# A Traceable and Anonymous Data Aggregation Scheme with Fog Computing Devices for Smart Grid

Authors: Fan Wu; Xiong Li
Journal: Security and Communication Networks
 (2022)

---

## Abstract

As an extension of the Internet of Things (IoT), smart city is a new aim for applications used in different industrial aspects. Intelligent IoT devices are used everywhere in smart cities to implement the functions such as monitoring and managing. Smart grid is one of the critical parts. Obtaining the quantity and cost of electricity usage is the most critical task of the smart grid. But such data in plaintext may leak the user privacy. So, it is an emergent aim to protect the private information of the user. Thus, we present a secure scheme for the smart grid, which not only protects the user’s information including identity and power consumption in the communications but also tracks the correct electricity cost for each user. Also, electricity consumption data from users could be aggregated in fog devices and then analyzed by the utility provider. The formal proof shows that the message transmission reaches the security level of the chosen plaintext attack (CPA). Also, the security properties of the scheme express the robustness. Finally, the performance study demonstrates that the proposed protocol is acceptable in practice.


---

## Body

## 1. Introduction

Nowadays, smart city aims to optimize every function of the city and improve the quality of citizens’ life with data analysis and technology development. Quality of life has been improved substantially in smart city. To complete the whole process from data collection to instruction assignment to concrete sensors, intelligent Internet of Things (IoT) devices such as smart meters, robots, aggregation devices, and software-defined production processes are deployed for different sorts of usage. Through sensors distributed everywhere, many kinds of data are gathered and sent to center servers for decision-making. Under that background, power grid, traffic, agriculture, and accommodation turn to be smart grid, smart traffic, smart agriculture, and smart home, respectively. However, security gaps containing weak authentication or vulnerability in code pieces lead to serious and urgent risks. Attackers can exploit the operating system and software’s holes, eavesdrop on the messages in public channels between sensors and servers, or compromise sensors to get valuable information after analyzing relative data flows.Traditional electricity grid consists of power stations, high-voltage transmission lines, and distribution lines. They build a large network that delivers electricity from the producer to the users, and the balance of power supply and usage relies on the construction of power plants. The more electricity is required, the more plants should be built. But with the technology progressing, smart grid becomes an attractive term, and it turns to be true in some developed countries. Promising changes appear in every aspect, including intelligent power generation, transmission, and applications. Advanced metering infrastructure (AMI) is the architecture of smart grid, where bidirection demand response is an important property, which permits the users and the utility providerUP to monitor, adjust, count, and forecast the electricity use. The time-of-use pricing mechanism is employed, and users should pay higher fees in the peak time under this measure. Also, smart grid is one of the most important sorts of cyber-physical systems (CPSs). As physical devices, smart meters (SMs) are distributed widely outside the houses or gathered in a meter box in a building. Each smart meter collects the power consumption value in one house with every fixed period to calculate the fees due to different prices in peaks and valleys. Since the power usage data are fine-grained, smart grid faces security problems containing threats and weaknesses including identity and consumption leaking, replay attack, denial-of-service attack, and so forth. The attacker may deduce user habits or behaviors via such information, so the privacy of the personal information turns to be an important issue and is discussed by researchers. According to [1], several requirements should be satisfied, including transmitted data privacy, data reliability, and authentication between participants.With the popularization of smart grid, enormous data have been generated. Simple data processing is done on fog devices (FDs). Fog computing means that some critical computations are completed on the edge of the network or fog devices distributed everywhere. SMs in one domain submit their collected data to the corresponding FD, and the extensional calculations, like clarifying the consumption fee and making data aggregations, could be done based on the data owned by FDs. All transmitted messages should be kept away from danger. Authentication and public key mechanism [2–4] are the necessary ways to protect the security of data. It is necessary to study the current situation of privacy-preserving schemes for smart grid and we will list the related literature.


### 1.1. Related Work

In recent years, a host of schemes for AMI has been presented. Based on [5], there are three classic sorts: key agreement, only consumption data encryption, and data aggregation. Authentication and key agreement is the usual way for sending information in smart grid [2–4, 6–15]. In 2011, Fouda et al. [6] presented a key agreement scheme between the building area network and home area network. But, it is criticized in [7] that heavy computation cost is used. Then, Li et al. [11] pointed out that identities of users were exposed by plaintext in [7]. In 2016, Tsai and Lo [8] presented a scheme with a session key formed between the smart meters and corresponding service supporter. But Odelu et al. and He et al. [9, 10] considered that calculation time in [8] costs too much due to bilinear pairing calculations. Unfortunately, the two schemes could not satisfy the anonymity of user [2]. In 2018, schemes [12–14] were proposed, but the weaknesses like lack of forward security and anonymity were still troubling people.The second sort is that only the consumption data are protected, but the user’s identity is not considered as the secret [5, 16–20]. In 2015, Diao et al. [16] proposed a scheme built on zero-knowledge and Camenisch-Lysyanskaya signature. They claimed that user identity was anonymous and linkable in the scheme, but soon, the forgery attack on the scheme was given in [17]. In 2016, Sui et al. [18] designed a scheme between SM and the electricity utility. But the user who consumes more electricity than the threshold will be exposed in plaintext. Next year, Ge et al. [19] pointed out that unlinkability feature could not be satisfied in [18]. But the two schemes [18, 19] are unfit due to exposing user identity simply and crudely. And in [5], secure channel is required several times when normal data transmission proceeds, and the identity is also in plaintext against the anonymity requirement. In 2020, Ding et al. [20] put forward a data aggregation scheme for smart grid, but both the identity and public key of user were transmitted directly in the public channel. In 2021, Su et al. [21] proposed a changeable threshold-based aggregation scheme for smart grid. However, identity is ignored in the message transmission, and only the aggregation value can be obtained in the control center, which is equal to UP here. Also, Wang et al. [22] presented an aggregation scheme keeping privacy of user in the same year, but the identity of user was still ignored.The last sort is aggregating data relative to the consumption [1, 23–29]. In 2017, He et al. proposed studies [23, 24] which described the aggregation between SMs and the special aggregator. But in the aggregation part, the identity of user, which should be transmitted in plaintext, is needed to verify the data. Wang’s scheme [25], which employed the identity-based signature, had the same problem, where the user’s identity must be exposed in the public channel or the final check on the aggregation device could not be completed. In 2017, Badra and Zeadally [1] presented a scheme with symmetric homomorphic encryption and Diffie–Hellman problem. Every time, one user should update the shared key between the server and himself, with the help of another user. But how to find the suitable helper is not mentioned. Shen et al. [26] proposed a cube-data aggregation scheme for smart grid. However, the user identity is also in plaintext. Lu et al. [27] proposed a Paillier encryption-based scheme to make the data aggregation. But the time-based hash chain in the scheme is not suitable if the smart meter malfunctions once. The fog device cannot check the correct submission, while the last one or several submissions are lost or rejected. Liu et al. [28] used lifted EC-ElGamal cryptosystem with plaintext identity. However, except [1], all of the above schemes do not consider the fee of each user. Only aggregation and some statistical operations, such as mean and variance values, are regarded. Smart grid is first for electrical consumption, and the fee of electricity usage is much more important than statistical data for prognosis. On this aspect, in 2016, Wang et al. [29] proposed a scheme which could not only disclose the user consumption but also collect statistical data for computing statistic values. However, some weaknesses are exposed: the data in the aggregation process cannot be verified, the adversary can calculate the private consumption from the message, and the pseudoidentity will be exhaustively searched on the trusted server side by doing both hash and scalar multiplication, since the trusted server only calculates the collected data of the special smart meter which is required by UP.Usually, the quantity of electricity usage is set as the discrete logarithm in aggregation. Based on [30], the power energy consumption in China is about 7225.5 terawatt/hour in 2017. This number is at the level of 248, and such discrete logarithm could be solved in 0.1 s [31], generally with the Pollard rho algorithm [32]. This technology is employed in many studies [23–25, 27, 29, 33].


