# SEMDA: Secure and Efficient Multidimensional Data Aggregation in Smart Grid without a Trusted Third Party

Authors: Zichao Song; Weidong Zhong; Tanping Zhou; Dong Chen; Yujie Ding; Xiaoyuan Yang
Journal: Security and Communication Networks
 (2023)

---

## Abstract

Smart grids are a combination of traditional power system engineering as well as information and communications technology. Smart grid terminals provide convenient services to users by aggregating their data in real time. However, terminals can derive user privacy information from real-time data on smart devices. Therefore, security data aggregation has been widely studied in the field of smart grid. Most existing schemes are one-dimensional data aggregation or rely on a trusted third party. In reality, multidimensional data (such as a user’s electricity consumption or user’s main usage time, etc.) makes sense for terminals to flexibly adjust supply and demand strategies. In this paper, we propose an efficient and secure multidimensional data aggregation scheme that supports batch validation without a trusted third party. Firstly, we apply the Chinese remainder theorem to encode the user’s multidimensional data and realize the independence of each dimension in terminal decryption. Secondly, we adopt a secure key negotiation protocol that does not require a trusted third party. Finally, based on paillier homomorphic encryption and bilinear pairing, we construct an encryption scheme that can reuse the key and blind factor and support batch verification. The analysis results show that our scheme is secure for users’ privacy protection. Experimental results show that, compared with existing 1 dimensional aggregation schemes, our scheme has almost no growth in computational overhead for terminal decryption.


---

## Body

## 1. Introduction

In recent years, as increasing numbers of countries place more emphasis on the next generation of electricity networks, considerable human, material, and financial resources have been invested in the research and development of intelligent electricity networks. As the next generation of grids, smart grids integrate traditional grids with information and communication technologies for the efficient and reliable generation, transmission, distribution, and control of services [1–3], and these technologies will be used in future work. Smart grids will play an increasingly important role in meeting the needs of users, improving data reliability, and providing power control management [4]. In order to intelligently monitor and control the network in real time, smart grid control centers must continuously collect data on the amount of electricity consumed by users. But smart grid usage data directly reveals where, when, and what people are doing. In the event of a leak, these data can expose individual users’ electricity usage patterns. For example, if a user’s power consumption is almost zero at a fixed time of day, it can be inferred that the user is out at that time of day and no one else is home. If a smart device terminal obtains this data, it can use big data technology to provide personalized service recommendations to users and improve service quality. However, when an external attacker gains access to that user’s electricity data, it can be sold for financial gain or it can be used to commit a crime such as a burglary, while the user is away at a later date. Clearly, exposure to such sensitive information is a threat to the privacy of these users [5]. Thus, it is particularly important to ensure the confidentiality and integrity of the information transmitted in smart grids while protecting the privacy of the users in smart grids from being compromised [6].Security and privacy are two of the main obstacles to the development of the smart grid. How to monitor regional electricity consumption without divulging the power consumption of a single user has become the direction of scholars. The homomorphic encryption scheme guarantees that the algebraic operation of cryptography is equivalent to the direct operation of plaintext. Therefore, homomorphic encryption schemes are widely used in smart grids to protect users’ privacy.The idea of combining data aggregation with a homomorphic encryption algorithm is proposed to solve the privacy problem in smart grids. Compared with symmetric encryption algorithms, the use of homomorphic encryption algorithms and data aggregation combine to achieve both efficiency and privacy protection and to detect power leakage and fraud by comparing the aggregated results of smart meters with the total meter readings.In 2012, Lu et al. [7] first proposed an EPPA scheme based on paillier homomorphic encryption and super-incremental sequences to address privacy concerns in smart grids. However, paillier encryption is not as efficient as BGN encryption in very small plaintext spaces; so in 2015, Chen et al. [8] proposed a BGN homomorphic encryption scheme based on MuDA data aggregation to solve the problem of small plaintext spaces and paillier encryption’s inefficiency. In order to measure the interval distribution of electricity consumption by users, Li et al., (2018) proposed a PPMA scheme for data aggregation across multiple subsets using super-incremental sequences and paillier homomorphic cryptography [9]. It can calculate the amount of electricity used and the number of users at a given time. In 2019, Saleemd et al. [10] proposed a fault-tolerant FESDA scheme to address the failure of unsuccessfully decrypting meter faults. When a user fails, the Control Center (CC) uses the user’s equivalent cipher to decrypt and gain good fault tolerance. However, in 2021 Wu et al. [11] found that the presence of equivalent ciphertext in the FESDA scheme can leak users’ private information, attacked the FESDA scheme, and proposed a secure PDFA aggregation scheme using the extended Shamir secret-sharing scheme.These schemes require the involvement of a trusted third party, who passes the corresponding decryption key to CC, assists in the management of user registration and deregistration, and so on. However, finding a fully trusted third party in the real world is extremely difficult, and even if such a trusted third party does exist, significant human, material, and financial resources need to be devoted to maintaining its absolute security and credibility in the future. Based on these considerations, some scholars have proposed aggregation schemes without trusting third parties. In 2016 Knirsch et al. [12] proposed a time-series spatiotemporal aggregation shield that utilizes key superposition between users to protect individual privacy while still providing sufficient bug resistance and an efficient data aggregation scheme. In 2018, Li et al. [13] proposed a data aggregation scheme without trusted third parties based on BGN homomorphic encryption. And in the same year, Gong et al. [14] proposed a distribution method that does not rely on any trusted third party to generate security parameters that tolerate conspiratorial attacks between n-2 users. In 2019, Liu et al. [15] proposed an EC-Elgamal data aggregation scheme without a trusted third party, which protects the privacy of individual users by constructing a virtual aggregation region based on the level of trust between users. However, these schemes are functionally single and do not allow for the aggregation of multidimensional data.In the above scheme, the signature of each cryptographic text needs to be verified, but it is less efficient. Several other proposals have been floated. In 2020, Ding et al. [16] proposed a homogenous encrypted data aggregation scheme based on user identity that allows only collectors authorized by electricity service providers to decrypt, thereby protecting the privacy of the user. In 2021, Chen et al. [17] proposed a data aggregation scheme based on dynamic member groups that enables dynamic user management. In 2022, Liu et al. [18] proposed a data aggregation scheme that supports the rapid detection of deceptive users.These solutions address the different needs of smart grids, but none of them is fully functional. In real life, we expect a scheme that can achieve multidimensional data aggregation without the involvement of a trusted third party while protecting the privacy and integrity of users’ electricity data. Our scheme can solve this problem.Our contributions are as follows:(i)
We apply the Chinese remainder theorem [19] to construct a multidimensional data aggregation scheme. The Chinese remainder theorem makes each dimension independent of the other when the terminal is decrypted, which ensures the correctness of our scheme.(ii)
We design a data aggregation scheme supporting key, blind factor reuses, and batch authentication based on paillier homomorphic encryption [20] scheme and bilinear pairing [21]. In addition, an example of fast detection of incorrectly signed users when bulk verification fails is given using combinatorial mathematical principles [22].(iii)
We apply a secure key negotiation protocol [23] that does not require the participation of trusted third parties. All devices are semi-honest throughout the process, and we prove the privacy of user information at every step.In Section1, we introduce the basic situation of smart grids. In Section 2, we introduce related work to the paper. In Section 3, we introduce the basic blocks as the preliminaries of our scheme. In Section 4, we introduced our system model. In Section 5, we describe the construction of our scheme in detail. In Section 6, we analyze our scheme. In Section 7, we conducted the experiment evaluation. Finally, we draw our conclusion in Section 8.


