# Efficient Privacy-Preserving Data Aggregation Scheme with Fault Tolerance in Smart Grid

Authors: Yang Ming; Yabin Li; Yi Zhao; Pengfei Yang
Journal: Security and Communication Networks
 (2022)

---

## Abstract

As the traditional grid produces a large amount of greenhouse gas and cannot adapt to such new demands as dynamic electricity prices, data analysis, and early warning, smart grid with high efficiency and reliability is increasingly valued. It plays a key role in achieving carbon neutrality. Nonetheless, smart grid requires the collection of real-time power data, and personal privacy may be leaked through the frequent electricity measurement reports. With the requirements of data analysis and prediction while preserving users’ personal privacy, data aggregation schemes have emerged. However, existing schemes cannot resolve all the troubles well. Some schemes do not consider the failures for smart meters, and most of the schemes have expensive computation cost. In view of this, an efficient privacy-preserving data aggregation scheme with fault tolerance in smart grid is put forward in this paper. To be specific, the proposed scheme is lightweight due to the application of the symmetric homomorphic encryption technology and the elliptic curve cryptography. Even if some smart meters are destroyed, the proposed scheme can still successfully obtain aggregated data. Moreover, the proposed data aggregation scheme is proved to be secure, and all security requirements can be satisfied. Performance evaluation illustrates the relatively low computation cost and communication overhead of the proposed scheme compared to other related schemes.


---

## Body

## 1. Introduction

In recent years, the negative effects of global warming have become increasingly significant, as can be observed from the rising sea levels and the destruction of biodiversity. All countries are looking for ways to achieve carbon neutrality [1]. The application of smart grid (SG) can effectively accelerate the realization of this goal, and SG is included in long-term development plans [2–6]. Compared with traditional grid, SG has the advantages of conforming to low-carbon sustainable development, adopting a two-way communication mode, and allowing for diversified gradient electricity prices and early warning based on status analysis [7–9]. These features compensate for various shortcomings of traditional power grid; therefore, SG is considered an excellent next-generation power system. Figure 1 illustrates the framework of SG, which consists of the markets, control center, service provider, energy generation, transmission, distribution, and customers [10].Figure 1
Framework of the smart grid.For the information communication in SG, a large number of sensors are employed, especially smart meters (SM), which need to collect real-time household power measurement data every 10–15 minutes and send them to the control center (CC) for electricity data analysis and dispatch [11]. It is very time-consuming for a large amount of data transmission; at the same time, real-time data transmission also raises people’s privacy concern. According to the survey [12, 13], individual real-time electricity consumption data will expose sensitive information of users; for example, the lifestyle and living habits of family members might be exploited by malicious adversary.In order to deal with the above contradiction simultaneously, data aggregation technology has been proposed, where SM will use homomorphic encryption to protect real-time power data and upload ciphertext to gateway (GW); then, data ciphertext is aggregated by GW and sent to CC. Finally, CC can take advantage its private key to decrypt the aggregated ciphertext, but it is unable to gain a single power measurement data of a SM. In this way, the users’ personal privacy information can be protected, and in the meanwhile, CC can analyze power measurement data and allocate and adjust power supply in a timely and reasonable manner.Although there have been many data aggregation schemes [14–37], many issues are still worthy of further improvement.First, SM exposed to an environment without any protection may malfunction and cannot send reports; the lack of partial power data reports may make the system fail to recover the aggregated power data. The feature of fault tolerance enables the recovery of the aggregated data despite the SM malfunction. Some previously existing aggregation schemes [14, 16–20] do not support fault tolerance, so they cannot obtain normally aggregated data, and the entire system will be paralyzed. Although some other schemes [22, 24, 29] achieve fault tolerance, their trusted authority (TA) or CC needs to do some special operations, such as generating dummy ciphertext; this is not very practical because the number of GW and SM under the control of the TA is enormous, which will bring unbearable computation costs to the TA.Second, since the GW and CC are semitrusted, they may launch collision attacks to obtain the private data of a single SM. In the existing schemes [22, 28, 30, 37], the data reports are encrypted directly with the public key of CC. If GW sends the ciphertext of a certain SM to CC, or CC accidentally obtains the single ciphertext, the individual report can be decrypted by CC through its private key.Third, identity privacy is also a kind of secret information, which should be protected; meanwhile, when malicious SM appear, its real identity should be revealed by the TA. Some existing schemes [18, 23, 25, 26] fail to consider identity privacy, some other schemes [16, 17, 20, 27] achieve identity anonymity, but the way is that the data reports do not contain identity information, which makes it impossible to trace the identity of the malicious SM when it appears.In order to settle the above problems and realize further optimization, an efficient data aggregation scheme that would support fault tolerance is proposed. The primary contributions are shown below:(i)
The proposed scheme applies lightweight symmetric homomorphic encryption technology and elliptic curve signature to accomplish efficiency, instead of commonly used time-consuming public key homomorphic encryption technologies such as Paillier [38] and BGN [39]. It is also characterized by the feature of fault tolerance, thus being able to run normally even if some SM fail to upload data reports.(ii)
The security analysis formally proves that the proposed aggregation scheme is secure based onℒ,p^-based decision problem and elliptic curve discrete logarithm problem. Moreover, the proposed scheme would implement required security requirements, especially to resist collusion attacks.(iii)
Performance evaluation carries out quantitative analysis, and the result displays; the proposed scheme involves less computation cost and communication overhead compared with other related data aggregation schemes.The structure of the rest of this paper is allocated as follows. Section2 displays the related works of data aggregation schemes. The background and preliminaries are given in Sections 3 and 4, respectively. In Section 5, the proposed scheme is introduced in detail. Sections 6 and 7, respectively, illustrate the security analysis and the performance evaluation. Ultimately, the conclusion is described in Section 8.


## 2. Related Work

With the long-term research of data aggregation technology, many problems are considered to satisfy the security requirements, for instance, collision attack, fault tolerance, and identity privacy protection.The related aggregation schemes are vulnerable to various attacks, especially collision attacks. Compared with external adversaries, internal attackers are more likely to damage the SG system because they have more private information. Fan et al. [14] first considered collision attacks and successfully resisted them by virtue of blinding factors assigned by a trusted third party. Regrettably, Bao and Lu [15] illustrated the integrity drawback of the scheme [14], which lies in that the private key of the user was easily recovered so that data pollution would be caused. He et al. [16] created the certificateless data aggregation scheme by the mechanism of elliptic curve cryptography which could speed up the process and withstand the collision attacks. He et al. [17] improved the BGN scheme to realize data aggregation scheme against collision attacks. Zhang et al. [18] considered the false data injection attacks and prevented them with the blinding factors. Li et al. [19] applied the BGN encryption and blinding factors to complete data aggregation scheme that can prevent collision attacks. Shen et al. [20] put forward the aggregation scheme that can counteract new malicious data mining attacks and internal attacks with BLS short signature. Based on elliptic curve cryptography, a scalable data aggregation scheme was designed by Chen et al. [21], where the encryption key, instead of the public key of CC, was generated independently, even if CC cannot decrypt the single ciphertext.Once SM malfunction appears and hinders the normal submission of electricity reports, most of the above schemes [14, 16–20] would be paralyzed. Therefore, fault tolerance needs to be taken into consideration. In the scheme [22] of Chen et al., a trusted third party additionally generated the dummy ciphertext for the damaged SM to ensure the smooth running of the agreement as the trusted third party held the private keys of all users. Bao and Lu [23] advanced the differentially private aggregation scheme with fault tolerance, where CC was still able to receive the aggregated data from the remaining reports. Pan et al. [24] combined with Lagrangian interpolation technology to propose a two-dimensional and fault-tolerable privacy-preserving aggregation scheme. Ge et al. [25] put forward a fine-grained data analysis scheme which could still run even if the meter was failed, and this scheme could obtain a variety of statistics. Xue et al. [26] proposed the privacy-preserving service outsourcing scheme, which supported fault tolerance mechanism and flexible electricity price. Guan et al. [27] utilized the Shamir sharing method and RSA signature to implement the fault tolerant aggregation protocol, yet this protocol cannot be decrypted correctly. In [28], Ding et al. raised an identity-based secure data aggregation scheme, which supported fault tolerance due to their particular ciphertext structure. Wang et al. [29] skillfully improved the Paillier encryption to get the fault tolerant data aggregation scheme through collaborating between users; unfortunately, the integrity was not considered here. In general, when facing SM malfunction, TA will perform additional operations to achieve fault tolerance, but it will be overloaded because it manages many GW and many SM under GW.In addition, user identity privacy is an important security problem. Liu et al. [30] utilized the blind signature technology to realize an anonymous data aggregation scheme, where the token was unlinkable to any valid signature. Combined with the ring signature technology, Badra and Zeadally [31] blocked the connection between the content of the report and the identity of the SM. Tan et al. [32] designed a privacy-preserving pseudonym-based collection scheme, where the SM adopted the group key to generate a pseudoidentity so that the adversary was unable to get its real identity. Gong et al. [33] satisfied anonymity by separating data reports and identity of the SM.Although the above schemes achieve different functions and features, most of them are time-consuming, which can make SM with limited calculation resources embarrassing. He et al. [34] applied batch verification to accelerate the execution of the aggregation scheme. Combining the elliptic curves cryptography and super-increasing sequence technology, Ming et al. [35] came up with an efficient privacy-preserving multidimensional data aggregation scheme, which can classify power measurement data and achieve fine-grained analysis. In scheme [36] of Shen et al., XOR operation of pseudorandom function was employed to encrypt power data and realize confusion so that the adversary could not identify the source of the reports. Zhang et al. [37] adopted online and offline signature technology to create a lightweight aggregation scheme, which would help to speed up the signature verification process.


## 3. Background

The background of the proposed scheme is described, mainly including system model, security requirements, and design goal in this section.


### 3.1. System Model

In the proposed scheme, the system model is divided into four entities: trusted authority (TA), control center (CC), gateway (GW), andn smart meters (SM), as shown in Figure 2. For the ease of description, considering only one GW, we link nn>1 smart meters in the model.(1)
TA: it is a fully trusted entity, who produces the blinding factors and the secret value for SM. TA would recover the exact identity of the SM with malicious behavior.(2)
CC: it is a semitrusted entity, who generates the system parameters. CC is also in charge of the registration of SM and GW. In addition, after receiving aggregated encrypted data from GW, CC will decrypt and analyze them.(3)
GW: it is a semitrusted entity. GW collects and aggregates the encrypted electricity report from each domain header; then, GW transmits it to CC.(4)
SM: according to geographical proximity principle, entiren SM are divided into ω domains D1,D2,…,Dω, and each domain Dii=1,2,…,ω contains t members, that is, ω⋅t=n. In the ith domain Di, a random member is selected as the domain header. Without loss of generality, assuming that the first member SMi1 is appointed as the domain header SMi1H by GW, obviously, the domain header SMi1H itself is also a member in Di. Here, the domain member SMijj=1,2,…,t is charge of collecting electricity measurement data of each user’s household and sending it to SMi1H. The domain header SMi1H is responsible for preaggregating the data report in the domain Di and then uploading it to GW. Besides, SMij is not allowed to send electricity report directly to GW. It is worth noting that all SM cannot collude with GW or CC.Figure 2
System model.


### 3.2. Security Requirements

The security requirements that the proposed scheme should satisfy are as follows:(1)
Confidentiality: the electricity data are closely related to users’ privacy information. Therefore, only useless knowledge can be obtained even if the adversary gets the transmitted ciphertext.(2)
Authentication: it is necessary to realize the authentication because the report transmission between any two entities must verify each other to ensure legal identity.(3)
Integrity: the report transmitted in the open channel may be tampered, and wrong message may be conveyed. So, the proposed scheme would detect whether the report has been altered.(4)
Anonymity and traceability: no entity other than TA can determine or distinguish identity by analyzing transmitted reports. From another aspect, when a malicious SM uploads fake data, its true identity should be revealed by TA to supervise the behavior.(5)
Resistance against common attacks: the proposed scheme should guarantee that many common types of attacks would be rejected, including but not limited to collision attack, modification attack, and replay attack.


### 3.3. Design Goal

The proposed scheme satisfies the following the objectives.(1)
Privacy-preserving: the actual data and identity of a single SM are prohibited from being obtained by anyone. CC is only allowed to decrypt aggregated data ciphertext. In addition, the abovementioned attacks should be resisted.(2)
Fault tolerance: it is unbearable that the aggregated data cannot be recovered when few SM are damaged. Therefore, even if some SM fail to submit reports, the system should continue to run normally.(3)
High efficiency: on the premise of fulfilling the above security requirements, the proposed scheme tries to reduce the computation cost and communication overhead. For practical smart grid, an efficient scheme is more suitable for SM with limited resources.


## 3.1. System Model

In the proposed scheme, the system model is divided into four entities: trusted authority (TA), control center (CC), gateway (GW), andn smart meters (SM), as shown in Figure 2. For the ease of description, considering only one GW, we link nn>1 smart meters in the model.(1)
TA: it is a fully trusted entity, who produces the blinding factors and the secret value for SM. TA would recover the exact identity of the SM with malicious behavior.(2)
CC: it is a semitrusted entity, who generates the system parameters. CC is also in charge of the registration of SM and GW. In addition, after receiving aggregated encrypted data from GW, CC will decrypt and analyze them.(3)
GW: it is a semitrusted entity. GW collects and aggregates the encrypted electricity report from each domain header; then, GW transmits it to CC.(4)
SM: according to geographical proximity principle, entiren SM are divided into ω domains D1,D2,…,Dω, and each domain Dii=1,2,…,ω contains t members, that is, ω⋅t=n. In the ith domain Di, a random member is selected as the domain header. Without loss of generality, assuming that the first member SMi1 is appointed as the domain header SMi1H by GW, obviously, the domain header SMi1H itself is also a member in Di. Here, the domain member SMijj=1,2,…,t is charge of collecting electricity measurement data of each user’s household and sending it to SMi1H. The domain header SMi1H is responsible for preaggregating the data report in the domain Di and then uploading it to GW. Besides, SMij is not allowed to send electricity report directly to GW. It is worth noting that all SM cannot collude with GW or CC.Figure 2
System model.


