# Privacy-Preserving Multidimensional Data Aggregation Scheme for Smart Grid

Authors: Yousheng Zhou; Xinyun Chen; Meihuan Chen
Journal: Security and Communication Networks
 (2020)

---

## Abstract

In a smart grid, data aggregation is a common method to evaluate regional power consumption. Data leakage in the process of data transmission poses a security threat to the privacy of users. Many existing data aggregation schemes can only aggregate one-dimensional data; however, it is necessary to aggregate multidimensional data in practical smart grid applications. Therefore, this paper proposes a privacy-preserving multidimensional data aggregation scheme, which can aggregate multidimensional data and protect the individual user’s identity and data privacy. The security of the proposed scheme is proved under the random oracle model. The simulation results show that the proposed scheme has great advantages in computing overhead, and the communication overhead also meets the requirements of the smart grid.


---

## Body

## 1. Introduction

A smart grid is a more efficient and modern grid. “Grid 2030” defines a smart grid as follows: “A fully automatic power transmission network that monitors and controls each user and node to ensure the two-way flow of power and information between power plants and power devices and all nodes between them” [1]. Smart grid consists of seven domains: the generation, transmission, distribution, customer, electricity market, service provider, and operation center domain, as shown in Figure 1.Figure 1
The network model for the smart grid.Based on the real-time information of power consumption, the control center can monitor the power generation and consumption of each area, get the real-time power demand, and then take timely measures to optimize the power generation and distribution strategy. The customer can also get knowledge of current real-time power consumption and adjust his behavior to reduce expenses. In order to make a better transmission and distribution strategy, data aggregation is usually used to evaluate the power usage in a certain area. The purpose of data aggregation in a smart grid is to collect total power consumption data of users in a certain area and protect the power consumption data of an individual user from leakage.In order to support various network functions, many smart devices such as smart terminals and smart meters have been deployed and used in the smart grid [2]. As wireless networks are increasingly used in smart grids, the communication channel between the smart meter and the control center may be open [3]. Therefore, the attacker can easily intercept, tamper with, or delete the messages in the communication channel, which causes great distress or economic loss. For example, an attacker can track a user’s habits or lifestyle (he or she is at home or not at home) after obtaining his or her power consumption data, thus committing a crime inside a house [4]. An attacker may also cause economic loss to the user or service provider by injecting false information or making unreasonable demands.With the wide application of the smart home, actual power data is possible to be multidimensional, for example, measuring power data by the type of household appliances such as refrigerators, air conditioners, and washing machines. Therefore, it is necessary to study multidimensional data aggregation in a smart grid.In this paper, we propose a privacy-preserving multidimensional data aggregation scheme. The characteristics of the proposed scheme are as follows: (1) feasibility: the proposed scheme can aggregate multidimensional data; (2) security: the proposed scheme can protect the user’s identity and data privacy; (3) robustness: the proposed scheme can work normally when any smart meter is off-line or out of order; (4) high efficiency: the proposed scheme adopts EC-ElGamal cryptosystem, and the computation performance is efficient.The rest of this paper is organized as follows. In Section2, we review the related works. In Section 3, we describe the preliminaries. In Section 4, we describe the system model and security requirements. We present our proposed scheme in Section 5. We analyze the security and performance in Sections 6 and 7, respectively. Finally, we make some conclusions in Section 8.


## 2. Related Work

Smart meters have three factors: smart meters’ real-time power consumption data, smart meters’ total power consumption data, and smart meters’ identity [5]. In order to achieve the goal of data aggregation and protect the privacy of smart meters, several privacy-preserving one-dimensional data aggregation schemes have been proposed based on homomorphic encryption, blind factors, and Shamir’s secret sharing.Homomorphic encryption is a classical method for data aggregation. Homomorphic encryption can perform special algebraic operations on two or more ciphertexts to obtain the aggregated ciphertext, and the result of the decrypted aggregated ciphertext is the same as that of performing the same algebraic operation on the plaintext. At present, many privacy-preserving data aggregation schemes have been proposed based on homomorphic encryption (BGN cryptosystem [6], Paillier cryptosystem [7], EC-ElGamal cryptosystem [8], and lattice-based cryptosystem), such as BGN-based schemes [9–11], Paillier-based schemes [12–14], EC-ElGamal-based schemes [15–17], and lattice-based schemes [18].Homomorphic encryption combined with blind factors (random numbers) is a common method to design data aggregation schemes. The trusted third party predistributes different blind factors to each user and the aggregator. Each user uses its own blind factor to obfuscate the power consumption data. When the aggregator receives data from all users, it can eliminate the blind factors added by all users to obtain aggregated data. Fan et al. [19] proposed the first data aggregation scheme that can resist internal attacks, which uses BGN cryptosystem and blind factors. Bao and Lu [20] found that Fan’s scheme cannot provide data integrity. He et al. also proposed their scheme by using BGN cryptosystem and blind factors in [21], which can protect the integrity of data. The scheme proposed by He et al. [22] and Vahedi et al. [23] uses EC-ElGamal cryptosystem and blind factors and has high computational efficiency. All of the above [19–23] schemes can defend against internal attacks.The combination of homomorphic encryption and Shamir’s secret sharing is also used to design a data aggregation scheme [24]. For example, the PMDA scheme proposed by He [25] uses Shamir’s secret sharing to allow smart meters to collectively negotiate aggregation parameters and supports multifunctional data aggregation. The 3PDA scheme proposed by Liu et al. [26] uses EC-ElGamal cryptosystem and Shamir’s secret sharing, and users construct a virtual aggregation area to mask single data. The scheme presented in [25, 26] does not rely on a trusted third party. Even if any smart meter is off-line or out of order, the system can work normally. New smart meters can be easily added to the system while the user’s secret share remains the same.At present, only one-dimensional data is considered in many schemes, but in practical application, power consumption data is usually multidimensional to facilitate fine-grained analysis. Based on the superincreasing sequence and Horner’s rule, some researchers proposed multidimensional data aggregation schemes.Knapsack cryptosystem based on superincreasing sequence can compress multidimensional data into one-dimensional data. The PPMA scheme proposed by Li et al. [27] uses Paillier cryptosystem and superincreasing sequence to aggregate multidimensional data. The PPMA scheme gives several successive power consumption ranges, divides the regional users into several subsets, and can get the sum of power consumption data of each subset and the number of users. The EPPA scheme proposed by Lu et al. [28] uses a superincreasing sequence to compress multidimensional data into one-dimensional data and then uses Paillier’s cryptosystem to encrypt the compressed data.The algorithm based on Horner’s rule can also compress multidimensional data into one-dimensional data. The scheme proposed by Shen et al. [29] uses Paillier's cryptosystem and Horner’s rule. Each user constructs Horner polynomial with the first Horner parameter, storing the multidimensional data in a single data. After embedding the second Horner parameter into the polynomial, Paillier’s cryptosystem is used to encrypt the single data.


## 3. Preliminaries

### 3.1. Hard Problems

LetG be an additive cyclic group with prime order q; then some hard problems in the group G are described as follows.Elliptic Curve Discrete Logarithm (DL) Problem. Given points G,Q∈G , where Q=aG, a∈Zq∗, a is unknown. DL problem is to compute the value of a.Elliptic Curve Computational Diffie-Hellman (CDH) Problem. Given points G,P,Q∈G, where P=aG and Q=bG, a,b∈Zq∗, a and b are unknown. CDH problem is to compute abG. CDH assumption holds if there exists no probabilistic polynomial-time adversary that can solve the CDH problem with a nonnegligible advantage.Elliptic Curve Decisional Diffie-Hellman (DDH) Problem. Given a point G,P,Q,Z∈G, where P=aG and Q=bG, a,b∈Zq∗, a and b are unknown. The DDH problem is to determine whether Z=abG holds. DDH assumption holds if there exists no probabilistic polynomial-time adversary that can solve the DDH problem with a nonnegligible advantage.


### 3.2. Security Model of Authentication and Key Agreement

Define a probabilistic polynomial-time adversaryA, which can make a series of queries to simulate real attacks, define a simulator S, and define a game played between A and S. Then, A can adaptively make the following queries.Hashm: This query simulates an adversary’s hash request for a message m. S needs to keep a table LH=m,r. When S receives the request from A, S checks if LH contains a tuple m,r. If so, S returns r to A; otherwise, S randomly chooses r, stores m,r in LH, and returns r to A.ExecuteIDi: A makes this query to simulate an eavesdropping attack (passive attack). S returns a copy of the exchange message executed under the real authentication protocol.SendIDi,m: A makes this query to simulate an active attack. A can query the response information associated with the message m. S normally performs the steps of the authentication protocol and then returns the corresponding message to A.CorruptIDi: A makes this query to simulate a corrosive attack that can obtain the participant’s private key. S returns the relevant private key according to the authentication protocol.RevealIDi: A makes this query to simulate a known session key attack. If a valid session exists, S returns the session key corresponding to the participant; otherwise, S returns ⊥.TestIDi: This query simulates an adversary’s ability to distinguish between a true session key and a random number. When the session key has been defined, S chooses a random number b∈0,1. If b=1, S returns the true session key to A; if not, S returns a random number with the same length of the session key to A.After making the above queries,A can make Test query. The output of Test query depends only on the value of the bit b. The output of A is the result of guessing b′ associated with the bit b. If b=b′, A wins the game. Define an event Succ as A wins the game. The advantage of A breaking the semantic security of the authentication protocol is(1)ADVAProtocol=2PrSucc−1.Definition 1.
The proposed authentication protocol is semantic secure if there exists no probabilistic polynomial-time adversaryA that can win the above game with a nonnegligible advantage.