### 1.2. Contributions

(1)
We give a new data transmission scheme for smart grid, and it could make both the power consumption and data aggregation clear.(2)
Formal proof demonstrates that the messages are robust enough against forgery attacks(3)
Considering the security characters and performance evaluation, our scheme is good for practicality


### 1.3. Organization of the Paper

The rest of study is organized as follows: Section2 expresses the basic knowledge of the study. Our scheme is in Section 3. Then, the formal proof lies in Section 4 and security analysis is in Section 5. The performance situation is in Section 6. Finally, the conclusion is drawn in Section 7.


## 1.1. Related Work

In recent years, a host of schemes for AMI has been presented. Based on [5], there are three classic sorts: key agreement, only consumption data encryption, and data aggregation. Authentication and key agreement is the usual way for sending information in smart grid [2–4, 6–15]. In 2011, Fouda et al. [6] presented a key agreement scheme between the building area network and home area network. But, it is criticized in [7] that heavy computation cost is used. Then, Li et al. [11] pointed out that identities of users were exposed by plaintext in [7]. In 2016, Tsai and Lo [8] presented a scheme with a session key formed between the smart meters and corresponding service supporter. But Odelu et al. and He et al. [9, 10] considered that calculation time in [8] costs too much due to bilinear pairing calculations. Unfortunately, the two schemes could not satisfy the anonymity of user [2]. In 2018, schemes [12–14] were proposed, but the weaknesses like lack of forward security and anonymity were still troubling people.The second sort is that only the consumption data are protected, but the user’s identity is not considered as the secret [5, 16–20]. In 2015, Diao et al. [16] proposed a scheme built on zero-knowledge and Camenisch-Lysyanskaya signature. They claimed that user identity was anonymous and linkable in the scheme, but soon, the forgery attack on the scheme was given in [17]. In 2016, Sui et al. [18] designed a scheme between SM and the electricity utility. But the user who consumes more electricity than the threshold will be exposed in plaintext. Next year, Ge et al. [19] pointed out that unlinkability feature could not be satisfied in [18]. But the two schemes [18, 19] are unfit due to exposing user identity simply and crudely. And in [5], secure channel is required several times when normal data transmission proceeds, and the identity is also in plaintext against the anonymity requirement. In 2020, Ding et al. [20] put forward a data aggregation scheme for smart grid, but both the identity and public key of user were transmitted directly in the public channel. In 2021, Su et al. [21] proposed a changeable threshold-based aggregation scheme for smart grid. However, identity is ignored in the message transmission, and only the aggregation value can be obtained in the control center, which is equal to UP here. Also, Wang et al. [22] presented an aggregation scheme keeping privacy of user in the same year, but the identity of user was still ignored.The last sort is aggregating data relative to the consumption [1, 23–29]. In 2017, He et al. proposed studies [23, 24] which described the aggregation between SMs and the special aggregator. But in the aggregation part, the identity of user, which should be transmitted in plaintext, is needed to verify the data. Wang’s scheme [25], which employed the identity-based signature, had the same problem, where the user’s identity must be exposed in the public channel or the final check on the aggregation device could not be completed. In 2017, Badra and Zeadally [1] presented a scheme with symmetric homomorphic encryption and Diffie–Hellman problem. Every time, one user should update the shared key between the server and himself, with the help of another user. But how to find the suitable helper is not mentioned. Shen et al. [26] proposed a cube-data aggregation scheme for smart grid. However, the user identity is also in plaintext. Lu et al. [27] proposed a Paillier encryption-based scheme to make the data aggregation. But the time-based hash chain in the scheme is not suitable if the smart meter malfunctions once. The fog device cannot check the correct submission, while the last one or several submissions are lost or rejected. Liu et al. [28] used lifted EC-ElGamal cryptosystem with plaintext identity. However, except [1], all of the above schemes do not consider the fee of each user. Only aggregation and some statistical operations, such as mean and variance values, are regarded. Smart grid is first for electrical consumption, and the fee of electricity usage is much more important than statistical data for prognosis. On this aspect, in 2016, Wang et al. [29] proposed a scheme which could not only disclose the user consumption but also collect statistical data for computing statistic values. However, some weaknesses are exposed: the data in the aggregation process cannot be verified, the adversary can calculate the private consumption from the message, and the pseudoidentity will be exhaustively searched on the trusted server side by doing both hash and scalar multiplication, since the trusted server only calculates the collected data of the special smart meter which is required by UP.Usually, the quantity of electricity usage is set as the discrete logarithm in aggregation. Based on [30], the power energy consumption in China is about 7225.5 terawatt/hour in 2017. This number is at the level of 248, and such discrete logarithm could be solved in 0.1 s [31], generally with the Pollard rho algorithm [32]. This technology is employed in many studies [23–25, 27, 29, 33].


## 1.2. Contributions

(1)
We give a new data transmission scheme for smart grid, and it could make both the power consumption and data aggregation clear.(2)
Formal proof demonstrates that the messages are robust enough against forgery attacks(3)
Considering the security characters and performance evaluation, our scheme is good for practicality


## 1.3. Organization of the Paper

The rest of study is organized as follows: Section2 expresses the basic knowledge of the study. Our scheme is in Section 3. Then, the formal proof lies in Section 4 and security analysis is in Section 5. The performance situation is in Section 6. Finally, the conclusion is drawn in Section 7.


## 2. Preliminary

### 2.1. Notations

In Table1, the notations used throughout the study are given.Table 1
Notations.
SymbolMeaningSMi, IDSMiith smart meter and its identityFDj, IDFDjjth fog device and its identityTSTrusted serverUP, IDUPUtility provider and its identityGA cyclic group on a finite fieldFn from an elliptic curveqA large prime, which is the order ofGPGenerator ofGZq∗Multiplicative group moduloqhii=1,2,…10Hash functions⊕Exclusive or operation‖Concatenation operationVDistribution of power consumption in a domainviQuantity of usage onSMilsSecurity lengthzj/Zj=zjPPrivate/public key forFDjx/X=xPPrivate/public key forTSy/Y=yPPrivate/public key forUPkeyjThe common secret key betweenFDj and UPAThe adversaryM1,M2,M3Messages


### 2.2. Referred Mathematical Problems

The problems given in the following are based on the elliptic groupG with order q and generator P mentioned in Table 1.Definition 1.
The discrete logarithm (DL) problem is that in the tupleP,aP, where a∈Zq∗ is unknown, it is hard to calculate a.Definition 2.
The computational Diffie–Hellman (CDH) problem onG is that given the tuple P,aP,bP, where a,b∈Zq∗ are unknown, it is hard to calculate abP∈G.Definition 3.
The decisional Diffie–Hellman (DDH) problem onG is that given the tuple P,aP,bP,cP, where a,b∈Zq∗ are unknown, it is hard to judge if cP=abP.Definition 4.
The gap Diffie–Hellman (GDH) problem onG is that given tuple P,aP,bP, where a,b∈Zq∗ are unknown, it is hard to calculate abP∈G via the help of DDH tool, like an oracle. Here, we define ε=AdvAGDHt, which is the probability of solving GDH problem for A in polynomial time t.