## 3.2. Security Requirements

The security requirements that the proposed scheme should satisfy are as follows:(1)
Confidentiality: the electricity data are closely related to users’ privacy information. Therefore, only useless knowledge can be obtained even if the adversary gets the transmitted ciphertext.(2)
Authentication: it is necessary to realize the authentication because the report transmission between any two entities must verify each other to ensure legal identity.(3)
Integrity: the report transmitted in the open channel may be tampered, and wrong message may be conveyed. So, the proposed scheme would detect whether the report has been altered.(4)
Anonymity and traceability: no entity other than TA can determine or distinguish identity by analyzing transmitted reports. From another aspect, when a malicious SM uploads fake data, its true identity should be revealed by TA to supervise the behavior.(5)
Resistance against common attacks: the proposed scheme should guarantee that many common types of attacks would be rejected, including but not limited to collision attack, modification attack, and replay attack.


## 3.3. Design Goal

The proposed scheme satisfies the following the objectives.(1)
Privacy-preserving: the actual data and identity of a single SM are prohibited from being obtained by anyone. CC is only allowed to decrypt aggregated data ciphertext. In addition, the abovementioned attacks should be resisted.(2)
Fault tolerance: it is unbearable that the aggregated data cannot be recovered when few SM are damaged. Therefore, even if some SM fail to submit reports, the system should continue to run normally.(3)
High efficiency: on the premise of fulfilling the above security requirements, the proposed scheme tries to reduce the computation cost and communication overhead. For practical smart grid, an efficient scheme is more suitable for SM with limited resources.


## 4. Preliminaries

Two preknowledge are briefly stated in this section, including elliptic curve cryptography and symmetric homomorphic encryption.


### 4.1. Elliptic Curve Cryptography

The definition of elliptic curve cryptography (ECC) comes from Millier [40]. Let G be an additive cyclic group of prime order q; the generator is P. The security problem and assumption are described as follows.Elliptic curve discrete logarithm problem (ECDL problem) [41]: given two elements P,Q∈G in the elliptic curve E as input, output an integer a∈ℤq∗ where Q=aP.Elliptic curve discrete logarithm assumption (ECDL assumption) [41]: it is difficult for the probabilistic polynomial time algorithm to solve the ECDL problem with a nonnegligible advantage.


### 4.2. Symmetric Homomorphic Encryption

Mahdikhani et al. [42] designed a new symmetric homomorphic encryption; the algorithm is described as follows.KeyGenτ: on inputting the security parameter k0,k1,k2 satisfying k1≪k2<k0/2, the probabilistic key generation algorithm outputs the symmetric homomorphic encryption key K=p^,q^,ℒ, where the two large prime numbers p^,q^ satisfy p^=q^=k0 and ℒ is randomly selected from 0,1k2. Next, the algorithm calculates N=p^q^ and publishes the system parameters PP=k0,k1,k2,N.EncK,m,r,r′: on inputting the symmetric homomorphic encryption key K and the plaintext m∈ℳ, where the message space ℳ is 0,1k1, the encryption algorithm selects two random numbers r∈0,1k2 and r′∈0,1k0 and encrypts the plaintext:(1)c=rℒ+m1+r′p^modN.DecK,c: on inputting the ciphertext c and the symmetric homomorphic encryption key K, the decryption algorithm decrypts the ciphertext:(2)m=cmodp^modℒ.The security of symmetric homomorphic encryption [42] is based on the following security assumption.ℒ,p^-based decision problem [43]: given k0,k2,N, the ℒ,p^-based decision problem is to determine whether an integer x∈ℤN belongs to S or S¯ without p^,q^,ℒ, where(3)S:x=αℒ+βp^modN|α,β∈ℤN,αℒ<p^S¯=ℤN/S:x=αℒ+βp^modN|α,β∈ℤN,αℒ≥p^.ℒ,p^-based decision assumption [43]: it is difficult for the probabilistic polynomial time algorithm to solve the ℒ,p^-based decision problem with a nonnegligible advantage in k0 and k2.


## 4.1. Elliptic Curve Cryptography

The definition of elliptic curve cryptography (ECC) comes from Millier [40]. Let G be an additive cyclic group of prime order q; the generator is P. The security problem and assumption are described as follows.Elliptic curve discrete logarithm problem (ECDL problem) [41]: given two elements P,Q∈G in the elliptic curve E as input, output an integer a∈ℤq∗ where Q=aP.Elliptic curve discrete logarithm assumption (ECDL assumption) [41]: it is difficult for the probabilistic polynomial time algorithm to solve the ECDL problem with a nonnegligible advantage.


## 4.2. Symmetric Homomorphic Encryption

Mahdikhani et al. [42] designed a new symmetric homomorphic encryption; the algorithm is described as follows.KeyGenτ: on inputting the security parameter k0,k1,k2 satisfying k1≪k2<k0/2, the probabilistic key generation algorithm outputs the symmetric homomorphic encryption key K=p^,q^,ℒ, where the two large prime numbers p^,q^ satisfy p^=q^=k0 and ℒ is randomly selected from 0,1k2. Next, the algorithm calculates N=p^q^ and publishes the system parameters PP=k0,k1,k2,N.EncK,m,r,r′: on inputting the symmetric homomorphic encryption key K and the plaintext m∈ℳ, where the message space ℳ is 0,1k1, the encryption algorithm selects two random numbers r∈0,1k2 and r′∈0,1k0 and encrypts the plaintext:(1)c=rℒ+m1+r′p^modN.DecK,c: on inputting the ciphertext c and the symmetric homomorphic encryption key K, the decryption algorithm decrypts the ciphertext:(2)m=cmodp^modℒ.The security of symmetric homomorphic encryption [42] is based on the following security assumption.ℒ,p^-based decision problem [43]: given k0,k2,N, the ℒ,p^-based decision problem is to determine whether an integer x∈ℤN belongs to S or S¯ without p^,q^,ℒ, where(3)S:x=αℒ+βp^modN|α,β∈ℤN,αℒ<p^S¯=ℤN/S:x=αℒ+βp^modN|α,β∈ℤN,αℒ≥p^.ℒ,p^-based decision assumption [43]: it is difficult for the probabilistic polynomial time algorithm to solve the ℒ,p^-based decision problem with a nonnegligible advantage in k0 and k2.


## 5. The Proposed Scheme

In this section, a detailed privacy-preserving data aggregation scheme that supports fault tolerant in the smart grid is proposed, consisting of six phases: initialization phase, registration phase, report generation phase, report aggregation phase, report reading phase, and fault tolerant phase. All the notations used in this paper are described in Table1. The general picture of the proposed scheme is depicted in Figure 3.Table 1
Notations.
NotationsDescriptionTAThe trusted authorityCCThe control centerGWThe gatewaySMijThejth smart meter in the ith domainSMi1HThe domain header in theith domainGThe additive cyclic groupPThe generator ofGsTA,PpubThe private/public key pair of TAHiThe secure hash functionsθijThe blinding factor ofSMijnThe number of smart meterssij,SijThe private/public key pair ofSMijsG,SGThe private/public key pair of GWRIDijThe real identity ofSMijIDijThe pseudoidentity ofSMijKThe key of symmetric homomorphic encryptionTThe current timestampFigure 3
Overview of the proposed scheme.


### 5.1. Initialization

In this section, CC would produce the system parameters, TA would generate the blinding factors and the secret value for smart meters.


#### 5.1.1. Control Center

(1)
Given the security parameterk0,k1,k2,K, CC produces an additive cyclic group G of the prime order q satisfying q=K; G is based on a nonsingular elliptic curve E which is defined over a finite field Fp, satisfying p>q. CC chooses the generator P of G.(2)
CC randomly chooses two large prime numbersp^,q^ satisfying p^=q^=k0 and computes the public parameter N=p^q^. CC chooses arbitrary ℒ∈0,1k2 and computes Eij0=rijℒ+01+rij′p^modN and Eij1=rijℒ+11+rij′p^modN for SMiji=1,2,…,ω;j=1,2,…,t, where rij∈0,1k2 and rij′∈0,1k0 are two random numbers. CC secretly transmits the key K=p^,q^,ℒ to TA.(3)
CC chooses five secure hash functionsH:0,1∗⟶0,1k2, H1:0,1∗⟶0,1l, Hi:0,1∗⟶ℤq∗i=2,3,4, where l is the length of the real identity RIDi.(4)
CC publishes the system parametersG,p,q,P,k0,k1,k2,K,N,H,H1,H2,H3,H4.


#### 5.1.2. Trusted Authority

(1)
TA selects the random numbersTA∈ℤq∗ as the master secret key and calculates the corresponding public key Ppub=sTAP.(2)
TA selectsn arbitrary blinding factors θij∈ℤℒ satisfying ∑i=1ω∑j=1tθij=0modℒ.(3)
TA chooses a random secret valuek∈ℤℒ.(4)
TA secretly transmitsθij,k to SMiji=1,2,…,ω;j=1,2,…,t.


### 5.2. Registration

SMij and GW would register with CC, respectively, in this section.


#### 5.2.1. Smart Meters’ Registration

(1)
SMij randomly chooses sij,uij∈ℤq∗ and calculates the public key Sij=sijP and knowledge signature:(4)Uij=uijP,vij=sijH2RIDij,Sij,Uij+uij.Then,SMij transmits RIDij,Sij,Uij,vij to CC.(2)
After receivingRIDij,Sij,Uij,vij, CC verifies whether vijP=?SijH2RIDij,Sij,Uij+Uij. If it holds, CC randomly selects πij∈ℤq∗ and calculates the pseudoidentity IDij=IDij1,IDij2 for SMij, in which IDij1=πijP and IDij2=RIDij⊕H1πijPpub.(3)
CC publishesIDij,Sij,Uij,vij and secretly transmits Eij1,Eij0 to SMij.


#### 5.2.2. Gateway's Registration

(1)
GW randomly selectssG,uG∈ℤq∗ and computes the public key SG=sGP and knowledge signature(5)UG=uGP,vG=sGH2RIDG,SG,UG+uG.Then, GW sendsRIDG,SG,UG,vG to CC.(2)
CC verifies whethervGP=?SGH2RIDG,SG,UG+UG. If it holds, CC publishes RIDG,SG,UG,vG.


### 5.3. Report Generation

In this section,SMij would collect and transmit electricity data to GW.


#### 5.3.1.SMij Submits the Data Report to SMi1H

(1)
SMij collects electricity measurement data mij, randomly selects rij″∈0,1k2, and computes(6)Cij=mij+HT,kθijEij1+rij″Eij0modN,whereT is the current timestamp.(2)
SMij randomly chooses eij∈ℤq∗ and calculates(7)Eij=eijP,σij=sijH3Cij,Sij,IDij,Eij,T+eij.(3)
SMij submits the data report IDij,Cij,Eij,σij,T to SMi1H.


#### 5.3.2.SMi1H Uploads the Preaggregated Report to GW

(1)
GivenIDij,Cij,Eij,σij,T from other t−1SMij∈Di, SMi1H examines the timestamp T and verifies whether(8)σijP=?SijH3Cij,Sij,IDij,Eij,T+Eij.In order to speed up the verification,SMi1H uses small exponent test technology [44] to achieve batch verification. SMi1H randomly selects a set of tiny numbers ϕi2,ϕi3,…,ϕit∈1,2t and verifies whether(9)∑j=2tϕijσijP=?∑j=2tϕijSijH3Cij,Sij,IDij,Eij,T+∑j=2tϕijEij.(2)
Givent−1 data reports and his own data report Ci1, SMi1H randomly selects eiH∈ℤq∗ and calculates(10)Ci=∑j=1tCijmodN,EiH=eiHP,σiH=si1H3Ci,Si1,IDi1,EiH,TiH+eiH,whereTiH is the current timestamp.(3)
Finally,SMi1H uploads the preaggregated report IDi1,Ci,EiH,σiH,TiH to GW.


### 5.4. Report Aggregation

In this section, GW would verify and aggregate the preaggregated reports fromSMi1H. Afterward, GW would upload the aggregated report to CC.(1)
GivenIDi1,Ci,EiH,σiH,TiH from the domain headers SMi1Hi=1,2,…,ω, GW examines the timestamp TiH, randomly selects a group of tiny values ϕ1,ϕ2,…,ϕω∈1,2ω, and verifies whether(11)∑i=1ωϕiσiHP=?∑i=1ωϕiSi1H3Ci,Si1,IDi1,EiH,TiH+∑i=1ωϕiEiH.(2)
GW randomly selectseG∈ℤq∗ and calculates(12)C=∑i=1ωCimodN,EG=eGP,σG=sGH4C,SG,RIDG,EG,TG+eG.whereTG is the current timestamp.(3)
Finally, GW uploads the aggregated reportRIDG,C,EG,σG,TG to CC.


### 5.5. Report Reading

CC would verify and decrypt the aggregated report from GW in this section.(1)
ReceivingRIDG,C,EG,σG,TG from GW, CC checks the timestamp TG and verifies whether(13)σGP=?SGH4C,SG,RIDG,EG,TG+EG.(2)
CC decrypts aggregated electricity measurement data:(14)∑i=1ω∑j=1tmij=Cmodp^modℒ.(3)
CC analyzes and processes the aggregated data and makes optimal allocation.Correctness:(15)Cmodp^modℒ,=∑i=1ω∑j=1tCijmodNmodp^modℒ=∑i=1ω∑j=1tmij+HT,kθijEij1+rij″Eij0modNmodp^modℒ=∑i=1ω∑j=1tmij+HT,kθij+αijℒ+βijp^modNmodp^modℒ=∑i=1ω∑j=1tmij+HT,kθij+αijℒmodℒ=∑i=1ω∑j=1tmij+HT,k∑i=1ω∑j=1tθij+ℒ∑i=1ω∑j=1tαijmodℒ=∑i=1ω∑j=1tmij,where αij=mij+HT,kθijrij+rij′′rij and βij=rij′mij+HT,kθij1+rijℒ+rij′′rij′rijℒ.


