# EPPSA: Efficient Privacy-Preserving Statistical Aggregation Scheme for Edge Computing-Enhanced Wireless Sensor Networks

Authors: Yunting Tao; Fanyu Kong; Jia Yu; Qiuliang Xu
Journal: Security and Communication Networks
 (2022)

---

## Abstract

In edge computing-enhanced wireless sensor networks (WSNs), multidimensional data aggregation can optimize the utilization of computation resources for data collection. How to improve the efficiency of data aggregation has gained considerable attention in both academic and industrial fields. This article proposes a new efficient privacy-preserving statistical aggregation scheme (EPPSA) for WSNs, in which statistical data can be calculated without exposing the total number of sensor devices to control center. The EPPSA scheme supports multiple statistical aggregation functions, including arithmetic mean, quadratic mean, weighted mean, and variance. Furthermore, the EPPSA scheme adopts the modified Montgomery exponentiation algorithms to improve the aggregation efficiency in the edge aggregator. The performance evaluation shows that the EPPSA scheme gets higher aggregation efficiency and lower communication load than the existing statistical aggregation schemes.


---

## Body

## 1. Introduction

In recent years, wireless sensor networks (WSNs) have achieved an accelerated increase in deployment. WSNs are widely utilized in scenarios such as smart homes [1], vehicular ad hoc networks [2–4], industrial Internet of Things [5], and monitoring environments [6–8]. The sensor devices in WSNs are responsible for sensing real-time data and transmitting the sensed data to control center for data analysis and intelligent control. In a variety of WSN applications, some computations are too time-consuming for sensor devices. Edge computation is an effective solution for resource-limited sensor devices to gain edge devices’ assistance, such as data aggregation and neural network models [9]. With the edge computation devices deployed near the target area, the computing load in WSN sensor devices could be distributed to the edge devices. With the help of edge computation devices, cloud data centers provide various services for numbers of applications [10–13].To reduce data redundancy and communication delay, data aggregation has become one of the most practical techniques, which can be used in edge computing-enhanced WSNs. Usually, a gateway is an ideal edge device to perform data aggregation operations due to its high computational capability, and mobile edge computing (MEC) also provides an emergent paradigm that brings computation close to mobile sensors [14]. It is worth noting that data aggregation at edge gateways may suffer from some potential security risks [15]. Firstly, the data may be captured or falsified during the delivery process, considering WSNs are usually deployed in an unattended environment. Secondly, adversaries can invade the edge gateway for stealing users’ private data. The traditional security approaches cannot be directly applied to edge computing-enhanced WSN data aggregation, since they may be conflicted with aggregation function [16]. Furthermore, due to the dynamic and heterogeneous characteristics of WSN devices, there exits difficulty for the sensed data to be collected, encrypted, used, and stored in accordance with the users’ preferences [17, 18].To solve the above problems, homomorphic encryption algorithms have been considered to construct privacy-preserving single-dimensional aggregation schemes [19–21]. Furthermore, researchers proposed several multidimensional privacy-preserving data aggregation schemes, the core idea of which is to construct a conversion mechanism between multidimensional data and large integers [19, 20, 22–33]. These researches are centered on how to reduce computation costs and communication load while collecting and transmitting the data. Lu et al. [26] proposed an efficient privacy-preserving data aggregation (EPPA) scheme in smart grids. Merging multidimensional data by super-increasing sequence of large primes, Lu et al.‘s scheme is more efficient than the one-dimensional data aggregation schemes. Using a polynomial method, Shen et al. [27] constructed a user-level polynomial to store multidimensional values in a single data space based on Horner’s rule. Fault tolerance can be used to enhance the security and robustness of a data aggregation scheme. In [32], Mohammadali et al. presented a homomorphic privacy-preserving data aggregation scheme with the fault tolerance property, so it can keep data secure even if the aggregator is malicious or curious.Most secure data aggregation schemes only consider summation-based aggregation since the underlying additive homomorphic encryption only supports the modular addition operations. In practice, various types of statistics (e.g., mean, variance and standard deviation) might often need to be supported for data application [34]. Therefore, it is necessary to design multifunctional secure data aggregation scheme supporting various data statistics. Zhang et al. [35] proposed a multifunctional secure data aggregation scheme (MODA). This scheme offers the building blocks for multifunctional aggregation by encoding raw data into well-defined vectors. Peng et al. [36] introduced a multifunctional aggregation scheme supporting diversified aggregation functions, including linear, polynomial, and continuous functions. Both of the above schemes implement the statistical functions computed by control center. For example, in [36], the ciphertext sum is generated in the edge device and the mean is calculated using the decrypted sum by control center. Thus, the total number of sensor devices is required to transmit to control center for calculating the mean by sum/total number.In lots of WSN application scenarios (e.g., industrial monitoring), the total number of sensor devices represents industrial scale which should be kept secret. Smart factories use WSNs and edge computation to create new production forms with better efficiency and flexibility. The total number of sensor devices usually represents industrial production scale in a smart factory. Usually, control center is a third-party service from the cloud or a regulatory agency from the government side. Trade secrets can be learned and used by rivals if the scale of a factory’s production is disclosed. Therefore, it is necessary to compute statistical aggregation functions without exposing the total number of WSN sensor devices. In such a scenario, the control center could use statistical data for scientific analysis and intelligent decision-making but would not have any data about the industrial production scale of the smart factory.In this article, we propose the first privacy-preserving statistical aggregation scheme without revealing the total number of sensor devices to control center for edge computing-enhanced WSNs. The contributions of this article can be summarized as follows:(i)
We construct an efficient privacy-preserving statistical aggregation scheme based on the Paillier additive homomorphic encryption scheme and the ECDSA digital signature scheme, called EPPSA. The EPPSA scheme supports multiple statistical aggregation functions, including arithmetic mean, quadratic mean, weighted mean, and variance.(ii)
In the EPPSA scheme, the mean values can be calculated by the edge device and control center cooperatively, while control center does not know the total number of sensor devices. Firstly, the edge device computes the mean value in ciphertext since it has calculated the sum of the data in ciphertext.. Secondly, after receiving the mean in ciphertext, control center calculates the correct mean by using the modified extended Euclidean algorithm to process the decrypted mean. The EPPSA scheme avoids calculatingsum/total number and the total number of WSN sensor devices can be kept secret to control center.(iii)
In the EPPSA scheme, we propose three modified Montgomery exponentiation algorithms to improve the aggregation efficiency in the edge device. Our idea is to avoid converting the data between the Montgomery domain and residue domain frequently during the whole process. The ciphertext data in the Montgomery domain can be aggregated by Montgomery multiplications, which are more efficient than ordinary modular multiplications.(iv)
We implement the EPPSA scheme and compare it with the existing schemes. Compared with [28], the EPPSA scheme gets 62.5% aggregation performance improvement for 1024 bits modulus. Compared with [36], the EPPSA scheme gets 50% and 33% communication load decrease on arithmetic mean and variance statistics, respectively.The rest of this article is organized as follows: In Section2, the problem formulation is presented. In Section 3, the related preliminaries are reviewed. In Section 4, the proposed EPPSA data aggregation scheme is given. In Section 5, the secure analysis is given. In Section 6, the performance evaluation and comparison are presented. Finally, Section 7 concludes this article.


## 2. Problem Formulation

In this section, the formalized system model, the security requirements, and design goals are presented.


### 2.1. System Model

In the EPPSA scheme, a WSN system is comprised of four parts, namely trusted authority (TA), control center (CC), edge aggregator (EA), and sensor device (SD). The system describes a three-level topological structure, as shown in Figure1.(i)
TA is a trusted third party, which is responsible for generating and distributing the secret keys to all the system participants. In the phase of system initialization, TA sets the ECDSA key pairs into the sensor devices, edge devices, and control center. TA distributes the Paillier public key to the sensor devices, edge devices, and the Paillier private key to control center separately by sending digital envelopes over the Internet.(ii)
CC is a powerful service controller of a WSN sensing system. According to special application requirements, CC is responsible for analyzing the data statistics, for example, data mining. CC is assumed to be honest-but-curious. It means that CC attempts to mine valuable information while performing its specified tasks.(iii)
EA is a wireless receiving equipment that is deployed at the edge of the WSN. EA is responsible for collection, aggregation, and transmission of sensor data. EA collects encrypted data from sensor devices, aggregates the data, and transmits the aggregated data to CC. EA is a high-performance computing device so that it can perform computationally expensive processes.(iv)
SD is deployed at the intended area and is responsible for sensing and communication. SDs automatically sense and encrypt the particular data before sending them to EA. For example, ambient temperature sensors record the real-time temperature in an intelligent agricultural system and report the encrypted data to CC via EA.Figure 1
System model.


