i}\). After receiving the encrypted aggregate, the BS filters out the correct aggregate by subtracting all the random numbers added by the nodes.  
There are several disadvantages of the AH scheme, despite providing data privacy cheaply in terms of computational cost. First, the AH scheme is not scalable because the base station must know the keys of all aggregated packets in order to decrypt the received result. This requires additional communication costs for the transmission of all participated nodes' _IDs_ and corresponding security measures. There is no reliable solution to this problem, except that all nodes' _IDs_ are transmitted to the sink node as plaintext. None of the known solutions can provide both data integrity and confidentiality on the high level of security. Second, the AH scheme is vulnerable to malicious modifications of data by adding natural numbers to the cipher text. Finally, the AH scheme does not support data integrity.