### 5.6. Fault Tolerant

This section describes how to obtain the aggregated data when some smart meters fail to work normally.(1)
Assuming that only receivingλ−1λ<t reports, SMi1H performs the same operations as Section 5.3.2 except Ci=∑j=1λCijmodN. Then, SMi1H broadcasts IDi1,Ci,EiH,σiH,TiH,λ into the domain Di.(2)
GivenIDi1,Ci,EiH,σiH,TiH,λ, SMij examines the timestamp TiH and verifies the signature σiH. If it is valid, SMij randomly selects e^ij∈ℤq∗, r^ij∈0,1k2 and computes(16)C^ij=Ci−λHT,kθijEij1+r^ijEij0modN,E^ij=e^ijP,σ^ij=sijH3C^ij,Sij,IDij,E^ij,T^ij+e^ij,whereT^ij is the current timestamp. Then, SMij submits the report IDij,C^ij,E^ij,σ^ij,T^ij to SMi1H.(3)
After receivingλ−1 data reports IDij,C^ij,E^ij,σ^ij,T^ij from SMij∈Di, the domain header SMi1H examines λ−1 timestamp T^ij and verifies λ−1 signature σ^ij. If batch verification is valid, SMi1H randomly selects e^iH∈ℤq∗ and calculates(17)C^i=1λ∑j=1λC^ijmodN,E^iH=e^iHP,σ^iH=si1H3C^i,Si1,IDi1,E^iH,T^iH+e^iH,whereT^iH is the current timestamp. Finally, SMi1H uploads the preaggregated report IDi1,C^i,E^iH,σ^iH,T^iH to GW.(4)
GW and CC normally execute the protocol as Sections5.4 and 5.5, respectively. Finally, CC gets aggregated electricity data for no malfunctioning smart meters.Correctness:(18)Cmodp^modℒ,=∑i=1ωC^imodNmodp^modℒ=1λ∑i=1ω∑j=1λC^ijmodNmodp^modℒ=1λ∑i=1ω∑j=1λCi−λHT,kθijEij1+r^ijEij0modNmodp^modℒ=∑i=1ω∑j=1λCij−HT,kθijEij1+1λr^ijEij0modNmodp^modℒ=∑i=1ω∑j=1λmijEij1+rij″Eij0+1λr^ijEij0modNmodp^modℒ=∑i=1ω∑j=1λmij+α^ijℒ+β^ijp^modNmodp^modℒ=∑i=1ω∑j=1λmij+α^ijℒmodℒ=∑i=1ω∑j=1λmij+ℒ∑i=1ω∑j=1λα^ijmodℒ=∑i=1ω∑j=1λmij,where α^ij=mijrij1+rij′p^+rijrij′′+1/λr^ij1+rij′p^ and β^ij=mijrij′.


## 5.1. Initialization

In this section, CC would produce the system parameters, TA would generate the blinding factors and the secret value for smart meters.


### 5.1.1. Control Center

(1)
Given the security parameterk0,k1,k2,K, CC produces an additive cyclic group G of the prime order q satisfying q=K; G is based on a nonsingular elliptic curve E which is defined over a finite field Fp, satisfying p>q. CC chooses the generator P of G.(2)
CC randomly chooses two large prime numbersp^,q^ satisfying p^=q^=k0 and computes the public parameter N=p^q^. CC chooses arbitrary ℒ∈0,1k2 and computes Eij0=rijℒ+01+rij′p^modN and Eij1=rijℒ+11+rij′p^modN for SMiji=1,2,…,ω;j=1,2,…,t, where rij∈0,1k2 and rij′∈0,1k0 are two random numbers. CC secretly transmits the key K=p^,q^,ℒ to TA.(3)
CC chooses five secure hash functionsH:0,1∗⟶0,1k2, H1:0,1∗⟶0,1l, Hi:0,1∗⟶ℤq∗i=2,3,4, where l is the length of the real identity RIDi.(4)
CC publishes the system parametersG,p,q,P,k0,k1,k2,K,N,H,H1,H2,H3,H4.


### 5.1.2. Trusted Authority

(1)
TA selects the random numbersTA∈ℤq∗ as the master secret key and calculates the corresponding public key Ppub=sTAP.(2)
TA selectsn arbitrary blinding factors θij∈ℤℒ satisfying ∑i=1ω∑j=1tθij=0modℒ.(3)
TA chooses a random secret valuek∈ℤℒ.(4)
TA secretly transmitsθij,k to SMiji=1,2,…,ω;j=1,2,…,t.


## 5.1.1. Control Center

(1)
Given the security parameterk0,k1,k2,K, CC produces an additive cyclic group G of the prime order q satisfying q=K; G is based on a nonsingular elliptic curve E which is defined over a finite field Fp, satisfying p>q. CC chooses the generator P of G.(2)
CC randomly chooses two large prime numbersp^,q^ satisfying p^=q^=k0 and computes the public parameter N=p^q^. CC chooses arbitrary ℒ∈0,1k2 and computes Eij0=rijℒ+01+rij′p^modN and Eij1=rijℒ+11+rij′p^modN for SMiji=1,2,…,ω;j=1,2,…,t, where rij∈0,1k2 and rij′∈0,1k0 are two random numbers. CC secretly transmits the key K=p^,q^,ℒ to TA.(3)
CC chooses five secure hash functionsH:0,1∗⟶0,1k2, H1:0,1∗⟶0,1l, Hi:0,1∗⟶ℤq∗i=2,3,4, where l is the length of the real identity RIDi.(4)
CC publishes the system parametersG,p,q,P,k0,k1,k2,K,N,H,H1,H2,H3,H4.


## 5.1.2. Trusted Authority

(1)
TA selects the random numbersTA∈ℤq∗ as the master secret key and calculates the corresponding public key Ppub=sTAP.(2)
TA selectsn arbitrary blinding factors θij∈ℤℒ satisfying ∑i=1ω∑j=1tθij=0modℒ.(3)
TA chooses a random secret valuek∈ℤℒ.(4)
TA secretly transmitsθij,k to SMiji=1,2,…,ω;j=1,2,…,t.


## 5.2. Registration

SMij and GW would register with CC, respectively, in this section.


### 5.2.1. Smart Meters’ Registration

(1)
SMij randomly chooses sij,uij∈ℤq∗ and calculates the public key Sij=sijP and knowledge signature:(4)Uij=uijP,vij=sijH2RIDij,Sij,Uij+uij.Then,SMij transmits RIDij,Sij,Uij,vij to CC.(2)
After receivingRIDij,Sij,Uij,vij, CC verifies whether vijP=?SijH2RIDij,Sij,Uij+Uij. If it holds, CC randomly selects πij∈ℤq∗ and calculates the pseudoidentity IDij=IDij1,IDij2 for SMij, in which IDij1=πijP and IDij2=RIDij⊕H1πijPpub.(3)
CC publishesIDij,Sij,Uij,vij and secretly transmits Eij1,Eij0 to SMij.


### 5.2.2. Gateway's Registration

(1)
GW randomly selectssG,uG∈ℤq∗ and computes the public key SG=sGP and knowledge signature(5)UG=uGP,vG=sGH2RIDG,SG,UG+uG.Then, GW sendsRIDG,SG,UG,vG to CC.(2)
CC verifies whethervGP=?SGH2RIDG,SG,UG+UG. If it holds, CC publishes RIDG,SG,UG,vG.


## 5.2.1. Smart Meters’ Registration

(1)
SMij randomly chooses sij,uij∈ℤq∗ and calculates the public key Sij=sijP and knowledge signature:(4)Uij=uijP,vij=sijH2RIDij,Sij,Uij+uij.Then,SMij transmits RIDij,Sij,Uij,vij to CC.(2)
After receivingRIDij,Sij,Uij,vij, CC verifies whether vijP=?SijH2RIDij,Sij,Uij+Uij. If it holds, CC randomly selects πij∈ℤq∗ and calculates the pseudoidentity IDij=IDij1,IDij2 for SMij, in which IDij1=πijP and IDij2=RIDij⊕H1πijPpub.(3)
CC publishesIDij,Sij,Uij,vij and secretly transmits Eij1,Eij0 to SMij.


## 5.2.2. Gateway's Registration

(1)
GW randomly selectssG,uG∈ℤq∗ and computes the public key SG=sGP and knowledge signature(5)UG=uGP,vG=sGH2RIDG,SG,UG+uG.Then, GW sendsRIDG,SG,UG,vG to CC.(2)
CC verifies whethervGP=?SGH2RIDG,SG,UG+UG. If it holds, CC publishes RIDG,SG,UG,vG.


## 5.3. Report Generation

In this section,SMij would collect and transmit electricity data to GW.


### 5.3.1.SMij Submits the Data Report to SMi1H

(1)
SMij collects electricity measurement data mij, randomly selects rij″∈0,1k2, and computes(6)Cij=mij+HT,kθijEij1+rij″Eij0modN,whereT is the current timestamp.(2)
SMij randomly chooses eij∈ℤq∗ and calculates(7)Eij=eijP,σij=sijH3Cij,Sij,IDij,Eij,T+eij.(3)
SMij submits the data report IDij,Cij,Eij,σij,T to SMi1H.


### 5.3.2.SMi1H Uploads the Preaggregated Report to GW

(1)
GivenIDij,Cij,Eij,σij,T from other t−1SMij∈Di, SMi1H examines the timestamp T and verifies whether(8)σijP=?SijH3Cij,Sij,IDij,Eij,T+Eij.In order to speed up the verification,SMi1H uses small exponent test technology [44] to achieve batch verification. SMi1H randomly selects a set of tiny numbers ϕi2,ϕi3,…,ϕit∈1,2t and verifies whether(9)∑j=2tϕijσijP=?∑j=2tϕijSijH3Cij,Sij,IDij,Eij,T+∑j=2tϕijEij.(2)
Givent−1 data reports and his own data report Ci1, SMi1H randomly selects eiH∈ℤq∗ and calculates(10)Ci=∑j=1tCijmodN,EiH=eiHP,σiH=si1H3Ci,Si1,IDi1,EiH,TiH+eiH,whereTiH is the current timestamp.(3)
Finally,SMi1H uploads the preaggregated report IDi1,Ci,EiH,σiH,TiH to GW.


## 5.3.1.SMij Submits the Data Report to SMi1H

(1)
SMij collects electricity measurement data mij, randomly selects rij″∈0,1k2, and computes(6)Cij=mij+HT,kθijEij1+rij″Eij0modN,whereT is the current timestamp.(2)
SMij randomly chooses eij∈ℤq∗ and calculates(7)Eij=eijP,σij=sijH3Cij,Sij,IDij,Eij,T+eij.(3)
SMij submits the data report IDij,Cij,Eij,σij,T to SMi1H.


## 5.3.2.SMi1H Uploads the Preaggregated Report to GW

(1)
GivenIDij,Cij,Eij,σij,T from other t−1SMij∈Di, SMi1H examines the timestamp T and verifies whether(8)σijP=?SijH3Cij,Sij,IDij,Eij,T+Eij.In order to speed up the verification,SMi1H uses small exponent test technology [44] to achieve batch verification. SMi1H randomly selects a set of tiny numbers ϕi2,ϕi3,…,ϕit∈1,2t and verifies whether(9)∑j=2tϕijσijP=?∑j=2tϕijSijH3Cij,Sij,IDij,Eij,T+∑j=2tϕijEij.(2)
Givent−1 data reports and his own data report Ci1, SMi1H randomly selects eiH∈ℤq∗ and calculates(10)Ci=∑j=1tCijmodN,EiH=eiHP,σiH=si1H3Ci,Si1,IDi1,EiH,TiH+eiH,whereTiH is the current timestamp.(3)
Finally,SMi1H uploads the preaggregated report IDi1,Ci,EiH,σiH,TiH to GW.


## 5.4. Report Aggregation

In this section, GW would verify and aggregate the preaggregated reports fromSMi1H. Afterward, GW would upload the aggregated report to CC.(1)
GivenIDi1,Ci,EiH,σiH,TiH from the domain headers SMi1Hi=1,2,…,ω, GW examines the timestamp TiH, randomly selects a group of tiny values ϕ1,ϕ2,…,ϕω∈1,2ω, and verifies whether(11)∑i=1ωϕiσiHP=?∑i=1ωϕiSi1H3Ci,Si1,IDi1,EiH,TiH+∑i=1ωϕiEiH.(2)
GW randomly selectseG∈ℤq∗ and calculates(12)C=∑i=1ωCimodN,EG=eGP,σG=sGH4C,SG,RIDG,EG,TG+eG.whereTG is the current timestamp.(3)
Finally, GW uploads the aggregated reportRIDG,C,EG,σG,TG to CC.


## 5.5. Report Reading

CC would verify and decrypt the aggregated report from GW in this section.(1)
ReceivingRIDG,C,EG,σG,TG from GW, CC checks the timestamp TG and verifies whether(13)σGP=?SGH4C,SG,RIDG,EG,TG+EG.(2)
CC decrypts aggregated electricity measurement data:(14)∑i=1ω∑j=1tmij=Cmodp^modℒ.(3)
CC analyzes and processes the aggregated data and makes optimal allocation.Correctness:(15)Cmodp^modℒ,=∑i=1ω∑j=1tCijmodNmodp^modℒ=∑i=1ω∑j=1tmij+HT,kθijEij1+rij″Eij0modNmodp^modℒ=∑i=1ω∑j=1tmij+HT,kθij+αijℒ+βijp^modNmodp^modℒ=∑i=1ω∑j=1tmij+HT,kθij+αijℒmodℒ=∑i=1ω∑j=1tmij+HT,k∑i=1ω∑j=1tθij+ℒ∑i=1ω∑j=1tαijmodℒ=∑i=1ω∑j=1tmij,where αij=mij+HT,kθijrij+rij′′rij and βij=rij′mij+HT,kθij1+rijℒ+rij′′rij′rijℒ.