### 2.3. Network Model

Our scheme relies on the model in [29]. If the users obey the laws and pay the bill in time, it is unnecessary to expose the fine-grain consumption value to smart grid, especially UP. UP only accepts the aggregation of consumption and changes power supply with the corresponding price in different time spans. The architecture of the network is shown in Figure 1. Four kinds of devices are in the network: smart meter, fog device, trusted server TS, and utility provider. Smart meter measures the power consumption details for every house. It is natural that the fee should be checked. But in [29], the fee is calculated on SM side. Without verifications on some trusted server, such data cannot be believed. Different from [29], only the consumptions will be submitted. Fees are not considered. Also, only total electricity consumption in one house is submitted in our scheme. Consumptions from all appliances in the house are not considered. Such data are submitted to the fog device, which stores the collection and is ready to provide data for people to check the consumption and to aggregate the data without leaking user information. The trusted server can get power consumption from each user, in order to calculate the electricity fee later. Also, it generates the key for the fog device to send the aggregated data with encryption, in order to prevent the attacker from cracking. The utility provider requires the aggregated statistical data to predict the total data in a long time. Wired channels are between fog devices and the trusted server and between fog devices and UP.Figure 1
Network model.


### 2.4. Security Model

Combining studies [27, 29, 34], we give the security model of our scheme as follows.(1)
The scheme is chosen plaintext attack (CPA) secure(2)
The trusted server is reliable and can get the real identity and power consumption of user. It is for the property of user anonymity and traceability.(3)
A could eavesdrop and forge messages in the public channel(4)
TheUP and fog devices are honest-but-curious, since they execute the protocol but are curious about the privacy of users. However, according to [27], any FDj will not collude with UP.


## 2.1. Notations

In Table1, the notations used throughout the study are given.Table 1
Notations.
SymbolMeaningSMi, IDSMiith smart meter and its identityFDj, IDFDjjth fog device and its identityTSTrusted serverUP, IDUPUtility provider and its identityGA cyclic group on a finite fieldFn from an elliptic curveqA large prime, which is the order ofGPGenerator ofGZq∗Multiplicative group moduloqhii=1,2,…10Hash functions⊕Exclusive or operation‖Concatenation operationVDistribution of power consumption in a domainviQuantity of usage onSMilsSecurity lengthzj/Zj=zjPPrivate/public key forFDjx/X=xPPrivate/public key forTSy/Y=yPPrivate/public key forUPkeyjThe common secret key betweenFDj and UPAThe adversaryM1,M2,M3Messages


## 2.2. Referred Mathematical Problems

The problems given in the following are based on the elliptic groupG with order q and generator P mentioned in Table 1.Definition 1.
The discrete logarithm (DL) problem is that in the tupleP,aP, where a∈Zq∗ is unknown, it is hard to calculate a.Definition 2.
The computational Diffie–Hellman (CDH) problem onG is that given the tuple P,aP,bP, where a,b∈Zq∗ are unknown, it is hard to calculate abP∈G.Definition 3.
The decisional Diffie–Hellman (DDH) problem onG is that given the tuple P,aP,bP,cP, where a,b∈Zq∗ are unknown, it is hard to judge if cP=abP.Definition 4.
The gap Diffie–Hellman (GDH) problem onG is that given tuple P,aP,bP, where a,b∈Zq∗ are unknown, it is hard to calculate abP∈G via the help of DDH tool, like an oracle. Here, we define ε=AdvAGDHt, which is the probability of solving GDH problem for A in polynomial time t.


## 2.3. Network Model

Our scheme relies on the model in [29]. If the users obey the laws and pay the bill in time, it is unnecessary to expose the fine-grain consumption value to smart grid, especially UP. UP only accepts the aggregation of consumption and changes power supply with the corresponding price in different time spans. The architecture of the network is shown in Figure 1. Four kinds of devices are in the network: smart meter, fog device, trusted server TS, and utility provider. Smart meter measures the power consumption details for every house. It is natural that the fee should be checked. But in [29], the fee is calculated on SM side. Without verifications on some trusted server, such data cannot be believed. Different from [29], only the consumptions will be submitted. Fees are not considered. Also, only total electricity consumption in one house is submitted in our scheme. Consumptions from all appliances in the house are not considered. Such data are submitted to the fog device, which stores the collection and is ready to provide data for people to check the consumption and to aggregate the data without leaking user information. The trusted server can get power consumption from each user, in order to calculate the electricity fee later. Also, it generates the key for the fog device to send the aggregated data with encryption, in order to prevent the attacker from cracking. The utility provider requires the aggregated statistical data to predict the total data in a long time. Wired channels are between fog devices and the trusted server and between fog devices and UP.Figure 1
Network model.


## 2.4. Security Model

Combining studies [27, 29, 34], we give the security model of our scheme as follows.(1)
The scheme is chosen plaintext attack (CPA) secure(2)
The trusted server is reliable and can get the real identity and power consumption of user. It is for the property of user anonymity and traceability.(3)
A could eavesdrop and forge messages in the public channel(4)
TheUP and fog devices are honest-but-curious, since they execute the protocol but are curious about the privacy of users. However, according to [27], any FDj will not collude with UP.


## 3. Proposed Scheme

We divide our scheme into six phases: initialization, data encryption, consumption affirmation, aggregation key generation, aggregation, and aggregated data decryption. Different from [29], we do not consider user’s fee submission, as the fee should be checked on the TS side, and it is not suitable to completely trust the fee calculated by smart meters. Moreover, we focus on the unitary consumption or one smart meter for a house. We do not use the way in [29], where each appliance is counted, respectively. Moreover, there is only one TS and one UP. Moreover, we put the process from Section 3.2 to Section 3.6 in Table 2.Table 2
Data flow for consumption submission.
SMiFDjTSUPSelectr1,r2,t1Ai,1=r1PAi,2=r2P, Ai,3=h1r1X⊕viAi,4=h2r2X⊕IDSMiAi,5=2r1X+r2X+viPwi=vi2Ai,6=r1X+2r2X+wiPAi,7=h3r1XviIDSMiIDFDjwir2Xt1⟶M1=Ai,1,Ai,2,Ai,3,Ai,4,Ai,5,Ai,6,Ai,7,t1Checkt1, stores M1⟶M1B1=xAi,1, B2=xAi,2vi=Ai,3⊕h1B1IDSMi=Ai,4⊕h2B2B3=Ai,5−2B1−B2, B4=Ai,6−B1−2B2GetFDjCheckB3?=viP, wi?=vi2, B4?=wiPAndAi,7?=h3B1viIDSMiIDFDjwiB2t1Selects, t2, r3B5=r3PB6=xh4r3Y‖s⊕h5r3Zj‖IDFDjB7=h4−1r3Y‖s⊕h6r3Y‖IDUPB8=h7xh4r3Y‖sIDFDjB7‖t2B9=h8h4−1r3Y‖s‖r3Y←M2=B5,B6,B7,B8,B9,t2Checkt2, get k,t3,r4C1=B6⊕h5zjB5‖IDFDjCheckB8?=h7C1IDFDjB7‖t2ComputeC2=∑i=1KAi,1, C3=C1C2C4=∑i=1kAi,2, C5=C1C4C6=B5, C7=B7, C8=∑i=1kAi,5C9=∑i=1kAi,6, C10=B9C11=r4P, C12=h9r4Y‖t3⊕kC13=h10C3‖C5‖C7‖C8‖C9‖C10‖kkeyjt3M3=←C3,C5,C6,C7,C8,C9,C10,C11,C12,C13,t3,IDFDjCheckt3, search keyjComputek=C12⊕h9yC11‖t3CheckC13?=h10C3‖C5‖C7‖C8‖C9‖C10‖kkeyjt3ComputeD1=C7⊕h6yC6‖IDUPCheckC10?=h8D1‖yC6ComputeD2=C8−2D1C3−D1C5D3=C9−D1C3−2D1C5getW1=∑i=1kvi from D2getW2=∑i=1kwi from D3Compute the mean value and variance value according tok


### 3.1. Initialization

TS generates a cyclic group G with a large prime order q and generator P, as given in Table 1. Its private/public key pair is x/X=xP. Similarly, UP owns its private/public key pair y/Y=yP, and FDj owns its private/public key pair zj/Zj=zjP. Moreover, UP’s identity is IDUP and FDj’s identity is IDFDj; TS stores the pair IDSMi,IDFDj, where the submission target of IDSMi is IDFDj; SMi also stores the pair IDSMi,IDFDj, such that SMi should submit the information to FDj. At last, FDj and UP have a common secret key keyj. UP stores the quantity of smart meters Nj in FDj’s domain. Finally, hash functions are defined as follows: hii=1,2,3,5,6,7,8,9,10:0,1∗↦0,1ls and h4:0,1∗↦Zq∗.