### 2.2. Security Requirements

In our system model, EA and CC are curious about SD’s privacy data, but they cannot collude with each other. Moreover, there is an adversaryα assumed to have the capability to eavesdrop on data during their transit. To protect data against internal and external attacks, the following security requirements should be fulfilled:(i)
Data confidentiality. Even though data from SDs or EA is eavesdropped on by α during their transit, they cannot be identified. EA cannot infer the privacy information of SDs while aggregating statistic data. When CC receives the statistics data, for example, mean, variance, it cannot identify the individual data or number of SDs.(ii)
Authentication. It should be guaranteed that the data are generated by legitimate SD entities. Otherwise, malicious operations from α, for example, replay attack, may undermine the accuracy of the statistics. Similarly, the aggregate data should be guaranteed to be generated by a legitimate EA.(iii)
Data integrity. Accuracy and completeness of data in transmission should be guaranteed. When an adversary α forges or modifies the data, the malicious operations should be detected by the receiver.


### 2.3. Design Goal

Our design goal is to design an efficient privacy-preserving statistical aggregation scheme. The following design goals should be achieved:(i)
Security. The proposed scheme should satisfy the secure requirements mentioned above. The security goal is to prevent individual data and statistical data from being stolen by the adversary. In order to achieve this security goal, both internal and external behavior should be detected.(ii)
Efficiency. The proposed scheme should consider computation cost and communication load. On one hand, it is necessary to use lightweight encryption and signing primitives. On the other hand, methods should be adopted to reduce the consumption of aggregate computation.(iii)
Statistical aggregation. A series of data statistical functions should be supported by the proposed scheme. In an actual scenario, statistics of measurement indicators, such as mean, weighted mean, and variance, are essential for analysis. Meanwhile, except for statistics, the CC should not get any other information.


## 2.1. System Model

In the EPPSA scheme, a WSN system is comprised of four parts, namely trusted authority (TA), control center (CC), edge aggregator (EA), and sensor device (SD). The system describes a three-level topological structure, as shown in Figure1.(i)
TA is a trusted third party, which is responsible for generating and distributing the secret keys to all the system participants. In the phase of system initialization, TA sets the ECDSA key pairs into the sensor devices, edge devices, and control center. TA distributes the Paillier public key to the sensor devices, edge devices, and the Paillier private key to control center separately by sending digital envelopes over the Internet.(ii)
CC is a powerful service controller of a WSN sensing system. According to special application requirements, CC is responsible for analyzing the data statistics, for example, data mining. CC is assumed to be honest-but-curious. It means that CC attempts to mine valuable information while performing its specified tasks.(iii)
EA is a wireless receiving equipment that is deployed at the edge of the WSN. EA is responsible for collection, aggregation, and transmission of sensor data. EA collects encrypted data from sensor devices, aggregates the data, and transmits the aggregated data to CC. EA is a high-performance computing device so that it can perform computationally expensive processes.(iv)
SD is deployed at the intended area and is responsible for sensing and communication. SDs automatically sense and encrypt the particular data before sending them to EA. For example, ambient temperature sensors record the real-time temperature in an intelligent agricultural system and report the encrypted data to CC via EA.Figure 1
System model.


## 2.2. Security Requirements

In our system model, EA and CC are curious about SD’s privacy data, but they cannot collude with each other. Moreover, there is an adversaryα assumed to have the capability to eavesdrop on data during their transit. To protect data against internal and external attacks, the following security requirements should be fulfilled:(i)
Data confidentiality. Even though data from SDs or EA is eavesdropped on by α during their transit, they cannot be identified. EA cannot infer the privacy information of SDs while aggregating statistic data. When CC receives the statistics data, for example, mean, variance, it cannot identify the individual data or number of SDs.(ii)
Authentication. It should be guaranteed that the data are generated by legitimate SD entities. Otherwise, malicious operations from α, for example, replay attack, may undermine the accuracy of the statistics. Similarly, the aggregate data should be guaranteed to be generated by a legitimate EA.(iii)
Data integrity. Accuracy and completeness of data in transmission should be guaranteed. When an adversary α forges or modifies the data, the malicious operations should be detected by the receiver.


## 2.3. Design Goal

Our design goal is to design an efficient privacy-preserving statistical aggregation scheme. The following design goals should be achieved:(i)
Security. The proposed scheme should satisfy the secure requirements mentioned above. The security goal is to prevent individual data and statistical data from being stolen by the adversary. In order to achieve this security goal, both internal and external behavior should be detected.(ii)
Efficiency. The proposed scheme should consider computation cost and communication load. On one hand, it is necessary to use lightweight encryption and signing primitives. On the other hand, methods should be adopted to reduce the consumption of aggregate computation.(iii)
Statistical aggregation. A series of data statistical functions should be supported by the proposed scheme. In an actual scenario, statistics of measurement indicators, such as mean, weighted mean, and variance, are essential for analysis. Meanwhile, except for statistics, the CC should not get any other information.


## 3. Preliminaries

### 3.1. The Paillier Cryptosystem

The Paillier cryptosystem is a widely used public key encryption scheme with additive homomorphic property [37] and is standardized by International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) in 2019 [38]. The Paillier cryptosystem consists of three parts, namely key generation, encryption, and decryption, which are described in Scheme 1.Scheme 1
The Paillier cryptosystem.The security of the Paillier encryption algorithm is based on the integer factoring problem. When choosing the parameterg, it is necessary to judge whether n is divisible by the order of g. This can be efficiently checked by testing whether gcdLgλmodn2,n=1, where function gcd. is the greatest common divisor function.The Paillier cryptosystem has several interesting homomorphic properties, which are associated with the statistics given below:(1)DecEncd1Encd2modn2=d1+d2modn.


### 3.2. Mean Value Computation on Ciphertext of Paillier Cryptosystem

Shah et al. [39] proposed a solution for noninteger mean value computation in the homomorphic encrypted domain. This method can be adopted by statistical aggregation scheme in WSNs. Let d1,d2,…,dm be a set of numbers. The mean value, denoted by dmean, is the sum of the values divided by the total number of elements, dmean=∑i=1i=mdi/m. In practice, the mean dmean may result in integer or float value. Using the homomorphic property of the Paillier cryptosystem given in (2), the mean can be calculated in the encrypted domain.(2)Encdmean=∏i=1i=mEncdim−1modnmodn2.If the plain domain meandmean is an integer, the encrypted domain mean Encdmean calculated by (2) results in the correct mean dmean after decryption. However, if the plain domain mean dmean is a decimal, the encrypted domain mean Encdmean calculated by (2) results in a large integer after decryption. For example, dmean=α/β, where α is not divisible by β. After decryption, Encdmean will result in αβ−1modn2, which is a large integer. Reducing the large integer to the correct mean value is a two-dimensional lattice reduction problem and can be solved by the Lagrange-Gauss lattice reduction algorithm. Shah et al. proposed an efficient method to reduce the large integer called the modified extended Euclidean algorithm MME. The method is shown in Algorithm 1.Algorithm 1: The reduction based on modified extended Euclidean algorithm
Input:n, w, where n is the modulus and w is the large number.Output:Rw=MEEn,w.(1)
x1,x2=0,n(2)
y1,y2=1,w(3)
Q=x2/y2(4)
tmp1,tmp2=x1,x2−Qy1,y2(5)
x1,x2=y1,y2(6)
y1,y2=tmp1,tmp2(7)
whilew>n do(8)
Q=x2/y2(9)
tmp1,tmp2=x1,x2−Qy1,y2(10)
x1,x2=y1,y2(11)
y1,y2=tmp1,tmp2(12)
end while(13)
returnRw=x2/x1The modulusn of Paillier cryptosystem and large integer value w can be considered as independent points in a two-dimensional lattice space ✓. These two basis vectors, 0,n and 1,w, can be reduced for optimal values. Algorithm 1 computes the reduced value of w using adapted extended Euclidean algorithm, which is the correct mean value.