### 3.3. Security Model of Encryption and Signature

The encryption and signature scheme are used in this paper. Therefore, semantic security and unforgeability should be considered in the security model. Define a probabilistic polynomial-time adversaryA that can make a series of queries to simulate real attacks, define a simulator S, and define a game played between A and S. Then A can adaptively make the following queries.hm: This query simulates an adversary’s request for a message m. S needs to keep a table Lh=m,r. When S receives a request from A, S checks if Lh contains a tuple m,r. If so, S returns r to A; otherwise, S randomly chooses r, stores m,r in Lh, and returns r to A.CreatIDi: This query simulates an adversary’s attack to obtain the smart meter’s public key. S needs to keep a table LU=IDi,SK,PK. When S receives the request from A, S checks if table LU exists in the public key PK with IDi. If so, S returns PK to A; otherwise, S randomly chooses a private key SK, generates the corresponding public key PK, stores IDi,SK,PK in LU, and returns PK to A.ExtractIDi: This query simulates an adversary’s attack to obtain the smart meter’s private key. S checks if table LU exists in the private key SK with IDi. If so, S returns SK to A; otherwise, S randomly chooses a private key SK, generates the corresponding public key PK, stores IDi,SK,PK in LU, and returns SK to AEncryptIDi,mi: this query simulates an adversary’s encryption request for a message mi. S queries the public key PK with IDi, uses PK to encrypt the message mi, and then returns the ciphertext to A.SignIDi,mi: This query simulates an adversary’s signature request for a message mi. S queries the private key SK with IDi, uses SK to sign message mi, and then returns the message mi and signature to A.UnsignIDi,mi: This query simulates an adversary’s request to verify the message mi’s signature. S queries the public key PK with IDi and uses PK to validate the signature of the message mi.Definition 2.
If there exists no probabilistic polynomial-time adversary that can win the following game with a nonnegligible advantage, the proposed scheme is secure against indistinguishability under the chosen-plaintext attack (IND-CPA).Initialization:S runs a key generation algorithm, generates a key pair PK,SK, sends the public key PK to A, and keeps the private key SKPhase 1:A can access a random oracle to make a series of queries. A randomly chooses two plaintexts m0,m1 with the same length and sends them to S.Challenge:S randomly chooses a bit u∈0,1 and sends the ciphertext Cu of the message mu to A. We call the ciphertext Cu the challenging ciphertextGuess:A outputs its guess u′∈0,1. The advantage of A in the above game is defined as follows:(2)ADVAIND−CPA=2Pru=u′−1.Definition 3.
If there exists no probabilistic polynomial-time adversary that can win the following game with a nonnegligible advantage, the proposed scheme is secure against existential unforgeability under the adaptive chosen messages attacks (EUF-CMA).Initialization:S runs a key generation algorithm, generates a key pair PK,SK, sends the public key PK to A (also known as a forger), and keeps the private key SK.Query 1:A queries the hash value of the message m, and S returns the corresponding hash value hm to A.Query 2:A queries the signature of the message m, and S returns the corresponding signature Signm to A.Challenge:A forges a message’s signature pair m∗,Signm∗ and sends it to S. S verifies the validity of the signature. If the forged signature is valid, A succeeds; otherwise, A fails.


## 3.1. Hard Problems

LetG be an additive cyclic group with prime order q; then some hard problems in the group G are described as follows.Elliptic Curve Discrete Logarithm (DL) Problem. Given points G,Q∈G , where Q=aG, a∈Zq∗, a is unknown. DL problem is to compute the value of a.Elliptic Curve Computational Diffie-Hellman (CDH) Problem. Given points G,P,Q∈G, where P=aG and Q=bG, a,b∈Zq∗, a and b are unknown. CDH problem is to compute abG. CDH assumption holds if there exists no probabilistic polynomial-time adversary that can solve the CDH problem with a nonnegligible advantage.Elliptic Curve Decisional Diffie-Hellman (DDH) Problem. Given a point G,P,Q,Z∈G, where P=aG and Q=bG, a,b∈Zq∗, a and b are unknown. The DDH problem is to determine whether Z=abG holds. DDH assumption holds if there exists no probabilistic polynomial-time adversary that can solve the DDH problem with a nonnegligible advantage.


## 3.2. Security Model of Authentication and Key Agreement

Define a probabilistic polynomial-time adversaryA, which can make a series of queries to simulate real attacks, define a simulator S, and define a game played between A and S. Then, A can adaptively make the following queries.Hashm: This query simulates an adversary’s hash request for a message m. S needs to keep a table LH=m,r. When S receives the request from A, S checks if LH contains a tuple m,r. If so, S returns r to A; otherwise, S randomly chooses r, stores m,r in LH, and returns r to A.ExecuteIDi: A makes this query to simulate an eavesdropping attack (passive attack). S returns a copy of the exchange message executed under the real authentication protocol.SendIDi,m: A makes this query to simulate an active attack. A can query the response information associated with the message m. S normally performs the steps of the authentication protocol and then returns the corresponding message to A.CorruptIDi: A makes this query to simulate a corrosive attack that can obtain the participant’s private key. S returns the relevant private key according to the authentication protocol.RevealIDi: A makes this query to simulate a known session key attack. If a valid session exists, S returns the session key corresponding to the participant; otherwise, S returns ⊥.TestIDi: This query simulates an adversary’s ability to distinguish between a true session key and a random number. When the session key has been defined, S chooses a random number b∈0,1. If b=1, S returns the true session key to A; if not, S returns a random number with the same length of the session key to A.After making the above queries,A can make Test query. The output of Test query depends only on the value of the bit b. The output of A is the result of guessing b′ associated with the bit b. If b=b′, A wins the game. Define an event Succ as A wins the game. The advantage of A breaking the semantic security of the authentication protocol is(1)ADVAProtocol=2PrSucc−1.Definition 1.
The proposed authentication protocol is semantic secure if there exists no probabilistic polynomial-time adversaryA that can win the above game with a nonnegligible advantage.


## 3.3. Security Model of Encryption and Signature

The encryption and signature scheme are used in this paper. Therefore, semantic security and unforgeability should be considered in the security model. Define a probabilistic polynomial-time adversaryA that can make a series of queries to simulate real attacks, define a simulator S, and define a game played between A and S. Then A can adaptively make the following queries.hm: This query simulates an adversary’s request for a message m. S needs to keep a table Lh=m,r. When S receives a request from A, S checks if Lh contains a tuple m,r. If so, S returns r to A; otherwise, S randomly chooses r, stores m,r in Lh, and returns r to A.CreatIDi: This query simulates an adversary’s attack to obtain the smart meter’s public key. S needs to keep a table LU=IDi,SK,PK. When S receives the request from A, S checks if table LU exists in the public key PK with IDi. If so, S returns PK to A; otherwise, S randomly chooses a private key SK, generates the corresponding public key PK, stores IDi,SK,PK in LU, and returns PK to A.ExtractIDi: This query simulates an adversary’s attack to obtain the smart meter’s private key. S checks if table LU exists in the private key SK with IDi. If so, S returns SK to A; otherwise, S randomly chooses a private key SK, generates the corresponding public key PK, stores IDi,SK,PK in LU, and returns SK to AEncryptIDi,mi: this query simulates an adversary’s encryption request for a message mi. S queries the public key PK with IDi, uses PK to encrypt the message mi, and then returns the ciphertext to A.SignIDi,mi: This query simulates an adversary’s signature request for a message mi. S queries the private key SK with IDi, uses SK to sign message mi, and then returns the message mi and signature to A.UnsignIDi,mi: This query simulates an adversary’s request to verify the message mi’s signature. S queries the public key PK with IDi and uses PK to validate the signature of the message mi.Definition 2.
If there exists no probabilistic polynomial-time adversary that can win the following game with a nonnegligible advantage, the proposed scheme is secure against indistinguishability under the chosen-plaintext attack (IND-CPA).Initialization:S runs a key generation algorithm, generates a key pair PK,SK, sends the public key PK to A, and keeps the private key SKPhase 1:A can access a random oracle to make a series of queries. A randomly chooses two plaintexts m0,m1 with the same length and sends them to S.Challenge:S randomly chooses a bit u∈0,1 and sends the ciphertext Cu of the message mu to A. We call the ciphertext Cu the challenging ciphertextGuess:A outputs its guess u′∈0,1. The advantage of A in the above game is defined as follows:(2)ADVAIND−CPA=2Pru=u′−1.Definition 3.
If there exists no probabilistic polynomial-time adversary that can win the following game with a nonnegligible advantage, the proposed scheme is secure against existential unforgeability under the adaptive chosen messages attacks (EUF-CMA).Initialization:S runs a key generation algorithm, generates a key pair PK,SK, sends the public key PK to A (also known as a forger), and keeps the private key SK.Query 1:A queries the hash value of the message m, and S returns the corresponding hash value hm to A.Query 2:A queries the signature of the message m, and S returns the corresponding signature Signm to A.Challenge:A forges a message’s signature pair m∗,Signm∗ and sends it to S. S verifies the validity of the signature. If the forged signature is valid, A succeeds; otherwise, A fails.