## 5.6. Fault Tolerant

This section describes how to obtain the aggregated data when some smart meters fail to work normally.(1)
Assuming that only receivingλ−1λ<t reports, SMi1H performs the same operations as Section 5.3.2 except Ci=∑j=1λCijmodN. Then, SMi1H broadcasts IDi1,Ci,EiH,σiH,TiH,λ into the domain Di.(2)
GivenIDi1,Ci,EiH,σiH,TiH,λ, SMij examines the timestamp TiH and verifies the signature σiH. If it is valid, SMij randomly selects e^ij∈ℤq∗, r^ij∈0,1k2 and computes(16)C^ij=Ci−λHT,kθijEij1+r^ijEij0modN,E^ij=e^ijP,σ^ij=sijH3C^ij,Sij,IDij,E^ij,T^ij+e^ij,whereT^ij is the current timestamp. Then, SMij submits the report IDij,C^ij,E^ij,σ^ij,T^ij to SMi1H.(3)
After receivingλ−1 data reports IDij,C^ij,E^ij,σ^ij,T^ij from SMij∈Di, the domain header SMi1H examines λ−1 timestamp T^ij and verifies λ−1 signature σ^ij. If batch verification is valid, SMi1H randomly selects e^iH∈ℤq∗ and calculates(17)C^i=1λ∑j=1λC^ijmodN,E^iH=e^iHP,σ^iH=si1H3C^i,Si1,IDi1,E^iH,T^iH+e^iH,whereT^iH is the current timestamp. Finally, SMi1H uploads the preaggregated report IDi1,C^i,E^iH,σ^iH,T^iH to GW.(4)
GW and CC normally execute the protocol as Sections5.4 and 5.5, respectively. Finally, CC gets aggregated electricity data for no malfunctioning smart meters.Correctness:(18)Cmodp^modℒ,=∑i=1ωC^imodNmodp^modℒ=1λ∑i=1ω∑j=1λC^ijmodNmodp^modℒ=1λ∑i=1ω∑j=1λCi−λHT,kθijEij1+r^ijEij0modNmodp^modℒ=∑i=1ω∑j=1λCij−HT,kθijEij1+1λr^ijEij0modNmodp^modℒ=∑i=1ω∑j=1λmijEij1+rij″Eij0+1λr^ijEij0modNmodp^modℒ=∑i=1ω∑j=1λmij+α^ijℒ+β^ijp^modNmodp^modℒ=∑i=1ω∑j=1λmij+α^ijℒmodℒ=∑i=1ω∑j=1λmij+ℒ∑i=1ω∑j=1λα^ijmodℒ=∑i=1ω∑j=1λmij,where α^ij=mijrij1+rij′p^+rijrij′′+1/λr^ij1+rij′p^ and β^ij=mijrij′.


## 6. Security Analysis

### 6.1. Indistinguishability

The proposed scheme is proved to be the indistinguishability under the chosen plaintext attack (IND-CPA). The adversaryA can execute the below queries:Hash query: given a hash query, output a random valueEncryption query: given an encryption query on the messagemij, output the ciphertext CijThe security model can be defined by the interactive game played between the adversaryA and the challenger C.Setup:C produces the system parameters and sends them to A.Phase 1:A adaptively executes the hash queries and the encryption queries for polynomial times.Challenge: after completing phase 1,A randomly selects two messages mij0,mij1∈ℳ and submits two messages to C. Next, C randomly chooses b∈0,1, calculates the ciphertext Cijb corresponding to mijb, and replies it to A.Phase 2:A executes the same queries as Phase 1 apart from the encryption query on the message mij0 and mij1.Guess:A outputs b′∈0,1 as the result of guess.The advantage for the adversaryA to win the game is defined as(19)AdvAIND−CPA=Prb′=b−12.Definition 1.
The proposed scheme ensures IND-CPA secure if the advantage of an adversary in the above game is negligible.Theorem 1.
The proposed scheme is IND-CPA secure under theℒ,p^-based decision assumption.Proof.
Assume that the adversaryA wins the game in Definition 1 with a nonnegligible advantage ε; an algorithm ℬ would be constituted for breaking the ℒ,p^-based decision problem with advantage ε′. Given an arbitrary bit z∈0,1, an instance k0,k2,N,x is established, in which x is arbitrarily selected from S if z=0 and x is arbitrarily selected from S¯ if z=1. The ultimate target of ℬ is to guess z.
Setup:ℬ sets the security parameter k0,k1,k2 satisfying k1≪k2<k0/2 and chooses two large prime numbers p^,q^ which satisfy p^=q^=k0. C calculates N=p^q^. Next, ℬ randomly chooses ℒ∈0,1k2 and sets up message space ℳ=m|m∈0,1k1. ℬ secretly keeps p^,q^,ℒ and returns k0,k1,k2,N to A.
For the purpose of continuous rapid response and consistency,ℬ holds the below list.(1)
LH: it consists of tuples T,k,hi.Phase 1:A executes the following queries adaptively.HashH query: A makes a H query on T,k and ℬ responds according to the following steps:(1)
IfT,k is included in the list LH, ℬ replies the hash value hi=HT,k to A.(2)
IfT,k is not included in the list LH, ℬ randomly selects hi∈0,1k2, inserts T,k,hi into the list LH, and returns hi to A.Encryption query:A makes an encryption query on the message mij and ℬ randomly picks k,θ∈ℤℒ and calculates Cij=mij+HT,kθ+x. Finally, ℬ returns Cij to A.Challenge: two messagesmij0,mij1∈ℳ are provided by A which submits them to ℬ. Next, ℬ randomly picks k,θ∈ℤℒ and a bit b∈0,1, calculates Cijb=mijb+HT,kθ+x, and replies it to A.Phase 2: the same queries are executed byA as Phase 1 apart from the encryption query on the messages mij0 and mij1.Guess:A outputs guess b′ and submits it to ℬ. If b′=b, ℬ outputs the guess z=0.
Whenz=0, which means x∈S and αℒ<p^, the ciphertext Cijb=mijb+HT,kθ+x=mijb+HT,kθ+αℒ+βp^modN is a valid ciphertext. The probability of A correctly guessing b is 1/2+ε. Therefore, the probability that ℬ can successfully guess is PrSuccess ofℬ|z=0=1/2+ε.
Whenz=1, which means x∈S¯ and αℒ≥p^, the ciphertext Cijb=mijb+HT,kθ+x=mijb+HT,kθ+αℒ+βp^modN is an invalid ciphertext. The probability of A correctly guessing b is 1/2. Therefore, the probability that ℬ can successfully guess is PrSuccess ofℬ|z=1=1/2.
Based on the above two cases, the probability thatℬ would break the ℒ,p^-based decision problem is(20)ε′=PrSuccess ofℬ=Prz=0PrSuccess ofℬ|z=0+Prz=1PrSuccess ofℬ|z=1=1212+ε+12⋅12=12+ε2.
Consequently,ℬ can break the ℒ,p^-based decision problem with nonnegligible probability, ε′=1/2+ε/2. This generates a conflict with ℒ,p^-based decision assumption; therefore, the proposed scheme is IND-CPA secure.


### 6.2. Unforgeability

The security of the proposed scheme satisfies the existential unforgeability under the adaptively chosen message attack (EUF-CMA). The adversaryA can execute the following queries:Hash query: given the hash query, output a random valueCreate user query: given a create user query onIDij of SMij, output the public key Sij,UijCorrupt user query: given a corrupt user query onIDij of SMij, output the private key sijSignature query: given a signature query on the ciphertextCij under IDij of SMij, output the signature σijThe security model can be defined by the interactive game between the adversaryA and the challenger C.Initialization:A chooses a challenging identity IDij∗ and submits it to C.Setup:C produces the system parameters and sends them to A.Query:A adaptively executes the hash queries, the create user queries, the corrupt queries, and the signature queries for polynomial times except the corrupt user query on IDij∗.Forgery:A produces a forged signature σij∗ on the ciphertext Cij∗ and the challenging identity IDij∗, such that(1)
σij∗ is a valid signature(2)
IDij∗ has never been queried in the corrupt user queriesThe advantage for the adversaryA to win the game is defined as(21)AdvAEUF−CMA=PrSuccess ofA.Definition 2.
The proposed scheme ensures EUF-CMA secure if the advantage of an adversary in the above game is negligible.Theorem 2.
The proposed scheme is EUF-CMA secure under ECDL assumption.Proof.
Assume that the adversaryA wins the game in Definition 2 with a nonnegligible advantage ε; an algorithm ℬ would be constituted for breaking ECDL problem with advantage ε′. An instance P,aP=Q of ECDL assumption is established, the ultimate target of ℬ is to discover a∈ℤq∗.
Initialization:A selects a challenging identity IDij∗ and submits it to ℬ.
Setup:ℬ selects security parameter k0,k1,k2,K and the cyclic group G. Then, ℬ randomly selects five hash functions H,H1,H2,H3,H4 that are regarded as random oracles. Finally, ℬ sends the system parameters G,p,q,P,k0,k1,k2,K,N,H,H1,H2,H3,H4 to A.ℬ maintains the following three lists:(1)
LH2: it consists of tuples RIDij,Sij,Uij,h2,ij(2)
LH3: it consists of tuples Cij,Sij,IDij,Eij,T,h3,ij(3)
LSMij: it consists of tuples IDij,sij,Sij,vij,Uij
Query:A adaptively executes the polynomial times following queries.HashH2 query: A makes a H2 query on RIDij,Sij,Uij and ℬ responds according to the following steps:(1)
IfRIDij,Sij,Uij is included in the list LH2, ℬ responds h2,ij=H2RIDij,Sij,Uij to A(2)
IfRIDij,Sij,Uij is not included in the list LH2, ℬ randomly selects h2,ij∈ℤq∗, inserts RIDij,Sij,Uij,h2,ij into the list LH2 and responds h2,ij to AHashH3 query: A executes a H3 query for Cij,Sij,IDij,Eij,T and ℬ responds according to the following steps:(1)
IfCij,Sij,IDij,Eij,T is included in the list LH3, ℬ responds h3,ij=H3Cij,Sij,IDij,Eij,T to A(2)
IfCij,Sij,IDij,Eij,T is not included in the list LH3, ℬ randomly selects h3,ij∈ℤq∗, inserts Cij,Sij,IDij,Eij,T,h3,ij into the list LH3, and responds h3,ij to ACreate user query: this query is issued byA on the identity IDij of SMij and ℬ responds according to the following steps:(1)
IfIDij,sij,Sij,vij,Uij is included in the list LSMij, ℬ responds Sij,Uij to A.(2)
IfIDij,sij,Sij,vij,Uij is not included in the list LSMij, ℬ executes the following steps:(i)
IfIDij=IDij∗, ℬ randomly chooses vij,h2,ij∈ℤq∗ and sets Sij=aP=Q and Uij=vijP−h2,ijSij; if h2,ij already emerges in the list LH2, ℬ randomly selects another vij∈ℤq∗ and tries again. Then, ℬ inserts RIDij,Sij,Uij,h2,ij into the list LH2 and inserts IDij,⊥,Sij,vij,Uij into the list LSMij, respectively. Ultimately, ℬ responds Sij,Uij to A.(ii)
IfIDij≠IDij∗, ℬ executes the smart meters’ registration algorithm to produce Sij,Uij and responds them to A.Corrupt user query: this query is performed byA on the identity IDij of SMij and ℬ responds according to the following steps:(1)
IfIDij=IDij∗, ℬ aborts the game.(2)
IfIDij≠IDij∗, ℬ executes the following steps:(i)
IfIDij,sij,Sij,vij,Uij is included in the list LSMij, ℬ responds sij,vij to A.(i)
IfIDij,sij,Sij,vij,Uij is not included in the list LSMij, ℬ executes the create user query on IDij and responds sij,vij to A.Signature query: after receiving a ciphertextCij and IDij for a signature query, ℬ responds according to the following steps:(1)
IfIDij=IDij∗, ℬ randomly chooses σij,T,h3,ij∈ℤq∗ and calculates Eij=σijP−h3,ijSij. If h3,ij already emerges in the list LH3, ℬ randomly chooses another σij∈ℤq∗ and tries again. Afterward, ℬ inserts Cij,Sij,IDij,Eij,T,h3,ij into the list LH3 and responds IDij,Cij,Eij,σij,T to A.(2)
IfIDij≠IDij∗, ℬ executes the report generation algorithm to produce IDij,Cij,Eij,σij,T and responds them to A.
Forgery:A produces a forged signature σij on the ciphertext Cij under identity IDij of SMij, such that(1)
IfIDij≠IDij∗, ℬ aborts the game.(2)
IfIDij=IDij∗, ℬ can produce an additional valid signature σij′ through different hash value H3 according to forking lemma [45]. The following two equations can be obtained:(22)σijP=h3,ijSij+Eij,σij′P=h3,ij′Sij+Eij.
We can calculate(23)σij−σij′P=h3,ij−h3,ij′Sij=h3,ij−h3,ij′aP.
ECDL problem’s solution is obtained byℬ:(24)a=σij−σij′h3,ij−h3,ij′−1.
Probability analysis: considering thatA is allowed to execute at most qH2 times H2 query, qH3 times H3 query, qcre times create user query, qcor times corrupt user query, and qs times signature query. The situation that ℬ breaks the ECDL problem defined three events as follows:(1)
E1: ℬ never aborts the game for the corrupt user queries(2)
E2: ℬ can produce a valid signature(3)
E3: IDij=IDij∗
According to the above simulation, there arePrE1≥1−qH2/qqcre⋅1−1/qH2qcor⋅1−qH3/qqs, PrE2|E1≥ε, and PrE3|E1∧E2≥1/qH2. Therefore, the probability that ℬ can solve the ECDL problem is(25)ε′=PrE1∧E2∧E3=PrE1⋅PrE2|E1⋅PrE3|E1∧E2≥1qH2⋅1−qH2qqcre⋅1−1qH2qcor⋅1−qH3qqs⋅ε.
Thus,ℬ can break the ECDL problem with nonnegligible advantage ε′≥1/qH2⋅1−qH2/qqcre⋅1−1/qH2qcor⋅1−qH3/qqs⋅ε. This produces a contradiction with ECDL assumption; consequently, the proposed scheme satisfies unforgeability security.