## 2. Related Work

In this section, we provide an overview of traditional solutions for smart grids as well as some of the latest research findings. In 2010, Li et al. [24] first proposed a distributed incremental data aggregation method, which covers the entire local neighborhood or any specified node set with minimal overhead through carefully constructed aggregation trees. At the same time, homomorphic encryption was used to ensure the security of data during transmission. This approach guarantees that all devices participate in aggregation and that no intermediate or final result is obtained by any device, so this approach is mainly used in privacy-preserving data aggregation schemes in smart grids.Compared with the privacy-preserving one-dimensional data aggregation scheme, the multidimensional data aggregation scheme contains multiple detailed pieces of information of the user, which can not only extend the application of data aggregation but also meet the needs of the terminal for fine-grained analysis of multidimensional data and facilitate strategy adjustment. In 2012, Lu et al. [7] constructed a multidimensional data aggregation scheme by using a super-increasing sequence and homomorphic encryption scheme to obtain more electricity information of users. However, this scheme needs to encrypt the data of each dimension, which leads to excessive computational overhead and low efficiency during encryption. In 2017, Merad Boudia et al. [25] proposed an ElGamal homomorphic encryption multidimensional data aggregation scheme based on an elliptic curve, which does not require complex encryption operations on the way. However, the smart meter needs to encrypt the data for each dimension, which will greatly reduce the calculation efficiency with the increase of the dimension. In 2018, Li et al. [9] used two super-increasing sequences and paillier homomorphic encryption algorithm to construct a multisubset data aggregation scheme, which could count the electricity consumption and the number of users in a certain period of time. However, when the number of electricity consumption intervals is too large, the smart meter needs to encrypt each electricity consumption interval, which leads to excessive computational overhead and low efficiency. In 2019, Ming et al. [26] proposed to construct a multidimensional data aggregation scheme through an elliptic curve encryption method and a super-increasing sequence. The super-increasing sequence ensures that messages of each dimension will not affect each other when the terminal is decrypted, but the terminal needs to solve the discrete logarithm problem to recover data, so the scheme is not efficient. In 2020, Zuo et al. [27] proposed a privacy-preserving multidimensional data aggregation scheme based on the ElGamal homomorphic cryptosystem with distributed decryption, which can resist joint attacks from the gateway and the control center. However, the ciphertext of each user in this scheme is composed of two parts, which leads to an increase in computation cost, communication cost, and storage cost.In recent years, with the development of fog computing, many scholars have proposed many solutions in the context of fog computing. In 2018, Lyu et al. [28] proposed a privacy-preserving fog computing aggregation scheme using one-time padded homomorphic encryption, which uses a fog node to collect the transmitted data for efficient processing and calculation. However, in this scheme, the integrity of the user’s encrypted data is not guaranteed. In 2019, Liu et al. [29] proposed an aggregation scheme supporting fog computing, which used the double trapdoor encryption scheme to construct a homomorphic encryption scheme supporting service organization query and self-query query. However, encrypting each dimension in this scheme incurs an additional heavy computational cost. In 2020, Merad-Boudia et al. [30] proposed a method of using coding to aggregate multidimensional data, which gives each dimension data a certain space according to certain rules so that each dimension data does not affect each other during aggregation and decryption. However, in this method, the length of the coding used is fixed, which is easy to cause space waste and increase storage overhead.Compared with the above schemes, our scheme uses the Chinese Remainder Theorem to encode the user’s multidimensional data, which overcomes the shortcomings of increasing computational overhead with the increase in data dimension and does not cause a waste of storage space. Therefore, our scheme is more practical.


## 3. Preliminaries

### 3.1. Chinese Remainder Theorem

Letb1,b2⋯bn be l pairwise co-prime primes, e1,e2⋯en denotes n integers, then the following congruence equations have a unique solution:(1)x≡e1modb1x≡e2modb2⋮x≡enmodbn.The form of the solution can be expressed asx=e1y1B1+e2y2B2+⋯+enynBnmodB, where B=b1b2⋯bn, Bi=B/bi, yi=Bi−1modbi, 1≤i≤n. By x≡eimodbi, we can easily calculate ei. In our scheme, we make full use of the properties of the Chinese remainder theorem to obtain the aggregation value of multidimensional data.


### 3.2. Paillier Homomorphic Encryption

The paillier public key encryption algorithm is a popular homomorphic encryption which supports homomorphic addition.


#### 3.2.1. Key Generation

Given security parametersκ, random generation of two large primes p and q, calculates N=pq, λ=lcmp−1,q−1. Defining functions Lx=x−1/N, and randomly selecting the raw elements g∈ZN2∗, make gcdLgλmodN2,N=1 and calculate μ=LgλmodN2−1modN. Then, the public key of the encryption algorithm is PK=N,g, the private key is SK=λ,μ.


#### 3.2.2. Encryption

For any plaintextm∈ZN, select a random integer r, where 0<r<N,r∈ZN2∗. That is, r has a multiplication inverse in the remainder of N2. Calculate ciphertext c=gmrNmodN2.


#### 3.2.3. Decryption

For a given ciphertextc∈ZN2∗, calculate the plaintext m=LcλmodN2⋅μmodN.


### 3.3. Bilinear Pairing

LetG1,G2 be a cyclic group that satisfies the order of large prime number P, in which a pairing relation e:G1×G1⟶G2 is defined to meet the following conditions.


#### 3.3.1. Bilinear

For anyg,h∈G1,a,b∈Zp, there is a ega,hb=eg,hab.


#### 3.3.2. Computability

For anyg,h∈G1,a,b∈Zp, there is an efficient polynomial time algorithm to calculate the value of ega,hb,eg,hab.


#### 3.3.3. Nondegeneracy

For anyg,h∈G1, there is a eg,h≠1G2.


### 3.4. Uniformk,n−Set of a Finite Set

k,n threshold set is a technique in combinatorial mathematics that plays an important role in the rapid detection of error signatures, as defined below.Let setA=d1,d2,⋯,dm, the subsets A1,A2,⋯An∈A is called a uniform k,n−set of A (m≥nk−1) if the following three conditions are satisfied:(i)
A1=A2=⋯=An.(ii)
For anyk subsets Ai,1,⋯Ai,k∈A1,A2,⋯An, there is ∪j=1kAi,j=A.(iii)
For anyk−1 subsets Ai,1,⋯Ai,k−1∈A1,A2,⋯An, there is ∪j=1k−1Ai,j=A\di.Figure1 shows an example of a (3,5) threshold set for A=1,2,⋯,10.Figure 1
The uniform (3, 5)-set ofA=1,2,⋯,10.


## 3.1. Chinese Remainder Theorem

Letb1,b2⋯bn be l pairwise co-prime primes, e1,e2⋯en denotes n integers, then the following congruence equations have a unique solution:(1)x≡e1modb1x≡e2modb2⋮x≡enmodbn.The form of the solution can be expressed asx=e1y1B1+e2y2B2+⋯+enynBnmodB, where B=b1b2⋯bn, Bi=B/bi, yi=Bi−1modbi, 1≤i≤n. By x≡eimodbi, we can easily calculate ei. In our scheme, we make full use of the properties of the Chinese remainder theorem to obtain the aggregation value of multidimensional data.


## 3.2. Paillier Homomorphic Encryption

The paillier public key encryption algorithm is a popular homomorphic encryption which supports homomorphic addition.


### 3.2.1. Key Generation

Given security parametersκ, random generation of two large primes p and q, calculates N=pq, λ=lcmp−1,q−1. Defining functions Lx=x−1/N, and randomly selecting the raw elements g∈ZN2∗, make gcdLgλmodN2,N=1 and calculate μ=LgλmodN2−1modN. Then, the public key of the encryption algorithm is PK=N,g, the private key is SK=λ,μ.


