# Privacy-Preserving Data Aggregation with Dynamic Billing in Fog-Based Smart Grid
## 5 Soundness and Security Analysis
Even if the adversary \(\mathcal{A}\) taps \(C_{ij,m}\), \(\mathcal{A}\) still can not reveal the corresponding plaintext information. Upon receiving all the reports sent by all covered SMs, \(FN_{i}\) cannot recover each report; instead, \(FN_{i}\) just computes \(C_{i,m}=\left(\prod\limits_{j=1}^{n}u_{ij,m},\prod\limits_{j=1}^{n}\upsilon_ {ij,m}\right)=\left(g^{\sum\limits_{i=1}^{n}r_{ij,m}},\left(PK\right)^{\sum \limits_{i=1}^{n}r_{ij,m}}\right)\) to perform the aggregation of the ciphertext data. As a result, even if \(\mathcal{A}\) invades into \(FN_{i}\)'s database, \(\mathcal{A}\) cannot obtain the user's usage data \(\left(m_{1}^{i,jm},m_{2}^{i,jm},\cdots,m_{l}^{i,jm}\right)\). Similarly, the reports generated by AC are still valid ciphertexts in the EIGamal cryptosystem, so even if \(\mathcal{A}\) hacks into AC's database, \(\mathcal{A}\) cannot obtain personal usage data \(\left(m_{1}^{i,jm},m_{2}^{i,jm},\cdots,m_{l}^{i,jm}\right)\). Finally, after receiving the report from AC, the SP can only decrypt it to obtain the total amount of power usage of the same type in one area \(\sum\limits_{j=1}^{n}m_{\bar{w}}^{i,jm}(w=1,2,\cdots,l)\); the SP still cannot infer the consumption data of each user. The above discussion shows that neither external nor internal adversaries can access the users' usage data, and therefore, the proposed PPDB can provide strong confidentiality. Supposing the CDH assumption holds, the proposed PPDB is EU-CMA secure under it. In other words, the proposed PPDB can guarantee the integrity and authentication of users' electricity consumption data against the chosen message attack. In the threat model, we suppose that \(\mathcal{A}\) can launch a number of active attacks (for example, tampering, forgery, replay) to compromise the source authentication and data integrity, thus threatening the stability of the smart grid. In order to ensure that the proposed PPDB has strong security against active attacks launched by adversaries, we adopt timestamps to protect against replay attacks. For the report \(\mathcal{T}_{ij,m}=(ID_{SM_{ij}},u_{ij,m},v_{ij,m},T_{ij,m},\sigma_{ij,m},pk_{ ij})\) sent by \(SM_{ij}\), the corresponding \(FN_{i}\) first checks the timestamp and identity, and then, verifying the integrity of the report by checking whether Equation (1) holds, from the construction of the equation, it can be seen if any element of the report is tampered with, which will cause the equation to fail. Thus, the integrity of the report can be guaranteed. In general, the integrity of reports sent by entities can be verified by the corresponding entities through checking whether the corresponding equations are satisfied. We employ the BLS signature [37] to sign the reports sent by each entity. Since the BLS signature was proven to be secure under the CDH assumption [37], the adversary cannot forge a valid ciphertext without knowing the entity's private key. Our scheme authenticates the source of the reports, thus ensuring that the reports received are from legitimate entities. From the above analysis, it is clear that the PPDB scheme can provide integrity and authentication for users' electricity consumption data.