### 3.2. Data Encryption

SMi selects random numbers r1,r2∈Zq∗, picks the timestamp t1, and calculates the following elements with user consumption vi: Ai,1=r1P, Ai,2=r2P, Ai,3=h1r1X⊕vi, Ai,4=h2r2X⊕IDSMi, Ai,5=2r1X+r2X+viP, wi=vi2, Ai,6=r1X+2r2X+wiP, and Ai,7=h3r1XviIDSMiIDFDjwir2Xt1. Then, SMi sends M1=Ai,1,Ai,2,Ai,3,Ai,4,Ai,5,Ai,6,Ai,7,t1 to the corresponding FDj.


### 3.3. Consumption Affirmation

FDj checks t1 and stores M1 if t1 is valid. Then, it sends M1 to TS, in order to disclose the user identity and corresponding power consumption. TS computes B1=xAi,1, B2=xAi,2, vi=Ai,3⊕h1B1, IDSMi=Ai,4⊕h2B2, B3=Ai,5−2B1−B2, and B4=Ai,6−B1−2B2, finds out the corresponding FDj according to SMi, and checks if B3=viP, wi=vi2, B4=wiP, and Ai,7=h3B1viIDSMiIDFDjwiB2t1. If true, TS could calculate the fee according to vi.


### 3.4. Aggregation Key Generation

In order to helpFDj aggregate power usage in smart meters for a time span, TS selects a random string s, the timestamp t2 in relative time span and r3∈Zq∗, and calculates B5=r3P, B6=xh4r3Y‖s⊕h5r3Zj‖IDFDj, B7=h4−1r3Y‖s⊕h6r3Y‖IDUP, B8=h7xh4r3Y‖sIDFDjB7‖t2, and B9=h8h4−1r3Y‖s‖r3Y. Then, TS sends M2=B5,B6,B7,B8,B9,t2 to FDj.


### 3.5. Aggregation

FDj checks t2, gets the number k as the number of functioning smart meters, picks up timestamp t3 and r4∈Zq∗, calculates C1=B6⊕h5zjB5‖IDFDj, and checks if B8=h7C1IDFDjB7‖t2. If true, FDj computes C2=∑i=1kAi,1, C3=C1C2, C4=∑i=1kAi,2, C5=C1C4, C6=B5, C7=B7, C8=∑i=1kAi,5, C9=∑i=1kAi,6, C10=B9, C11=r4P, C12=h9r4Y‖t3⊕k, and C13=h10C3‖C5‖C7‖C8‖C9‖C10‖kkeyjt3. Then, FDj sends M3=C3,C5,C6,C7,C8,C9,C10,C11,C12,C13,t3,IDFDj to UP.


### 3.6. Aggregated Data Decryption

UP checks t3 and searches keyj based on IDFDj. If the checks and the data are found, it computes k=C12⊕h9yC11‖t3 and checks c13=C3,C5,C6,C7,C8,C9,C10,C11,C12,C13,t3,IDFDj. If true, UP computes D1=C7⊕h6yC6‖IDUP and checks if C10=h8D1‖yC6. If correct, UP computes D2=C8−2D1C3−D1C5 and D3=C9−D1C3−2D1C5 and then uses the Pollard rho algorithm to get W1=∑i=1kvi from D2 and W2=∑i=1kwi from D3. If k=Nj, the mean value EV=W1/k and the variance value VarV=W2/k−W12/k2; else, if k<Nj, the variance value is changed to be VarV=1/k−1W2−W12/k.


## 3.1. Initialization

TS generates a cyclic group G with a large prime order q and generator P, as given in Table 1. Its private/public key pair is x/X=xP. Similarly, UP owns its private/public key pair y/Y=yP, and FDj owns its private/public key pair zj/Zj=zjP. Moreover, UP’s identity is IDUP and FDj’s identity is IDFDj; TS stores the pair IDSMi,IDFDj, where the submission target of IDSMi is IDFDj; SMi also stores the pair IDSMi,IDFDj, such that SMi should submit the information to FDj. At last, FDj and UP have a common secret key keyj. UP stores the quantity of smart meters Nj in FDj’s domain. Finally, hash functions are defined as follows: hii=1,2,3,5,6,7,8,9,10:0,1∗↦0,1ls and h4:0,1∗↦Zq∗.


## 3.2. Data Encryption

SMi selects random numbers r1,r2∈Zq∗, picks the timestamp t1, and calculates the following elements with user consumption vi: Ai,1=r1P, Ai,2=r2P, Ai,3=h1r1X⊕vi, Ai,4=h2r2X⊕IDSMi, Ai,5=2r1X+r2X+viP, wi=vi2, Ai,6=r1X+2r2X+wiP, and Ai,7=h3r1XviIDSMiIDFDjwir2Xt1. Then, SMi sends M1=Ai,1,Ai,2,Ai,3,Ai,4,Ai,5,Ai,6,Ai,7,t1 to the corresponding FDj.


## 3.3. Consumption Affirmation

FDj checks t1 and stores M1 if t1 is valid. Then, it sends M1 to TS, in order to disclose the user identity and corresponding power consumption. TS computes B1=xAi,1, B2=xAi,2, vi=Ai,3⊕h1B1, IDSMi=Ai,4⊕h2B2, B3=Ai,5−2B1−B2, and B4=Ai,6−B1−2B2, finds out the corresponding FDj according to SMi, and checks if B3=viP, wi=vi2, B4=wiP, and Ai,7=h3B1viIDSMiIDFDjwiB2t1. If true, TS could calculate the fee according to vi.


## 3.4. Aggregation Key Generation

In order to helpFDj aggregate power usage in smart meters for a time span, TS selects a random string s, the timestamp t2 in relative time span and r3∈Zq∗, and calculates B5=r3P, B6=xh4r3Y‖s⊕h5r3Zj‖IDFDj, B7=h4−1r3Y‖s⊕h6r3Y‖IDUP, B8=h7xh4r3Y‖sIDFDjB7‖t2, and B9=h8h4−1r3Y‖s‖r3Y. Then, TS sends M2=B5,B6,B7,B8,B9,t2 to FDj.


## 3.5. Aggregation

FDj checks t2, gets the number k as the number of functioning smart meters, picks up timestamp t3 and r4∈Zq∗, calculates C1=B6⊕h5zjB5‖IDFDj, and checks if B8=h7C1IDFDjB7‖t2. If true, FDj computes C2=∑i=1kAi,1, C3=C1C2, C4=∑i=1kAi,2, C5=C1C4, C6=B5, C7=B7, C8=∑i=1kAi,5, C9=∑i=1kAi,6, C10=B9, C11=r4P, C12=h9r4Y‖t3⊕k, and C13=h10C3‖C5‖C7‖C8‖C9‖C10‖kkeyjt3. Then, FDj sends M3=C3,C5,C6,C7,C8,C9,C10,C11,C12,C13,t3,IDFDj to UP.