### 3.2.2. Encryption

For any plaintextm∈ZN, select a random integer r, where 0<r<N,r∈ZN2∗. That is, r has a multiplication inverse in the remainder of N2. Calculate ciphertext c=gmrNmodN2.


### 3.2.3. Decryption

For a given ciphertextc∈ZN2∗, calculate the plaintext m=LcλmodN2⋅μmodN.


## 3.2.1. Key Generation

Given security parametersκ, random generation of two large primes p and q, calculates N=pq, λ=lcmp−1,q−1. Defining functions Lx=x−1/N, and randomly selecting the raw elements g∈ZN2∗, make gcdLgλmodN2,N=1 and calculate μ=LgλmodN2−1modN. Then, the public key of the encryption algorithm is PK=N,g, the private key is SK=λ,μ.


## 3.2.2. Encryption

For any plaintextm∈ZN, select a random integer r, where 0<r<N,r∈ZN2∗. That is, r has a multiplication inverse in the remainder of N2. Calculate ciphertext c=gmrNmodN2.


## 3.2.3. Decryption

For a given ciphertextc∈ZN2∗, calculate the plaintext m=LcλmodN2⋅μmodN.


## 3.3. Bilinear Pairing

LetG1,G2 be a cyclic group that satisfies the order of large prime number P, in which a pairing relation e:G1×G1⟶G2 is defined to meet the following conditions.


### 3.3.1. Bilinear

For anyg,h∈G1,a,b∈Zp, there is a ega,hb=eg,hab.


### 3.3.2. Computability

For anyg,h∈G1,a,b∈Zp, there is an efficient polynomial time algorithm to calculate the value of ega,hb,eg,hab.


### 3.3.3. Nondegeneracy

For anyg,h∈G1, there is a eg,h≠1G2.


## 3.3.1. Bilinear

For anyg,h∈G1,a,b∈Zp, there is a ega,hb=eg,hab.


## 3.3.2. Computability

For anyg,h∈G1,a,b∈Zp, there is an efficient polynomial time algorithm to calculate the value of ega,hb,eg,hab.


## 3.3.3. Nondegeneracy

For anyg,h∈G1, there is a eg,h≠1G2.


## 3.4. Uniformk,n−Set of a Finite Set

k,n threshold set is a technique in combinatorial mathematics that plays an important role in the rapid detection of error signatures, as defined below.Let setA=d1,d2,⋯,dm, the subsets A1,A2,⋯An∈A is called a uniform k,n−set of A (m≥nk−1) if the following three conditions are satisfied:(i)
A1=A2=⋯=An.(ii)
For anyk subsets Ai,1,⋯Ai,k∈A1,A2,⋯An, there is ∪j=1kAi,j=A.(iii)
For anyk−1 subsets Ai,1,⋯Ai,k−1∈A1,A2,⋯An, there is ∪j=1k−1Ai,j=A\di.Figure1 shows an example of a (3,5) threshold set for A=1,2,⋯,10.Figure 1
The uniform (3, 5)-set ofA=1,2,⋯,10.


## 4. System Design

### 4.1. System Model

In our scheme, we focus on how to securely aggregate user electricity consumption data and forward user electricity consumption data to the control center (CC) of the smart grid in a privacy-preserving way. Figure2 shows the system model of the smart grid. There are three main players in the system model: a large number of smart meters (SM), fog nodes (FN), and CC. Their role in smart grid systems is as follows.Figure 2
Smart grid system model.


#### 4.1.1. Smart Meter (SM)

A smart meter is a smart device installed by a utility company on a user’s premises. It collects specific real-time data from its surroundings and regularly reports it to the nearest fog node (FN). Obviously, we can easily connect smart meters to the users involved.


#### 4.1.2. Fog Node (FN)

FN is the intermediate node between the control center and the smart meter, with a high level of storage and calculative power. It performs three main functions: (1) verifying the authenticity of the message received; (2) data aggregation of incoming messages; and (3) transferring the aggregated messages to CC.


#### 4.1.3. Control Center (CC)

After receiving the FN report, CC first verifies the authenticity and integrity of the message, then decrypts the data. By decrypting the data, CC can learn the status of the entire smart grid in real-time, which can be used to conduct data analysis and make timely strategic adjustments.


### 4.2. Threat Model

In our scheme, all participants (including CC and FN) were curious but honest. In general, CC and FN will interact exactly as defined, not tampering with calculations but trying to learn sensitive information from uploaded messages. In our threat model, we assume that an attacker has the following capabilities:(i)
Attackers can intercept the communication information between SM, FN, and CC. In addition, the attacker can break into some users in a residential area, which means that the attacker will obtain all the consumption data and the corresponding security parameters of these users and attempt to infer the privacy information of other users through these data.(ii)
Attackers can invade FN and CC databases, steal personal data and security parameters, and even damage FN and CC. Although the CC is powerful in reality, the data stored in it is not completely safe from the risk of being compromised because the attacker is powerful enough under our assumptions. Therefore, CC can also be considered a formidable opponent because of its curiosity about user privacy.(iii)
Attackers inject fake data into the system by intercepting messages and forging the identities of authorized users or tampering with data transmitted over a public communication channel to send fake power consumption data to the CC. In addition, attackers could launch attacks that compromise the data integrity of the smart grid.


### 4.3. Design Goals

Our goal is to design an efficient and stable multidimensional data aggregation solution without a trusted third party, which can protect the privacy of the user while achieving the required functionality. Specifically, our design objectives include the following design goals.


#### 4.3.1. Security

To avoid the leakage of users’ privacy, the privacy of users’ electricity data should be ensured. Specifically, the electricity consumption data of users should be kept private during the whole communication process from SM to FN and then to CC. External adversaries do not have access to restore the plaintext of individual user data, ensuring that any changes to messages can be checked. The authenticity and integrity of the data transmitted and the identity of illegal users can be checked by FN and CC.


#### 4.3.2. Privacy-Preserving

User’s privacy is a key issue in smart grid applications. No one, including CC, has access to a single user’s privacy information from real-time energy consumption data.


#### 4.3.3. Functionality

The scheme can achieve the aggregation of user multidimensional data and support the integrity authentication of batch data without the participation of a trusted third party and the reuse of keys and blind factors.


#### 4.3.4. Computing and Communication Efficiency

User meters have limited computing power. Therefore, the high efficiency of computing and communication needs to be considered in smart grids.


#### 4.3.5. Dynamic User Management

Schemes should provide flexible equipment management mechanisms to support users in joining and exiting smart grid systems dynamically.


## 4.1. System Model

In our scheme, we focus on how to securely aggregate user electricity consumption data and forward user electricity consumption data to the control center (CC) of the smart grid in a privacy-preserving way. Figure2 shows the system model of the smart grid. There are three main players in the system model: a large number of smart meters (SM), fog nodes (FN), and CC. Their role in smart grid systems is as follows.Figure 2
Smart grid system model.


### 4.1.1. Smart Meter (SM)

A smart meter is a smart device installed by a utility company on a user’s premises. It collects specific real-time data from its surroundings and regularly reports it to the nearest fog node (FN). Obviously, we can easily connect smart meters to the users involved.


### 4.1.2. Fog Node (FN)

FN is the intermediate node between the control center and the smart meter, with a high level of storage and calculative power. It performs three main functions: (1) verifying the authenticity of the message received; (2) data aggregation of incoming messages; and (3) transferring the aggregated messages to CC.


