## 3 Privacy-Preserving Aggregation with Authentication  
In smart grid systems, millions of smart meters are controlled by a single central controller, and an aggregator collects and aggregates metering information from hundreds of smart meters at intervals ranging from a few milliseconds to several days. Under such a scenario, attacks compromising smart grid security can be divided into passive and active attacks [10; 28; 29]. The aims of passive attacks are to learn and use the exchanged information without affecting system resources. Thus, its objective is general privacy (i.e., confidentiality) invasion of transmitted information such as system configuration, architecture, and operation behaviors. These attacks are rarely detected by the system administrator, hence the main focus is prevention of information leakage by exploiting cryptographic primitives. On the other hand, the aims of active attacks are to modify and affect systems through modification of exchanged data and/or injection of false information into a system [30]. In order to make smart grids resilient against attacks, cryptographic primitives are widely employed. As regarding data confidentiality, encryption algorithms are exploited as an elementary approach to guarantee security in communication and storage. Especially regarding integrity, the metering information is subject to unintentional modification or intentional modification from malicious adversaries during transmission. For the purpose of integrity violation detection, several authentication mechanisms have been extensively studied. In addition, all sorts of smart grid entities are required to prove their authenticity to avoid impersonation attacks. Therefore, verification of its source is of paramount importance. Another essential feature in smart grids is computational and communicational efficiency, so that delivery and operational delays of the expected metering information should be minimized to maintain strict control of the infrastructure. To achieve the aforementioned properties, countermeasures need to be efficiently handled by participating entities in an automated fashion because many distributed entities, such as smart meters, have limited computation capabilities and have a long chain of communications in the aggregation path. Specifically,the length of packets in a smart grid is restricted, which means that the number of messages that can be aggregated in one packet is also limited. Energy consumption costs have been proven to be higher in data transmission than computation costs for security improvements in a single device [31]. Therefore, various integrity guarantee techniques have been studied through cryptographic operations for secure data aggregation before and after communication. First, the aggregation can be divided into lossy and lossless approaches. In the former, the aggregator just collects the total sum or average usage of smart meters. It then takes multiple input values as input and outputs a single value (e.g., sum or average) for the purpose of statistics by exploiting a homomorphic encryption algorithm to provide data privacy. On the other hand, in the lossless approach, the aggregator collects the individual usage of distributed smart meters and stores all the data received from individual smart meters in a database for the purpose of billing [32]. [PERSON] et al. [33] proposed privacy-preserving authentication with a lossless data aggregation scheme, called PALDA, which exploited homomorphic encryption. However, the aggregation was performed without cryptographic operations (i.e., payloads of received packets are aggregated into the payload of the output packet by removing redundant headers and tails through encapsulation and decapsulation accordingly). They provided an analysis of their scheme in a numerical manner.