### 3.3. Montgomery Multiplication

Montgomery multiplication (MM) is an efficient technique for computing modular multiplications [40]. Assuming an odd modulus n is a t-bit number, let r=2t. For integers 0<a,b<k, the Montgomery multiplication is MMa,b=ab2−tmodn. By taking r as a power of 2, the division becomes simple shifting. The process of MM is presented in Algorithm 2.Algorithm 2: The Montgomery multiplication
(i)
Input:a, b, n′, where n′ is computed by the extended Euclidean algorithm.Output:v=MMa,b.(1)
s=ab(2)
m=sn′modr(3)
u=s+mk/r(4)
ifv≥n, then return v−n(ii)
else returnvUtilizing the MM algorithm, the Montgomery exponentiation is present in Algorithm 3. For a numberα, the corresponding number in the Montgomery domain is denoted by α¯.Algorithm 3: The Montgomery exponentiation
(i)
Input:γ, e, n, where n′ is computed by the extended Euclidean algorithm.Output:θ=γemodn.(1)
γ¯=γ.rmodn(2)
θ¯=1.rmodn(3)
Fori=t−1 down to 0(4)
θ¯=MMθ¯,θ¯(5)
ifei=1, then θ¯=MMγ¯,θ¯(6)
θ=MMθ¯,1(7)
returnθ


## 3.1. The Paillier Cryptosystem

The Paillier cryptosystem is a widely used public key encryption scheme with additive homomorphic property [37] and is standardized by International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) in 2019 [38]. The Paillier cryptosystem consists of three parts, namely key generation, encryption, and decryption, which are described in Scheme 1.Scheme 1
The Paillier cryptosystem.The security of the Paillier encryption algorithm is based on the integer factoring problem. When choosing the parameterg, it is necessary to judge whether n is divisible by the order of g. This can be efficiently checked by testing whether gcdLgλmodn2,n=1, where function gcd. is the greatest common divisor function.The Paillier cryptosystem has several interesting homomorphic properties, which are associated with the statistics given below:(1)DecEncd1Encd2modn2=d1+d2modn.


## 3.2. Mean Value Computation on Ciphertext of Paillier Cryptosystem

Shah et al. [39] proposed a solution for noninteger mean value computation in the homomorphic encrypted domain. This method can be adopted by statistical aggregation scheme in WSNs. Let d1,d2,…,dm be a set of numbers. The mean value, denoted by dmean, is the sum of the values divided by the total number of elements, dmean=∑i=1i=mdi/m. In practice, the mean dmean may result in integer or float value. Using the homomorphic property of the Paillier cryptosystem given in (2), the mean can be calculated in the encrypted domain.(2)Encdmean=∏i=1i=mEncdim−1modnmodn2.If the plain domain meandmean is an integer, the encrypted domain mean Encdmean calculated by (2) results in the correct mean dmean after decryption. However, if the plain domain mean dmean is a decimal, the encrypted domain mean Encdmean calculated by (2) results in a large integer after decryption. For example, dmean=α/β, where α is not divisible by β. After decryption, Encdmean will result in αβ−1modn2, which is a large integer. Reducing the large integer to the correct mean value is a two-dimensional lattice reduction problem and can be solved by the Lagrange-Gauss lattice reduction algorithm. Shah et al. proposed an efficient method to reduce the large integer called the modified extended Euclidean algorithm MME. The method is shown in Algorithm 1.Algorithm 1: The reduction based on modified extended Euclidean algorithm
Input:n, w, where n is the modulus and w is the large number.Output:Rw=MEEn,w.(1)
x1,x2=0,n(2)
y1,y2=1,w(3)
Q=x2/y2(4)
tmp1,tmp2=x1,x2−Qy1,y2(5)
x1,x2=y1,y2(6)
y1,y2=tmp1,tmp2(7)
whilew>n do(8)
Q=x2/y2(9)
tmp1,tmp2=x1,x2−Qy1,y2(10)
x1,x2=y1,y2(11)
y1,y2=tmp1,tmp2(12)
end while(13)
returnRw=x2/x1The modulusn of Paillier cryptosystem and large integer value w can be considered as independent points in a two-dimensional lattice space ✓. These two basis vectors, 0,n and 1,w, can be reduced for optimal values. Algorithm 1 computes the reduced value of w using adapted extended Euclidean algorithm, which is the correct mean value.


## 3.3. Montgomery Multiplication

Montgomery multiplication (MM) is an efficient technique for computing modular multiplications [40]. Assuming an odd modulus n is a t-bit number, let r=2t. For integers 0<a,b<k, the Montgomery multiplication is MMa,b=ab2−tmodn. By taking r as a power of 2, the division becomes simple shifting. The process of MM is presented in Algorithm 2.Algorithm 2: The Montgomery multiplication
(i)
Input:a, b, n′, where n′ is computed by the extended Euclidean algorithm.Output:v=MMa,b.(1)
s=ab(2)
m=sn′modr(3)
u=s+mk/r(4)
ifv≥n, then return v−n(ii)
else returnvUtilizing the MM algorithm, the Montgomery exponentiation is present in Algorithm 3. For a numberα, the corresponding number in the Montgomery domain is denoted by α¯.Algorithm 3: The Montgomery exponentiation
(i)
Input:γ, e, n, where n′ is computed by the extended Euclidean algorithm.Output:θ=γemodn.(1)
γ¯=γ.rmodn(2)
θ¯=1.rmodn(3)
Fori=t−1 down to 0(4)
θ¯=MMθ¯,θ¯(5)
ifei=1, then θ¯=MMγ¯,θ¯(6)
θ=MMθ¯,1(7)
returnθ


## 4. The Proposed EPPSA Scheme

In this section, we propose the first privacy-preserving statistical aggregation scheme without revealing the total number of sensor devices to control center. In order to achieve the security goals, the edge device and control center calculates the statistics cooperatively, while control center does not know the total number of sensor devices. The Paillier cryptosystem is used as the encryption scheme and the ECDSA algorithm [41] is used as the signature scheme.The EPPSA scheme consists of four phases including system initialization, data encryption, secure statistical aggregation, and secure statistics reading. In the system initialization phase, TA initializes the WSN system by generating and distributing the secret keys of the Paillier and ECDSA algorithms. In the data encryption phase, sensor device SDi collects raw data and encrypts these data to generate a data report. Then sensor device sends the encrypted data report to EA via wireless networks. In the secure statistical aggregation phase, EA calculates sum and mean value in the encrypted domain and sends the statistical report to CC. In this phase, EA does not reveal the total number of sensor devices to CC. In the secure statistics reading phase, CC decrypts the statistical report and calculates the quadratic mean and variance of each dimension. Finally, CC gets all the arithmetic mean, quadratic mean, weighted mean, and variance without knowing the total number of sensor devices. Furthermore, to achieve the improvement in aggregation performance, we present three modified Montgomery exponentiation algorithms. Using these algorithms, EPPSA avoids frequent conversion of exponentiation results between the Montgomery domain and residue domain.


### 4.1. Modified Montgomery Exponentiation Algorithms

We modified Algorithm 3 to improve the aggregation performance. Three modified algorithms below map the result of modular exponentiation into the Montgomery domain.


#### 4.1.1. Modified Montgomery exponentiation 1

The modified Montgomery exponentiation method 1 (MME1) is described in Algorithm 4.Algorithm 4: The modified Montgomery exponentiation 1 (MME1)
(i)
Input:γ, e, n, where n′ is computed by the extended Euclidean algorithm.Output:θ¯(1)
γ¯=γ⋅rmodn(2)
θ¯=1⋅rmodn(3)
Fori=t−1 down to 0(4)
θ¯=MMθ¯,θ¯(5)
ifei=1, then θ¯=MMγ¯,θ¯(6)
returnθ¯Compared with Algorithm 3, Algorithm 4 removes the stepθ=MMθ¯,1, which converts the result into the correct domain zn∗. This denotes that the exponentiation result is still in the Montgomery domain. The result of exponentiation is denoted by θ¯ to be distinguished from the one in Algorithm 3.


#### 4.1.2. Modified Montgomery Exponentiation 2

The modified Montgomery exponentiation method 2 (MME2) is described in Algorithm 5.Algorithm 5: The modified Montgomery exponentiation 2 (MME2)
(i)
Input:γ¯, e, n, where n′ is computed by the extended Euclidean algorithm.Output:θ¯(1)
θ¯=1⋅rmodn(2)
Fori=t−1 down to 0(3)
θ¯=MMθ¯,θ¯(4)
ifei=1, then θ¯=MMγ¯,θ¯(5)
returnθ¯Compared with Algorithm 3, Algorithm 5 removes the stepγ¯=MMγ and θ=MMθ¯,1. The base number and result of Algorithm 5 are both in the Montgomery domain and are denoted by γ¯ and θ¯, respectively, to be distinguished from the ones in Algorithm 3.