### 4.1.3. Control Center (CC)

After receiving the FN report, CC first verifies the authenticity and integrity of the message, then decrypts the data. By decrypting the data, CC can learn the status of the entire smart grid in real-time, which can be used to conduct data analysis and make timely strategic adjustments.


## 4.1.1. Smart Meter (SM)

A smart meter is a smart device installed by a utility company on a user’s premises. It collects specific real-time data from its surroundings and regularly reports it to the nearest fog node (FN). Obviously, we can easily connect smart meters to the users involved.


## 4.1.2. Fog Node (FN)

FN is the intermediate node between the control center and the smart meter, with a high level of storage and calculative power. It performs three main functions: (1) verifying the authenticity of the message received; (2) data aggregation of incoming messages; and (3) transferring the aggregated messages to CC.


## 4.1.3. Control Center (CC)

After receiving the FN report, CC first verifies the authenticity and integrity of the message, then decrypts the data. By decrypting the data, CC can learn the status of the entire smart grid in real-time, which can be used to conduct data analysis and make timely strategic adjustments.


## 4.2. Threat Model

In our scheme, all participants (including CC and FN) were curious but honest. In general, CC and FN will interact exactly as defined, not tampering with calculations but trying to learn sensitive information from uploaded messages. In our threat model, we assume that an attacker has the following capabilities:(i)
Attackers can intercept the communication information between SM, FN, and CC. In addition, the attacker can break into some users in a residential area, which means that the attacker will obtain all the consumption data and the corresponding security parameters of these users and attempt to infer the privacy information of other users through these data.(ii)
Attackers can invade FN and CC databases, steal personal data and security parameters, and even damage FN and CC. Although the CC is powerful in reality, the data stored in it is not completely safe from the risk of being compromised because the attacker is powerful enough under our assumptions. Therefore, CC can also be considered a formidable opponent because of its curiosity about user privacy.(iii)
Attackers inject fake data into the system by intercepting messages and forging the identities of authorized users or tampering with data transmitted over a public communication channel to send fake power consumption data to the CC. In addition, attackers could launch attacks that compromise the data integrity of the smart grid.


## 4.3. Design Goals

Our goal is to design an efficient and stable multidimensional data aggregation solution without a trusted third party, which can protect the privacy of the user while achieving the required functionality. Specifically, our design objectives include the following design goals.


### 4.3.1. Security

To avoid the leakage of users’ privacy, the privacy of users’ electricity data should be ensured. Specifically, the electricity consumption data of users should be kept private during the whole communication process from SM to FN and then to CC. External adversaries do not have access to restore the plaintext of individual user data, ensuring that any changes to messages can be checked. The authenticity and integrity of the data transmitted and the identity of illegal users can be checked by FN and CC.


### 4.3.2. Privacy-Preserving

User’s privacy is a key issue in smart grid applications. No one, including CC, has access to a single user’s privacy information from real-time energy consumption data.


### 4.3.3. Functionality

The scheme can achieve the aggregation of user multidimensional data and support the integrity authentication of batch data without the participation of a trusted third party and the reuse of keys and blind factors.


### 4.3.4. Computing and Communication Efficiency

User meters have limited computing power. Therefore, the high efficiency of computing and communication needs to be considered in smart grids.


### 4.3.5. Dynamic User Management

Schemes should provide flexible equipment management mechanisms to support users in joining and exiting smart grid systems dynamically.


## 4.3.1. Security

To avoid the leakage of users’ privacy, the privacy of users’ electricity data should be ensured. Specifically, the electricity consumption data of users should be kept private during the whole communication process from SM to FN and then to CC. External adversaries do not have access to restore the plaintext of individual user data, ensuring that any changes to messages can be checked. The authenticity and integrity of the data transmitted and the identity of illegal users can be checked by FN and CC.


## 4.3.2. Privacy-Preserving

User’s privacy is a key issue in smart grid applications. No one, including CC, has access to a single user’s privacy information from real-time energy consumption data.


## 4.3.3. Functionality

The scheme can achieve the aggregation of user multidimensional data and support the integrity authentication of batch data without the participation of a trusted third party and the reuse of keys and blind factors.


## 4.3.4. Computing and Communication Efficiency

User meters have limited computing power. Therefore, the high efficiency of computing and communication needs to be considered in smart grids.


## 4.3.5. Dynamic User Management

Schemes should provide flexible equipment management mechanisms to support users in joining and exiting smart grid systems dynamically.


## 5. Our SEMDA Scheme

In this section, we introduce our SEMDA scheme in detail. The scheme consists of five stages: system initialization, multidimensional data coding and encryption, batch verification and data aggregation, data decryption, and dynamic user management. The symbols used in SEMDA and their descriptions are shown in Table1.Table 1
Notations in SEMDA scheme.
NotationDescriptionSMiSmart metersFNFog nodeCCControl centerdi,lFine-grained user datamiThe encoded plaintext message valuexiKey signed by the userYiUser authenticated keyIDi,IDfUser and FN identitycCiphertext after FN aggregationMPlaintext after CC decryptionskiThe private key to encryptβiUser blind factorkiUser’s key setT,TsCurrent time and time slotH1,H2H1:0,1∗⟶G1,H2:0,1∗⟶ZN∗σi,σfSignatures of user and FNλCC’s private keybiLarge prime selected by Chinese remainder theorem


### 5.1. Initialization Phase

Step 1: Given the security parameterk, system users set U=u1,u2,⋯,un, the system randomly selects two large primes p and q to generate the parameters G1,G2,e,h. The group G1,G2 satisfies the bilinear relation e:G1×G1⟶G2 and h is the generator of the group G1.Step 2: First of all, CC calculatesN=p⋅q, λ=lcmp−1,q−1; and for ease of calculation choose g=N+1, choose l prime numbers Ρ=b1,b2,b3⋯bl, where bi≥ndmax, 0≤i≤l, dmax is the upper bound of a single dimension of a user’s electricity data, n is the number of users; and two Hash functions H1:0,1∗⟶G1, H2:0,1∗⟶ZN∗. Secondly, CC calculates B=b1b2⋯bl, B′=BiBi=B/bi,1≤i≤l, y=yiyi=Bi−1modbi,1≤i≤l. Then, CC randomly selects n blind factors βi∈RZN∗,1≤i≤n and assigns to n users. Finally, CC public parameters l,N,g,G1,G2,h,e,H1,H2,B,B′, and set the private key as λ.Step 3: Userui∈U randomly selects xi∈RZN∗ as his private key and calculates Yi=hxi as his public key. Then, FN randomly select xf∈RZN∗ as his private key and calculate Yf=hxf as his public key.Step 4: Userui∈U randomly selects Rij∈RZN2∗, where 1≤j≤n−1. Ri1,⋯,Ri,n−1 form the user’s shared key set. Through the secure channel, users send Rij to user j. User ui∈U receives the shared key of other users, which forms the key set of users R1i,⋯,Rni. The user’s key set Ri1,⋯,Ri,n−1,R1i,⋯,Rni is recorded ki, and these user ui∈U uses his key set to calculate the encrypt key ski=Ri1+⋯+Ri,n−1−R1i−⋯−Rni, clearly ∑i=1nski=0. To illustrate this, three user examples are given, as shown in Figure 3.


### 5.2. Reporting Phase

When a userui∈U needs to send smart meter data to FN at the interval Ts, he will implement two steps. Step one: the user collects his multidimensional data di=di,1,di,2,⋯,di,l and uses the Chinese remainder theorem to compute multidimensional messages mi=di,1B1+di,2B2+⋯+di,lBlmodB. Step two: the user encrypts message mi by ci=gmiH2TsNski+βimodN2 and generates the signature value σi=H1IDiTcixi with his private key xi, where T is the current time, which can used to defend against a replay attacks. After that, the user sends the data ci,σi,T,IDi to the nearest FN.Figure 3
The process of generating the user key.