## 4. System Model and Security Requirement

### 4.1. System Model

In the proposed scheme, the system model for the smart grid consists of four entities: smart meter (SM), aggregator (AGG), control center (CC), and trusted third party (TTP), as shown in Figure2.SM: It is responsible for regularly collecting real-time power consumption data of the user and sending encrypted data to the aggregator. The smart meter is honest-but-curious. It operates according to the protocol and may infer information from other users.AGG: It is responsible for aggregating the power consumption data of all users and sending the aggregated data to the control center. The aggregator is honest-but-curious. It stores all intermediate computational results and may get users’ privacy information from themCC: It is responsible for decrypting and analyzing aggregated data to obtain the sum of users’ power consumption data for each area and to generate an appropriate response. The control center is fully trusted and may attempt to analyze incoming messages to obtain valuable information.TTP: It is responsible for generating and distributing security parameters for all smart meters. TTP is fully trusted and participate only in the registration process, not in the data aggregation process.Figure 2
The system model of the proposed scheme.


### 4.2. Security Requirement

According to related works in recent years, the data aggregation scheme in a smart grid should meet three security requirements. We summarize these requirements as follows.Confidentiality: A malicious attacker may intercept information from a user. The leakage of a user’s power consumption data can compromise its privacy. Therefore, it is important to ensure that the attacker cannot obtain the power consumption data of an individual user.Integrity: A malicious attacker may tamper with a message sent by a user, which will affect the normal statistical analysis. Therefore, it is important to ensure that the messages sent by the user are correct.Authentication: A malicious attacker may forge a message and impersonate a real user to send a message, which will affect the normal process of statistical analysis. Therefore, it is important to ensure that the data received by the aggregator is from a legitimate user.


## 4.1. System Model

In the proposed scheme, the system model for the smart grid consists of four entities: smart meter (SM), aggregator (AGG), control center (CC), and trusted third party (TTP), as shown in Figure2.SM: It is responsible for regularly collecting real-time power consumption data of the user and sending encrypted data to the aggregator. The smart meter is honest-but-curious. It operates according to the protocol and may infer information from other users.AGG: It is responsible for aggregating the power consumption data of all users and sending the aggregated data to the control center. The aggregator is honest-but-curious. It stores all intermediate computational results and may get users’ privacy information from themCC: It is responsible for decrypting and analyzing aggregated data to obtain the sum of users’ power consumption data for each area and to generate an appropriate response. The control center is fully trusted and may attempt to analyze incoming messages to obtain valuable information.TTP: It is responsible for generating and distributing security parameters for all smart meters. TTP is fully trusted and participate only in the registration process, not in the data aggregation process.Figure 2
The system model of the proposed scheme.


## 4.2. Security Requirement

According to related works in recent years, the data aggregation scheme in a smart grid should meet three security requirements. We summarize these requirements as follows.Confidentiality: A malicious attacker may intercept information from a user. The leakage of a user’s power consumption data can compromise its privacy. Therefore, it is important to ensure that the attacker cannot obtain the power consumption data of an individual user.Integrity: A malicious attacker may tamper with a message sent by a user, which will affect the normal statistical analysis. Therefore, it is important to ensure that the messages sent by the user are correct.Authentication: A malicious attacker may forge a message and impersonate a real user to send a message, which will affect the normal process of statistical analysis. Therefore, it is important to ensure that the data received by the aggregator is from a legitimate user.


## 5. Scheme Construction

This section describes the proposed privacy-preserving multidimensional data aggregation scheme. The proposed scheme consists of six steps: system setup, registration and login, authentication and key agreement, data generation, data aggregation, and multidimensional data decryption. We assume that there aren users in each residential area. The symbols and their definitions used in this section are shown in Table 1.Table 1
Symbols and definitions.
SymbolDefinitionSMiThei−th smart meterAGGThe aggregator (usually a gateway)qa large primeGAn elliptic curve group of orderqH0A one-way hash functionH0:G⟶Zq∗h,H1,H2,H3,H4A one-way hash functionh,H1,H2,H3,H4:0,1∗⟶Zq∗IDiThe identity ofSMiAIDiThe pseudonym ofSMixi,XiThe private key and public key ofSMixA,XAThe private key and public key ofAGGxCC,XCCThe private key and public key ofCCxT,XTThe private key and public key ofTTPThe connection symbol


### 5.1. System Setup

The initialization phase is used to generate system public parameters. The smart meter, aggregator, control center, and trusted third party randomly choose an integer fromZq∗ as their private key and compute the corresponding public key Xi=xiG, XA=xAG, XCC=xCCG, XT=xTG.


### 5.2. Registration and Login

(1)
Registration. All smart meters need to register, and each smart meter only needs to register once. The detailed steps for the registration phase are described as follows:(1)
SMi submits its identity IDi and password PWi to TTP through a secure channel.(2)
After receiving the messageIDi,PWi, TTP saves the identity and password information and computes Ai=hPWi‖xT, PIDi=IDi⊕Ai, and Bi=hIDiPWiAi. Finally, TTP returns the message PIDi,Bi to SMi through a secure channel.(3)
After receiving the messagePIDi,Bi, SMi saves PIDi,Bi in its own memory (with some tamper-proof ability).(2)
Login. SMi needs to perform a login phase before communicating with the aggregator. The detailed steps of the login phase are described as follows:(1)
SMi computes Ai=IDi⊕PIDi and Bi′=hIDiPWiAi(2)
SMi verifies whether the parameter Bi stored in memory is equal to Bi′. If so, the login of SMi succeeds; otherwise, the login of SMi fails


### 5.3. Authentication and Key Agreement

The goal of the authentication and key agreement phase is for the smart meter to request authentication from the aggregator and establish a session key between the smart meter and the aggregator, as shown in Figure3. The session key is used by the aggregator to encrypt the response message using a symmetric encryption algorithm when the response message is returned. The detailed steps for authentication and key agreement phase are described as follows.(1)
SMi randomly chooses an integer ri∈Zq∗ and computes AIDi=IDi⊕H0riXA, Ri=riG, and δ1=H1AIDiIDiRi‖ti, where ti is the current timestamp. Finally, SMi sends the message AIDi,Ri,δ1,ti to AGG(2)
After receiving the messageAIDi,Ri,δ1,ti, AGG computes IDi=AIDi⊕H0xARi and checks whether the equation δ1=H1AIDiIDiRi‖ti holds. If not, AGG terminates the communication; otherwise, AGG randomly chooses rj∈Zq∗ and computes Tj=rjG, Sij=rjRi, skij=H1RiTjSij‖IDi, and δ2=H1skijIDitj, where skij is the session key and tj is the current timestamp. Finally, AGG returns the message Tj,δ2,tj to SMi(3)
After receiving the messageTj,δ2,tj, SMi computes Sij=riTj, skij=H1RiTjskij‖IDi and checks whether the equation δ2=H1skijIDitj holds. If not, SMi terminates the communication; otherwise, SMi computes δ3=H1Tjskijti′, where skij is the session key and ti′ is the current timestamp. Finally, SMi sends the message δ3,ti′ to AGG(4)
AGG verifies whether δ3=H1Tjskijti′ holds. If so, the authentication of SMi succeeds; otherwise, the authentication of SMi failsFigure 3
The authentication and key agreement phase of the proposed scheme.


### 5.4. Data Generation

Assume thatSMi can obtain l-dimensional power consumption data di1,di2,…,dil. The detailed steps for generating the ciphertext are described as follows.(1)
SMi randomly chooses si∈Zq∗ and computes the ciphertext according to(3)Ci=siG,di1G+siXA+XCC,di2G+siXA+XCC,…,dilG+siXA+XCC.(2)
SMi randomly chooses ki∈Zq∗ and computes its signature Ki,zi according to(4)Ki=kiG,ϕi=hAIDiXiCiKiTi,zi=ki+ϕi⋅ximodq.(3)
SMi sends the message AIDiXiCiKiTi‖zi to AGG, where Ti is the current timestamp.


### 5.5. Data Aggregation

After receiving the messageAIDiXiCiKiTi‖zi, AGG verifies the smart meter’s signature and computes the aggregated ciphertext, as shown in Figure 4. Suppose that there are currently k smart meters participating in the data aggregation.(1)
AGG verifies signatures of all smart meters according to(5)∑i=1kzi⋅G=?∑i=1kKi+∑i=1khAIDiXiCiKiTi⋅Xi.(2)
AGG computes the aggregated ciphertext C according to(6)C=∑i=1kCi=∑i=1ksiG,∑i=1kdi1G+∑i=1ksiXA+XCC,∑i=1kdi2G+∑i=1ksiXA+XCC,…,∑i=1kdilG+∑i=1ksiXA+XCC.(3)
AGG partially decrypts the aggregated ciphertext C using the private key xA according to(7)∑i=1kdi1G+∑i=1ksiXA+XCC−xA∑i=1ksiG,∑i=1kdi2G+∑i=1ksiXA+XCC−xA∑i=1ksiG,…,∑i=1kdilG+∑i=1ksiXA+XCC−xA∑i=1ksiG=∑i=1kdi1G+∑i=1ksiXCC,∑i=1kdi2G+∑i=1ksiXCC,…,∑i=1kdilG+∑i=1ksiXCC.Therefore, the form of partially decrypted ciphertextCA is shown in(8)CA=∑i=1ksiG,∑i=1kdi1G+∑i=1ksiXCC,∑i=1kdi2G+∑i=1ksiXCC,…,∑i=1kdilG+∑i=1ksiXCC.(4)
AGG randomly chooses kA∈Zq∗ and computes its signature KA,zA according to(9)KA=kAG,ϕA=hIDAXACAKATA,zA=kA+ϕA⋅xA.(5)
AGG sends the message IDAXACAKATA‖zA to CC, where TA is the current timestamp.Figure 4
The data aggregation phase of the proposed scheme.