#### 4.1.3. Modified Montgomery Exponentiation 3

The modified Montgomery exponentiation method 3 (MME3) is described in Algorithm 6.Algorithm 6: The modified Montgomery exponentiation 3 (MME3)
(i)
Input:γ¯, e, n, where n′ is computed by the extended Euclidean algorithm.Output:θ(1)
θ¯=1⋅rmodn(2)
Fori=t−1 down to 0(3)
θ¯=MMθ¯,θ¯(4)
ifei=1, then θ¯=MMγ¯,θ¯(5)
θ=MMθ¯,1(6)
returnθCompared with Algorithm 3, Algorithm 6 removes the stepγ¯=MMγ. The base number of Algorithm 6 is in the Montgomery domain and is denoted by γ¯ to be distinguished from the one in Algorithm 3.Using these algorithms, encrypted data are converted to the Montgomery domain at the beginning of the process during the process. Then encrypted data are kept in the Montgomery domain for further computation. In the end, the results are reconverted back to the residue (non-Montgomery) domain. By reducing the conversions between the Montgomery domain and the residue domain, the aggregation operation can be accelerated.


### 4.2. System Initialization

In the proposed system model, we assume that there arem SDs in WSN, which are denoted by Di,1≤i≤m. Each device Di generates an l-dimensional data vector di=di,1,di,2,…,di,j,…,di,l. Each Di gets an identity IDi and EA gets an identity IDEA. The data in a region can be denoted by a matrix(3)D=d1,1⋯d1,l⋮⋱⋮dm,1⋯dm,l.Given secure parametersκ and κ1, TA initializes the parameters of the additive homomorphic encryption algorithm and digital signature algorithm. The key generation procedure is shown as follows:Step 1: TA chooses prime numbersp, q randomly, where p=q=κ. Let n=pq and λ=lcmp−1,q−1. Choose g, with g∈Zn2∗, and the order of g is a multiple of n. Then, TA generates the encryption key pkAHE,skAHE, where the encryption public key is pkAHE=n,g and decryption private key is skAHE=p,q,λ.Step 2: TA chooses an Elliptic curve groupΓ of an order q1 with base point (generator) G, which is over the finite field Zp1 of integers modulo a prime p1. The bit length of q1 and p1 should be set as the security parameter, that is, p1=q1=κ1. For each SDi (1≤i≤m), TA chooses a secret key of digital signature skDS,i←Zq1 randomly. TA sets the public key of the digital signature pkDS,i=ski·G. The signature key of SDi is pkDS,i,skDS,i. The signature keys of EA, CC, and TA are generated in the same way, which are denoted by pkDS,EA,skDS,EA, pkDS,CC,skDS,CC, and pkDS,TA,skDS,TA, respectively. The signature algorithm makes use of a hash function H:0,1∗⟶Zq1.Step 3: Via a secure channel, TA sends the encryption public keypkAHE and the signature private key skDS,i to SDi (1≤i≤m). It sends the encryption public key pkAHE, the signature public key pkDS,i, and the signature private key skDS,EA to EA. It sends the decryption private key skAHE and the signature public key pkDS,EA to CC.After key generation, TA distributes the encryption keys and signing keys. The key distribution procedure is shown as follows:Step 1: TA writes signature key pairpkDS,i,skDS,i into the senor device SDi (1≤i≤m) before deploying the sensor device. TA writes the signature public key pkDS,i and the signature key pair pkDS,EA,skDS,EA into EA before deploying the edge device. TA sends the signature public key pkDS,TA and pkDS,EA to CC through the Internet and give the signature key pair pkDS,CC,skDS,CC to CC by a USB key device.Step 2: Using the private keyskDS,TA, TA computes a digital signature on skAHE denoted by σAHE. Using CC’s public key pkDS,CC, TA generates a digital envelope on the Paillier private key skAHE and the signature σAHE denoted by σDE. TA sends the σDE to CC through the Internet.Step 3: After receiving the digital envelopeσDE, CC decrypts it and gets the Paillier private key skAHE and the signature σAHE. Using the public key pkDS,TA, CC verifies the signature. If the verification is passed, the Pallier private key will be accepted.


### 4.3. Data Report Generation

Each sensor device SDi, 1≤i≤m, performs the following phases to get a data report:(i)
Generate: The SDi firstly generates the raw data vector di=di,1,di,2,…,di,j,…di,l. Then SDi calculates the corresponding quadratic data vector di2=di,12,di,22,…,di,j2,…di,l2. Given a weight vector w=w1,w2,…,wi,…wm, SDi calculates the weighted data vector di,wei=di,1,wei,di,2,wei,…,di,j,wei,…di,l,wei by di,j,wei=di,jwj.(ii)
Encrypt: After generating the l-dimensional data vectors di, di2, and di,wei, sensor device SDi encrypts the data using the Paillier encryption algorithm. When calculating the ciphertexts, EPPSA uses MME1 to convert the results to the Montgomery domain. These result of di, di2, and di,wei are denoted by ci¯=ci,1¯,…,ci,l¯, ci2¯=ci,12¯,…,ci,l2¯, and ci,wei¯=ci,1,wei¯,…,ci,l,wei¯, respectively.(iii)
Sign: Timestamp is denoted by TS, and the identity of SDi is denoted by IDi. SDi chooses an instance key ki←Zq1. Calculate rx,i,ry,i=kiG and sigi=Hci,1¯‖…‖ci,l¯‖ci,12¯‖…‖ci,l2¯‖ci,1,wei¯‖…‖ci,l,wei¯‖TS‖IDi+skDS,irx,i/ki. The signature is achieved by σi=sigimodq1,rx,imodq1.(iv)
Send: SDi sends the data report ci¯,ci2¯,ci,wei¯,σi,timestamp,IDi to EA.


### 4.4. Statistical Aggregation

After receiving the dataci¯,ci2¯,ci,wei¯σi,TS,IDi reported from m sensor devices, EA performs the following steps to generate the statistical aggregation report:(i)
Verify: EA firstly calculates rx,i′,ry,i′=G/sigi⋅Hci,1¯‖…‖ci,l¯‖ci,12¯‖…‖ci,l2¯‖ci,1,wei¯‖…‖ci,l,wei¯‖timestamp‖IDi+pkDS,i/sigi⋅rx,i. Then, EA checks the validity of ci¯,σi,timestamp,IDi by verifying the equation rx,i′modq1=rx,imodq1.(ii)
Aggregate: If the validity equation holds, EA executes the aggregation operations. EA firstly calculates the arithmetic sum, quadratic sum, and weighted sum of each dimension, which are denoted by cj,sum¯, cj,qsum¯, and cj,wsum¯, 1≤j≤l, respectively. When calculating the sum, EA uses the MM method (Algorithm 3) for modular multiplication. Then EA calculates arithmetic mean, quadratic mean, and weighted mean of each dimension, which are denoted by cj,mea¯, cj,qmea¯, and cj,wmea¯, 1≤j≤l, respectively. When calculating the mean by Equation 2, EA uses MME2 (Algorithm 5) for modular exponentiation. The result is denoted by cEA¯=c1,mea¯,…,cl,mea¯,c1,qmea¯,…,cl,qmea¯,c1,wmea¯,…,cl,wmea¯. The details of the aggregation are shown in Algorithm 7.(iii)
Sign: Timestamp is denoted by TS, and the identity of EA is denoted by IDEA. EA chooses an instance key kEA←Zq1. Calculate rx,EA,ry,EA=kEAG and sigEA=Hc1,mea¯‖…‖cl,mea¯‖c1,qmea¯‖…‖cl,qmea¯‖c1,wmea¯‖…‖cl,wmea¯‖TS‖IDEA+skEArx,EA/kEA. The signature is achieved by σEA=sigEAmodq1,rx,EAmodq1.(iv)
Send: EA sends the data report cEA¯,σEA,TS,IDEA to CC.Algorithm 7: Statistical aggregation
(i)
Input: Vectorsci¯=ci,1¯,…,ci,l¯,ci,12¯,…,ci,l2¯,ci,1,wei¯,…,ci,l,wei¯, where 1≤i≤m.Output: Ciphertext of arithmetic mean, mean of square, and weighted mean in the Montgomery domain of each dimension, denoted bycj,mea¯, cj,qmea¯, and cj,wmea¯, 1≤j≤l.(1)
cj,sum¯=ci,1¯, cj,qsum¯=ci,12, cj,wsum¯=ci,1,wei¯, 1≤j≤l(2)
forj=1 up to j=l(3)
fori=2 up to i=m(4)
cj,sum¯=MMcj,sum¯,ci,j¯,(5)
cj,mea¯=MME2cj,sum¯,m−1modn,n2(6)
forj=1 up to j=l(ii)
fori=2 up to i=m(8)
cj,qsum¯=MMcj,qsum¯,ci,j2¯,(9)
cj,qmea¯=MME2cj,qsum¯,m−1modn,n2(10)
forj=1 up to j=l(11)
fori=2 up to i=m(12)
cj,wsum¯=MMcj,wsum¯,ci,j,wei¯,(13)
cj,wmea¯=MME2cj,wsum¯,m−1modn,n2(14)
returncEA¯=c1,mea¯,…,cl,mea¯,c1,qmea¯,…,cl,qmea¯,c1,wmea¯,…,cl,wmea¯