### 5.3. Reading Phase

Firstly, FN verifies the legitimacy and integrity of the message received from the users. FN verifies that the following formulaeσi,h=?eH1IDiTci,Yi: (2)e∑i=1nσi,h=e∑i=1nH1IDiTcixi,h=∑i=1neH1IDiTcixi,h=∑i=1neH1IDiTci,Yi.If the verification fails, FN asks the user to resend the data.Secondly, after the batch verification is passed, FN aggregates the data. Due to∑i=1nski=0, we have(3)c=∏i=1nci=g∑i=1nmiH2Ts∑i=1nNski+βimodN2=gMH2Ts∑i=1nNβimodN2,where M=∑i=1nmi represents the value of all users’ message aggregations. Then, FN signs the aggregated value with its private key and generates the signature value σf=H1IDfTcxf. Finally, FN sends c,σf,T,IDf to CC.


### 5.4. Decryption Phase

After receiving the report from FN, CC first verifies that the following formula is true foreσf,h=?eH1IDfTc,Yf. Then, CC calculates that β0 satisfies ∑i=1nβi+β0=0modλ to decrypt the cipher c using its private key λ.(4)M′=c⋅H2TsNβ0modN2=gMH2Ts∑i=1nNβi⋅H2TsNβ0modN2=gMH2Ts∑i=1nNβimodN2=gMmodN2=N+1MmodN2=1+MN,M=M′−1N=∑i=1nmi=∑i=1ndi,1B1+di,2B2+⋯+di,lBlmodB=∑i=1n∑t=1ldi,tBtmodB=∑t=1l∑i=1ndi,tBtmodB=e1B1+e2B2+⋯+elBlmodB.Finally, the Chinese remainder theorem is used to calculateei=M⋅yimodbi,1≤i≤l, and e1,e2,⋯,el of each dimension of all users, which can be used for statistical analysis and strategy adjustment.


### 5.5. Dynamic User Management

Our scheme supports dynamic user join and revoke. User failure can be considered as user revocation.


#### 5.5.1. User Revoke

When userun′∈U revokes, FN broadcasts to revoke user IDn′. Each user removes the shared key Rn′i of the revocation user and the shared key Rjn′ sent to the user in its own key set. Then, others reupdate their set of shared keys, calculating the private key at this point in encryption. CC calculates the ∑i=1nβi+β0′−βn′=0modλ update decryption blind factor β0′.


#### 5.5.2. User Join

When userui′ joins, FN broadcast adds user identity information IDi′. Then, other users update their key sets as initialized. CC randomly generates a blind factor βi′∈RZN∗, sends it to the user, and updates CC’s decryption blind factor β0′ according to ∑i=1nβi+β0′+βi′=0modλ.


## 5.1. Initialization Phase

Step 1: Given the security parameterk, system users set U=u1,u2,⋯,un, the system randomly selects two large primes p and q to generate the parameters G1,G2,e,h. The group G1,G2 satisfies the bilinear relation e:G1×G1⟶G2 and h is the generator of the group G1.Step 2: First of all, CC calculatesN=p⋅q, λ=lcmp−1,q−1; and for ease of calculation choose g=N+1, choose l prime numbers Ρ=b1,b2,b3⋯bl, where bi≥ndmax, 0≤i≤l, dmax is the upper bound of a single dimension of a user’s electricity data, n is the number of users; and two Hash functions H1:0,1∗⟶G1, H2:0,1∗⟶ZN∗. Secondly, CC calculates B=b1b2⋯bl, B′=BiBi=B/bi,1≤i≤l, y=yiyi=Bi−1modbi,1≤i≤l. Then, CC randomly selects n blind factors βi∈RZN∗,1≤i≤n and assigns to n users. Finally, CC public parameters l,N,g,G1,G2,h,e,H1,H2,B,B′, and set the private key as λ.Step 3: Userui∈U randomly selects xi∈RZN∗ as his private key and calculates Yi=hxi as his public key. Then, FN randomly select xf∈RZN∗ as his private key and calculate Yf=hxf as his public key.Step 4: Userui∈U randomly selects Rij∈RZN2∗, where 1≤j≤n−1. Ri1,⋯,Ri,n−1 form the user’s shared key set. Through the secure channel, users send Rij to user j. User ui∈U receives the shared key of other users, which forms the key set of users R1i,⋯,Rni. The user’s key set Ri1,⋯,Ri,n−1,R1i,⋯,Rni is recorded ki, and these user ui∈U uses his key set to calculate the encrypt key ski=Ri1+⋯+Ri,n−1−R1i−⋯−Rni, clearly ∑i=1nski=0. To illustrate this, three user examples are given, as shown in Figure 3.


## 5.2. Reporting Phase

When a userui∈U needs to send smart meter data to FN at the interval Ts, he will implement two steps. Step one: the user collects his multidimensional data di=di,1,di,2,⋯,di,l and uses the Chinese remainder theorem to compute multidimensional messages mi=di,1B1+di,2B2+⋯+di,lBlmodB. Step two: the user encrypts message mi by ci=gmiH2TsNski+βimodN2 and generates the signature value σi=H1IDiTcixi with his private key xi, where T is the current time, which can used to defend against a replay attacks. After that, the user sends the data ci,σi,T,IDi to the nearest FN.Figure 3
The process of generating the user key.


## 5.3. Reading Phase

Firstly, FN verifies the legitimacy and integrity of the message received from the users. FN verifies that the following formulaeσi,h=?eH1IDiTci,Yi: (2)e∑i=1nσi,h=e∑i=1nH1IDiTcixi,h=∑i=1neH1IDiTcixi,h=∑i=1neH1IDiTci,Yi.If the verification fails, FN asks the user to resend the data.Secondly, after the batch verification is passed, FN aggregates the data. Due to∑i=1nski=0, we have(3)c=∏i=1nci=g∑i=1nmiH2Ts∑i=1nNski+βimodN2=gMH2Ts∑i=1nNβimodN2,where M=∑i=1nmi represents the value of all users’ message aggregations. Then, FN signs the aggregated value with its private key and generates the signature value σf=H1IDfTcxf. Finally, FN sends c,σf,T,IDf to CC.


## 5.4. Decryption Phase

After receiving the report from FN, CC first verifies that the following formula is true foreσf,h=?eH1IDfTc,Yf. Then, CC calculates that β0 satisfies ∑i=1nβi+β0=0modλ to decrypt the cipher c using its private key λ.(4)M′=c⋅H2TsNβ0modN2=gMH2Ts∑i=1nNβi⋅H2TsNβ0modN2=gMH2Ts∑i=1nNβimodN2=gMmodN2=N+1MmodN2=1+MN,M=M′−1N=∑i=1nmi=∑i=1ndi,1B1+di,2B2+⋯+di,lBlmodB=∑i=1n∑t=1ldi,tBtmodB=∑t=1l∑i=1ndi,tBtmodB=e1B1+e2B2+⋯+elBlmodB.Finally, the Chinese remainder theorem is used to calculateei=M⋅yimodbi,1≤i≤l, and e1,e2,⋯,el of each dimension of all users, which can be used for statistical analysis and strategy adjustment.


## 5.5. Dynamic User Management

Our scheme supports dynamic user join and revoke. User failure can be considered as user revocation.


### 5.5.1. User Revoke

When userun′∈U revokes, FN broadcasts to revoke user IDn′. Each user removes the shared key Rn′i of the revocation user and the shared key Rjn′ sent to the user in its own key set. Then, others reupdate their set of shared keys, calculating the private key at this point in encryption. CC calculates the ∑i=1nβi+β0′−βn′=0modλ update decryption blind factor β0′.