### 5.6. Data Decryption

After receiving the messageIDAXACAKATA‖zA, CC verifies the signature of AGG. After successful verification, CC decrypts the aggregated ciphertext CA using its own private key xCC to get the sum of the power consumption data.(1)
CC verifies the signature of AGG according to(10)zA⋅G=?KA+hIDAXACAKATA⋅XA.(2)
CC decrypts the aggregated ciphertext CA using the private key xCC according to(11)∑i=1kdi1G+∑i=1ksiXCC−xCC∑i=1ksiG,∑i=1kdi2G+∑i=1ksiXCC−xCC∑i=1ksiG,…,∑i=1kdilG+∑i=1ksiXCC−xCC∑i=1ksiG=∑i=1kdi1G,∑i=1kdi2G,…,∑i=1kdilG.(3)
Using Pollard’s lambda algorithm, the sum of the power consumption data for each dimension can be computed, as shown in (12), where ∑i=1kdil represents the total power consumption data of k users in the l−th dimension.(12)∑i=1kdi1G,∑i=1kdi2G,…,∑i=1kdilG=logG∑i=1kdi1,logG∑i=1kdi2,…,logG∑i=1kdil.


## 5.1. System Setup

The initialization phase is used to generate system public parameters. The smart meter, aggregator, control center, and trusted third party randomly choose an integer fromZq∗ as their private key and compute the corresponding public key Xi=xiG, XA=xAG, XCC=xCCG, XT=xTG.


## 5.2. Registration and Login

(1)
Registration. All smart meters need to register, and each smart meter only needs to register once. The detailed steps for the registration phase are described as follows:(1)
SMi submits its identity IDi and password PWi to TTP through a secure channel.(2)
After receiving the messageIDi,PWi, TTP saves the identity and password information and computes Ai=hPWi‖xT, PIDi=IDi⊕Ai, and Bi=hIDiPWiAi. Finally, TTP returns the message PIDi,Bi to SMi through a secure channel.(3)
After receiving the messagePIDi,Bi, SMi saves PIDi,Bi in its own memory (with some tamper-proof ability).(2)
Login. SMi needs to perform a login phase before communicating with the aggregator. The detailed steps of the login phase are described as follows:(1)
SMi computes Ai=IDi⊕PIDi and Bi′=hIDiPWiAi(2)
SMi verifies whether the parameter Bi stored in memory is equal to Bi′. If so, the login of SMi succeeds; otherwise, the login of SMi fails


## 5.3. Authentication and Key Agreement

The goal of the authentication and key agreement phase is for the smart meter to request authentication from the aggregator and establish a session key between the smart meter and the aggregator, as shown in Figure3. The session key is used by the aggregator to encrypt the response message using a symmetric encryption algorithm when the response message is returned. The detailed steps for authentication and key agreement phase are described as follows.(1)
SMi randomly chooses an integer ri∈Zq∗ and computes AIDi=IDi⊕H0riXA, Ri=riG, and δ1=H1AIDiIDiRi‖ti, where ti is the current timestamp. Finally, SMi sends the message AIDi,Ri,δ1,ti to AGG(2)
After receiving the messageAIDi,Ri,δ1,ti, AGG computes IDi=AIDi⊕H0xARi and checks whether the equation δ1=H1AIDiIDiRi‖ti holds. If not, AGG terminates the communication; otherwise, AGG randomly chooses rj∈Zq∗ and computes Tj=rjG, Sij=rjRi, skij=H1RiTjSij‖IDi, and δ2=H1skijIDitj, where skij is the session key and tj is the current timestamp. Finally, AGG returns the message Tj,δ2,tj to SMi(3)
After receiving the messageTj,δ2,tj, SMi computes Sij=riTj, skij=H1RiTjskij‖IDi and checks whether the equation δ2=H1skijIDitj holds. If not, SMi terminates the communication; otherwise, SMi computes δ3=H1Tjskijti′, where skij is the session key and ti′ is the current timestamp. Finally, SMi sends the message δ3,ti′ to AGG(4)
AGG verifies whether δ3=H1Tjskijti′ holds. If so, the authentication of SMi succeeds; otherwise, the authentication of SMi failsFigure 3
The authentication and key agreement phase of the proposed scheme.


## 5.4. Data Generation

Assume thatSMi can obtain l-dimensional power consumption data di1,di2,…,dil. The detailed steps for generating the ciphertext are described as follows.(1)
SMi randomly chooses si∈Zq∗ and computes the ciphertext according to(3)Ci=siG,di1G+siXA+XCC,di2G+siXA+XCC,…,dilG+siXA+XCC.(2)
SMi randomly chooses ki∈Zq∗ and computes its signature Ki,zi according to(4)Ki=kiG,ϕi=hAIDiXiCiKiTi,zi=ki+ϕi⋅ximodq.(3)
SMi sends the message AIDiXiCiKiTi‖zi to AGG, where Ti is the current timestamp.


## 5.5. Data Aggregation

After receiving the messageAIDiXiCiKiTi‖zi, AGG verifies the smart meter’s signature and computes the aggregated ciphertext, as shown in Figure 4. Suppose that there are currently k smart meters participating in the data aggregation.(1)
AGG verifies signatures of all smart meters according to(5)∑i=1kzi⋅G=?∑i=1kKi+∑i=1khAIDiXiCiKiTi⋅Xi.(2)
AGG computes the aggregated ciphertext C according to(6)C=∑i=1kCi=∑i=1ksiG,∑i=1kdi1G+∑i=1ksiXA+XCC,∑i=1kdi2G+∑i=1ksiXA+XCC,…,∑i=1kdilG+∑i=1ksiXA+XCC.(3)
AGG partially decrypts the aggregated ciphertext C using the private key xA according to(7)∑i=1kdi1G+∑i=1ksiXA+XCC−xA∑i=1ksiG,∑i=1kdi2G+∑i=1ksiXA+XCC−xA∑i=1ksiG,…,∑i=1kdilG+∑i=1ksiXA+XCC−xA∑i=1ksiG=∑i=1kdi1G+∑i=1ksiXCC,∑i=1kdi2G+∑i=1ksiXCC,…,∑i=1kdilG+∑i=1ksiXCC.Therefore, the form of partially decrypted ciphertextCA is shown in(8)CA=∑i=1ksiG,∑i=1kdi1G+∑i=1ksiXCC,∑i=1kdi2G+∑i=1ksiXCC,…,∑i=1kdilG+∑i=1ksiXCC.(4)
AGG randomly chooses kA∈Zq∗ and computes its signature KA,zA according to(9)KA=kAG,ϕA=hIDAXACAKATA,zA=kA+ϕA⋅xA.(5)
AGG sends the message IDAXACAKATA‖zA to CC, where TA is the current timestamp.Figure 4
The data aggregation phase of the proposed scheme.


## 5.6. Data Decryption

After receiving the messageIDAXACAKATA‖zA, CC verifies the signature of AGG. After successful verification, CC decrypts the aggregated ciphertext CA using its own private key xCC to get the sum of the power consumption data.(1)
CC verifies the signature of AGG according to(10)zA⋅G=?KA+hIDAXACAKATA⋅XA.(2)
CC decrypts the aggregated ciphertext CA using the private key xCC according to(11)∑i=1kdi1G+∑i=1ksiXCC−xCC∑i=1ksiG,∑i=1kdi2G+∑i=1ksiXCC−xCC∑i=1ksiG,…,∑i=1kdilG+∑i=1ksiXCC−xCC∑i=1ksiG=∑i=1kdi1G,∑i=1kdi2G,…,∑i=1kdilG.(3)
Using Pollard’s lambda algorithm, the sum of the power consumption data for each dimension can be computed, as shown in (12), where ∑i=1kdil represents the total power consumption data of k users in the l−th dimension.(12)∑i=1kdi1G,∑i=1kdi2G,…,∑i=1kdilG=logG∑i=1kdi1,logG∑i=1kdi2,…,logG∑i=1kdil.