## 3.6. Aggregated Data Decryption

UP checks t3 and searches keyj based on IDFDj. If the checks and the data are found, it computes k=C12⊕h9yC11‖t3 and checks c13=C3,C5,C6,C7,C8,C9,C10,C11,C12,C13,t3,IDFDj. If true, UP computes D1=C7⊕h6yC6‖IDUP and checks if C10=h8D1‖yC6. If correct, UP computes D2=C8−2D1C3−D1C5 and D3=C9−D1C3−2D1C5 and then uses the Pollard rho algorithm to get W1=∑i=1kvi from D2 and W2=∑i=1kwi from D3. If k=Nj, the mean value EV=W1/k and the variance value VarV=W2/k−W12/k2; else, if k<Nj, the variance value is changed to be VarV=1/k−1W2−W12/k.


## 4. Formal Proof

Nowadays, researchers consider that attackers should have negligible probability to retrieve any plaintext from ciphertext in cryptographic protocols. Such protocol should meet indistinguishability (IND) security which means thatA could not distinguish two plaintexts, while one of corresponding ciphertexts is given. In this study, chosen plaintext attack (CPA), which means A does not have decryption right for any ciphertext he selects, will be proved for our scheme.Our scheme is under IND-CPA secure. The concrete proof is given.


### 4.1. Basic Knowledge of IND-CPA Security for Our Scheme

Three games are brought in to explain the security for the three messages. We show the game process and then give the analysis of the games. The results show how the scheme keeps IND-CPA security. The proposed scheme meets the CPA security requirements if the polynomial time adversaryA has negligible probability to win the games. A simulator S is used to provide the random oracle query service and A makes queries to try to break the IND-CPA security. All games can be divided into five phases as follows:(1)
Initialization:S generates system parameters including G with generator P and large prime order q, public keys of FDj, UP, and TS, identities of smart meters, fog devices, trusted server and utility provider, secret keys between FDj and UP, and hash functions. We define the public keys of TS. UP and FDj are X=aTSP, Y=aUPP, and Z=ajP, respectively, where aTS, aUP, and aj are unknown.(2)
Query 1:A queries the hash oracles, and S returns the results.(3)
Challenge:A selects fresh information info0 and info1 to S. S then chooses a bit ω∈0,1. And infoω is used to generate the corresponding message in the game.(4)
Query 2: it is same as query 1.(5)
Guess:A should give a bit ω′ as the result of guessing ω. If ω=ω′, A wins the game.A knows all public parameters and all identities of participants. He will ask hi oracle for qhii=1,2,…10 times. There are hash lists for storing A’s corresponding hash queries. For instance, Lhi stores i,str,result, where hi is queried by A and result is the hash result of str. The advantage for A breaking the message Mbb=1,2,3 is denoted as AdvMbIND−CPAA=Prω=ω′−1/2. In the following proofs, we only consider the extra probabilities beyond 1/2. As mentioned in Section 2.2, ε=AdvAGDHt, and we employ the probability to express the hard level of solving the GDH problem in the following theorems. That probability is used when we find the tuple format aP,bP,abP occurring in the hash list Lhi, where a and b are unknown, as we mentioned also in Section 2.2.


### 4.2. Proof of CPA

Theorem 1.
The data encryption phase is IND-CPA secure andAdvM1IND−CPAA≤qh12+qh22+qh32+2qh1+qh2+qh3/2ls+1+qh1qh2qh3ε2.Proof.
The concrete operations are as follows:(1)
Initialization:S produces parameters as mentioned in Section 4.1.(2)
Query 1:A makes h1, h2, and h3 queries with the string str. S searches if there is the existed queried tuple i,str,result in Lhii=1,2,3. If true, result will be returned. Otherwise, S selects result∈0,1ls, and the tuple i,str,result is written into the list.(3)
Challenge:A selects vi0 and vi1 and submits them to S. S produces M1ω as the following operations. First, a bit ω is chosen and viω is used to produce the message.Then, the corresponding message is sent toA.(4)
Query 2:A makes h1, h2, and h3 queries again until the numbers qhii=1,2,3 are reached.(5)
Guessing:A gives a bit ω′.
Ifω=ω′, we divide the advantage of A’s guessing into three parts. First, to avoid the collision of hash results, the upper probability is qh12+qh22+qh32/2ls+1, based on birthday paradox. Second, if the hash results are guessed correctly without oracle queries, the probability is at most qh1+qh2+qh3/2ls. Finally, if A could judge the message by generating a correct one for comparison, 1,r1X,∗, 2,r2X,∗, and 3,r1X‖∗r2X∗,Ai,7 can be obtained from Lh1,Lh2, and Lh3, respectively. So, the condition of A querying the correct strings is solving both GDH problems, and the probability is qh1qh2qh3ε2. Then, the theorem is deduced.Theorem 2.
The aggregation key generation phase is IND-CPA secure andAdvM2IND−CPAA≤qh42+2qh4/2q−1+qh52+qh62+qh72+qh82+2qh5+qh6+qh7+qh8/2ls+1+qh4qh5qh6qh8ε2.Proof.
The concrete operations are as follows:(1)
Initialization:S produces parameters as mentioned in Section 4.1.(2)
Query 1:A makes h4, h5, h6, h7, and h8 queries with the string str. S searches if there is the existed queried tuple i,str,result in Lhii=4,5,6,7,8. If true, result will be returned. Otherwise, S selects result∈0,1lsi=5,6,7,8 or result∈Zq∗i=4, and the tuple i,str,result is written into the list.(3)
Challenge:A selects strings s0 and s1 and sends them to S. Then, M2ω is produced as follows. First, S chooses a bit ω and sω is used to produce the message M2ω.Then, the corresponding message is sent toA.(4)
Query 2:A makes h4, h5, h6, h7, and h8 queries again until the numbers qhii=4,5,6,7,8 are reached.(5)
Guessing:A gives a bit ω′.
Ifω=ω′, we divide the advantage of A’s guessing into three parts. First, to avoid the collision of hash results, the upper probability is qh42/2q−1+qh52+qh62+qh72+qh82/2ls+1, based on birthday paradox. Second, if the hash results are guessed correctly without oracle queries, the probability is at most qh4/q−1+qh5+qh6+qh7+qh8/2ls. Finally, if A could judge the message by generating a correct one for comparison, 4,r3Y‖∗,∗∈Lh4, 5,r3Zj‖∗,∗∈Lh5, 6,r3Y‖∗,∗∈Lh6, and 8,∗‖r3Y,∗∈Lh8 could be found. The probability is at least 1/qhii=4,5,6,8. Like the analysis in Theorem 1, the probability is qh4qh5qh6qh8ε2. So, we get the theorem.Theorem 3.
The aggregation phase is IND-CPA secure andAdvM3IND−CPAA≤qh42+2qh4/2q−1+qh62+qh82+qh92+qh102+2qh6+qh8+qh9+qh10/2ls+1+qh4/q−1+qh4qh6qh8qh9ε2.Proof.
The concrete operations are as follows:(1)
Initialization:S produces parameters as mentioned in Section 4.1.(2)
Query 1: according toM3, all related hash functions hii=4,6,8,9,10 are queried by A. S searches if there is the existed queried tuple i,str,result in Lhii=4,6,8,9,10. If true, result will be returned. Otherwise, S selects result∈0,1lsi=6,8,9,10 or result∈Zq∗i=4, and the tuple i,str,result is written into the list.(3)
Challenge:A selects vi0 and vi1 and submits them to S. Then, M3 is produced as follows: first, a bit ω is chosen, and sω is used to produce M3ω.(4)
Query 2:A makes h4, h6, h8, h9, and h10 queries again until the numbers qhii=4,6,8,9,10 are reached.(5)
Guessing:A gives a bit ω′.
Ifω=ω′, we divide the advantage of A’s guessing into three parts. First, to avoid the collision of hash results, the upper probability is qh42/2q−1+qh62+qh82+qh92+qh102/2ls+1. Second, if the hash results are guessed correctly without oracle queries, the probability is at most qh4/q−1+qh6+qh8+qh9+qh10/2ls. Finally, if A could judge the message by generating a correct one for comparison, 4,r3Y‖∗,∗∈Lh4, 6,r3Y‖∗,∗∈Lh6, 8,∗‖r3Y,∗∈Lh8, and 9,r4Y‖∗,∗∈Lh9 could be found. The probability is at least 1/qhii=4,6,8,9. Like the analysis in Theorem 1, the probability is qh4qh6qh8qh9ε2. So, we get the theorem.