### 6.3. Analysis of Security Requirement

The security requirements are analyzed comprehensively in this section.


#### 6.3.1. Confidentiality

On the basis of Theorem1, the adversary cannot decrypts the ciphertext Cij,Ci, and C to collect electricity data without the key of symmetric homomorphic encryption K. Consequently, confidentiality can be satisfied.


#### 6.3.2. Authentication

Legal smart meterSMij will register its identity information with CC in advance. After receiving the reports of SMij, SMi1H will verify whether σijP=?SijH3Cij,Sij,IDij,Eij,T+Eij holds. Based on Theorem 2, the adversary cannot create a valid authentication without the private key sij. Obviously, authentication can be met.


#### 6.3.3. Integrity

The ciphertextCij is signed to generate the signature σij,Eij. On the basis of Theorem 2, the adversary cannot generate the legal signature without the private key sij, and only valid reports can be accepted. So, this means integrity can be achieved.


#### 6.3.4. Anonymity

EverySMij is set as a pseudoidentity IDij=IDij,1,IDij,2 in the registration phase corresponding to the real identity RIDij, where IDij,1=πijP and IDij,2=RIDij⊕H1πijPpub. The adversary cannot get real identity RIDij without πij or sTA. Thus, anonymity is guaranteed in the proposed scheme.


#### 6.3.5. Traceability

WhenSMij has malicious behavior, only TA can calculate RIDij=IDij,2⊕H1sTAIDij,1 by using private key sTA to uncover the true identity RIDij. In this way, the proposed scheme realizes traceability.


#### 6.3.6. Resistance against Collision Attack

GW can disclose extra ciphertextCi to CC. Next, CC can obtain ∑j=1tmij+HT,kθij by calculating Cimodp^modℒ. However, they cannot gain the plaintext ∑j=1tmij without θij and k, even if CC obtains ciphertext Ci by accident. Similarly, CC is still unable to obtain the real electricity data. Hence, the proposed scheme would withstand the collision attack.


#### 6.3.7. Resistance against Modification Attack

According to the guarantee of Theorem2, any modification of the data report by the polynomial adversary will be detected. Hence, the proposed scheme could resist the modification attack.


#### 6.3.8. Resistance against Replay Attack

Since the reportsIDij,Cij,Eij,σij,T,IDi1,Ci,EiH,σiH,TiH, and RIDG,C,EG,σG,TG contain the timestamp, the receiver could check the freshness of timestamp. Therefore, the replay attacks can be withstood.


### 6.4. Functionality Comparison

The functionality comparison with the related schemes [19–21, 27, 28] is shown in Table 2. Confidentiality, authentication, integrity, and fault tolerance are denoted by F1, F2, F3, and F4, respectively. In addition, anonymity, traceability, and resistance against collision attack, modification attack, and replay attack are represented by F5, F6, F7, F8, and F9, respectively.Table 2
Functionality comparison.
SchemesF1F2F3F4F5F6F7F8F9Li et al.’s scheme [19]✓✓✓××✓✓✓✓Shen et al.’s scheme [20]✓✓✓×✓×✓✓✓Chen et al.’s scheme [21]✓✓✓✓×✓✓✓✓Guan et al.’s scheme [27]✓✓✓✓✓××✓×Ding et al.’s scheme [28]✓✓✓✓×✓×✓✓The proposed scheme✓✓✓✓✓✓✓✓✓The schemes [19, 20] do not support fault tolerance. Furthermore, the schemes [19, 21, 28] do not protect users’ identity privacy, and the schemes [20, 27] cannot trace malicious behaviors. Besides, the schemes [27, 28] may be subjected to collision attacks, and the scheme [27] may be subjected to replay attacks. It is clear that the other related schemes fail to meet several requirements, yet the proposed scheme simultaneously fulfill all the security requirements.


## 6.1. Indistinguishability

The proposed scheme is proved to be the indistinguishability under the chosen plaintext attack (IND-CPA). The adversaryA can execute the below queries:Hash query: given a hash query, output a random valueEncryption query: given an encryption query on the messagemij, output the ciphertext CijThe security model can be defined by the interactive game played between the adversaryA and the challenger C.Setup:C produces the system parameters and sends them to A.Phase 1:A adaptively executes the hash queries and the encryption queries for polynomial times.Challenge: after completing phase 1,A randomly selects two messages mij0,mij1∈ℳ and submits two messages to C. Next, C randomly chooses b∈0,1, calculates the ciphertext Cijb corresponding to mijb, and replies it to A.Phase 2:A executes the same queries as Phase 1 apart from the encryption query on the message mij0 and mij1.Guess:A outputs b′∈0,1 as the result of guess.The advantage for the adversaryA to win the game is defined as(19)AdvAIND−CPA=Prb′=b−12.Definition 1.
The proposed scheme ensures IND-CPA secure if the advantage of an adversary in the above game is negligible.Theorem 1.
The proposed scheme is IND-CPA secure under theℒ,p^-based decision assumption.Proof.
Assume that the adversaryA wins the game in Definition 1 with a nonnegligible advantage ε; an algorithm ℬ would be constituted for breaking the ℒ,p^-based decision problem with advantage ε′. Given an arbitrary bit z∈0,1, an instance k0,k2,N,x is established, in which x is arbitrarily selected from S if z=0 and x is arbitrarily selected from S¯ if z=1. The ultimate target of ℬ is to guess z.
Setup:ℬ sets the security parameter k0,k1,k2 satisfying k1≪k2<k0/2 and chooses two large prime numbers p^,q^ which satisfy p^=q^=k0. C calculates N=p^q^. Next, ℬ randomly chooses ℒ∈0,1k2 and sets up message space ℳ=m|m∈0,1k1. ℬ secretly keeps p^,q^,ℒ and returns k0,k1,k2,N to A.
For the purpose of continuous rapid response and consistency,ℬ holds the below list.(1)
LH: it consists of tuples T,k,hi.Phase 1:A executes the following queries adaptively.HashH query: A makes a H query on T,k and ℬ responds according to the following steps:(1)
IfT,k is included in the list LH, ℬ replies the hash value hi=HT,k to A.(2)
IfT,k is not included in the list LH, ℬ randomly selects hi∈0,1k2, inserts T,k,hi into the list LH, and returns hi to A.Encryption query:A makes an encryption query on the message mij and ℬ randomly picks k,θ∈ℤℒ and calculates Cij=mij+HT,kθ+x. Finally, ℬ returns Cij to A.Challenge: two messagesmij0,mij1∈ℳ are provided by A which submits them to ℬ. Next, ℬ randomly picks k,θ∈ℤℒ and a bit b∈0,1, calculates Cijb=mijb+HT,kθ+x, and replies it to A.Phase 2: the same queries are executed byA as Phase 1 apart from the encryption query on the messages mij0 and mij1.Guess:A outputs guess b′ and submits it to ℬ. If b′=b, ℬ outputs the guess z=0.
Whenz=0, which means x∈S and αℒ<p^, the ciphertext Cijb=mijb+HT,kθ+x=mijb+HT,kθ+αℒ+βp^modN is a valid ciphertext. The probability of A correctly guessing b is 1/2+ε. Therefore, the probability that ℬ can successfully guess is PrSuccess ofℬ|z=0=1/2+ε.
Whenz=1, which means x∈S¯ and αℒ≥p^, the ciphertext Cijb=mijb+HT,kθ+x=mijb+HT,kθ+αℒ+βp^modN is an invalid ciphertext. The probability of A correctly guessing b is 1/2. Therefore, the probability that ℬ can successfully guess is PrSuccess ofℬ|z=1=1/2.
Based on the above two cases, the probability thatℬ would break the ℒ,p^-based decision problem is(20)ε′=PrSuccess ofℬ=Prz=0PrSuccess ofℬ|z=0+Prz=1PrSuccess ofℬ|z=1=1212+ε+12⋅12=12+ε2.
Consequently,ℬ can break the ℒ,p^-based decision problem with nonnegligible probability, ε′=1/2+ε/2. This generates a conflict with ℒ,p^-based decision assumption; therefore, the proposed scheme is IND-CPA secure.


## 6.2. Unforgeability

The security of the proposed scheme satisfies the existential unforgeability under the adaptively chosen message attack (EUF-CMA). The adversaryA can execute the following queries:Hash query: given the hash query, output a random valueCreate user query: given a create user query onIDij of SMij, output the public key Sij,UijCorrupt user query: given a corrupt user query onIDij of SMij, output the private key sijSignature query: given a signature query on the ciphertextCij under IDij of SMij, output the signature σijThe security model can be defined by the interactive game between the adversaryA and the challenger C.Initialization:A chooses a challenging identity IDij∗ and submits it to C.Setup:C produces the system parameters and sends them to A.Query:A adaptively executes the hash queries, the create user queries, the corrupt queries, and the signature queries for polynomial times except the corrupt user query on IDij∗.Forgery:A produces a forged signature σij∗ on the ciphertext Cij∗ and the challenging identity IDij∗, such that(1)
σij∗ is a valid signature(2)
IDij∗ has never been queried in the corrupt user queriesThe advantage for the adversaryA to win the game is defined as(21)AdvAEUF−CMA=PrSuccess ofA.Definition 2.
The proposed scheme ensures EUF-CMA secure if the advantage of an adversary in the above game is negligible.Theorem 2.
The proposed scheme is EUF-CMA secure under ECDL assumption.Proof.
Assume that the adversaryA wins the game in Definition 2 with a nonnegligible advantage ε; an algorithm ℬ would be constituted for breaking ECDL problem with advantage ε′. An instance P,aP=Q of ECDL assumption is established, the ultimate target of ℬ is to discover a∈ℤq∗.
Initialization:A selects a challenging identity IDij∗ and submits it to ℬ.
Setup:ℬ selects security parameter k0,k1,k2,K and the cyclic group G. Then, ℬ randomly selects five hash functions H,H1,H2,H3,H4 that are regarded as random oracles. Finally, ℬ sends the system parameters G,p,q,P,k0,k1,k2,K,N,H,H1,H2,H3,H4 to A.ℬ maintains the following three lists:(1)
LH2: it consists of tuples RIDij,Sij,Uij,h2,ij(2)
LH3: it consists of tuples Cij,Sij,IDij,Eij,T,h3,ij(3)
LSMij: it consists of tuples IDij,sij,Sij,vij,Uij
Query:A adaptively executes the polynomial times following queries.HashH2 query: A makes a H2 query on RIDij,Sij,Uij and ℬ responds according to the following steps:(1)
IfRIDij,Sij,Uij is included in the list LH2, ℬ responds h2,ij=H2RIDij,Sij,Uij to A(2)
IfRIDij,Sij,Uij is not included in the list LH2, ℬ randomly selects h2,ij∈ℤq∗, inserts RIDij,Sij,Uij,h2,ij into the list LH2 and responds h2,ij to AHashH3 query: A executes a H3 query for Cij,Sij,IDij,Eij,T and ℬ responds according to the following steps:(1)
IfCij,Sij,IDij,Eij,T is included in the list LH3, ℬ responds h3,ij=H3Cij,Sij,IDij,Eij,T to A(2)
IfCij,Sij,IDij,Eij,T is not included in the list LH3, ℬ randomly selects h3,ij∈ℤq∗, inserts Cij,Sij,IDij,Eij,T,h3,ij into the list LH3, and responds h3,ij to ACreate user query: this query is issued byA on the identity IDij of SMij and ℬ responds according to the following steps:(1)
IfIDij,sij,Sij,vij,Uij is included in the list LSMij, ℬ responds Sij,Uij to A.(2)
IfIDij,sij,Sij,vij,Uij is not included in the list LSMij, ℬ executes the following steps:(i)
IfIDij=IDij∗, ℬ randomly chooses vij,h2,ij∈ℤq∗ and sets Sij=aP=Q and Uij=vijP−h2,ijSij; if h2,ij already emerges in the list LH2, ℬ randomly selects another vij∈ℤq∗ and tries again. Then, ℬ inserts RIDij,Sij,Uij,h2,ij into the list LH2 and inserts IDij,⊥,Sij,vij,Uij into the list LSMij, respectively. Ultimately, ℬ responds Sij,Uij to A.(ii)
IfIDij≠IDij∗, ℬ executes the smart meters’ registration algorithm to produce Sij,Uij and responds them to A.Corrupt user query: this query is performed byA on the identity IDij of SMij and ℬ responds according to the following steps:(1)
IfIDij=IDij∗, ℬ aborts the game.(2)
IfIDij≠IDij∗, ℬ executes the following steps:(i)
IfIDij,sij,Sij,vij,Uij is included in the list LSMij, ℬ responds sij,vij to A.(i)
IfIDij,sij,Sij,vij,Uij is not included in the list LSMij, ℬ executes the create user query on IDij and responds sij,vij to A.Signature query: after receiving a ciphertextCij and IDij for a signature query, ℬ responds according to the following steps:(1)
IfIDij=IDij∗, ℬ randomly chooses σij,T,h3,ij∈ℤq∗ and calculates Eij=σijP−h3,ijSij. If h3,ij already emerges in the list LH3, ℬ randomly chooses another σij∈ℤq∗ and tries again. Afterward, ℬ inserts Cij,Sij,IDij,Eij,T,h3,ij into the list LH3 and responds IDij,Cij,Eij,σij,T to A.(2)
IfIDij≠IDij∗, ℬ executes the report generation algorithm to produce IDij,Cij,Eij,σij,T and responds them to A.
Forgery:A produces a forged signature σij on the ciphertext Cij under identity IDij of SMij, such that(1)
IfIDij≠IDij∗, ℬ aborts the game.(2)
IfIDij=IDij∗, ℬ can produce an additional valid signature σij′ through different hash value H3 according to forking lemma [45]. The following two equations can be obtained:(22)σijP=h3,ijSij+Eij,σij′P=h3,ij′Sij+Eij.
We can calculate(23)σij−σij′P=h3,ij−h3,ij′Sij=h3,ij−h3,ij′aP.
ECDL problem’s solution is obtained byℬ:(24)a=σij−σij′h3,ij−h3,ij′−1.
Probability analysis: considering thatA is allowed to execute at most qH2 times H2 query, qH3 times H3 query, qcre times create user query, qcor times corrupt user query, and qs times signature query. The situation that ℬ breaks the ECDL problem defined three events as follows:(1)
E1: ℬ never aborts the game for the corrupt user queries(2)
E2: ℬ can produce a valid signature(3)
E3: IDij=IDij∗
According to the above simulation, there arePrE1≥1−qH2/qqcre⋅1−1/qH2qcor⋅1−qH3/qqs, PrE2|E1≥ε, and PrE3|E1∧E2≥1/qH2. Therefore, the probability that ℬ can solve the ECDL problem is(25)ε′=PrE1∧E2∧E3=PrE1⋅PrE2|E1⋅PrE3|E1∧E2≥1qH2⋅1−qH2qqcre⋅1−1qH2qcor⋅1−qH3qqs⋅ε.
Thus,ℬ can break the ECDL problem with nonnegligible advantage ε′≥1/qH2⋅1−qH2/qqcre⋅1−1/qH2qcor⋅1−qH3/qqs⋅ε. This produces a contradiction with ECDL assumption; consequently, the proposed scheme satisfies unforgeability security.