## 6. Security Analysis

### 6.1. Formal Security Analysis

Theorem 1.
Assume thatADVAPtotocol represents the advantage of a probabilistic polynomial-time adversary to break the semantic security of the proposed authentication protocol; then,(13)ADVAPtotocol≤2qsend+qexeL+qH02H0+qH12H1+qH22H2+qH32H3+4q+2ADVGCDHt,where L represents the size of the identity space, Hi represents the size of the hash function space, q is the prime order of group G, and qsend, qexe, and qHi represent the number of Send query, Execute query, and Hash query, respectively.Proof.
Define a series of gamesGame0,Game1,Game2,and Game6. We use Succjj=0,1,…,6 to indicate the event that A successfully guesses b=b′ in Test query in Gamej.Game0: this game simulates real-world attacks by an adversary. The value of b is chosen at random. Therefore, according to the authentication and key agreement model, we have(14)ADVAProtocol=2PrSucc0−1.Game1: this game uses Execute, Send, Reveal, Corrupt, and Test query to simulate real attacks. Game0 and Game1 are indistinguishable. Therefore, we have(15)PrSucc1=PrSucc0.Game2: this game simulates all queries in Game1; the only difference is that Game2 will simulate an adversary’s guess attack on the smart meter’s true identity. Since the smart meter’s identity is converted to a pseudonym by a random number during each authentication phase, the adversary is unable to determine the smart meter’s true identity and has no other information to verify the smart meter’s true identity. Therefore, we have(16)PrSucc1−PrSucc2≤qsend+qexeL.Game3: this game simulates all queries in Game2; the only difference is that Game3 will simulate collision attacks that occur on messages AIDi,Ri,δi,ti,Tj,δ2,tj, and δ3,ti′. Therefore, we have(17)PrSucc2−PrSucc3≤qH022H0+qH122H1+qH222H2+qH322H3.Game4: this game simulates all queries in Game3; the only difference is that Game4 will simulate the adversary’s corrosion attack on the participant. When Corrupt query is executed, the private key stored in the smart meter and in the aggregator can be extracted by the adversary. However, this information is useless for calculating the session key, because a secret random number that is generated temporarily must be required. Due to the fact that ri and rj are randomly selected from Zq∗, we have(18)PrSucc3−PrSucc4≤2q.Game5: this game simulates all queries in Game4; the only difference is that other hash functions will be used to compute the temporary session key skij. That is, instead of using a random oracle, we use skij=Hash′RiTjSij‖IDi to generate the session key. Game5 and Game4 are indistinguishable unless an event AskH5RiTjSij‖IDi occurs. AskH5RiTjSij‖IDi represents the adversary that makes a query about message RiTjSij‖IDi to the random oracle. No matter how many Test queries are made, all results are independently random. Therefore, we have(19)PrSucc5≤12,PrSucc4−PrSucc5≤PrAskH5.Game6: this game simulates all queries in Game5; the only difference is that Game6 will simulate an event where the adversary breaks CDH problem, randomly choose two integers a,b∈Zq∗, given an instance of CDH problem aG,bG, and compute A=aG, B=bG; then, we have AskH6RiTjCDHaG,bG‖IDi. In Game5, the adversary needs to make a query such as AskH5RiTjZ‖IDi, where Z=CDHA,B. Therefore, we have PrAskH5=PrAskH6=PrSucc6. In addition, we have(20)PrSucc6≤ADVGCDHt,where ADVGCDHt represents the advantage of A to break the CDH problem.
From the above analysis, we have(21)PrSucc0−12=PrSucc0−PrSucc5≤PrSucc0−PrSucc1+PrSucc1−PrSucc2+PrSucc2−PrSucc3+PrSucc3−PrSucc4+PrSucc4−PrSucc5≤qsend+qexeL+qH022H0+qH122H1+qH222H2+qH322H3+2q+ADVGCDH.
Due toADVAProtocol≤2PrSucc0−1, we have(22)ADVAProtocol≤2qsend+qexeL+qH02H0+qH12H1+qH22H2+qH32H3+4q+2ADVGCDHt.
To sum up, the advantage of adversaryA to break the proposed authentication protocol is negligible, and the proposed authentication protocol is semantic secure.Theorem 2.
The proposed scheme is secure against IND-CPA, if the DDH problem is hard.Proof.
Assume that there exists a probabilistic polynomial-time adversaryA that can win the game in Definition 2 with a nonnegligible advantage ε. Then, we can construct a simulator S to solve DDH problem with a nonnegligible advantage ε′. The simulator S chooses a challenging identity IDI, and the adversary A can make the following queries:Him: S needs to keep a table LHi=m,r, where i=0,1,2,3,4. After receiving the hash request from A, S checks if the tuple m,r exists in LHi. If so, S returns r to A; otherwise, S randomly chooses r, stores m,r into LHi, and returns r to AhIDi,Xi,Ci,Ki,Ti: S needs to keep a table Lh=IDi,Xi,Ci,Ki,Ti,r. After receiving the hash request from A, S checks if IDi,Xi,Ci,Ki,Ti,r exists in Lh. If so, S returns r to A; otherwise, S randomly chooses r∈Zq∗, stores IDi,Xi,Ci,Ki,Ti,r into Lh, and returns r to ACreatIDi: S needs to keep a table LU=IDi,xi,Xi. After receiving the request from A, S checks if IDi,xi,Xi exists in LU. If so, S returns Xi to A; otherwise, S randomly chooses xi∈Zq∗, computes Xi=xiG, stores IDi,xi,Xi into LU, and returns Xi to AExtractIDi: after receiving the request from A, S first checks whether the identity IDi used by A in the query is equivalent to the challenging identity IDI. If so, S terminates this game; otherwise, S checks if IDi,xi,Xi exists in LU. If so, S returns xi to A; otherwise, S makes CreatIDi query to generate the private key and public key xi and Xi, stores IDi,xi,Xi into LU, and returns xi to AEncryptIDi,mi: after receiving the request from A, S checks if IDi,xi,Xi exists in LU. If so, S uses Xi to generate the ciphertext; otherwise, S makes CreatIDi query to generate the private key and public key xi and Xi and then uses Xi to generate the ciphertextProof.
Assume that the ciphertextCi=miG+siX is secure against IND-CPA. Define a series of games Game0,Game1,and Game2. With these games, we reduce the instance of the DDH problem. That is, given G,P=aG,Q=bG,Z, determine whether Z=abG, where G,P,Q,Z∈G, a,b∈Zq∗, and a and b are unknown. S chooses a challenging identity IDI.Game0: this game simulates real-world attacks. S acts as a smart meter, knowing the public and private key pair Si=siG,si. A knows the public key and has access to the random oracle. At some point, A randomly chooses an identity IDi and two plaintexts mi0,mi1 with the same length and sends them to S for an encryption query. Then, S chooses a bit u∈0,1, encrypts the ciphertext Ci=miuG+siX, and sends the ciphertext Ci to A. Finally, A outputs its guess u′∈0,1. Succ0 represents the event in Game0 that u=u′, and we use symbols Succjj=0,1,2 to represent the same meaning in any game. Based on Definition 2, we have(23)ε=2Pru=u′−1.Game1: in this game, we embed the instance G,aG,bG,Z of the DDH problem. When A makes CreatIDi query, S randomly chooses ri∈Zq∗, sets X=ribG, saves IDi,ri,X into LU, and sends X to A. Because X=ribG is evenly distributed in the group G, Game1 is completely indistinguishable from Game0. Therefore, we have(24)PrSucc1=PrSucc0.Game2: in this game, S replaces the public key Si=siG with Si=aG. S does not know the private key a. Therefore, when A makes EncryptIDi,mi query, S performs the following steps. (1) When IDi=IDI, S looks for the record IDI,rI,X in LU. (2) S computes CI=mIuG+rIZ and sends CI to A. (3) Define Z=abG∈G as event E.
If eventE actually occurs, then CI is a valid ciphertext when public key Si=aG and X=rIbG holds. Therefore, at this time, A can play its ability to guess whether u=u′.
However, if eventE does not occur, A can only guess u=u′ at a random probability of 1/2. Therefore, we have(25)PrSucc2|E¯=12.
Therefore, based on the above analysis, we can solve the DDH problem with probabilityε′.(26)ε′=PrSucc2|E−PrSucc2|E¯=PrSucc1−12=PrSucc0−12=Pru=u′−12.
Due toε=2Pru=u′−1, ε′=Pru=u′−1/2=ε/2.
Because the advantageε in the previous assumption cannot be ignored, ε′ cannot be ignored. That is, a simulator S can be constructed to solve the DDH problem. However, DDH problem cannot be solved in practice; then, the conclusion is impossible. Therefore, our assumption does not hold. In other words, the proposed scheme is secure against indistinguishability under the chosen-plaintext attack (IND-CPA).Theorem 3.
The proposed scheme is secure against EUF-CMA, if the discrete logarithm problem is hard.Proof.
Assume that there exists a probabilistic polynomial-time adversary that can win the game in Definition3 with a nonnegligible advantage ε. Then, we can construct a simulator S to solve the discrete logarithm problem. Given an instance P,Q of a discrete logarithm problem, where P,Q∈G, the goal of S is to find x∈Zq∗, such that Q=xG. S chooses a challenging identity IDI. A can make Him, hIDi,Xi,Ci,Ki,Ti, ExtractIDi queries as it did in Theorem 2. The adversary can also make other queries as follows:CreateIDi: S needs to keep a table LU=IDi,xi,Xi. After receiving the request from A, S first checks if IDi,xi,Xi exists in LU. If so, S returns Xi to A; otherwise, S checks whether the identity IDi used by A is equal to the challenging identity IDI, and if not, S generates xi and Xi according to the proposed scheme; otherwise, S sets Xi=Q, stores IDi,,Xi into LU, and returns Xi to ASignIDi,mi: after receiving the request from A, S first checks whether IDi and IDI are equal. If not, S generates the signature of the message mi according to the proposed scheme; otherwise, S randomly chooses si,ki,ϕi∈Zq∗, computes Ci=siG,miG+siXA+XCC,Ki=kiG−ϕi⋅Xi, sets zi=ki, stores IDi,Xi,Ci,Ki,Ti,ϕi in Lh, and returns Ki,zi to AVerifyIDi,mi: S verifies the signature of the message mi according to the proposed scheme
Finally,A can use S to forge a valid signature Ci,Ki,zi,Ti of the message mi with the identity IDi. According to the forking lemma, A can obtain another valid signature Ci,Ki,zi′,Ti, where zi=ki+ϕi⋅ximodq and zi′=ki+ϕi′⋅ximodq. Therefore, we can obtain two equations:(27)ziG=kiG+ϕixiG,zi′G=kiG+ϕi′xiG.
According to the above equations, we haveziG−zi′G=ϕi−ϕi′xiG, then xi=zi−zi′ϕi−ϕi′−1.
Finally,S gets the solution xi=zi−zi′ϕi−ϕi′−1 of the DL problem instance P,Q=xiG.
To calculate the advantage ofS solving the discrete logarithm problem, we define the following three events. (1) E1: S does not terminate the game; (2) E2: IDi and IDI are equal; (3) E3: A outputs a valid signature.
Therefore, we havePrE1=1−1/qH4qext, PrE2|E1=1/qH4, and PrE3|E1∧E2=ε, where qH4 and qext represent the number of H4 query and Extract query, respectively. Therefore, the probability of A solving the discrete logarithm problem is(28)PrE1∧E2∧E3=PrE3|E1∧E2⋅PrE2|E1⋅PrE1=1−1qH4qext⋅εqH4.
Becauseε cannot be ignored, the probability of A using S to solve discrete logarithm problem cannot be ignored. However, in the actual situation, the discrete logarithm problem is unable to solve; therefore, the conclusion cannot hold. As a result, our assumption does not hold. That is, the proposed scheme is secure against existential unforgeability under the adaptive chosen messages attacks (EUF-CMA).


