## 1 Introduction
### Related Work
This scheme suggested an aggregated data verification mechanism using a hash tree, but it is also vulnerable to active attacks by intermediate malicious meters because it grants the task of verification to each meter rather than to the collection unit. [PERSON] _et al._[15] and [PERSON] _et al._[16] have also proposed verifiable in-network data aggregation schemes in sensor network literature; however, their schemes have some privacy drawbacks. In [PERSON] _et al._'s scheme, intermediate aggregators can obtain individual raw data from its child nodes during in-network aggregation. In [PERSON] _et al._'s scheme, the final data collection unit can generate all of the symmetric keys shared with each node. Thus, if the collection unit captures any of the encrypted data reported from the leaf nodes, it can obtain the raw data in plaintext by deriving the symmetric key and decrypting the ciphertext with that key. Therefore, these two schemes cannot be directly adapted to privacy-preserving smart metering since they violate user privacy. When multiple metering data are aggregated using homomorphic encryption, it is impossible to verify the integrity of each measurement and aggregated result without violating user privacy because the verification process needs individual metering data which has not been aggregated. In order for the collection unit to verify the aggregated data, every smart meter \(s_{i}\) should send its \(\{m_{i}\}_{K}\) individually together with a signature for it, where \(K\) is the public key of the collection unit. Although this solution ensures the integrity of metering data, it allows the collection unit to obtain the plain metering data, which violates user privacy. Alternatively, a homomorphic signature algorithm [17] is capable of evaluating multivariate polynomials on signed data. Given the public key and a signed data set, it allows users to delegate computations (e.g., produce a signature on the mean, standard deviation, and other statistics of the signed data) to an untrusted third party while ensuring integrity. Even though the homomorphic signature algorithm seems to enable the collection unit to ensure the integrity of the aggregated data by verifying the homomorphic signature generated for it, the homomorphic signature algorithm cannot be adopted by a smart grid environment. This is because, in the homomorphic signature setting, the delegate can produce a signature for the statistics (such as the sum) of a set of data signed by the same signer; while smart metering applications require a solution for the collection unit to ensure the integrity of the statistics of a set of data signed by different signers or smart meters. Therefore, designing an efficient and secure metering scheme that guarantees sender authentication and the integrity of aggregated data while preserving user privacy is essential. Recently, several other smart metering schemes were proposed [18; 19; 20; 21; 22; 23; 24]. However, the schemes are all constructed on the basis of public key based homomorphic encryption such as Paillier's encryption, which may incur much higher computational overhead on resource-limited meters compared to the symmetric approach in smart grid networks, or do not guarantee data integrity and sender authentication. [PERSON] _et al._[25] and [PERSON] _et al._[26] proposed data aggregation schemes which ensure data integrity, but they cannot preserve user privacy during smart metering.