## 6.3. Analysis of Security Requirement

The security requirements are analyzed comprehensively in this section.


### 6.3.1. Confidentiality

On the basis of Theorem1, the adversary cannot decrypts the ciphertext Cij,Ci, and C to collect electricity data without the key of symmetric homomorphic encryption K. Consequently, confidentiality can be satisfied.


### 6.3.2. Authentication

Legal smart meterSMij will register its identity information with CC in advance. After receiving the reports of SMij, SMi1H will verify whether σijP=?SijH3Cij,Sij,IDij,Eij,T+Eij holds. Based on Theorem 2, the adversary cannot create a valid authentication without the private key sij. Obviously, authentication can be met.


### 6.3.3. Integrity

The ciphertextCij is signed to generate the signature σij,Eij. On the basis of Theorem 2, the adversary cannot generate the legal signature without the private key sij, and only valid reports can be accepted. So, this means integrity can be achieved.


### 6.3.4. Anonymity

EverySMij is set as a pseudoidentity IDij=IDij,1,IDij,2 in the registration phase corresponding to the real identity RIDij, where IDij,1=πijP and IDij,2=RIDij⊕H1πijPpub. The adversary cannot get real identity RIDij without πij or sTA. Thus, anonymity is guaranteed in the proposed scheme.


### 6.3.5. Traceability

WhenSMij has malicious behavior, only TA can calculate RIDij=IDij,2⊕H1sTAIDij,1 by using private key sTA to uncover the true identity RIDij. In this way, the proposed scheme realizes traceability.


### 6.3.6. Resistance against Collision Attack

GW can disclose extra ciphertextCi to CC. Next, CC can obtain ∑j=1tmij+HT,kθij by calculating Cimodp^modℒ. However, they cannot gain the plaintext ∑j=1tmij without θij and k, even if CC obtains ciphertext Ci by accident. Similarly, CC is still unable to obtain the real electricity data. Hence, the proposed scheme would withstand the collision attack.


### 6.3.7. Resistance against Modification Attack

According to the guarantee of Theorem2, any modification of the data report by the polynomial adversary will be detected. Hence, the proposed scheme could resist the modification attack.


### 6.3.8. Resistance against Replay Attack

Since the reportsIDij,Cij,Eij,σij,T,IDi1,Ci,EiH,σiH,TiH, and RIDG,C,EG,σG,TG contain the timestamp, the receiver could check the freshness of timestamp. Therefore, the replay attacks can be withstood.


## 6.3.1. Confidentiality

On the basis of Theorem1, the adversary cannot decrypts the ciphertext Cij,Ci, and C to collect electricity data without the key of symmetric homomorphic encryption K. Consequently, confidentiality can be satisfied.


## 6.3.2. Authentication

Legal smart meterSMij will register its identity information with CC in advance. After receiving the reports of SMij, SMi1H will verify whether σijP=?SijH3Cij,Sij,IDij,Eij,T+Eij holds. Based on Theorem 2, the adversary cannot create a valid authentication without the private key sij. Obviously, authentication can be met.


## 6.3.3. Integrity

The ciphertextCij is signed to generate the signature σij,Eij. On the basis of Theorem 2, the adversary cannot generate the legal signature without the private key sij, and only valid reports can be accepted. So, this means integrity can be achieved.


## 6.3.4. Anonymity

EverySMij is set as a pseudoidentity IDij=IDij,1,IDij,2 in the registration phase corresponding to the real identity RIDij, where IDij,1=πijP and IDij,2=RIDij⊕H1πijPpub. The adversary cannot get real identity RIDij without πij or sTA. Thus, anonymity is guaranteed in the proposed scheme.


## 6.3.5. Traceability

WhenSMij has malicious behavior, only TA can calculate RIDij=IDij,2⊕H1sTAIDij,1 by using private key sTA to uncover the true identity RIDij. In this way, the proposed scheme realizes traceability.


## 6.3.6. Resistance against Collision Attack

GW can disclose extra ciphertextCi to CC. Next, CC can obtain ∑j=1tmij+HT,kθij by calculating Cimodp^modℒ. However, they cannot gain the plaintext ∑j=1tmij without θij and k, even if CC obtains ciphertext Ci by accident. Similarly, CC is still unable to obtain the real electricity data. Hence, the proposed scheme would withstand the collision attack.


## 6.3.7. Resistance against Modification Attack

According to the guarantee of Theorem2, any modification of the data report by the polynomial adversary will be detected. Hence, the proposed scheme could resist the modification attack.


## 6.3.8. Resistance against Replay Attack

Since the reportsIDij,Cij,Eij,σij,T,IDi1,Ci,EiH,σiH,TiH, and RIDG,C,EG,σG,TG contain the timestamp, the receiver could check the freshness of timestamp. Therefore, the replay attacks can be withstood.


## 6.4. Functionality Comparison

The functionality comparison with the related schemes [19–21, 27, 28] is shown in Table 2. Confidentiality, authentication, integrity, and fault tolerance are denoted by F1, F2, F3, and F4, respectively. In addition, anonymity, traceability, and resistance against collision attack, modification attack, and replay attack are represented by F5, F6, F7, F8, and F9, respectively.Table 2
Functionality comparison.
SchemesF1F2F3F4F5F6F7F8F9Li et al.’s scheme [19]✓✓✓××✓✓✓✓Shen et al.’s scheme [20]✓✓✓×✓×✓✓✓Chen et al.’s scheme [21]✓✓✓✓×✓✓✓✓Guan et al.’s scheme [27]✓✓✓✓✓××✓×Ding et al.’s scheme [28]✓✓✓✓×✓×✓✓The proposed scheme✓✓✓✓✓✓✓✓✓The schemes [19, 20] do not support fault tolerance. Furthermore, the schemes [19, 21, 28] do not protect users’ identity privacy, and the schemes [20, 27] cannot trace malicious behaviors. Besides, the schemes [27, 28] may be subjected to collision attacks, and the scheme [27] may be subjected to replay attacks. It is clear that the other related schemes fail to meet several requirements, yet the proposed scheme simultaneously fulfill all the security requirements.


## 7. Performance Evaluation

In this section, the computation cost and the communication overhead are compared and analyzed in a quantitative way between the related schemes [19–21, 27, 28] and the proposed scheme.


### 7.1. Computation Cost

In order to ensure fairness comparison, the proposed scheme should be compared with other existing data aggregation schemes [19–21, 27, 28] based on the same 80 bits security level. With respect to the schemes [20, 27] based on Paillier encryption, two large prime numbers u,v are selected as 512 bits, and N=uv is 1024 bits. Considering the schemes [19–21, 27, 28] based on bilinear pairing, the symmetric bilinear pairing e:G1×G1⟶GT is exploited, where G1 is an additive group with generator P of the order q, that is defined on the super singular elliptic curve E:y2=x3+xmodp with embedding degree 2, q is 160-bit Solinas prime number, and p is 512-bit primer number satisfying q⋅12⋅r=p+1. In terms of the ECC-based schemes [20, 21] and the proposed scheme, an additive group G with prime order q is established by nonsingular elliptic curve E:y2=x3+ax+bmodp, in which p,q are both 160 bits prime numbers and a=−3andb is a random 160-bits prime number. With regard to the symmetric homomorphic encryption in this paper, p^ and q^ are two 512 bits prime numbers, and the length of ℒ is 160 bits.For making more accurate comparison, the running time of each cryptographic operation is estimated by the MIRACL Crypto SDK [46]. The hardware equipment is a PC with 2.90 GHz, whose CPU is i5-10400, memory is 16 GB, and the operating system is 64 bit Windows 10 system. Table 3 indicates the mean consumed time of 10000 executions corresponding to different cryptographic operations.Table 3
Time cost of cryptographic operations (millisecond).
NotationsDescriptionsRun timeTbpBilinear pairing operation1.6678TmtpMap-to-point hash operation1.5586Te−GTExponentiation operation inGT0.1491Te−NExponentiation operation inℤN0.1779Tm−NMultiplication operation inℤN0.0268TlogSolving the discrete logarithm operation0.1845Te−G1Exponentiation operation inG10.6126Te−q¯Exponentiation operation inℤq¯0.0063TEnc−PPaillier public key encryption operation0.9466TDec−PPaillier public key decryption operation1.2129Te−N2Exponentiation operation inℤN20.4999Tm−ECCScale multiplication operation in ECC0.1088Tmodp^Modularp^ operation0.0138TmodℒModularℒ operation0.0028Considering simplicity, some lightweight operations have been ignored, such as general hash function and point addition. The specific details are described in Table4, in which n represents the number of smart meters. Assume t=10 in the proposed scheme, that is, ω=0.1n. The computation cost is divided into three phases, including report generation phase, report aggregation phase, and report reading phase.Table 4
Comparison of computation cost.
SchemesReport generation phaseReport aggregation phaseReport reading phaseLi et al.’s scheme [19]3nTe−N+2nTm−N+nTe−G1+nTmtp=2.7585nmsn+1Tbp+n+1Tmtp+nTm−N+Te−G1+Te−N=3.2532n+4.0169ms2Tbp+Tmtp+Te−N+Tlog=5.2566msShen et al.’s scheme [20]nTEnc−P+2nTe−q¯+nTm−ECC+nTmtp=2.6266nmsn+2Tbp+n+1Tmtp+Tm−ECC=3.2264n+5.003ms2Tbp+Tmtp+TDec−P+2Te−q¯=6.1197msChen et al.’s scheme [21]nTbp+2nTmtp+nTe−GT+nTm−ECC=5.0429nms2nTbp+n+1Tmtp+Tm−ECC=4.8942n+1.6674ms3Tbp+2Tmtp+Tlog=8.3051msGuan et al.’s scheme [27]nTe−N2+nTEnc−P+nTe−G1+nTe−N=2.237nmsn+2Te−N+nTe−G1=0.7905n+0.3558msTe−N+TDec−P=1.3908msDing et al.’s scheme [28]2nTe−GT+nTe−G1=0.9108nmsn+3Te−G1=0.6126n+1.8378ms3Te−G1+Tbp+Tlog=3.6901msThe proposed scheme2.2nTm−ECC+3nTm−N=0.3198nms0.1n+2Tm−ECC=0.0109n+0.2176ms2Tm−ECC+Tmodp^+Tmodℒ=0.2342msFirst of all, the computation cost of the report generation phase is considered.Li et al.’s scheme [19] employs 3n exponentiation operations in ℤN, 2n multiplication operations in ℤN, n exponentiation operations in G1, and n map-to-point hash operations. As a result, the running time is 3nTe−N+2nTm−N+nTe−G1+nTmtp=2.7585nms.Shen et al.’s scheme [20] applies n Paillier public key encryption operations, 2n exponentiation operations in ℤq¯, n scale multiplication operations in ECC, and n map-to-point hash operations. In this way, the running time is nTEnc−P+2nTe−q¯+nTm−ECC+nTmtp=2.6266nms.Chen et al.’s scheme [21] utilizes n bilinear pairing operations, 2n map-to-point hash operations, n exponentiation operations in GT, and n scale multiplication operations in ECC. Consequently, the running time is nTbp+2nTmtp+nTe−GT+nTm−ECC=5.0429nms.Guan et al.’s scheme [27] demands n exponentiation operations in ℤN2, n Paillier public key encryption operations, n exponentiation operations in G1, and n exponentiation operations in ℤN. As a consequence, the running time is nTe−N2+nTEnc−P+nTe−G1+nTe−N=2.237nms.Ding et al.’s scheme [28] needs 2n exponentiation operations in GT and n exponentiation operations in G1. Hence, the running time is 2nTe−GT+nTe−G1=0.9108nms.In the report generation phase of the proposed aggregation scheme,SMij executes n scale multiplication operations in ECC and 3n multiplication operations in ℤN. SMi1H executes 1.2n scale multiplication operations in ECC. As a matter of fact, the running time is 2.2nTm−ECC+3nTm−N=0.3198nms.Afterward, the computation cost of the report aggregation phase is analyzed.Li et al.’s scheme [19] employs n+1 bilinear pairing operations, n+1 map-to-point hash operations, n multiplication operations in ℤN, one exponentiation operation in G1, and one exponentiation operation in ℤN. As a result, the running time is n+1Tbp+n+1Tmtp+nTm−N+Te−G1+Te−N=3.2532n+4.0169ms.Shen et al.’s scheme [20] applies n+2 bilinear pairing operations, n+1 map-to-point hash operations, and one scale multiplication operation in ECC. In this way, the running time is n+2Tbp+n+1Tmtp+Tm−ECC=3.2264n+5.003ms.Chen et al.’s scheme [21] utilizes 2n bilinear pairing operations, n+1 map-to-point hash operations, and one scale multiplication operation in ECC. Consequently, the running time is 2nTbp+n+1Tmtp+Tm−ECC=4.8942n+1.6674ms.Guan et al.’s scheme [27] demands n+2 exponentiation operations in ℤN and n exponentiation operations in G1. As a consequence, the running time is n+2Te−N+nTe−G1=0.7905n+0.3558ms.Ding et al.’s scheme [28] needs n+3 exponentiation operations in G1. Hence, the running time is n+3Te−G1=0.6126n+1.8378ms.In the report aggregation phase, the proposed scheme executes0.1n+2 scale multiplication operations in ECC. As a matter of fact, the running time is 0.1n+2Tm−ECC=0.0109n+0.2176ms.Ultimately, the computation cost of the report reading phase is summarized.Li et al.’s scheme [19] employs two bilinear pairing operations, one map-to-point hash operation, one exponentiation operation in ℤN, and one solving the discrete logarithm operation. As a result, the running time is 2Tbp+Tmtp+Te−N+Tlog=5.2566ms.Shen et al.’s scheme [20] applies two bilinear pairing operations, one map-to-point hash operation, one Paillier public key decryption operation, and two exponentiation operations in ℤq¯. In this way, the running time is 2Tbp+Tmtp+TDec−P+2Te−q¯=6.1197ms.Chen et al.’s scheme [21] utilizes three bilinear pairing operations, two map-to-point hash operations, and one solving discrete logarithm operation. Consequently, the running time is 3Tbp+2Tmtp+Tlog=8.3051ms.Guan et al.’s scheme [27] demands one exponentiation operation in ℤN and one Paillier public key decryption operation. As a consequence, the running time is Te−N+TDec−P=1.3908ms.Ding et al.’s scheme [28] needs three exponentiation operations in G1, one bilinear pairing operation, and one solving discrete logarithm operation. Hence, the running time is 3Te−G1+Tbp+Tlog=3.6901ms.In the report reading phase, the proposed scheme executes two scale multiplication operations in ECC, one modularp^ operation, and one modular ℒ operation. As a matter of fact, the running time is 2Tm−ECC+Tmodp^+Tmodℒ=0.2342ms.The total running time of the other schemes [19–21, 27, 28] and the proposed scheme are 6.0117n+9.2735, 5.853n+11.1227, 9.9371n+9.9725, 3.0275n+1.7466, 1.5234n+5.5279, and 0.3307n+0.4518, respectively. Figure 4 displays that the overall computation cost varies with the number of smart meters. Apparently, the overall computation cost of all schemes has a linear relationship with the number of smart meters. The proposed scheme requires the minimum overall computation cost and shows slower growth than other schemes. Specifically, the proposed scheme reduced the cost by 94.5%, 94.3%, 96.7%, 89.1%, and 78.3%, respectively, compared with other schemes [19–21, 27, 28]. Consequently, the proposed data aggregation scheme is more appropriate for the smart meters with limited computation resources because it involves no time-consuming operations, such as map-to-point hash and bilinear pairing operation.Figure 4
Comparison of overall computation cost.