### 6.2. Informal Security Analysis

(1)
The proposed scheme provides anonymity for users. As wireless networks are increasingly used in the smart grid, communication channels may be open. It is easy for adversaries to intercept messages from communication channels. In the proposed authentication protocol, the identity of each smart meter is anonymous. Because the CDH problem is hard, the adversary cannot obtain a true identity without knowing the temporary random number. Therefore, the proposed scheme can protect the identity privacy of users.(2)
The proposed scheme ensures the confidentiality of the session key. In the proposed scheme, the session key in the proposed authentication protocol uses random numbers chosen by the smart meter and the aggregator. During each authentication phase, the smart meter and aggregator reselect new random numbers. Even if the adversary eavesdrops on the communication channel, it is difficult for the adversary to guess the session key or to calculate the session key from the messages transmitted over the network. Therefore, the proposed scheme ensures the confidentiality of the session key.(3)
The proposed scheme ensures the confidentiality of users’ data. EC-ElGamal cryptosystem is used to encrypt the power consumption data. Assume that the DDH problem is hard, the EC-ElGamal cryptosystem is secure against IND-CPA. Therefore, an external eavesdropper cannot obtain any individual user’s power consumption data. Furthermore, the adversary cannot infer the plaintext of the aggregated data in the aggregator’s database and the control center’s database. Therefore, the proposed scheme ensures the confidentiality of users’ data.(4)
The proposed scheme ensures data integrity and authentication. The signature algorithm in the proposed scheme is provable secure. In practice, if an attacker wants to forge a signature, it would have to either crack the hash function or the discrete logarithm problem. In the proposed scheme, the signature algorithm uses a secure hash function and an elliptic curve, so that the possibility of both types of cracking is negligible. Therefore, the proposed scheme provides data integrity and authentication.(5)
The proposed scheme is secure under the attack of malware. Suppose an attacker successfully intercepts private information from the aggregator database by deploying malicious software in the aggregator system. Because the aggregator cannot completely decrypt the aggregated ciphertext, the attacker cannot obtain any single user’s power consumption data. In addition, the attacker can also intercept private information from the control center. The decrypted plaintext of the control center is the sum of users’ power consumption data, and the attacker cannot obtain the power consumption data of an individual user. Therefore, the proposed scheme can protect the user’s power consumption data from malicious software.(6)
The proposed scheme can resist replay attacks. Because the messages whether in the authentication or data generation phase contain a timestamp, the aggregator can detect any replayed messages by verifying the validity of the timestamp. Therefore, the proposed scheme can resist replay attacks.