## 4.1. Basic Knowledge of IND-CPA Security for Our Scheme

Three games are brought in to explain the security for the three messages. We show the game process and then give the analysis of the games. The results show how the scheme keeps IND-CPA security. The proposed scheme meets the CPA security requirements if the polynomial time adversaryA has negligible probability to win the games. A simulator S is used to provide the random oracle query service and A makes queries to try to break the IND-CPA security. All games can be divided into five phases as follows:(1)
Initialization:S generates system parameters including G with generator P and large prime order q, public keys of FDj, UP, and TS, identities of smart meters, fog devices, trusted server and utility provider, secret keys between FDj and UP, and hash functions. We define the public keys of TS. UP and FDj are X=aTSP, Y=aUPP, and Z=ajP, respectively, where aTS, aUP, and aj are unknown.(2)
Query 1:A queries the hash oracles, and S returns the results.(3)
Challenge:A selects fresh information info0 and info1 to S. S then chooses a bit ω∈0,1. And infoω is used to generate the corresponding message in the game.(4)
Query 2: it is same as query 1.(5)
Guess:A should give a bit ω′ as the result of guessing ω. If ω=ω′, A wins the game.A knows all public parameters and all identities of participants. He will ask hi oracle for qhii=1,2,…10 times. There are hash lists for storing A’s corresponding hash queries. For instance, Lhi stores i,str,result, where hi is queried by A and result is the hash result of str. The advantage for A breaking the message Mbb=1,2,3 is denoted as AdvMbIND−CPAA=Prω=ω′−1/2. In the following proofs, we only consider the extra probabilities beyond 1/2. As mentioned in Section 2.2, ε=AdvAGDHt, and we employ the probability to express the hard level of solving the GDH problem in the following theorems. That probability is used when we find the tuple format aP,bP,abP occurring in the hash list Lhi, where a and b are unknown, as we mentioned also in Section 2.2.


## 4.2. Proof of CPA

Theorem 1.
The data encryption phase is IND-CPA secure andAdvM1IND−CPAA≤qh12+qh22+qh32+2qh1+qh2+qh3/2ls+1+qh1qh2qh3ε2.Proof.
The concrete operations are as follows:(1)
Initialization:S produces parameters as mentioned in Section 4.1.(2)
Query 1:A makes h1, h2, and h3 queries with the string str. S searches if there is the existed queried tuple i,str,result in Lhii=1,2,3. If true, result will be returned. Otherwise, S selects result∈0,1ls, and the tuple i,str,result is written into the list.(3)
Challenge:A selects vi0 and vi1 and submits them to S. S produces M1ω as the following operations. First, a bit ω is chosen and viω is used to produce the message.Then, the corresponding message is sent toA.(4)
Query 2:A makes h1, h2, and h3 queries again until the numbers qhii=1,2,3 are reached.(5)
Guessing:A gives a bit ω′.
Ifω=ω′, we divide the advantage of A’s guessing into three parts. First, to avoid the collision of hash results, the upper probability is qh12+qh22+qh32/2ls+1, based on birthday paradox. Second, if the hash results are guessed correctly without oracle queries, the probability is at most qh1+qh2+qh3/2ls. Finally, if A could judge the message by generating a correct one for comparison, 1,r1X,∗, 2,r2X,∗, and 3,r1X‖∗r2X∗,Ai,7 can be obtained from Lh1,Lh2, and Lh3, respectively. So, the condition of A querying the correct strings is solving both GDH problems, and the probability is qh1qh2qh3ε2. Then, the theorem is deduced.Theorem 2.
The aggregation key generation phase is IND-CPA secure andAdvM2IND−CPAA≤qh42+2qh4/2q−1+qh52+qh62+qh72+qh82+2qh5+qh6+qh7+qh8/2ls+1+qh4qh5qh6qh8ε2.Proof.
The concrete operations are as follows:(1)
Initialization:S produces parameters as mentioned in Section 4.1.(2)
Query 1:A makes h4, h5, h6, h7, and h8 queries with the string str. S searches if there is the existed queried tuple i,str,result in Lhii=4,5,6,7,8. If true, result will be returned. Otherwise, S selects result∈0,1lsi=5,6,7,8 or result∈Zq∗i=4, and the tuple i,str,result is written into the list.(3)
Challenge:A selects strings s0 and s1 and sends them to S. Then, M2ω is produced as follows. First, S chooses a bit ω and sω is used to produce the message M2ω.Then, the corresponding message is sent toA.(4)
Query 2:A makes h4, h5, h6, h7, and h8 queries again until the numbers qhii=4,5,6,7,8 are reached.(5)
Guessing:A gives a bit ω′.
Ifω=ω′, we divide the advantage of A’s guessing into three parts. First, to avoid the collision of hash results, the upper probability is qh42/2q−1+qh52+qh62+qh72+qh82/2ls+1, based on birthday paradox. Second, if the hash results are guessed correctly without oracle queries, the probability is at most qh4/q−1+qh5+qh6+qh7+qh8/2ls. Finally, if A could judge the message by generating a correct one for comparison, 4,r3Y‖∗,∗∈Lh4, 5,r3Zj‖∗,∗∈Lh5, 6,r3Y‖∗,∗∈Lh6, and 8,∗‖r3Y,∗∈Lh8 could be found. The probability is at least 1/qhii=4,5,6,8. Like the analysis in Theorem 1, the probability is qh4qh5qh6qh8ε2. So, we get the theorem.Theorem 3.
The aggregation phase is IND-CPA secure andAdvM3IND−CPAA≤qh42+2qh4/2q−1+qh62+qh82+qh92+qh102+2qh6+qh8+qh9+qh10/2ls+1+qh4/q−1+qh4qh6qh8qh9ε2.Proof.
The concrete operations are as follows:(1)
Initialization:S produces parameters as mentioned in Section 4.1.(2)
Query 1: according toM3, all related hash functions hii=4,6,8,9,10 are queried by A. S searches if there is the existed queried tuple i,str,result in Lhii=4,6,8,9,10. If true, result will be returned. Otherwise, S selects result∈0,1lsi=6,8,9,10 or result∈Zq∗i=4, and the tuple i,str,result is written into the list.(3)
Challenge:A selects vi0 and vi1 and submits them to S. Then, M3 is produced as follows: first, a bit ω is chosen, and sω is used to produce M3ω.(4)
Query 2:A makes h4, h6, h8, h9, and h10 queries again until the numbers qhii=4,6,8,9,10 are reached.(5)
Guessing:A gives a bit ω′.
Ifω=ω′, we divide the advantage of A’s guessing into three parts. First, to avoid the collision of hash results, the upper probability is qh42/2q−1+qh62+qh82+qh92+qh102/2ls+1. Second, if the hash results are guessed correctly without oracle queries, the probability is at most qh4/q−1+qh6+qh8+qh9+qh10/2ls. Finally, if A could judge the message by generating a correct one for comparison, 4,r3Y‖∗,∗∈Lh4, 6,r3Y‖∗,∗∈Lh6, 8,∗‖r3Y,∗∈Lh8, and 9,r4Y‖∗,∗∈Lh9 could be found. The probability is at least 1/qhii=4,6,8,9. Like the analysis in Theorem 1, the probability is qh4qh6qh8qh9ε2. So, we get the theorem.