### 4.5. Statistical Report Decryption

After receiving the data reportcEA¯,σEA,TS,IDEA reported from EA, EA performs the following steps to decrypt the statistical aggregation report:(i)
Verify: EA firstly calculates r′x,EA,r′y,EA=G/sigEA⋅Hc1,mea¯‖…‖cl,mea¯‖c1,qmea¯‖…‖cl,qmea¯‖c1,wmea¯‖…‖cl,wmea¯‖TS‖IDEA+pkEA/sigEA⋅rx,EA. The EA checks the validity of cEA¯,σEA,TS,IDi by verifying the equation rx,EA′modq1=rx,EAmodq1.(ii)
Decrypt: If the validity equation holds, CC executes the decryption operations using d=Dc=Lcλmodn2μmodn. When calculating the decryption, CC uses the MME3 (Algorithm 6) for modular exponentiation. The result is d1,mea,…,dl,mea,d1,qmea,…,dl,qmea,d1,wmea,…,dl,wmea(iii)
Reduce: Considering that the decryption result of the mean may be a large integer with no sense, CC reduces each decryption result using Algorithm 2. CC takes elements in the decrypted data vector d1,mea,…,dl,mea,d1,qmea,…,dl,qmea,d1,wmea,…,dl,wmea and the modulus as inputs and gets the reduced data vector D1,mea,…,Dl,mea,D1,qmea,…,Dl,qmea,D1,wmea,…,Dl,wmea.(iv)
Post-Process: The reduced data vector includes arithmetic mean, mean of square, and weighted mean of each dimension. For each dimension, CC calculates the quadratic mean Dj,Qmea by equation (3) and variance Dj,var by equation (4). Finally, CC gets the result of arithmetic mean, quadratic mean, weighted mean, and variance of each dimension, denoted by D1,mea,…,Dl,mea,D1,Qmea,…,Dl,Qmea,D1,wmea,…,Dl,wmea,D1,var,…,Dl,var.(4)Dj,Qmea=Dj,qmea,(5)Dj,var=Dj,qmea−Dj,mea2,


## 4.1. Modified Montgomery Exponentiation Algorithms

We modified Algorithm 3 to improve the aggregation performance. Three modified algorithms below map the result of modular exponentiation into the Montgomery domain.


### 4.1.1. Modified Montgomery exponentiation 1

The modified Montgomery exponentiation method 1 (MME1) is described in Algorithm 4.Algorithm 4: The modified Montgomery exponentiation 1 (MME1)
(i)
Input:γ, e, n, where n′ is computed by the extended Euclidean algorithm.Output:θ¯(1)
γ¯=γ⋅rmodn(2)
θ¯=1⋅rmodn(3)
Fori=t−1 down to 0(4)
θ¯=MMθ¯,θ¯(5)
ifei=1, then θ¯=MMγ¯,θ¯(6)
returnθ¯Compared with Algorithm 3, Algorithm 4 removes the stepθ=MMθ¯,1, which converts the result into the correct domain zn∗. This denotes that the exponentiation result is still in the Montgomery domain. The result of exponentiation is denoted by θ¯ to be distinguished from the one in Algorithm 3.


### 4.1.2. Modified Montgomery Exponentiation 2

The modified Montgomery exponentiation method 2 (MME2) is described in Algorithm 5.Algorithm 5: The modified Montgomery exponentiation 2 (MME2)
(i)
Input:γ¯, e, n, where n′ is computed by the extended Euclidean algorithm.Output:θ¯(1)
θ¯=1⋅rmodn(2)
Fori=t−1 down to 0(3)
θ¯=MMθ¯,θ¯(4)
ifei=1, then θ¯=MMγ¯,θ¯(5)
returnθ¯Compared with Algorithm 3, Algorithm 5 removes the stepγ¯=MMγ and θ=MMθ¯,1. The base number and result of Algorithm 5 are both in the Montgomery domain and are denoted by γ¯ and θ¯, respectively, to be distinguished from the ones in Algorithm 3.


### 4.1.3. Modified Montgomery Exponentiation 3

The modified Montgomery exponentiation method 3 (MME3) is described in Algorithm 6.Algorithm 6: The modified Montgomery exponentiation 3 (MME3)
(i)
Input:γ¯, e, n, where n′ is computed by the extended Euclidean algorithm.Output:θ(1)
θ¯=1⋅rmodn(2)
Fori=t−1 down to 0(3)
θ¯=MMθ¯,θ¯(4)
ifei=1, then θ¯=MMγ¯,θ¯(5)
θ=MMθ¯,1(6)
returnθCompared with Algorithm 3, Algorithm 6 removes the stepγ¯=MMγ. The base number of Algorithm 6 is in the Montgomery domain and is denoted by γ¯ to be distinguished from the one in Algorithm 3.Using these algorithms, encrypted data are converted to the Montgomery domain at the beginning of the process during the process. Then encrypted data are kept in the Montgomery domain for further computation. In the end, the results are reconverted back to the residue (non-Montgomery) domain. By reducing the conversions between the Montgomery domain and the residue domain, the aggregation operation can be accelerated.


## 4.1.1. Modified Montgomery exponentiation 1

The modified Montgomery exponentiation method 1 (MME1) is described in Algorithm 4.Algorithm 4: The modified Montgomery exponentiation 1 (MME1)
(i)
Input:γ, e, n, where n′ is computed by the extended Euclidean algorithm.Output:θ¯(1)
γ¯=γ⋅rmodn(2)
θ¯=1⋅rmodn(3)
Fori=t−1 down to 0(4)
θ¯=MMθ¯,θ¯(5)
ifei=1, then θ¯=MMγ¯,θ¯(6)
returnθ¯Compared with Algorithm 3, Algorithm 4 removes the stepθ=MMθ¯,1, which converts the result into the correct domain zn∗. This denotes that the exponentiation result is still in the Montgomery domain. The result of exponentiation is denoted by θ¯ to be distinguished from the one in Algorithm 3.


## 4.1.2. Modified Montgomery Exponentiation 2

The modified Montgomery exponentiation method 2 (MME2) is described in Algorithm 5.Algorithm 5: The modified Montgomery exponentiation 2 (MME2)
(i)
Input:γ¯, e, n, where n′ is computed by the extended Euclidean algorithm.Output:θ¯(1)
θ¯=1⋅rmodn(2)
Fori=t−1 down to 0(3)
θ¯=MMθ¯,θ¯(4)
ifei=1, then θ¯=MMγ¯,θ¯(5)
returnθ¯Compared with Algorithm 3, Algorithm 5 removes the stepγ¯=MMγ and θ=MMθ¯,1. The base number and result of Algorithm 5 are both in the Montgomery domain and are denoted by γ¯ and θ¯, respectively, to be distinguished from the ones in Algorithm 3.


## 4.1.3. Modified Montgomery Exponentiation 3

The modified Montgomery exponentiation method 3 (MME3) is described in Algorithm 6.Algorithm 6: The modified Montgomery exponentiation 3 (MME3)
(i)
Input:γ¯, e, n, where n′ is computed by the extended Euclidean algorithm.Output:θ(1)
θ¯=1⋅rmodn(2)
Fori=t−1 down to 0(3)
θ¯=MMθ¯,θ¯(4)
ifei=1, then θ¯=MMγ¯,θ¯(5)
θ=MMθ¯,1(6)
returnθCompared with Algorithm 3, Algorithm 6 removes the stepγ¯=MMγ. The base number of Algorithm 6 is in the Montgomery domain and is denoted by γ¯ to be distinguished from the one in Algorithm 3.Using these algorithms, encrypted data are converted to the Montgomery domain at the beginning of the process during the process. Then encrypted data are kept in the Montgomery domain for further computation. In the end, the results are reconverted back to the residue (non-Montgomery) domain. By reducing the conversions between the Montgomery domain and the residue domain, the aggregation operation can be accelerated.