### 5.5.2. User Join

When userui′ joins, FN broadcast adds user identity information IDi′. Then, other users update their key sets as initialized. CC randomly generates a blind factor βi′∈RZN∗, sends it to the user, and updates CC’s decryption blind factor β0′ according to ∑i=1nβi+β0′+βi′=0modλ.


## 5.5.1. User Revoke

When userun′∈U revokes, FN broadcasts to revoke user IDn′. Each user removes the shared key Rn′i of the revocation user and the shared key Rjn′ sent to the user in its own key set. Then, others reupdate their set of shared keys, calculating the private key at this point in encryption. CC calculates the ∑i=1nβi+β0′−βn′=0modλ update decryption blind factor β0′.


## 5.5.2. User Join

When userui′ joins, FN broadcast adds user identity information IDi′. Then, other users update their key sets as initialized. CC randomly generates a blind factor βi′∈RZN∗, sends it to the user, and updates CC’s decryption blind factor β0′ according to ∑i=1nβi+β0′+βi′=0modλ.


## 6. Systems Analysis

### 6.1. Semantic Security of Encrypted Data

In our scheme, each user encrypts the user’s electricity consumptionci=gmiH2TsNski+βimodN2 at Ts time and submits it to FN for data aggregation, which we demonstrate to be semantically secure with the following theorem.Lemma 1.
For given messagem0 and m1, encrypted ciphers are indistinguishable.Proof.
First, we randomly select a message in messagesm0 and m1 with ci=gmiH2TsNski+βimodN2i∈0,1 to encrypt it. For the attacker, the advantage is advA=prm0∈0,1∗:c0=Encm0−prm1∈0,1∗:c0=Encm0 because the calculated H2Ts and H2Ts←$ZN2 are indistinguishable. Therefore, for the attacker, the indistinguishable ciphers cii∈0,1 and ci←$ZN2 are also indistinguishable. So, the attacker’s advantage is advA<negligible, the attacker cannot distinguish between encrypted messages m0 or m1. Thus, the encryption scheme is semantically secure. End proof.


### 6.2. Privacy-Preserving

To prevent user privacy from being compromised, our proposal requires that neither FN nor CC restore user data for individual users.Lemma 2.
Even if an external attacker steals the communication channel between the user and FN and obtains the relevant data. The attacker cannot get any information about the user’s message.Proof.
External attackers stole messages between users and FN, obtainingci,σi,T,IDi. As our encrypted messages are semantically secure, therefore, the attacker cannot recover messages from users without knowing the secret key ski and blind factor βi. End proof.Lemma 3.
Even if an attacker breaks FN, no private data can be inferred from the cryptoc uploaded by the user.Proof.
The message uploaded by the user is an encrypted cipher. FN can’t decrypt without the key can only aggregate. The aggregated information is as follows:(5)c=∏i=1nci=gMH2Ts∑i=1nNβimodN2.
Without CC’s and the private key, the attacker still cannot get any information about the user from the aggregated message. End proof.Lemma 4.
The attacker destroys CC to obtain CC’s private key and aggregated data. The attacker cannot access any of the user’s private information.Proof.
The attacker destroyed CC and obtained CC’s private key. By decrypting the data, the attacker can obtain aggregated plaintext information. But decryption messages are private to a single user’s message and cannot analyze specific information about a single user. End proof.


### 6.3. Data Integrity

Our scheme has the functions of authentication and data completeness check, using bilinear pairing to sign and send the signature value to FN. The attacker cannot deduce the secret key of the user’s signature and forge the signature value. If forged successfully, the difficult problem of bilinear pairing is solved. However, it is impossible, so our scheme can protect the integrity of the data.To better illustrate how to detect errors quickly, as shown in Figure4, an example of a quick detection error signature is given. In our example, A=E1,E2,⋯,E10, Ei=eH1IDiTci,Yi, assuming that the wrong signature is randomly distributed and the wrong signature is σ10. We construct a (3, 5) threshold set. Depending on the nature of the threshold set, we can easily identify the wrong signature σ10. Compared to the 10 times it takes to detect an error signature by detecting it one by one, we only need to count up to five times to find the wrong signature σ10, which improves the efficiency of the calculation. For other details, please refer to [18].Figure 4
An example of a quick error signature detection.


### 6.4. Functional Analysis

In our scheme, according to the property of paillier homomorphic encryption scheme, the ciphertext of the same plaintext is indistinguishable, so our key and blind factor can be reused. As is shown in Table2, we compare the functionality of our scheme with that of other schemes. Our scheme is functionally superior.Table 2
Functional comparison of other schemes.
SchemeData confidentialityNo trusted authorityDynamic usersMultidimensionalKey and blind factor reuseMSDA [31]YesYesYesNoYesEPMDA-FED [18]YesYesNoYesNoFPDA [11]YesNoYesNoYesOurYesYesYesYesYes


## 6.1. Semantic Security of Encrypted Data

In our scheme, each user encrypts the user’s electricity consumptionci=gmiH2TsNski+βimodN2 at Ts time and submits it to FN for data aggregation, which we demonstrate to be semantically secure with the following theorem.Lemma 1.
For given messagem0 and m1, encrypted ciphers are indistinguishable.Proof.
First, we randomly select a message in messagesm0 and m1 with ci=gmiH2TsNski+βimodN2i∈0,1 to encrypt it. For the attacker, the advantage is advA=prm0∈0,1∗:c0=Encm0−prm1∈0,1∗:c0=Encm0 because the calculated H2Ts and H2Ts←$ZN2 are indistinguishable. Therefore, for the attacker, the indistinguishable ciphers cii∈0,1 and ci←$ZN2 are also indistinguishable. So, the attacker’s advantage is advA<negligible, the attacker cannot distinguish between encrypted messages m0 or m1. Thus, the encryption scheme is semantically secure. End proof.


## 6.2. Privacy-Preserving

To prevent user privacy from being compromised, our proposal requires that neither FN nor CC restore user data for individual users.Lemma 2.
Even if an external attacker steals the communication channel between the user and FN and obtains the relevant data. The attacker cannot get any information about the user’s message.Proof.
External attackers stole messages between users and FN, obtainingci,σi,T,IDi. As our encrypted messages are semantically secure, therefore, the attacker cannot recover messages from users without knowing the secret key ski and blind factor βi. End proof.Lemma 3.
Even if an attacker breaks FN, no private data can be inferred from the cryptoc uploaded by the user.Proof.
The message uploaded by the user is an encrypted cipher. FN can’t decrypt without the key can only aggregate. The aggregated information is as follows:(5)c=∏i=1nci=gMH2Ts∑i=1nNβimodN2.
Without CC’s and the private key, the attacker still cannot get any information about the user from the aggregated message. End proof.Lemma 4.
The attacker destroys CC to obtain CC’s private key and aggregated data. The attacker cannot access any of the user’s private information.Proof.
The attacker destroyed CC and obtained CC’s private key. By decrypting the data, the attacker can obtain aggregated plaintext information. But decryption messages are private to a single user’s message and cannot analyze specific information about a single user. End proof.