### 7.2. Communication Overhead

The communication overhead will be compared with the schemes [19–21, 27, 28]; the details are shown in Table 5, where x denotes bit size of x. In the smart grid, the size of the transmitted report is analyzed, including two parts, communication overhead from SM to GW and from GW to CC. Same as before, the length of G, G1, GT, ℤq¯, ℤN, and ℤN2 are 160 bits, 512 bits, 1024 bits, 160 bits, 1024 bits, and 2048 bits, respectively. Furthermore, assume that the identity and the timestamp are both defined as 32 bits.Table 5
Comparison of communication overhead.
SchemesCommunication overhead SM-GWCommunication overhead GW-CCLi et al.’s scheme [19]1600n bits1600 bitsShen et al.’s scheme [20]3264n bits3264 bitsChen et al.’s scheme [21]1600n bits1600 bitsGuan et al.’s scheme [27]3648n bits3104 bitsDing et al.’s scheme [28]2272n bits2784 bitsThe proposed scheme1725n bits1408 bitsFor the first part, the communication process from SM to GW is analyzed.In Li et al.’s scheme [19], the electricity transmission data are IDTDij,tij,Cij,σij, where IDTDij is 32 bits identity and tij is 32 bits timestamp, Cij∈ℤN and σij∈G1. Consequently, the size of communication overhead is IDTDij+tij+Cij+σijn=32+32+1024+512n=1600nbits.In Shen et al.’s scheme [20], the electricity transmission data are C¯i,g2ski,vkUi,T,σi, where C¯i∈ℤN2, g2ski∈G1, vkUi∈G1, T is 32 bits timestamp, and σi∈G. In this way, the size of communication overhead is C¯i+g2ski+vkUi+T+σin=2048+512+512+32+160n=3264nbits.In Chen et al.’s scheme [21], the electricity transmission data are ci,Si,ti,idi, where ci∈GT, Si∈G1, ti is 32 bits timestamp, and idi is 32 bits identity. Therefore, the size of communication overhead is ci+Si+ti+idin=1024+512+32+32n=1600nbits.In Guan et al.’s scheme [27], the electricity transmission data are Ci,δi,SIDUiai,lj0,Gxi, where Ci∈ℤN2, δi∈ℤN, SIDUiai∈G1, lj0, and Gxi are considered as 32 bits. Thus, the size of communication overhead is Ci+δi+SIDUiai+|lj0|+Gxin=2048+1024+512+32+32n=3648nbits.In Ding et al.’s scheme [28], the electricity transmission data are CTi,j,Si,j,Ri,Ti,j,IDi, where CTi,j=ci,j,1∈G1,ci,j,2∈GT, Si,j∈ℤq¯, Ri∈G1, Ti,j is 32 bits timestamp, and IDi is 32 bits identity. Hence, the size of communication overhead is CTi,j+Si,j+Ri+Ti,j+IDin=1536+160+512+32+32n=2272nbits.In the proposed scheme,SMij submits the data report IDij,Cij,Eij,σij,T to SMi1H, where IDij=IDij,1∈G,IDij,2∈0,132, Cij∈ℤN, Eij∈G, σij∈ℤq¯, T is 32 bits, and the size is IDij+Cij+Eij+σij+Tn=192+1024+160+160+32n=1568nbits. SMi1H submits the data report IDi1,Ci,EiH,σiH,TiH to GW, and the size is IDi1+Ci+EiH+σiH+TiH0.1n=192+1024+160+160+320.1n=157nbits. As a matter of fact, the communication overhead is 1568n+157n=1725nbits.Figure5 intuitively reflects the relationship between the communication overhead from SM to GW and the number of smart meters. It is clear that the communication overhead raises linearly with the increase in the number of smart meters. The proposed scheme demands 1725n bits, so it reduces the communication overhead by 47.2%, 52.7%, and 24.1%, respectively, compared with the other schemes [20, 27, 28]. Although the related schemes [19, 21] are slightly better than our work in terms of the communication overhead from SM to GW, this is negligible because the proposed scheme would meet the fault tolerance and anonymity that they did not. In general, the proposed scheme consumes less communication resources.Figure 5
Comparison of communication overhead from SM to GW.For the second part, the communication process from GW to CC is analyzed.In Li et al.’s scheme [19], the electricity transmission data are IDESi,ti,Ci,σi, where IDESi is 32 bits identity and ti is 32 bits timestamp, Ci∈ℤN and σi∈G1. Consequently, the size of communication overhead is IDESi+ti+Ci+σi=32+32+1024+512=1600bits.In Shen et al.’s scheme [20], the electricity transmission data are C¯,R,vkG,T,σ, where C¯∈ℤN2, R∈G1, vkG∈G1, T is 32 bits timestamp, and σ∈G. In this way, the size of communication overhead is C¯+R+vkG+T+σ=2048+512+512+32+160=3264bits.In Chen et al.’s scheme [21], the electricity transmission data are cj,Sj,ti,idj, where cj∈GT, Sj∈G1, ti is 32 bits timestamp, and idj is 32 bits identity. Therefore, the size of communication overhead is cj+Sj+ti+idj=1024+512+32+32=1600bits.In Guan et al.’s scheme [27], the electricity transmission data are Ca,σj,TS, where Ca∈ℤN2, σj∈ℤN, and TS is 32 bits timestamp. Thus, the size of communication overhead is Ca+σj+TS=2048+1024+32=3104bits.In Ding et al.’s scheme [28], the electricity transmission data are CTk,j,Sk,j,Rk,Uk,j,Tk,j,IDk, where CTk,j=C^k,j,1∈G1,C^k,j,2∈GT, Sk,j∈ℤq¯, Rk∈G1, Uk,j∈G1, Tk,j is 32 bits timestamp, and IDk is 32 bits identity. Hence, the size of communication overhead is CTk,j+Sk,j+Rk+Uk,j+Tk,j+IDk=1536+160+512+512+32+32=2784bits.In the proposed scheme, the electricity report isRIDG,C,EG,σG,TG, where RIDG is 32 bits identity, C∈ℤN, EG∈G, σG∈ℤq¯, and TG is 32 bits timestamp. As a matter of fact, the size of communication overhead is RIDG+C+EG+σG+TG=32+1024+160+160+32=1408bits.The last column of Table5 directly illustrates the communication overhead from GW to CC of the related schemes. According to the size of the transmission data report, the proposed scheme utilizes 1408 bits, which is reduced by 12.0%, 56.9%, 12.0%, 54.6%, and 49.4%, respectively, compared with other schemes [19–21, 27, 28]. Consequently, the proposed scheme realizes lower communication overhead from GW to CC, which is more beneficial for GW with limited communication resources.