## 6.1. Formal Security Analysis

Theorem 1.
Assume thatADVAPtotocol represents the advantage of a probabilistic polynomial-time adversary to break the semantic security of the proposed authentication protocol; then,(13)ADVAPtotocol≤2qsend+qexeL+qH02H0+qH12H1+qH22H2+qH32H3+4q+2ADVGCDHt,where L represents the size of the identity space, Hi represents the size of the hash function space, q is the prime order of group G, and qsend, qexe, and qHi represent the number of Send query, Execute query, and Hash query, respectively.Proof.
Define a series of gamesGame0,Game1,Game2,and Game6. We use Succjj=0,1,…,6 to indicate the event that A successfully guesses b=b′ in Test query in Gamej.Game0: this game simulates real-world attacks by an adversary. The value of b is chosen at random. Therefore, according to the authentication and key agreement model, we have(14)ADVAProtocol=2PrSucc0−1.Game1: this game uses Execute, Send, Reveal, Corrupt, and Test query to simulate real attacks. Game0 and Game1 are indistinguishable. Therefore, we have(15)PrSucc1=PrSucc0.Game2: this game simulates all queries in Game1; the only difference is that Game2 will simulate an adversary’s guess attack on the smart meter’s true identity. Since the smart meter’s identity is converted to a pseudonym by a random number during each authentication phase, the adversary is unable to determine the smart meter’s true identity and has no other information to verify the smart meter’s true identity. Therefore, we have(16)PrSucc1−PrSucc2≤qsend+qexeL.Game3: this game simulates all queries in Game2; the only difference is that Game3 will simulate collision attacks that occur on messages AIDi,Ri,δi,ti,Tj,δ2,tj, and δ3,ti′. Therefore, we have(17)PrSucc2−PrSucc3≤qH022H0+qH122H1+qH222H2+qH322H3.Game4: this game simulates all queries in Game3; the only difference is that Game4 will simulate the adversary’s corrosion attack on the participant. When Corrupt query is executed, the private key stored in the smart meter and in the aggregator can be extracted by the adversary. However, this information is useless for calculating the session key, because a secret random number that is generated temporarily must be required. Due to the fact that ri and rj are randomly selected from Zq∗, we have(18)PrSucc3−PrSucc4≤2q.Game5: this game simulates all queries in Game4; the only difference is that other hash functions will be used to compute the temporary session key skij. That is, instead of using a random oracle, we use skij=Hash′RiTjSij‖IDi to generate the session key. Game5 and Game4 are indistinguishable unless an event AskH5RiTjSij‖IDi occurs. AskH5RiTjSij‖IDi represents the adversary that makes a query about message RiTjSij‖IDi to the random oracle. No matter how many Test queries are made, all results are independently random. Therefore, we have(19)PrSucc5≤12,PrSucc4−PrSucc5≤PrAskH5.Game6: this game simulates all queries in Game5; the only difference is that Game6 will simulate an event where the adversary breaks CDH problem, randomly choose two integers a,b∈Zq∗, given an instance of CDH problem aG,bG, and compute A=aG, B=bG; then, we have AskH6RiTjCDHaG,bG‖IDi. In Game5, the adversary needs to make a query such as AskH5RiTjZ‖IDi, where Z=CDHA,B. Therefore, we have PrAskH5=PrAskH6=PrSucc6. In addition, we have(20)PrSucc6≤ADVGCDHt,where ADVGCDHt represents the advantage of A to break the CDH problem.
From the above analysis, we have(21)PrSucc0−12=PrSucc0−PrSucc5≤PrSucc0−PrSucc1+PrSucc1−PrSucc2+PrSucc2−PrSucc3+PrSucc3−PrSucc4+PrSucc4−PrSucc5≤qsend+qexeL+qH022H0+qH122H1+qH222H2+qH322H3+2q+ADVGCDH.
Due toADVAProtocol≤2PrSucc0−1, we have(22)ADVAProtocol≤2qsend+qexeL+qH02H0+qH12H1+qH22H2+qH32H3+4q+2ADVGCDHt.
To sum up, the advantage of adversaryA to break the proposed authentication protocol is negligible, and the proposed authentication protocol is semantic secure.Theorem 2.
The proposed scheme is secure against IND-CPA, if the DDH problem is hard.Proof.
Assume that there exists a probabilistic polynomial-time adversaryA that can win the game in Definition 2 with a nonnegligible advantage ε. Then, we can construct a simulator S to solve DDH problem with a nonnegligible advantage ε′. The simulator S chooses a challenging identity IDI, and the adversary A can make the following queries:Him: S needs to keep a table LHi=m,r, where i=0,1,2,3,4. After receiving the hash request from A, S checks if the tuple m,r exists in LHi. If so, S returns r to A; otherwise, S randomly chooses r, stores m,r into LHi, and returns r to AhIDi,Xi,Ci,Ki,Ti: S needs to keep a table Lh=IDi,Xi,Ci,Ki,Ti,r. After receiving the hash request from A, S checks if IDi,Xi,Ci,Ki,Ti,r exists in Lh. If so, S returns r to A; otherwise, S randomly chooses r∈Zq∗, stores IDi,Xi,Ci,Ki,Ti,r into Lh, and returns r to ACreatIDi: S needs to keep a table LU=IDi,xi,Xi. After receiving the request from A, S checks if IDi,xi,Xi exists in LU. If so, S returns Xi to A; otherwise, S randomly chooses xi∈Zq∗, computes Xi=xiG, stores IDi,xi,Xi into LU, and returns Xi to AExtractIDi: after receiving the request from A, S first checks whether the identity IDi used by A in the query is equivalent to the challenging identity IDI. If so, S terminates this game; otherwise, S checks if IDi,xi,Xi exists in LU. If so, S returns xi to A; otherwise, S makes CreatIDi query to generate the private key and public key xi and Xi, stores IDi,xi,Xi into LU, and returns xi to AEncryptIDi,mi: after receiving the request from A, S checks if IDi,xi,Xi exists in LU. If so, S uses Xi to generate the ciphertext; otherwise, S makes CreatIDi query to generate the private key and public key xi and Xi and then uses Xi to generate the ciphertextProof.
Assume that the ciphertextCi=miG+siX is secure against IND-CPA. Define a series of games Game0,Game1,and Game2. With these games, we reduce the instance of the DDH problem. That is, given G,P=aG,Q=bG,Z, determine whether Z=abG, where G,P,Q,Z∈G, a,b∈Zq∗, and a and b are unknown. S chooses a challenging identity IDI.Game0: this game simulates real-world attacks. S acts as a smart meter, knowing the public and private key pair Si=siG,si. A knows the public key and has access to the random oracle. At some point, A randomly chooses an identity IDi and two plaintexts mi0,mi1 with the same length and sends them to S for an encryption query. Then, S chooses a bit u∈0,1, encrypts the ciphertext Ci=miuG+siX, and sends the ciphertext Ci to A. Finally, A outputs its guess u′∈0,1. Succ0 represents the event in Game0 that u=u′, and we use symbols Succjj=0,1,2 to represent the same meaning in any game. Based on Definition 2, we have(23)ε=2Pru=u′−1.Game1: in this game, we embed the instance G,aG,bG,Z of the DDH problem. When A makes CreatIDi query, S randomly chooses ri∈Zq∗, sets X=ribG, saves IDi,ri,X into LU, and sends X to A. Because X=ribG is evenly distributed in the group G, Game1 is completely indistinguishable from Game0. Therefore, we have(24)PrSucc1=PrSucc0.Game2: in this game, S replaces the public key Si=siG with Si=aG. S does not know the private key a. Therefore, when A makes EncryptIDi,mi query, S performs the following steps. (1) When IDi=IDI, S looks for the record IDI,rI,X in LU. (2) S computes CI=mIuG+rIZ and sends CI to A. (3) Define Z=abG∈G as event E.
If eventE actually occurs, then CI is a valid ciphertext when public key Si=aG and X=rIbG holds. Therefore, at this time, A can play its ability to guess whether u=u′.
However, if eventE does not occur, A can only guess u=u′ at a random probability of 1/2. Therefore, we have(25)PrSucc2|E¯=12.
Therefore, based on the above analysis, we can solve the DDH problem with probabilityε′.(26)ε′=PrSucc2|E−PrSucc2|E¯=PrSucc1−12=PrSucc0−12=Pru=u′−12.
Due toε=2Pru=u′−1, ε′=Pru=u′−1/2=ε/2.
Because the advantageε in the previous assumption cannot be ignored, ε′ cannot be ignored. That is, a simulator S can be constructed to solve the DDH problem. However, DDH problem cannot be solved in practice; then, the conclusion is impossible. Therefore, our assumption does not hold. In other words, the proposed scheme is secure against indistinguishability under the chosen-plaintext attack (IND-CPA).Theorem 3.
The proposed scheme is secure against EUF-CMA, if the discrete logarithm problem is hard.Proof.
Assume that there exists a probabilistic polynomial-time adversary that can win the game in Definition3 with a nonnegligible advantage ε. Then, we can construct a simulator S to solve the discrete logarithm problem. Given an instance P,Q of a discrete logarithm problem, where P,Q∈G, the goal of S is to find x∈Zq∗, such that Q=xG. S chooses a challenging identity IDI. A can make Him, hIDi,Xi,Ci,Ki,Ti, ExtractIDi queries as it did in Theorem 2. The adversary can also make other queries as follows:CreateIDi: S needs to keep a table LU=IDi,xi,Xi. After receiving the request from A, S first checks if IDi,xi,Xi exists in LU. If so, S returns Xi to A; otherwise, S checks whether the identity IDi used by A is equal to the challenging identity IDI, and if not, S generates xi and Xi according to the proposed scheme; otherwise, S sets Xi=Q, stores IDi,,Xi into LU, and returns Xi to ASignIDi,mi: after receiving the request from A, S first checks whether IDi and IDI are equal. If not, S generates the signature of the message mi according to the proposed scheme; otherwise, S randomly chooses si,ki,ϕi∈Zq∗, computes Ci=siG,miG+siXA+XCC,Ki=kiG−ϕi⋅Xi, sets zi=ki, stores IDi,Xi,Ci,Ki,Ti,ϕi in Lh, and returns Ki,zi to AVerifyIDi,mi: S verifies the signature of the message mi according to the proposed scheme
Finally,A can use S to forge a valid signature Ci,Ki,zi,Ti of the message mi with the identity IDi. According to the forking lemma, A can obtain another valid signature Ci,Ki,zi′,Ti, where zi=ki+ϕi⋅ximodq and zi′=ki+ϕi′⋅ximodq. Therefore, we can obtain two equations:(27)ziG=kiG+ϕixiG,zi′G=kiG+ϕi′xiG.
According to the above equations, we haveziG−zi′G=ϕi−ϕi′xiG, then xi=zi−zi′ϕi−ϕi′−1.
Finally,S gets the solution xi=zi−zi′ϕi−ϕi′−1 of the DL problem instance P,Q=xiG.
To calculate the advantage ofS solving the discrete logarithm problem, we define the following three events. (1) E1: S does not terminate the game; (2) E2: IDi and IDI are equal; (3) E3: A outputs a valid signature.
Therefore, we havePrE1=1−1/qH4qext, PrE2|E1=1/qH4, and PrE3|E1∧E2=ε, where qH4 and qext represent the number of H4 query and Extract query, respectively. Therefore, the probability of A solving the discrete logarithm problem is(28)PrE1∧E2∧E3=PrE3|E1∧E2⋅PrE2|E1⋅PrE1=1−1qH4qext⋅εqH4.
Becauseε cannot be ignored, the probability of A using S to solve discrete logarithm problem cannot be ignored. However, in the actual situation, the discrete logarithm problem is unable to solve; therefore, the conclusion cannot hold. As a result, our assumption does not hold. That is, the proposed scheme is secure against existential unforgeability under the adaptive chosen messages attacks (EUF-CMA).


## 6.2. Informal Security Analysis

(1)
The proposed scheme provides anonymity for users. As wireless networks are increasingly used in the smart grid, communication channels may be open. It is easy for adversaries to intercept messages from communication channels. In the proposed authentication protocol, the identity of each smart meter is anonymous. Because the CDH problem is hard, the adversary cannot obtain a true identity without knowing the temporary random number. Therefore, the proposed scheme can protect the identity privacy of users.(2)
The proposed scheme ensures the confidentiality of the session key. In the proposed scheme, the session key in the proposed authentication protocol uses random numbers chosen by the smart meter and the aggregator. During each authentication phase, the smart meter and aggregator reselect new random numbers. Even if the adversary eavesdrops on the communication channel, it is difficult for the adversary to guess the session key or to calculate the session key from the messages transmitted over the network. Therefore, the proposed scheme ensures the confidentiality of the session key.(3)
The proposed scheme ensures the confidentiality of users’ data. EC-ElGamal cryptosystem is used to encrypt the power consumption data. Assume that the DDH problem is hard, the EC-ElGamal cryptosystem is secure against IND-CPA. Therefore, an external eavesdropper cannot obtain any individual user’s power consumption data. Furthermore, the adversary cannot infer the plaintext of the aggregated data in the aggregator’s database and the control center’s database. Therefore, the proposed scheme ensures the confidentiality of users’ data.(4)
The proposed scheme ensures data integrity and authentication. The signature algorithm in the proposed scheme is provable secure. In practice, if an attacker wants to forge a signature, it would have to either crack the hash function or the discrete logarithm problem. In the proposed scheme, the signature algorithm uses a secure hash function and an elliptic curve, so that the possibility of both types of cracking is negligible. Therefore, the proposed scheme provides data integrity and authentication.(5)
The proposed scheme is secure under the attack of malware. Suppose an attacker successfully intercepts private information from the aggregator database by deploying malicious software in the aggregator system. Because the aggregator cannot completely decrypt the aggregated ciphertext, the attacker cannot obtain any single user’s power consumption data. In addition, the attacker can also intercept private information from the control center. The decrypted plaintext of the control center is the sum of users’ power consumption data, and the attacker cannot obtain the power consumption data of an individual user. Therefore, the proposed scheme can protect the user’s power consumption data from malicious software.(6)
The proposed scheme can resist replay attacks. Because the messages whether in the authentication or data generation phase contain a timestamp, the aggregator can detect any replayed messages by verifying the validity of the timestamp. Therefore, the proposed scheme can resist replay attacks.