## 4.2. System Initialization

In the proposed system model, we assume that there arem SDs in WSN, which are denoted by Di,1≤i≤m. Each device Di generates an l-dimensional data vector di=di,1,di,2,…,di,j,…,di,l. Each Di gets an identity IDi and EA gets an identity IDEA. The data in a region can be denoted by a matrix(3)D=d1,1⋯d1,l⋮⋱⋮dm,1⋯dm,l.Given secure parametersκ and κ1, TA initializes the parameters of the additive homomorphic encryption algorithm and digital signature algorithm. The key generation procedure is shown as follows:Step 1: TA chooses prime numbersp, q randomly, where p=q=κ. Let n=pq and λ=lcmp−1,q−1. Choose g, with g∈Zn2∗, and the order of g is a multiple of n. Then, TA generates the encryption key pkAHE,skAHE, where the encryption public key is pkAHE=n,g and decryption private key is skAHE=p,q,λ.Step 2: TA chooses an Elliptic curve groupΓ of an order q1 with base point (generator) G, which is over the finite field Zp1 of integers modulo a prime p1. The bit length of q1 and p1 should be set as the security parameter, that is, p1=q1=κ1. For each SDi (1≤i≤m), TA chooses a secret key of digital signature skDS,i←Zq1 randomly. TA sets the public key of the digital signature pkDS,i=ski·G. The signature key of SDi is pkDS,i,skDS,i. The signature keys of EA, CC, and TA are generated in the same way, which are denoted by pkDS,EA,skDS,EA, pkDS,CC,skDS,CC, and pkDS,TA,skDS,TA, respectively. The signature algorithm makes use of a hash function H:0,1∗⟶Zq1.Step 3: Via a secure channel, TA sends the encryption public keypkAHE and the signature private key skDS,i to SDi (1≤i≤m). It sends the encryption public key pkAHE, the signature public key pkDS,i, and the signature private key skDS,EA to EA. It sends the decryption private key skAHE and the signature public key pkDS,EA to CC.After key generation, TA distributes the encryption keys and signing keys. The key distribution procedure is shown as follows:Step 1: TA writes signature key pairpkDS,i,skDS,i into the senor device SDi (1≤i≤m) before deploying the sensor device. TA writes the signature public key pkDS,i and the signature key pair pkDS,EA,skDS,EA into EA before deploying the edge device. TA sends the signature public key pkDS,TA and pkDS,EA to CC through the Internet and give the signature key pair pkDS,CC,skDS,CC to CC by a USB key device.Step 2: Using the private keyskDS,TA, TA computes a digital signature on skAHE denoted by σAHE. Using CC’s public key pkDS,CC, TA generates a digital envelope on the Paillier private key skAHE and the signature σAHE denoted by σDE. TA sends the σDE to CC through the Internet.Step 3: After receiving the digital envelopeσDE, CC decrypts it and gets the Paillier private key skAHE and the signature σAHE. Using the public key pkDS,TA, CC verifies the signature. If the verification is passed, the Pallier private key will be accepted.


## 4.3. Data Report Generation

Each sensor device SDi, 1≤i≤m, performs the following phases to get a data report:(i)
Generate: The SDi firstly generates the raw data vector di=di,1,di,2,…,di,j,…di,l. Then SDi calculates the corresponding quadratic data vector di2=di,12,di,22,…,di,j2,…di,l2. Given a weight vector w=w1,w2,…,wi,…wm, SDi calculates the weighted data vector di,wei=di,1,wei,di,2,wei,…,di,j,wei,…di,l,wei by di,j,wei=di,jwj.(ii)
Encrypt: After generating the l-dimensional data vectors di, di2, and di,wei, sensor device SDi encrypts the data using the Paillier encryption algorithm. When calculating the ciphertexts, EPPSA uses MME1 to convert the results to the Montgomery domain. These result of di, di2, and di,wei are denoted by ci¯=ci,1¯,…,ci,l¯, ci2¯=ci,12¯,…,ci,l2¯, and ci,wei¯=ci,1,wei¯,…,ci,l,wei¯, respectively.(iii)
Sign: Timestamp is denoted by TS, and the identity of SDi is denoted by IDi. SDi chooses an instance key ki←Zq1. Calculate rx,i,ry,i=kiG and sigi=Hci,1¯‖…‖ci,l¯‖ci,12¯‖…‖ci,l2¯‖ci,1,wei¯‖…‖ci,l,wei¯‖TS‖IDi+skDS,irx,i/ki. The signature is achieved by σi=sigimodq1,rx,imodq1.(iv)
Send: SDi sends the data report ci¯,ci2¯,ci,wei¯,σi,timestamp,IDi to EA.


## 4.4. Statistical Aggregation

After receiving the dataci¯,ci2¯,ci,wei¯σi,TS,IDi reported from m sensor devices, EA performs the following steps to generate the statistical aggregation report:(i)
Verify: EA firstly calculates rx,i′,ry,i′=G/sigi⋅Hci,1¯‖…‖ci,l¯‖ci,12¯‖…‖ci,l2¯‖ci,1,wei¯‖…‖ci,l,wei¯‖timestamp‖IDi+pkDS,i/sigi⋅rx,i. Then, EA checks the validity of ci¯,σi,timestamp,IDi by verifying the equation rx,i′modq1=rx,imodq1.(ii)
Aggregate: If the validity equation holds, EA executes the aggregation operations. EA firstly calculates the arithmetic sum, quadratic sum, and weighted sum of each dimension, which are denoted by cj,sum¯, cj,qsum¯, and cj,wsum¯, 1≤j≤l, respectively. When calculating the sum, EA uses the MM method (Algorithm 3) for modular multiplication. Then EA calculates arithmetic mean, quadratic mean, and weighted mean of each dimension, which are denoted by cj,mea¯, cj,qmea¯, and cj,wmea¯, 1≤j≤l, respectively. When calculating the mean by Equation 2, EA uses MME2 (Algorithm 5) for modular exponentiation. The result is denoted by cEA¯=c1,mea¯,…,cl,mea¯,c1,qmea¯,…,cl,qmea¯,c1,wmea¯,…,cl,wmea¯. The details of the aggregation are shown in Algorithm 7.(iii)
Sign: Timestamp is denoted by TS, and the identity of EA is denoted by IDEA. EA chooses an instance key kEA←Zq1. Calculate rx,EA,ry,EA=kEAG and sigEA=Hc1,mea¯‖…‖cl,mea¯‖c1,qmea¯‖…‖cl,qmea¯‖c1,wmea¯‖…‖cl,wmea¯‖TS‖IDEA+skEArx,EA/kEA. The signature is achieved by σEA=sigEAmodq1,rx,EAmodq1.(iv)
Send: EA sends the data report cEA¯,σEA,TS,IDEA to CC.Algorithm 7: Statistical aggregation
(i)
Input: Vectorsci¯=ci,1¯,…,ci,l¯,ci,12¯,…,ci,l2¯,ci,1,wei¯,…,ci,l,wei¯, where 1≤i≤m.Output: Ciphertext of arithmetic mean, mean of square, and weighted mean in the Montgomery domain of each dimension, denoted bycj,mea¯, cj,qmea¯, and cj,wmea¯, 1≤j≤l.(1)
cj,sum¯=ci,1¯, cj,qsum¯=ci,12, cj,wsum¯=ci,1,wei¯, 1≤j≤l(2)
forj=1 up to j=l(3)
fori=2 up to i=m(4)
cj,sum¯=MMcj,sum¯,ci,j¯,(5)
cj,mea¯=MME2cj,sum¯,m−1modn,n2(6)
forj=1 up to j=l(ii)
fori=2 up to i=m(8)
cj,qsum¯=MMcj,qsum¯,ci,j2¯,(9)
cj,qmea¯=MME2cj,qsum¯,m−1modn,n2(10)
forj=1 up to j=l(11)
fori=2 up to i=m(12)
cj,wsum¯=MMcj,wsum¯,ci,j,wei¯,(13)
cj,wmea¯=MME2cj,wsum¯,m−1modn,n2(14)
returncEA¯=c1,mea¯,…,cl,mea¯,c1,qmea¯,…,cl,qmea¯,c1,wmea¯,…,cl,wmea¯


