# Privacy-Preserving Data Aggregation with Dynamic Billing in Fog-Based Smart Grid
## 5 Soundness and Security Analysis  
In this section, we illustrate that PPDB is sound and meets the security requirements. Theorem 1: _The proposed PPDB construction is sound._  
Proof of Theorem 1: To prove the soundness of PPDB, we just need to prove that Equations (1)-(9) hold. 1. If all reports \(T_{ij,m}=(ID_{SM_{ij}},u_{ij,m},v_{ij,m},T_{ij,m},\sigma_{ij,m})(i=1,2,\cdots k,j=1,2,\cdots n)\) sent by the SMs to the corresponding \(FN_{i}(i=1,2,\cdots k)\) are valid, then we see the Equation (1) is established as follows \[e(\prod_{j=1}^{n}\sigma_{ij,m},g) =e(\prod_{j=1}^{n}H(ID_{SM_{ij}}||u_{ij,m}||v_{ij,m}||T_{ij,m})^{ x_{ij}},g)\] \[=\prod_{j=1}^{n}e(H(ID_{SM_{ij}}||u_{ij,m}||v_{ij,m}||T_{ij,m})^{ x_{ij}},g)\] \[=\prod_{j=1}^{n}e(H(ID_{SM_{ij}}||u_{ij,m}||v_{ij,m}||T_{ij,m}),pk_ {ij}).\]
2. If all reports \(\mathcal{T}_{i,m}=(ID_{FN_{i}},u_{i,m},v_{i,m},T_{FN_{i,m}},\sigma_{FN_{i,m}})(i =1,2,\cdots k)\) sent by \(FN_{i}(i=1,2,\cdots k)\) to AC are valid. Obviously, the Equation (2) holds, as follows: \[e(\prod_{i=1}^{k}\sigma_{FN_{i,m}},g) =e(\prod_{i=1}^{k}H(ID_{FN_{i}}||u_{i,m}\,\|v_{i,m}\,\Big{\|}T_{ FN_{i,m}})^{x_{FN_{i}}},g)\] \[=\prod_{i=1}^{k}e(H(ID_{FN_{i}}||u_{i,m}\,\|v_{i,m}\,\Big{\|}T_{ FN_{i,m}})^{x_{FN_{i}}},g)\] \[=\prod_{i=1}^{k}e(H(ID_{FN_{i}}||u_{i,m}\,\|v_{i,m}\,\Big{\|}T_{ FN_{i,m}}),pk_{FN_{i}}).\]
3. If all reports \(\mathcal{T}_{AC_{i,m}}=(ID_{AC},u_{i,m},C^{\prime}_{i,m},T_{AC_{i,m}},\sigma_{ AC_{i,m}})(i=1,2,\cdots k)\) sent by AC to the SP are valid, then the left of Equation (3) can be expanded as \[e(\prod_{i=1}^{k}\sigma_{AC_{i,m}},g) =e(\prod_{i=1}^{k}H(ID_{AC}\parallel u_{i,m}\parallel C^{\prime} _{i,m}\parallel T_{AC_{i,m}})^{x_{AC}},g)\] \[=\prod_{i=1}^{k}e(H(ID_{AC}\parallel u_{i,m}\parallel C^{\prime} _{i,m}\parallel T_{AC_{i,m}})^{x_{AC}},g)\] \[=\prod_{i=1}^{k}e(H(ID_{AC}\parallel u_{i,m}\parallel C^{\prime} _{i,m}\parallel T_{AC_{i,m}}),pk_{AC}).\] That means that Equation (3) holds. 4. We demonstrate the soundness of Equation (4) by expanding the left side of Equation (4) in detail: \[g^{\sum\limits_{i=1}^{n}c_{ij,m}} =\frac{\left(pkg_{SP}\right)^{\sum\limits_{i=1}^{n}r_{ij,m}}g^{ \sum\limits_{i=1}^{n}c_{ij,m}}}{\left(pkg_{SP}\right)^{\sum\limits_{i=1}^{n}r_ {ij,m}}}\] \[=\prod_{j=1}^{n}e(H(ID_{SM_{ij}}||u_{ij,m}||v_{ij,m}||T_{ij,m})^{ x_{ij}},g)\]0 \[=\prod_{j=1}^{n}e(H(ID_{SM_{ij}}||u_{ij,m}||v_{ij,m}||T_{ij,m})^{ x_{ij}},g)\]1 \[=\prod_{j=1}^{n}e(H(ID_{SM_{ij}}||u_{ij,m}||v_{ij,m}||T_{ij,m})^{ x_{ij}},g)\]2 \[=\prod_{j=1}^{n}e(H(ID_{SM_{ij}}||u_{ij,m}||v_{ij,m}||T_{ij,m})^{ x_{ij}},g)\]3  
With the above expansion, we can see that Equation (4) holds. Since the Equations (5)-(9) are constructed similarly to the previous equations, their soundness can be proven in the same way, and we do not prove them one by one. Through the above analysis, it is clear that the proposed PPDB is sound. Theorem 4.2: _Supposing that the DDH assumption holds, the proposed PPDB is IND-CPA secure under it. In other words, the proposed PPDB can provide strong confidentiality for users' electricity consumption data against the chosen plaintext attack._  
Proof of Theorem 4.2: In PPDB, in order to guarantee the confidentiality of users' privacy, \(SM_{ij}\) first utilizes the coding function [6] to process the \(l\)-dimensional electricity consumption data \(\left(m_{1}^{i,jm},m_{2}^{i,jm},\cdots,m_{l}^{i,m}\right)\) into one-dimensional data \(c_{ij,m}\) and then encrypt \(c_{ij,m}\) as \(C_{ij,m}=\left(u_{ij,m},\upsilon_{ij,m}\right)=\left(g^{i,j_{m}},PK^{i,j_{m}}g ^{c_{ij,m}}\right)\). In fact, \(C_{ij,m}\) is a valid ciphertext of hte EIGamal cryptosystem. Since the EIGamal cryptosystem is semantic secure under the DDH assumption [36], the data \(\left(m_{1}^{i,jm},m_{2}^{i,jm},\cdots,m_{l}^{i,jm}\right)\) are also semantic secure and confidential. As a result, it is impossible for any entity that has no knowledge of private key \(x_{ij}\) to reveal any information concerning the consumption data of the corresponding user.