## 5. Security Property Expression

The security properties are illustrated, and we compare our scheme with some recent ones [18, 20, 22, 27, 29]. Readers may search for some concrete details in corresponding studies. The results are given in Table 3. ✓ denotes the scheme meets the security property, while × denotes the opposite case. If the property is not fit for the scheme, ∅ is used. P1–P7 denote confidentiality, user anonymity, traceability, data aggregation, scalability, against internal attacks, and replay attacks, respectively. From the results, we see that the proposed scheme meets all the security requirements.Table 3
Security property.
P1P2P3P4P5P6P7Ours✓✓✓✓✓✓✓[29]✕✓✓✓✕✓✓[27]✓✓✕✓∅✓✓[18]✕✕✓✕✓∅✓[20]✓✕✕✓∅✓✓[22]✓∅✕✓∅✓✓


### 5.1. Confidentiality

First, we discuss our scheme. ForM1, if A wants to get vi and IDSMi, he should know TS’s secret key x to get r1X and r2X from r1P and r2P. For M2, if A wants to get the critical element xh4r3Ys, he must know any of the private keys y or zj. For M3, if A wants to get the element h4−1r3Ys, he must know any private keys same as in M2.Moreover, in [29], the keys for reencryption are directly sent to the public cloud server in the rekey phase, and they are exposed in the channel. Also, there is no authentication between the public cloud server and UP, so the data generated in this phase can be changed, e.g., adding P on c2. UP cannot check the correctness of data. Last, the consumption information is leaked. In the Enc phase, power usage quan and the cost fee are sent by rX+quan⋅P and rX+fee⋅P, respectively. A could calculate α=fee−quan by subtraction and Pollard rho algorithm. Then, A gets α=quanfee/quan−1. Fee/quan is just the price of electricity in the fixed period, and the power usage quan can be deduced.


### 5.2. User Anonymity

In our scheme,IDSMi is hidden by h2r2X. A should know TS’s secret key x to calculate r2X based on Ai,2=r2X. But in [18], the user identity may be exposed. Information of users who consume more electricity than the threshold will be exposed in the channel, including identity and power consumption. Using more electricity is not a crime, and it is unsuitable to publish user information simply due to such a case. Also, in [20], user identity is in plaintext obviously. So, we use × for the two schemes. In [22], user identity is not needed in the entire scheme, and ∅ is used.


### 5.3. Trace Ability

We set Section3.3 to make the power consumption of the user clear and to satisfy the basic function of the smart grid. TS computes B2=xAi,2 and IDSMi=Ai,4⊕h2B2 to get the identity IDSMi, accompanying with the consumption vi. Such calculations can make TS get the IDSMi,vi tuple and know the fee of the user consumption.However, in [20, 22, 27], no entity except the smart meter itself knows the power consumption. How to affirm the user’s fee for power usage is a difficult thing in the above three mentioned schemes.


### 5.4. Data Aggregation

Same as [20, 22, 27, 29], our scheme has the part of data aggregation, in order to analyze the statistical data on UP. But, in [18], data aggregation is not focused.


### 5.5. Scalability

In Section3.3, TS does not require exhaustive searching for checking the identity. Or we say that no extra computation is before searching, even a hash result. But, in [29], if UP questions for some smart meter, the trusted server should use a scalar multiplication and a hash function to check all indexed users. We use × at the corresponding blank. But, such property does not fit for [20, 22, 27], since no tracking operation is in any of them.


### 5.6. Against Internal Attack

We make analysis based on the fourth item in Section2.4. Since no fine-grained data appear in UP, if A colludes with UP to crack the messages, A still faces DL problem and GDH problem to get the timely private data from the messages due to lack of the private key x. A similar situation for colluding with fog devices can be deduced.


### 5.7. Against Replay Attack

To avoid replay attack, timestampst1, t2, and t3 are used in our scheme. Once A tries to modify any message, he must change the element for checking. In M1, Ai,7 contains t1, where r1X and r2X are also included. Computing the two results mean that two GDH problems should be cracked, based on Ai,1=r1P, Ai,2=r2P, and the public key of TS. In M2, t2 is used in B8, where r3Y, s, and x are also referred. Besides guessing s and x, computing r3Y also means that one GDH problem should be cracked, based on B5=r3P and the public key of UP. Similar situation occurs in M3. t3 is used in C13, where r4Y is needed to crack based on C11=r4P and public key of UP.


## 5.1. Confidentiality

First, we discuss our scheme. ForM1, if A wants to get vi and IDSMi, he should know TS’s secret key x to get r1X and r2X from r1P and r2P. For M2, if A wants to get the critical element xh4r3Ys, he must know any of the private keys y or zj. For M3, if A wants to get the element h4−1r3Ys, he must know any private keys same as in M2.Moreover, in [29], the keys for reencryption are directly sent to the public cloud server in the rekey phase, and they are exposed in the channel. Also, there is no authentication between the public cloud server and UP, so the data generated in this phase can be changed, e.g., adding P on c2. UP cannot check the correctness of data. Last, the consumption information is leaked. In the Enc phase, power usage quan and the cost fee are sent by rX+quan⋅P and rX+fee⋅P, respectively. A could calculate α=fee−quan by subtraction and Pollard rho algorithm. Then, A gets α=quanfee/quan−1. Fee/quan is just the price of electricity in the fixed period, and the power usage quan can be deduced.


## 5.2. User Anonymity

In our scheme,IDSMi is hidden by h2r2X. A should know TS’s secret key x to calculate r2X based on Ai,2=r2X. But in [18], the user identity may be exposed. Information of users who consume more electricity than the threshold will be exposed in the channel, including identity and power consumption. Using more electricity is not a crime, and it is unsuitable to publish user information simply due to such a case. Also, in [20], user identity is in plaintext obviously. So, we use × for the two schemes. In [22], user identity is not needed in the entire scheme, and ∅ is used.


## 5.3. Trace Ability

We set Section3.3 to make the power consumption of the user clear and to satisfy the basic function of the smart grid. TS computes B2=xAi,2 and IDSMi=Ai,4⊕h2B2 to get the identity IDSMi, accompanying with the consumption vi. Such calculations can make TS get the IDSMi,vi tuple and know the fee of the user consumption.However, in [20, 22, 27], no entity except the smart meter itself knows the power consumption. How to affirm the user’s fee for power usage is a difficult thing in the above three mentioned schemes.


## 5.4. Data Aggregation

Same as [20, 22, 27, 29], our scheme has the part of data aggregation, in order to analyze the statistical data on UP. But, in [18], data aggregation is not focused.


## 5.5. Scalability

In Section3.3, TS does not require exhaustive searching for checking the identity. Or we say that no extra computation is before searching, even a hash result. But, in [29], if UP questions for some smart meter, the trusted server should use a scalar multiplication and a hash function to check all indexed users. We use × at the corresponding blank. But, such property does not fit for [20, 22, 27], since no tracking operation is in any of them.


## 5.6. Against Internal Attack

We make analysis based on the fourth item in Section2.4. Since no fine-grained data appear in UP, if A colludes with UP to crack the messages, A still faces DL problem and GDH problem to get the timely private data from the messages due to lack of the private key x. A similar situation for colluding with fog devices can be deduced.