## 4.5. Statistical Report Decryption

After receiving the data reportcEA¯,σEA,TS,IDEA reported from EA, EA performs the following steps to decrypt the statistical aggregation report:(i)
Verify: EA firstly calculates r′x,EA,r′y,EA=G/sigEA⋅Hc1,mea¯‖…‖cl,mea¯‖c1,qmea¯‖…‖cl,qmea¯‖c1,wmea¯‖…‖cl,wmea¯‖TS‖IDEA+pkEA/sigEA⋅rx,EA. The EA checks the validity of cEA¯,σEA,TS,IDi by verifying the equation rx,EA′modq1=rx,EAmodq1.(ii)
Decrypt: If the validity equation holds, CC executes the decryption operations using d=Dc=Lcλmodn2μmodn. When calculating the decryption, CC uses the MME3 (Algorithm 6) for modular exponentiation. The result is d1,mea,…,dl,mea,d1,qmea,…,dl,qmea,d1,wmea,…,dl,wmea(iii)
Reduce: Considering that the decryption result of the mean may be a large integer with no sense, CC reduces each decryption result using Algorithm 2. CC takes elements in the decrypted data vector d1,mea,…,dl,mea,d1,qmea,…,dl,qmea,d1,wmea,…,dl,wmea and the modulus as inputs and gets the reduced data vector D1,mea,…,Dl,mea,D1,qmea,…,Dl,qmea,D1,wmea,…,Dl,wmea.(iv)
Post-Process: The reduced data vector includes arithmetic mean, mean of square, and weighted mean of each dimension. For each dimension, CC calculates the quadratic mean Dj,Qmea by equation (3) and variance Dj,var by equation (4). Finally, CC gets the result of arithmetic mean, quadratic mean, weighted mean, and variance of each dimension, denoted by D1,mea,…,Dl,mea,D1,Qmea,…,Dl,Qmea,D1,wmea,…,Dl,wmea,D1,var,…,Dl,var.(4)Dj,Qmea=Dj,qmea,(5)Dj,var=Dj,qmea−Dj,mea2,


## 5. Security Analysis

In this section, we analyze the security properties of the proposed EPPSA scheme, following the security requirements and design goals given in Section2.Lemma 1.
The result of encryption in the Montgomery domain is a valid format of the ciphertext.Proof 1.
The residue (non-Montgomery) system is a commutative ring denoted byRn, and the Montgomery domain is a commutative ring denoted by RnM. The rings Rn and RnM are isomorphic by the isomorphism h:Rn⟶RnM defined by ha=a⋅2tmodn and h−1:RnM⟶Rn defined by ha=a⋅2−tmodn. Due to the isomorphism, the result of encryption in the Montgomery domain is a valid format of the ciphertext.


### 5.1. Resistance to Eavesdropping Attack

Theorem 1.
WSN devices’ private data and statistics cannot be obtained by an adversaryα even if it is eavesdropped during transmitting.Proof 2.
In the EPPSA scheme, the data are encrypted by the Paillier cryptosystem. According to Lamma 1, the result of encryptionci,j=gdi,jrnmodn in the Montgomery domain is a valid format of the ciphertext. Meanwhile, the private key skAHE is transmitted to CC in digital envelope. The skAHE is encrypted by CC’s public key pkDS,CC so that α cannot get it. Since Paillier cryptosystem is provably secure against the chosen plaintext attack based on the decisional Diffie—Hellman problem, α cannot guess the plaintext in a nonnegligible probability without the private key skAHE. Similarly, α cannot obtain statistics by eavesdropping on the transmission between EA and CC. In a word, the data and statistics in transmission are semantically secure.


### 5.2. Resistance to Replay Attack

Theorem 2.
If a replayed data report is transmitted to EA, or a statistical report to CC, it can be detected.Proof 3.
If an adversaryα replays the data report cre¯,σnew,TSnew to aggregator EA, it needs to forge a new timestamp donated by timestampnew. Since the timestamp is new, α has to forge a new signature σnew of the replayed ciphertext cre¯. The security of the ECDSA system is based on the computational intractability of the discrete logarithm problem (DLP). The signature key pair pkDS,i,skDS,i is written to SDi directly when system initialization. Thus, α cannot guess the correct signature of the replayed report in a nonnegligible probability without the private key skDS,i. Similarly, the replay attack of the statistical report to CC can be detected for the same reason. In a word, the EPPSA scheme is resistant to replay attack.


### 5.3. Resistance to Manipulation Attack

Theorem 3.
If an adversary α manipulates the data report from WSN senor device or statistics from EG, it can be detected.Proof 4.
It is assumed that an adversaryα manipulates the encrypted data ci¯=ci,1¯,…,ci,l¯,ci,12¯,…,ci,l2¯,ci,1,wei¯,…,ci,l,wei¯s during the transmission to aggregator EA. When receiving the data report, EA calculates the hash value Hci,1¯‖…‖ci,l¯‖ci,12¯‖…‖ci,l2¯‖ci,1,wei¯‖…‖ci,l,wei¯‖TS‖IDi and checks the signature σi by verifying the equation rx,i′modq1=rx,imodq1. If ci¯ is manipulated, the hash value will be incorrect and the signature will not be validated. Similarly, when receiving statistical report from EA, CC calculates the hash value Hc1,mea¯‖…‖cl,mea¯‖c1,qmea¯‖…‖cl,qmea¯‖c1,wmea¯‖…‖cl,wmea¯‖TS‖IDEA and checks the signature σi by verifying the equation rx,EA′modq1=rx,EAmodq1. The statistical report is considered invalid if it is manipulated by α. In a word, the integrity of data and statistics can be satisfied.


### 5.4. Resistance to Internal Attack

Theorem 4.
If EA is an internal attacker which is curious about WSN devices’ privacy data, it still cannot obtain the actual data of the devices.Proof 5.
According to Lemma1, the encrypted data from WSN sensor devices ci¯=ci,1¯,…,ci,l¯,ci,12¯,…,ci,l2¯,ci,1,wei¯,…,ci,l,wei¯ in the Montgomery domain is a valid format of the ciphertext. The aggregator EA does not have the private key to decrypt the ciphertext.Theorem 5.
If CC is an internal attacker which is curious about the total number of WSN devices, it still cannot obtain the actual number of the devices.Proof 6.
CC obtains the arithmetic mean, quadratic mean, and weighted mean by decryption and reduction. Also, CC calculates the variance by Equation (3), which uses plaintext of arithmetic mean and quadratic mean. In a word, CC does not get any information on the total number of WSN devices when calculating statistics.


## 5.1. Resistance to Eavesdropping Attack

Theorem 1.
WSN devices’ private data and statistics cannot be obtained by an adversaryα even if it is eavesdropped during transmitting.Proof 2.
In the EPPSA scheme, the data are encrypted by the Paillier cryptosystem. According to Lamma 1, the result of encryptionci,j=gdi,jrnmodn in the Montgomery domain is a valid format of the ciphertext. Meanwhile, the private key skAHE is transmitted to CC in digital envelope. The skAHE is encrypted by CC’s public key pkDS,CC so that α cannot get it. Since Paillier cryptosystem is provably secure against the chosen plaintext attack based on the decisional Diffie—Hellman problem, α cannot guess the plaintext in a nonnegligible probability without the private key skAHE. Similarly, α cannot obtain statistics by eavesdropping on the transmission between EA and CC. In a word, the data and statistics in transmission are semantically secure.


## 5.2. Resistance to Replay Attack

Theorem 2.
If a replayed data report is transmitted to EA, or a statistical report to CC, it can be detected.Proof 3.
If an adversaryα replays the data report cre¯,σnew,TSnew to aggregator EA, it needs to forge a new timestamp donated by timestampnew. Since the timestamp is new, α has to forge a new signature σnew of the replayed ciphertext cre¯. The security of the ECDSA system is based on the computational intractability of the discrete logarithm problem (DLP). The signature key pair pkDS,i,skDS,i is written to SDi directly when system initialization. Thus, α cannot guess the correct signature of the replayed report in a nonnegligible probability without the private key skDS,i. Similarly, the replay attack of the statistical report to CC can be detected for the same reason. In a word, the EPPSA scheme is resistant to replay attack.


## 5.3. Resistance to Manipulation Attack

Theorem 3.
If an adversary α manipulates the data report from WSN senor device or statistics from EG, it can be detected.Proof 4.
It is assumed that an adversaryα manipulates the encrypted data ci¯=ci,1¯,…,ci,l¯,ci,12¯,…,ci,l2¯,ci,1,wei¯,…,ci,l,wei¯s during the transmission to aggregator EA. When receiving the data report, EA calculates the hash value Hci,1¯‖…‖ci,l¯‖ci,12¯‖…‖ci,l2¯‖ci,1,wei¯‖…‖ci,l,wei¯‖TS‖IDi and checks the signature σi by verifying the equation rx,i′modq1=rx,imodq1. If ci¯ is manipulated, the hash value will be incorrect and the signature will not be validated. Similarly, when receiving statistical report from EA, CC calculates the hash value Hc1,mea¯‖…‖cl,mea¯‖c1,qmea¯‖…‖cl,qmea¯‖c1,wmea¯‖…‖cl,wmea¯‖TS‖IDEA and checks the signature σi by verifying the equation rx,EA′modq1=rx,EAmodq1. The statistical report is considered invalid if it is manipulated by α. In a word, the integrity of data and statistics can be satisfied.