## 7.1. Computation Cost

In order to ensure fairness comparison, the proposed scheme should be compared with other existing data aggregation schemes [19–21, 27, 28] based on the same 80 bits security level. With respect to the schemes [20, 27] based on Paillier encryption, two large prime numbers u,v are selected as 512 bits, and N=uv is 1024 bits. Considering the schemes [19–21, 27, 28] based on bilinear pairing, the symmetric bilinear pairing e:G1×G1⟶GT is exploited, where G1 is an additive group with generator P of the order q, that is defined on the super singular elliptic curve E:y2=x3+xmodp with embedding degree 2, q is 160-bit Solinas prime number, and p is 512-bit primer number satisfying q⋅12⋅r=p+1. In terms of the ECC-based schemes [20, 21] and the proposed scheme, an additive group G with prime order q is established by nonsingular elliptic curve E:y2=x3+ax+bmodp, in which p,q are both 160 bits prime numbers and a=−3andb is a random 160-bits prime number. With regard to the symmetric homomorphic encryption in this paper, p^ and q^ are two 512 bits prime numbers, and the length of ℒ is 160 bits.For making more accurate comparison, the running time of each cryptographic operation is estimated by the MIRACL Crypto SDK [46]. The hardware equipment is a PC with 2.90 GHz, whose CPU is i5-10400, memory is 16 GB, and the operating system is 64 bit Windows 10 system. Table 3 indicates the mean consumed time of 10000 executions corresponding to different cryptographic operations.Table 3
Time cost of cryptographic operations (millisecond).
NotationsDescriptionsRun timeTbpBilinear pairing operation1.6678TmtpMap-to-point hash operation1.5586Te−GTExponentiation operation inGT0.1491Te−NExponentiation operation inℤN0.1779Tm−NMultiplication operation inℤN0.0268TlogSolving the discrete logarithm operation0.1845Te−G1Exponentiation operation inG10.6126Te−q¯Exponentiation operation inℤq¯0.0063TEnc−PPaillier public key encryption operation0.9466TDec−PPaillier public key decryption operation1.2129Te−N2Exponentiation operation inℤN20.4999Tm−ECCScale multiplication operation in ECC0.1088Tmodp^Modularp^ operation0.0138TmodℒModularℒ operation0.0028Considering simplicity, some lightweight operations have been ignored, such as general hash function and point addition. The specific details are described in Table4, in which n represents the number of smart meters. Assume t=10 in the proposed scheme, that is, ω=0.1n. The computation cost is divided into three phases, including report generation phase, report aggregation phase, and report reading phase.Table 4
Comparison of computation cost.
SchemesReport generation phaseReport aggregation phaseReport reading phaseLi et al.’s scheme [19]3nTe−N+2nTm−N+nTe−G1+nTmtp=2.7585nmsn+1Tbp+n+1Tmtp+nTm−N+Te−G1+Te−N=3.2532n+4.0169ms2Tbp+Tmtp+Te−N+Tlog=5.2566msShen et al.’s scheme [20]nTEnc−P+2nTe−q¯+nTm−ECC+nTmtp=2.6266nmsn+2Tbp+n+1Tmtp+Tm−ECC=3.2264n+5.003ms2Tbp+Tmtp+TDec−P+2Te−q¯=6.1197msChen et al.’s scheme [21]nTbp+2nTmtp+nTe−GT+nTm−ECC=5.0429nms2nTbp+n+1Tmtp+Tm−ECC=4.8942n+1.6674ms3Tbp+2Tmtp+Tlog=8.3051msGuan et al.’s scheme [27]nTe−N2+nTEnc−P+nTe−G1+nTe−N=2.237nmsn+2Te−N+nTe−G1=0.7905n+0.3558msTe−N+TDec−P=1.3908msDing et al.’s scheme [28]2nTe−GT+nTe−G1=0.9108nmsn+3Te−G1=0.6126n+1.8378ms3Te−G1+Tbp+Tlog=3.6901msThe proposed scheme2.2nTm−ECC+3nTm−N=0.3198nms0.1n+2Tm−ECC=0.0109n+0.2176ms2Tm−ECC+Tmodp^+Tmodℒ=0.2342msFirst of all, the computation cost of the report generation phase is considered.Li et al.’s scheme [19] employs 3n exponentiation operations in ℤN, 2n multiplication operations in ℤN, n exponentiation operations in G1, and n map-to-point hash operations. As a result, the running time is 3nTe−N+2nTm−N+nTe−G1+nTmtp=2.7585nms.Shen et al.’s scheme [20] applies n Paillier public key encryption operations, 2n exponentiation operations in ℤq¯, n scale multiplication operations in ECC, and n map-to-point hash operations. In this way, the running time is nTEnc−P+2nTe−q¯+nTm−ECC+nTmtp=2.6266nms.Chen et al.’s scheme [21] utilizes n bilinear pairing operations, 2n map-to-point hash operations, n exponentiation operations in GT, and n scale multiplication operations in ECC. Consequently, the running time is nTbp+2nTmtp+nTe−GT+nTm−ECC=5.0429nms.Guan et al.’s scheme [27] demands n exponentiation operations in ℤN2, n Paillier public key encryption operations, n exponentiation operations in G1, and n exponentiation operations in ℤN. As a consequence, the running time is nTe−N2+nTEnc−P+nTe−G1+nTe−N=2.237nms.Ding et al.’s scheme [28] needs 2n exponentiation operations in GT and n exponentiation operations in G1. Hence, the running time is 2nTe−GT+nTe−G1=0.9108nms.In the report generation phase of the proposed aggregation scheme,SMij executes n scale multiplication operations in ECC and 3n multiplication operations in ℤN. SMi1H executes 1.2n scale multiplication operations in ECC. As a matter of fact, the running time is 2.2nTm−ECC+3nTm−N=0.3198nms.Afterward, the computation cost of the report aggregation phase is analyzed.Li et al.’s scheme [19] employs n+1 bilinear pairing operations, n+1 map-to-point hash operations, n multiplication operations in ℤN, one exponentiation operation in G1, and one exponentiation operation in ℤN. As a result, the running time is n+1Tbp+n+1Tmtp+nTm−N+Te−G1+Te−N=3.2532n+4.0169ms.Shen et al.’s scheme [20] applies n+2 bilinear pairing operations, n+1 map-to-point hash operations, and one scale multiplication operation in ECC. In this way, the running time is n+2Tbp+n+1Tmtp+Tm−ECC=3.2264n+5.003ms.Chen et al.’s scheme [21] utilizes 2n bilinear pairing operations, n+1 map-to-point hash operations, and one scale multiplication operation in ECC. Consequently, the running time is 2nTbp+n+1Tmtp+Tm−ECC=4.8942n+1.6674ms.Guan et al.’s scheme [27] demands n+2 exponentiation operations in ℤN and n exponentiation operations in G1. As a consequence, the running time is n+2Te−N+nTe−G1=0.7905n+0.3558ms.Ding et al.’s scheme [28] needs n+3 exponentiation operations in G1. Hence, the running time is n+3Te−G1=0.6126n+1.8378ms.In the report aggregation phase, the proposed scheme executes0.1n+2 scale multiplication operations in ECC. As a matter of fact, the running time is 0.1n+2Tm−ECC=0.0109n+0.2176ms.Ultimately, the computation cost of the report reading phase is summarized.Li et al.’s scheme [19] employs two bilinear pairing operations, one map-to-point hash operation, one exponentiation operation in ℤN, and one solving the discrete logarithm operation. As a result, the running time is 2Tbp+Tmtp+Te−N+Tlog=5.2566ms.Shen et al.’s scheme [20] applies two bilinear pairing operations, one map-to-point hash operation, one Paillier public key decryption operation, and two exponentiation operations in ℤq¯. In this way, the running time is 2Tbp+Tmtp+TDec−P+2Te−q¯=6.1197ms.Chen et al.’s scheme [21] utilizes three bilinear pairing operations, two map-to-point hash operations, and one solving discrete logarithm operation. Consequently, the running time is 3Tbp+2Tmtp+Tlog=8.3051ms.Guan et al.’s scheme [27] demands one exponentiation operation in ℤN and one Paillier public key decryption operation. As a consequence, the running time is Te−N+TDec−P=1.3908ms.Ding et al.’s scheme [28] needs three exponentiation operations in G1, one bilinear pairing operation, and one solving discrete logarithm operation. Hence, the running time is 3Te−G1+Tbp+Tlog=3.6901ms.In the report reading phase, the proposed scheme executes two scale multiplication operations in ECC, one modularp^ operation, and one modular ℒ operation. As a matter of fact, the running time is 2Tm−ECC+Tmodp^+Tmodℒ=0.2342ms.The total running time of the other schemes [19–21, 27, 28] and the proposed scheme are 6.0117n+9.2735, 5.853n+11.1227, 9.9371n+9.9725, 3.0275n+1.7466, 1.5234n+5.5279, and 0.3307n+0.4518, respectively. Figure 4 displays that the overall computation cost varies with the number of smart meters. Apparently, the overall computation cost of all schemes has a linear relationship with the number of smart meters. The proposed scheme requires the minimum overall computation cost and shows slower growth than other schemes. Specifically, the proposed scheme reduced the cost by 94.5%, 94.3%, 96.7%, 89.1%, and 78.3%, respectively, compared with other schemes [19–21, 27, 28]. Consequently, the proposed data aggregation scheme is more appropriate for the smart meters with limited computation resources because it involves no time-consuming operations, such as map-to-point hash and bilinear pairing operation.Figure 4
Comparison of overall computation cost.


## 7.2. Communication Overhead

The communication overhead will be compared with the schemes [19–21, 27, 28]; the details are shown in Table 5, where x denotes bit size of x. In the smart grid, the size of the transmitted report is analyzed, including two parts, communication overhead from SM to GW and from GW to CC. Same as before, the length of G, G1, GT, ℤq¯, ℤN, and ℤN2 are 160 bits, 512 bits, 1024 bits, 160 bits, 1024 bits, and 2048 bits, respectively. Furthermore, assume that the identity and the timestamp are both defined as 32 bits.Table 5
Comparison of communication overhead.
SchemesCommunication overhead SM-GWCommunication overhead GW-CCLi et al.’s scheme [19]1600n bits1600 bitsShen et al.’s scheme [20]3264n bits3264 bitsChen et al.’s scheme [21]1600n bits1600 bitsGuan et al.’s scheme [27]3648n bits3104 bitsDing et al.’s scheme [28]2272n bits2784 bitsThe proposed scheme1725n bits1408 bitsFor the first part, the communication process from SM to GW is analyzed.In Li et al.’s scheme [19], the electricity transmission data are IDTDij,tij,Cij,σij, where IDTDij is 32 bits identity and tij is 32 bits timestamp, Cij∈ℤN and σij∈G1. Consequently, the size of communication overhead is IDTDij+tij+Cij+σijn=32+32+1024+512n=1600nbits.In Shen et al.’s scheme [20], the electricity transmission data are C¯i,g2ski,vkUi,T,σi, where C¯i∈ℤN2, g2ski∈G1, vkUi∈G1, T is 32 bits timestamp, and σi∈G. In this way, the size of communication overhead is C¯i+g2ski+vkUi+T+σin=2048+512+512+32+160n=3264nbits.In Chen et al.’s scheme [21], the electricity transmission data are ci,Si,ti,idi, where ci∈GT, Si∈G1, ti is 32 bits timestamp, and idi is 32 bits identity. Therefore, the size of communication overhead is ci+Si+ti+idin=1024+512+32+32n=1600nbits.In Guan et al.’s scheme [27], the electricity transmission data are Ci,δi,SIDUiai,lj0,Gxi, where Ci∈ℤN2, δi∈ℤN, SIDUiai∈G1, lj0, and Gxi are considered as 32 bits. Thus, the size of communication overhead is Ci+δi+SIDUiai+|lj0|+Gxin=2048+1024+512+32+32n=3648nbits.In Ding et al.’s scheme [28], the electricity transmission data are CTi,j,Si,j,Ri,Ti,j,IDi, where CTi,j=ci,j,1∈G1,ci,j,2∈GT, Si,j∈ℤq¯, Ri∈G1, Ti,j is 32 bits timestamp, and IDi is 32 bits identity. Hence, the size of communication overhead is CTi,j+Si,j+Ri+Ti,j+IDin=1536+160+512+32+32n=2272nbits.In the proposed scheme,SMij submits the data report IDij,Cij,Eij,σij,T to SMi1H, where IDij=IDij,1∈G,IDij,2∈0,132, Cij∈ℤN, Eij∈G, σij∈ℤq¯, T is 32 bits, and the size is IDij+Cij+Eij+σij+Tn=192+1024+160+160+32n=1568nbits. SMi1H submits the data report IDi1,Ci,EiH,σiH,TiH to GW, and the size is IDi1+Ci+EiH+σiH+TiH0.1n=192+1024+160+160+320.1n=157nbits. As a matter of fact, the communication overhead is 1568n+157n=1725nbits.Figure5 intuitively reflects the relationship between the communication overhead from SM to GW and the number of smart meters. It is clear that the communication overhead raises linearly with the increase in the number of smart meters. The proposed scheme demands 1725n bits, so it reduces the communication overhead by 47.2%, 52.7%, and 24.1%, respectively, compared with the other schemes [20, 27, 28]. Although the related schemes [19, 21] are slightly better than our work in terms of the communication overhead from SM to GW, this is negligible because the proposed scheme would meet the fault tolerance and anonymity that they did not. In general, the proposed scheme consumes less communication resources.Figure 5
Comparison of communication overhead from SM to GW.For the second part, the communication process from GW to CC is analyzed.In Li et al.’s scheme [19], the electricity transmission data are IDESi,ti,Ci,σi, where IDESi is 32 bits identity and ti is 32 bits timestamp, Ci∈ℤN and σi∈G1. Consequently, the size of communication overhead is IDESi+ti+Ci+σi=32+32+1024+512=1600bits.In Shen et al.’s scheme [20], the electricity transmission data are C¯,R,vkG,T,σ, where C¯∈ℤN2, R∈G1, vkG∈G1, T is 32 bits timestamp, and σ∈G. In this way, the size of communication overhead is C¯+R+vkG+T+σ=2048+512+512+32+160=3264bits.In Chen et al.’s scheme [21], the electricity transmission data are cj,Sj,ti,idj, where cj∈GT, Sj∈G1, ti is 32 bits timestamp, and idj is 32 bits identity. Therefore, the size of communication overhead is cj+Sj+ti+idj=1024+512+32+32=1600bits.In Guan et al.’s scheme [27], the electricity transmission data are Ca,σj,TS, where Ca∈ℤN2, σj∈ℤN, and TS is 32 bits timestamp. Thus, the size of communication overhead is Ca+σj+TS=2048+1024+32=3104bits.In Ding et al.’s scheme [28], the electricity transmission data are CTk,j,Sk,j,Rk,Uk,j,Tk,j,IDk, where CTk,j=C^k,j,1∈G1,C^k,j,2∈GT, Sk,j∈ℤq¯, Rk∈G1, Uk,j∈G1, Tk,j is 32 bits timestamp, and IDk is 32 bits identity. Hence, the size of communication overhead is CTk,j+Sk,j+Rk+Uk,j+Tk,j+IDk=1536+160+512+512+32+32=2784bits.In the proposed scheme, the electricity report isRIDG,C,EG,σG,TG, where RIDG is 32 bits identity, C∈ℤN, EG∈G, σG∈ℤq¯, and TG is 32 bits timestamp. As a matter of fact, the size of communication overhead is RIDG+C+EG+σG+TG=32+1024+160+160+32=1408bits.The last column of Table5 directly illustrates the communication overhead from GW to CC of the related schemes. According to the size of the transmission data report, the proposed scheme utilizes 1408 bits, which is reduced by 12.0%, 56.9%, 12.0%, 54.6%, and 49.4%, respectively, compared with other schemes [19–21, 27, 28]. Consequently, the proposed scheme realizes lower communication overhead from GW to CC, which is more beneficial for GW with limited communication resources.


## 8. Conclusion

In this paper, we have employed the symmetric homomorphic encryption technology and the elliptic curve signature to design a lightweight and privacy-preserving data aggregation scheme in smart grid. In the proposed scheme, even though the smart meters produce malfunction, the system can still run normally to get aggregated data. Besides, it does not restrict the space of electricity data. The security analysis has demonstrated that the proposed scheme is IND-CPA and EUF-CMA secure and satisfies all security requirements. Ultimately, the performance analysis has reflected the lightweight of the proposed scheme in terms of computation cost and communication overhead. Judging from the results, the proposed scheme is more practical for the smart grid with limited computation and communication capabilities.



---

*Source: 5895176-2022-01-25.xml*