## 5.7. Against Replay Attack

To avoid replay attack, timestampst1, t2, and t3 are used in our scheme. Once A tries to modify any message, he must change the element for checking. In M1, Ai,7 contains t1, where r1X and r2X are also included. Computing the two results mean that two GDH problems should be cracked, based on Ai,1=r1P, Ai,2=r2P, and the public key of TS. In M2, t2 is used in B8, where r3Y, s, and x are also referred. Besides guessing s and x, computing r3Y also means that one GDH problem should be cracked, based on B5=r3P and the public key of UP. Similar situation occurs in M3. t3 is used in C13, where r4Y is needed to crack based on C11=r4P and public key of UP.


## 6. Performance Evaluation

In this section, we compare our scheme with [20, 22, 29] via time cost and communication cost. The test platform is MIRACL Library under Ubuntu 20, with Intel(R) Core(TM) i5-9400H CPU 2.50 GHz and 16.0 GB memory. The length of points on the elliptic curve is 320 bits, where the order of the additive group is 160 bits long. The timestamps have 64 bits, while all identities of devices have 32 bits and the hash function is Sha2-256. We use AES as the symmetric encryption/decryption algorithm in [29]. The symbols of time cost are given in Table 4, and the time cost comparison is given in Table 5. We use PH1–PH5 to express phases including data encryption, consumption affirmation, aggregation key generation, aggregation, and aggregated data decryption. k is the number of smart meters belonging to one fog device, and m is the number of fog devices.Table 4
Time cost for referred cryptographical operations.
SymbolMeaningTime (ms)TsTime of one scalar multiplication onG0.2898TseTime of symmetric encryption/decryption0.01368T2eTime of double exponentiation in the group0.3528ThTime of Sha2-2560.003128TiTime of one inversion in a group0.02673TmTime of one multiplication in a group0.00169TaTime of one point addition onG0.00184TPRTime of one pollard rho algorithm61.4667Table 5
Time cost comparison (ms).
PH1PH2PH3PH4PH5Ours6Ts+3Th+6Ta=1.75914Ts+3Th+6Takm≤m=1.1795km3Ts+6Th+Ti=0.91485Ts+4Th+4k−1Ta4Ts+4Th+2Tm+6Ta+2TPR=124.1195[29]5Ts+Tse+2Th=1.46883Ts+Tse+Th+2Ta+2TPRkm=123.8264kmTs+Th+Ti+2Tm=0.32302k+1Ts+4kTa=0.5869k+0.57962Tm+2Ta+2TPR=124.1593[20]T2e+Te+Th+Tm=0.6602k+1T2e+2Te+4k−1Tm+3kTh=0.3690k+0.6537T2e+Te+tm+Th+Ti+TPR=62.516[22]T2e+Te+Th+Tm=0.96442kT2e+k+1Te+k+1Th+2k−1Tm=1.0147k+0.304T2e+Te+Th+3Tm+TPR=62.1302From Table5, we see that our scheme costs less than [29] in PH2 and PH5. In PH1, we use two random numbers for scalar multiplications. Since the power usage and fee are relatively small numbers, it is probable to calculate the private consumption, as we have demonstrated in Section 5.1 for [29]. In PH3, we add the operations to protect the rekeys, while there is no such idea in [29]. In PH5, since each submission of FDj will cost the same time, we only list one round calculation in UP. Our scheme costs only a little more than [29]. Here, we should claim that there is no phase like PH2 and PH3 in schemes [20, 22], so the corresponding blanks are empty. In PH5, only one Pollard rho algorithm is used in [20, 22], since the final result is aimed at the aggregation value of consumption that is different from our scheme and [29], which also have another target of the variance value. In PH4, as long as a natural condition k>2 exists, we see that our scheme costs better than [20, 22, 29]. The verifications of the process are settled on TS for our scheme and [29], unlike [20, 22], such the verification is put on the media devices. The reason is that the cost of user consumption needs to be calculated and affirmed.We illustrate the concrete communication cost here. For our scheme, in the data encryption phase,M1 has 320∗4+256∗3+64=2112 bits, and there are totally 2112km bits in one period. In the consumption affirmation phase, all FDs submit the collected messages to TS, and the total information is the same as the last step. In the aggregation key generation phase, M2 has 320+256∗4+64=1408 bits, and there are totally 1408m bits in one transmission. In the aggregation phase, M3 has 320∗6+256∗4+32+64∗2=3104 bits, and there are totally 3104m bits. So, the whole communication cost is 4224km+4512m bits. We evaluate the transmission situation. Generally, channels between smart meters and their corresponding fog devices are considered to be wireless. Suppose a normal building for residents, about 30 floors, and generally, it has less than 200 houses. Each smart meter submits its data in every 15 minutes [35]. In the 15-minute period, there are less than 2112∗200=422400bits in total or less than 470bps, that is, a very small data rate. Second, we consider wired transmission messages M2 and M3. Suppose there are 100000 fog devices to send the messages. The total data volume is 100000∗4512=451200000<500Mbits. Note such volume is for 15 minutes, and the fiber can support 10 Gbps rate [36]. So, the communication cost in our scheme is practical.On the other side, for scheme in [29], in the enc phase, the message has 256+32+256+320∗3+64=1568 bits and in total 1568km bits. In the TTP-Dec phase, the message has 256+64+1568=1888 bits and in total 1888km bits. In the rekey phase, the message has 160∗2=320 bits and in total 320m bits. In the LiAgg-ReEnc phase, the message has 320∗4+160=1440 bits and in total 1440m bits. So, the whole communication cost is 3456km+1760m bits. All could see that our scheme costs more than the scheme in [29]. However, according to our analysis of Section 4 and Section 5, our scheme is CPA secure and meets common security properties. Moreover, in [29], only CPA security is proved only for Enc and LiAgg-ReEnc phases. How to transmit the aggregation key from trusted server (corresponding to TTP in [29]) to FD (corresponding to PCS in [29]) is not demonstrated. If the secure channel is used, such cost is high. So, we consider that the consumption information is transmitted in public channels. At the same time, the whole scheme in [29] does not even reach CPA security, and the cost of time and communication increases in our scheme is rewarding.Schemes in [20, 22] belong to the same type. They both lack the communication between the servers which calculates the aggregation data and the media device, like collector or gateway. In Ding et al.’s scheme [20], the message from the smart meter to the collector has 1024+1024+1024+1024+64+32=4192 bits and in total 4192km bits. The message from the collector to the electricity service provider has the same construction as the last, and there are 4192m bits. Finally, we could see that 4192km+4192m bits occur in the whole process. Similarly, in Wang et al.’s scheme [22], the entire communication cost is 3616km+3552m bits. However, both of them have weaknesses including lack of user anonymity and no consideration of traceability, which we have mentioned in Section 5. Also, no statistic data are deduced on service providers on both of them [20, 22].Above all, our scheme is better than other schemes in [20, 22, 29] for security and practicality.


## 7. Conclusion

In this study, based on industrial Internet of Things, we give a novel scheme on smart grid, getting user power consumption and statistical data simultaneously. Formal proof with random oracle condition is shown to illustrate CPA security of the presented scheme. We also compare our scheme with some relative schemes for smart grid, and all can see ours is the only one that satisfies the security requirements. Via time and communication cost study, we express that our scheme performs well and it is fit for practicality.The security level is an important index to evaluate the scheme. In the future, we will try to enhance the security level of such scheme, e.g., designing a new scheme that resists chosen-ciphertext attack and meets the practical requirements like tracking the concrete power consumption of every user and not only owns the function of aggregating data.



---

*Source: 4548374-2022-06-22.xml*