## 6.3. Data Integrity

Our scheme has the functions of authentication and data completeness check, using bilinear pairing to sign and send the signature value to FN. The attacker cannot deduce the secret key of the user’s signature and forge the signature value. If forged successfully, the difficult problem of bilinear pairing is solved. However, it is impossible, so our scheme can protect the integrity of the data.To better illustrate how to detect errors quickly, as shown in Figure4, an example of a quick detection error signature is given. In our example, A=E1,E2,⋯,E10, Ei=eH1IDiTci,Yi, assuming that the wrong signature is randomly distributed and the wrong signature is σ10. We construct a (3, 5) threshold set. Depending on the nature of the threshold set, we can easily identify the wrong signature σ10. Compared to the 10 times it takes to detect an error signature by detecting it one by one, we only need to count up to five times to find the wrong signature σ10, which improves the efficiency of the calculation. For other details, please refer to [18].Figure 4
An example of a quick error signature detection.


## 6.4. Functional Analysis

In our scheme, according to the property of paillier homomorphic encryption scheme, the ciphertext of the same plaintext is indistinguishable, so our key and blind factor can be reused. As is shown in Table2, we compare the functionality of our scheme with that of other schemes. Our scheme is functionally superior.Table 2
Functional comparison of other schemes.
SchemeData confidentialityNo trusted authorityDynamic usersMultidimensionalKey and blind factor reuseMSDA [31]YesYesYesNoYesEPMDA-FED [18]YesYesNoYesNoFPDA [11]YesNoYesNoYesOurYesYesYesYesYes


## 7. Performance Evaluation

In this section, we evaluate our scheme in terms of computational overhead and communication overhead. Considering the computing power of smart meters and fog nodes. In literature [7, 9–11, 29–35], paillier homomorphic encryption scheme has been widely applied in data aggregation schemes of the smart grid. In literature [10, 11, 13, 29, 30, 32, 33, 35–38], fog nodes are used as intermediate nodes to process data transmitted by smart meters. Therefore, our scheme is feasible in reality. Our experiment is based on the JPBC library and uses a computer configured with an AMD R7-580H CPU@ 3.2 GHz and 16 GB of RAM with the Windows 11 operating system. We assume that there are k FNs in a smart grid system and n users in each FN. The relative parameters of the bilinear pairing are shown in Table 3, and the size of the experimental selection parameters is shown in Table 4. In order to improve the accuracy of the test, we took an average of 30 times as the test result. As is shown in Table 5, we present the computational overhead for each stage; the encryption overhead is the computational overhead of a user. As is shown in Figure 5, we tested the computational overhead of a different number of users in the same dimension in an FN. In addition, as is shown in Figure 6, we tested the computational overhead of different dimensions for the same number of users. Since the cost of FN signature verification is primarily linear to the number of users, we will not show the cost of signature verification in Figure 6.Table 3
Parameters of the type A curve.
NameValueq8780710799663312522437781984754049815806883199414208211028653399266475630880222957078625179422662221423155858769582317459277713367317481324925129998224791h12016012264891146079388821366740534204802954401251311822919615131047207289359704531102844802183906537786776r730750818665451621361119245571504901405976559617Table 4
Implementation parameters.
ParameterLength (bits)p,q512IDi,IDf32T,Ts64H1,H21024bi100di,l64Table 5
Computing overhead at each stage.
Users = 500StageDimension = 10EncryptionAggregationBatch verificationDecryptionTime (m·s)4.374.5018473.22Proportion0.24%0.24%99.35%0.17%Figure 5
Calculation overhead for different user numbers in the same dimension.Figure 6
Calculation overhead for different dimensions of the same number of users.


### 7.1. Computation Overhead

First of all, we mainly consider the cost of the data operation, because the cost of the system initialization stage does not affect the delay of our system. In addition,Tp to represent the computational cost of bilinear pairing. Tm1 to represent the multiplication of elements in group G1. Tm2 to represent the multiplication of elements in group G2. Tm3 to represent the multiplication of elements in group ZN2. Ta1 to represent the cost of adding elements in group G1. Ta2 to represent the cost of adding elements in group G2. Ta3 to represent the cost of adding elements in group ZN2. Th1 represents the cost of mapping elements to group G1 through Hash. Th2 represents the cost of mapping elements to group ZN2 through Hash. Te1 to represent the cost of exponential operations in group G1. Te2 to represent the cost of exponential operations in group G2. Te3 to represent the cost of exponential operations in group ZN2.In our scheme, each user needs to spendTe3+Th2+Tm3 to encrypt message, spend Th1+Te1 to generate his signature. So, the total computing cost of user is Th1+Te1+Te3+Th2+Tm3. For FN, it needs to verify n user’s signature in bulk, the computation cost is nTa1+n+1Tp+nTh1+n−1Ta2, the computation cost of data aggregation is n−1Tm3, and the computation cost of signatures is Th1+Te1, so the total computing cost of FN is nTa1+n+1Tp+n+1Th1+n−1Ta2+n−1Tm3+Te1. The experimental results show that dimensions have negligible impact on decryption costs. For CC, it spends 2Tp+Th1 to authenticate the signature and spends Th2+Tm3+Te3 to decrypt ciphertext, so the total computing cost of CC is 2Tp+Th1+Th2+Tm3+Te3k.In the MSDA scheme [31], each user needs to spend 3Te3+Th2+2Tm3 to encrypt message. In the scheme, there is no signature process. Therefore, FN aggregation costs is n−1Tm3. CC decryption cost is Te3+Tm3k.In the EPMDA-FED scheme [18], each user needs to spend 2Ta3 to encrypt message, spend Ta3+Th1+Tm1 to generate his signature, so the total computing cost of user is 3Ta3+Th1+Tm1. For FN, it needs to verify n user’s signature in bulk, the computation cost is n−1Ta1+Ta3+Th1+Tm1+Tm2+nTp, the computation cost of data aggregation is n−1Ta3, and the computation cost of signatures is Th1+Tm1, so the total computing cost of FN is n−1Ta1++Tm2+nTh1+Tm1+Tp+2n−1Ta3. For CC, it spends 2Tp+Th1 to authenticate the signature and n−1Tm3+2Ta3 to decrypt ciphertext, so the total computing cost of CC is 2Tp+Th1+n−1Tm3+2Ta3k.In the FPDA scheme [11], each user needs to spend Th2+Te3+Tm3 to encrypt message. In the scheme, there is no signature process. Therefore, FN aggregation costs is n−1Tm3. CC decryption cost is Th2+Te3+Tm3k.As shown in Table6, we compared the calculation costs of different schemes. It can be seen that the computation is still efficient because we include signature authentication in our scheme. But batch verification is done mainly in FN and does not impose an additional computational burden on CC decryption.Table 6
Comparison of computation overhead.
SchemeSMFNCCMSDA [31]3Te3+Th2+2Tm3n−1Tm3Te3+Tm3kEPMDA-FED [18]3Ta3+Th1+Tm1n−1Ta1++Tm2+nTh1+Tm1+Tp+2n−1Ta32Tp+Th1+n−1Tm3+2Ta3kFPDA [11]Th2+Te3+Tm3n−1Tm3Th2+Te3+Tm3kOurTh1+Te1+Te3+Th2+Tm3nTa1+n+1Tp+n+1Th1+n−1Ta2+n−1Tm3+Te12Tp+Th1+Th2+Tm3+Te3k