## 5.4. Resistance to Internal Attack

Theorem 4.
If EA is an internal attacker which is curious about WSN devices’ privacy data, it still cannot obtain the actual data of the devices.Proof 5.
According to Lemma1, the encrypted data from WSN sensor devices ci¯=ci,1¯,…,ci,l¯,ci,12¯,…,ci,l2¯,ci,1,wei¯,…,ci,l,wei¯ in the Montgomery domain is a valid format of the ciphertext. The aggregator EA does not have the private key to decrypt the ciphertext.Theorem 5.
If CC is an internal attacker which is curious about the total number of WSN devices, it still cannot obtain the actual number of the devices.Proof 6.
CC obtains the arithmetic mean, quadratic mean, and weighted mean by decryption and reduction. Also, CC calculates the variance by Equation (3), which uses plaintext of arithmetic mean and quadratic mean. In a word, CC does not get any information on the total number of WSN devices when calculating statistics.


## 6. Performance Evaluation and Comparison

In this section, our scheme is evaluated in terms of computation costs and communication costs. The performance results are compared with the scheme proposed in references [28, 31, 33, 36].


### 6.1. Computation Cost

Assume that there arem sensor devices SDi in the system and each of them reports an l-dimensional data vector for both our EPPSA scheme and schemes in [28, 31, 33]. For the fairness of comparison, these schemes are assumed to get moduli with the same bit length.In our EPPSA scheme, the modified Montgomery exponentiations (Algorithms 4, 5, and 6) are used to keep the result of exponentiation in the Montgomery domain. That means the aggregation in EA only needs Montgomery multiplications. LetTMM and TOMM be the time cost of a Montgomery multiplication operation and an ordinary modular multiplication operation, respectively. And time cost of a Montgomery exponentiation is denoted by TME. In our proposed EPPSA scheme, benefitting from the modified Montgomery exponentiations, m−1⋅TMM is needed. In [28], the aggregation of each dimension is calculated by m−1⋅TOMM. In [31], the aggregation of each dimension is calculated by m−1⋅TOMM. In [33], the cost of aggregation is m−1⋅TMM+TME. A comparative summary of computation cost for m SDs aggregation is listed in Table 1.Table 1
Aggregation computation complexity of MMDA and EPPSA.
SchemeComputation complexityEPPSAm−1⋅TMM[28]m−1⋅TOMM[31]m−1⋅TOMM[33]m−1TMM+TMETo evaluate the performance, we execute the experiments on a Laptop with Windows 10 OS, Intel® Core™ i5-700U 2.50 GHz and 16 GB RAM. And we utilize the OpenSSL library (OpenSSL 1.1.1 h) to provide basic cryptographic primitives. For the evaluation of the EPPSA scheme, we set then to be 512 and 1024 bits in the Paillier Cryptosystem, and the n2 to be 1024 and 2048 bits. As the number of dimensions changes, we get the comparison of aggregation computation costs of 1024 bits in Figure 2(a), and the computation costs of 2048 bits in Figure 2(b). In summary, Figure 2 clearly shows that compared with schemes in [28, 31, 33], EPPSA has the smallest computation cost. For example, compared with [28], the EPPSA scheme gets 62.5% aggregation performance improvement on 1024 bits.Figure 2
Comparison of aggregation computation costs: (a) comparison of aggregation computation cost on 1024 bits and (b) comparison of aggregation computation cost on 2048 bits.
(a)(b)


### 6.2. Communication Cost

Among the previous edge-aided aggregation schemes, the scheme in [36] is the only one that offers statistical functions. Therefore, we compare the communication costs of the EPPSA scheme with the scheme in [36]. We consider the communication costs of arithmetic mean and variance for fairness. For the sake of instruction, we denote the bit length of the modulus by L.In [36], EA needs to transmit the aggregated ciphertext of summation and counter to CC for arithmetic mean, in which the communication cost is 2L. In our EPPSA scheme, EA needs to send aggregated ciphertext of arithmetic mean to CC, in which the communication cost is L. In [36], EA needs to transmit the aggregated ciphertext of summation, quadratic summation, and counter to CC for variance, in which the communication cost is 3L. In our EPPSA scheme, EA needs to send aggregated ciphertext of arithmetic mean and quadratic mean to CC, in which the communication cost is 2L. Figure 3 shows the communication cost comparison of EPPSA and [36] in different bit lengths. It can be demonstrated that the communication cost of the EPPSA scheme decreases by 50% on arithmetic mean and 33% on variance.Figure 3
Comparison of communication cost: (a) comparison of communication cost on arithmetic mean and (b) comparison of communication cost on variance.
(a)(b)


## 6.1. Computation Cost

Assume that there arem sensor devices SDi in the system and each of them reports an l-dimensional data vector for both our EPPSA scheme and schemes in [28, 31, 33]. For the fairness of comparison, these schemes are assumed to get moduli with the same bit length.In our EPPSA scheme, the modified Montgomery exponentiations (Algorithms 4, 5, and 6) are used to keep the result of exponentiation in the Montgomery domain. That means the aggregation in EA only needs Montgomery multiplications. LetTMM and TOMM be the time cost of a Montgomery multiplication operation and an ordinary modular multiplication operation, respectively. And time cost of a Montgomery exponentiation is denoted by TME. In our proposed EPPSA scheme, benefitting from the modified Montgomery exponentiations, m−1⋅TMM is needed. In [28], the aggregation of each dimension is calculated by m−1⋅TOMM. In [31], the aggregation of each dimension is calculated by m−1⋅TOMM. In [33], the cost of aggregation is m−1⋅TMM+TME. A comparative summary of computation cost for m SDs aggregation is listed in Table 1.Table 1
Aggregation computation complexity of MMDA and EPPSA.
SchemeComputation complexityEPPSAm−1⋅TMM[28]m−1⋅TOMM[31]m−1⋅TOMM[33]m−1TMM+TMETo evaluate the performance, we execute the experiments on a Laptop with Windows 10 OS, Intel® Core™ i5-700U 2.50 GHz and 16 GB RAM. And we utilize the OpenSSL library (OpenSSL 1.1.1 h) to provide basic cryptographic primitives. For the evaluation of the EPPSA scheme, we set then to be 512 and 1024 bits in the Paillier Cryptosystem, and the n2 to be 1024 and 2048 bits. As the number of dimensions changes, we get the comparison of aggregation computation costs of 1024 bits in Figure 2(a), and the computation costs of 2048 bits in Figure 2(b). In summary, Figure 2 clearly shows that compared with schemes in [28, 31, 33], EPPSA has the smallest computation cost. For example, compared with [28], the EPPSA scheme gets 62.5% aggregation performance improvement on 1024 bits.Figure 2
Comparison of aggregation computation costs: (a) comparison of aggregation computation cost on 1024 bits and (b) comparison of aggregation computation cost on 2048 bits.
(a)(b)


## 6.2. Communication Cost

Among the previous edge-aided aggregation schemes, the scheme in [36] is the only one that offers statistical functions. Therefore, we compare the communication costs of the EPPSA scheme with the scheme in [36]. We consider the communication costs of arithmetic mean and variance for fairness. For the sake of instruction, we denote the bit length of the modulus by L.In [36], EA needs to transmit the aggregated ciphertext of summation and counter to CC for arithmetic mean, in which the communication cost is 2L. In our EPPSA scheme, EA needs to send aggregated ciphertext of arithmetic mean to CC, in which the communication cost is L. In [36], EA needs to transmit the aggregated ciphertext of summation, quadratic summation, and counter to CC for variance, in which the communication cost is 3L. In our EPPSA scheme, EA needs to send aggregated ciphertext of arithmetic mean and quadratic mean to CC, in which the communication cost is 2L. Figure 3 shows the communication cost comparison of EPPSA and [36] in different bit lengths. It can be demonstrated that the communication cost of the EPPSA scheme decreases by 50% on arithmetic mean and 33% on variance.Figure 3
Comparison of communication cost: (a) comparison of communication cost on arithmetic mean and (b) comparison of communication cost on variance.
(a)(b)


## 7. Conclusion

In this article, we present an efficient privacy-preserving statistical aggregation scheme for edge computing-enhanced WSNs. The EPPSA scheme adopts the Paillier encryption scheme and ECDSA signature algorithm to guarantee data confidentiality, authentication, and data integrity. Compared with the existing multidimensional and multifunctional data aggregation schemes, the EPPSA scheme improves the efficiency of aggregation and decreases the communication load. Furthermore, the EPPSA scheme improves privacy protection by hiding the total number of devices in the data report. The EPPSA scheme can be applied in various WSN scenarios, such as smart factory, health care, and environmental monitoring.



---

*Source: 7359134-2022-05-02.xml*