## 7. Performance Analysis

This section presents the performance comparison between the proposed scheme and other similar schemes in the data generation phase and data aggregation phase. Performance includes computation overhead and communication overhead. Experiments were all performed on a personal computer with Intel Core i5-7200U CPU @2.50 GHz, 12.00 GB memory, and Windows 10 operating system, based on the JPBC library.


### 7.1. Computation Cost

We compare the computation cost of the proposed scheme with that of Li et al. [27], Shen et al. [29], and Lang et al. [30]. For convenience, we define some notations and descriptions as shown in Table 2. Since CC is generally supposed to have enough computing power, we only compare the computation overhead of SMi and AGG.Table 2
Notations and descriptions.
NotationDescriptionEXPThe exponentiation operation in the Boneh-Goh-Nissim algorithmMUL−BGNThe multiplication operation in the Boneh-Goh-Nissim algorithmPMULThe point multiplication operation in an elliptic curve groupPADDThe point addition operation in an elliptic curve groupHTPThe hash-to-point operationBPThe bilinear pairing operationIn Li’s scheme [27], SMi executes two EXP operations, one HTP operation, and one PMUL operation. Therefore, the runtime of SMi is 2TEXP+THTP+TPMUL. AGG executes one EXP operation, n+1PMUL operations, and one HTP operation. Therefore, the runtime of AGG is TEXP+n+1TPMUL+THTP.In Shen’s scheme [29], SMi executes two EXP operations and one PMUL operation. Therefore, the runtime of SMi is 2TEXP+TPMUL. AGG executes n+1BP operations and nHTP operations. Therefore, the runtime of AGG is n+1TBP+nTHTP.In Lang’s scheme [30], SMi executes l+1MUL−BGN operations and one PMUL operation. Therefore, the runtime of SMi is l+1TMUL−BGN+TPMUL. AGG executes n+1PMUL operations. Therefore, the runtime of AGG is n+1TPMUL.In our proposed scheme,SMi executes 2l+2PMUL operations. Therefore, the runtime of SMi is 2l+2TPMUL. AGG executes n+1TPMUL operations. Therefore, the runtime of AGG is n+1TPMUL≈9.955n+7.57ms.Table3 and Figure 5 show the computation costs comparisons among Li’s scheme [27], Shen’s scheme [29], Lang’s scheme [30], and our proposed scheme.Table 3
Computation costs atSMi.
UsermsAGGmsLi’s scheme [27]2TEXP+THTP+TPMULTEXP+n+1TPMUL+THTPShen’s scheme [29]2TEXP+TPMULn+1TBP+nTHTPLang’s scheme [30]l+1TMUL−BGN+TPMULn+1TPMULOur scheme2l+2TPMULn+1TPMULFigure 5
Computation costs atAGG.


### 7.2. Communication Cost

Because the size ofq1,q2,q is 512 bits, 512 bits, and 160 bits, respectively, we can know that the size of Zn∗,G1,G2,G,Zq∗ is 1024 bits, 1024 bits, 160 bits, 160 bits, and 160 bits. Assume that the timestamp and the identity are both 32 bits.In Li’s scheme [27], SMi sends IDi,CTi,δi,T to AGG, where the length of CTi is 1024 bits and the length of δi is 512 bits. Thus, the communication cost is 32+1024+512+32=1600 bits.In Shen’s scheme [29], SMi sends IDi,IDAGG,CTi,δi,T to AGG, where the length of CTi is 2048 bits and the length of δi is 160 bits. Thus, the communication cost is 32+32+2048+160+32=2304 bits.In Lang’s scheme [30], SMi sends IDi,CTi,δi,T to AGG, where the length of CTi is 4096 bits and the length of δi is 512 bits when data has seven dimensions. Thus, the communication cost is 32+4096+512+32=4672 bits.In our proposed scheme,SMi sends IDi,Ci,δi,T to AGG, where the length of CTi is 2240 bits and the length of δi is 512 bits when data has seven dimensions. Thus, the communication cost is 32+2240+512+32=2816 bits.As shown in Figures5 and 6, the computation overhead in the aggregation phase of our proposed scheme has obvious advantages over Shen et al.’s [29] scheme. The communication cost is at the middle level compared with other schemes. Considering the security and reliability, it is reasonable to increase the communication cost. Therefore, the proposed scheme satisfies the requirement of security and performance for the smart grid.Figure 6
Communication costs.


## 7.1. Computation Cost

We compare the computation cost of the proposed scheme with that of Li et al. [27], Shen et al. [29], and Lang et al. [30]. For convenience, we define some notations and descriptions as shown in Table 2. Since CC is generally supposed to have enough computing power, we only compare the computation overhead of SMi and AGG.Table 2
Notations and descriptions.
NotationDescriptionEXPThe exponentiation operation in the Boneh-Goh-Nissim algorithmMUL−BGNThe multiplication operation in the Boneh-Goh-Nissim algorithmPMULThe point multiplication operation in an elliptic curve groupPADDThe point addition operation in an elliptic curve groupHTPThe hash-to-point operationBPThe bilinear pairing operationIn Li’s scheme [27], SMi executes two EXP operations, one HTP operation, and one PMUL operation. Therefore, the runtime of SMi is 2TEXP+THTP+TPMUL. AGG executes one EXP operation, n+1PMUL operations, and one HTP operation. Therefore, the runtime of AGG is TEXP+n+1TPMUL+THTP.In Shen’s scheme [29], SMi executes two EXP operations and one PMUL operation. Therefore, the runtime of SMi is 2TEXP+TPMUL. AGG executes n+1BP operations and nHTP operations. Therefore, the runtime of AGG is n+1TBP+nTHTP.In Lang’s scheme [30], SMi executes l+1MUL−BGN operations and one PMUL operation. Therefore, the runtime of SMi is l+1TMUL−BGN+TPMUL. AGG executes n+1PMUL operations. Therefore, the runtime of AGG is n+1TPMUL.In our proposed scheme,SMi executes 2l+2PMUL operations. Therefore, the runtime of SMi is 2l+2TPMUL. AGG executes n+1TPMUL operations. Therefore, the runtime of AGG is n+1TPMUL≈9.955n+7.57ms.Table3 and Figure 5 show the computation costs comparisons among Li’s scheme [27], Shen’s scheme [29], Lang’s scheme [30], and our proposed scheme.Table 3
Computation costs atSMi.
UsermsAGGmsLi’s scheme [27]2TEXP+THTP+TPMULTEXP+n+1TPMUL+THTPShen’s scheme [29]2TEXP+TPMULn+1TBP+nTHTPLang’s scheme [30]l+1TMUL−BGN+TPMULn+1TPMULOur scheme2l+2TPMULn+1TPMULFigure 5
Computation costs atAGG.


## 7.2. Communication Cost

Because the size ofq1,q2,q is 512 bits, 512 bits, and 160 bits, respectively, we can know that the size of Zn∗,G1,G2,G,Zq∗ is 1024 bits, 1024 bits, 160 bits, 160 bits, and 160 bits. Assume that the timestamp and the identity are both 32 bits.In Li’s scheme [27], SMi sends IDi,CTi,δi,T to AGG, where the length of CTi is 1024 bits and the length of δi is 512 bits. Thus, the communication cost is 32+1024+512+32=1600 bits.In Shen’s scheme [29], SMi sends IDi,IDAGG,CTi,δi,T to AGG, where the length of CTi is 2048 bits and the length of δi is 160 bits. Thus, the communication cost is 32+32+2048+160+32=2304 bits.In Lang’s scheme [30], SMi sends IDi,CTi,δi,T to AGG, where the length of CTi is 4096 bits and the length of δi is 512 bits when data has seven dimensions. Thus, the communication cost is 32+4096+512+32=4672 bits.In our proposed scheme,SMi sends IDi,Ci,δi,T to AGG, where the length of CTi is 2240 bits and the length of δi is 512 bits when data has seven dimensions. Thus, the communication cost is 32+2240+512+32=2816 bits.As shown in Figures5 and 6, the computation overhead in the aggregation phase of our proposed scheme has obvious advantages over Shen et al.’s [29] scheme. The communication cost is at the middle level compared with other schemes. Considering the security and reliability, it is reasonable to increase the communication cost. Therefore, the proposed scheme satisfies the requirement of security and performance for the smart grid.Figure 6
Communication costs.


## 8. Conclusion

In this paper, we propose a privacy-preserving multidimensional data aggregation scheme for a smart grid, which can aggregate multidimensional data and protect the user’s identity and data privacy. The analysis shows that the proposed scheme is provable secure and efficient. In addition, we will consider a more appropriate method of aggregating multidimensional data to improve the applicability of the proposed scheme in further work.



---

*Source: 8845959-2020-12-03.xml*