### 7.2. Communication Overhead

Communication overhead is calculated based on the size of the messages that the smart device sends to the fog node (SM−to−FN) and the fog node sends to the control center (FN−to−CC).In our scheme, each SM reports the messageci,σi,T,IDi to FN at each interval of time, so SM−to−FN’s communication cost is ci+σi+T+IDi=3168n. Before FN communicates with CC, FN aggregates the user’s data and sends aggregated data c,σf,T,IDf to CC. So FN−to−CC’s communication cost is c+σf+T+IDf=3168k.In the MSDA scheme [31], each SM reports the message ci to FN at each interval of time, so SM−to−FN’s communication cost is ci=2048n. Before FN communicates with CC, FN aggregates the user’s data and sends the aggregated data c to CC. So FN−to−CC’s communication cost is c=2048k.In the EPMDA-FED scheme [18], each SM reports the message ci,σi,T,IDi,IDf to FN at each interval of time, so SM−to−FN’s communication cost is ci+σi+T+IDi+IDf=3200n. Before FN communicates with CC, FN aggregates the user’s data and sends aggregated data c,σf,T,IDf to CC. So FN−to−CC’s communication cost is c+σf+T+IDf+IDcc=3200k.In the FPDA scheme [11], each SM reports the message ci to FN at each interval of time, so SM−to−FN’s communication cost is ci=2048n. Before FN communicates with CC, FN aggregates the user’s data and sends aggregated data c to CC. So FN−to−CC’s communication cost is c=2048k.As is shown in Table7, we compared the communication costs of other schemes. As can be seen from the table, the increase in communication cost of our scheme compared with the MSDA scheme and the FPDA scheme is mainly the communication cost of signature authentication. However, for the sake of the authenticity and integrity of the data. Therefore, our scheme’s increased communication costs are necessary.Table 7
Comparison of communication overhead.
SchemeSM−to−FN (n)FN−to−CC (k)MSDA [31]20482048EPMDA-FED [18]32003200FPDA [11]20482048Our31683168


## 7.1. Computation Overhead

First of all, we mainly consider the cost of the data operation, because the cost of the system initialization stage does not affect the delay of our system. In addition,Tp to represent the computational cost of bilinear pairing. Tm1 to represent the multiplication of elements in group G1. Tm2 to represent the multiplication of elements in group G2. Tm3 to represent the multiplication of elements in group ZN2. Ta1 to represent the cost of adding elements in group G1. Ta2 to represent the cost of adding elements in group G2. Ta3 to represent the cost of adding elements in group ZN2. Th1 represents the cost of mapping elements to group G1 through Hash. Th2 represents the cost of mapping elements to group ZN2 through Hash. Te1 to represent the cost of exponential operations in group G1. Te2 to represent the cost of exponential operations in group G2. Te3 to represent the cost of exponential operations in group ZN2.In our scheme, each user needs to spendTe3+Th2+Tm3 to encrypt message, spend Th1+Te1 to generate his signature. So, the total computing cost of user is Th1+Te1+Te3+Th2+Tm3. For FN, it needs to verify n user’s signature in bulk, the computation cost is nTa1+n+1Tp+nTh1+n−1Ta2, the computation cost of data aggregation is n−1Tm3, and the computation cost of signatures is Th1+Te1, so the total computing cost of FN is nTa1+n+1Tp+n+1Th1+n−1Ta2+n−1Tm3+Te1. The experimental results show that dimensions have negligible impact on decryption costs. For CC, it spends 2Tp+Th1 to authenticate the signature and spends Th2+Tm3+Te3 to decrypt ciphertext, so the total computing cost of CC is 2Tp+Th1+Th2+Tm3+Te3k.In the MSDA scheme [31], each user needs to spend 3Te3+Th2+2Tm3 to encrypt message. In the scheme, there is no signature process. Therefore, FN aggregation costs is n−1Tm3. CC decryption cost is Te3+Tm3k.In the EPMDA-FED scheme [18], each user needs to spend 2Ta3 to encrypt message, spend Ta3+Th1+Tm1 to generate his signature, so the total computing cost of user is 3Ta3+Th1+Tm1. For FN, it needs to verify n user’s signature in bulk, the computation cost is n−1Ta1+Ta3+Th1+Tm1+Tm2+nTp, the computation cost of data aggregation is n−1Ta3, and the computation cost of signatures is Th1+Tm1, so the total computing cost of FN is n−1Ta1++Tm2+nTh1+Tm1+Tp+2n−1Ta3. For CC, it spends 2Tp+Th1 to authenticate the signature and n−1Tm3+2Ta3 to decrypt ciphertext, so the total computing cost of CC is 2Tp+Th1+n−1Tm3+2Ta3k.In the FPDA scheme [11], each user needs to spend Th2+Te3+Tm3 to encrypt message. In the scheme, there is no signature process. Therefore, FN aggregation costs is n−1Tm3. CC decryption cost is Th2+Te3+Tm3k.As shown in Table6, we compared the calculation costs of different schemes. It can be seen that the computation is still efficient because we include signature authentication in our scheme. But batch verification is done mainly in FN and does not impose an additional computational burden on CC decryption.Table 6
Comparison of computation overhead.
SchemeSMFNCCMSDA [31]3Te3+Th2+2Tm3n−1Tm3Te3+Tm3kEPMDA-FED [18]3Ta3+Th1+Tm1n−1Ta1++Tm2+nTh1+Tm1+Tp+2n−1Ta32Tp+Th1+n−1Tm3+2Ta3kFPDA [11]Th2+Te3+Tm3n−1Tm3Th2+Te3+Tm3kOurTh1+Te1+Te3+Th2+Tm3nTa1+n+1Tp+n+1Th1+n−1Ta2+n−1Tm3+Te12Tp+Th1+Th2+Tm3+Te3k


## 7.2. Communication Overhead

Communication overhead is calculated based on the size of the messages that the smart device sends to the fog node (SM−to−FN) and the fog node sends to the control center (FN−to−CC).In our scheme, each SM reports the messageci,σi,T,IDi to FN at each interval of time, so SM−to−FN’s communication cost is ci+σi+T+IDi=3168n. Before FN communicates with CC, FN aggregates the user’s data and sends aggregated data c,σf,T,IDf to CC. So FN−to−CC’s communication cost is c+σf+T+IDf=3168k.In the MSDA scheme [31], each SM reports the message ci to FN at each interval of time, so SM−to−FN’s communication cost is ci=2048n. Before FN communicates with CC, FN aggregates the user’s data and sends the aggregated data c to CC. So FN−to−CC’s communication cost is c=2048k.In the EPMDA-FED scheme [18], each SM reports the message ci,σi,T,IDi,IDf to FN at each interval of time, so SM−to−FN’s communication cost is ci+σi+T+IDi+IDf=3200n. Before FN communicates with CC, FN aggregates the user’s data and sends aggregated data c,σf,T,IDf to CC. So FN−to−CC’s communication cost is c+σf+T+IDf+IDcc=3200k.In the FPDA scheme [11], each SM reports the message ci to FN at each interval of time, so SM−to−FN’s communication cost is ci=2048n. Before FN communicates with CC, FN aggregates the user’s data and sends aggregated data c to CC. So FN−to−CC’s communication cost is c=2048k.As is shown in Table7, we compared the communication costs of other schemes. As can be seen from the table, the increase in communication cost of our scheme compared with the MSDA scheme and the FPDA scheme is mainly the communication cost of signature authentication. However, for the sake of the authenticity and integrity of the data. Therefore, our scheme’s increased communication costs are necessary.Table 7
Comparison of communication overhead.
SchemeSM−to−FN (n)FN−to−CC (k)MSDA [31]20482048EPMDA-FED [18]32003200FPDA [11]20482048Our31683168


## 8. Conclusion

In this paper, we propose an efficient privacy-protecting multidimensional data aggregation scheme that does not require a trusted third party. The multidimensional data is encapsulated by the Chinese residual theorem and then encrypted securely, which can effectively resist the collusive attack. In addition, the scheme also supports blind factor reusability and batch data validation, so it can better adapt to the requirements of multidimensional data aggregation in complex scenarios. Experimental results show that the scheme is feasible and efficient.



---

*Source: 6693296-2023-02-01.xml*