SP 2 DAS: Self-certified PKC-Based Privacy-Preserving Data Aggregation Scheme in Smart Grid

Abstract

Smart grid is a network of computers and power infrastructures that monitor and control energy usage by collecting data from the power grid. It can gather and distribute information about the behavior of all consumers in order to improve the efficiency, reliability, economics, safety, and sustainability of electricity services. In this paper, we propose a self-certified PKC-based privacy-preserving data aggregation scheme in smart grid to increase computation efficiency and achieve privacy protection of end users. To realize the anonymous aggregation of multidimensional data, we adopt the Chinese Remainder Theorem and homomorphic property of Paillier cryptosystem to achieve it. Comparing our scheme with Lu et al.'s scheme, the result shows that our scheme has more advantages over Lu et al.'s scheme in terms of computational costs of the user, GW, and OA. After adopting batch verification technique, the computational cost of GW is constant in our scheme, however, that of GW is linear with the number of the users in Lu et al.'s scheme. Furthermore, our scheme also supports the anonymity of the user's identity. It indicates that the local gateway GW does not know the real identity of the resident user such that the privacy of the user is better protected.

1. Introduction

Power electric systems in most countries have became old and inefficient. It might result in potential safety hazards. The Northeast blackout of 2003 was worth to be pondered. In this accident, about 200,000 people were affected, and 265 power plants were shut down during the outage. Investigations report found that the reason of blackout was due to human error and equipment failures. And this report indicated that this blackout could have been prevented and that immediate actions must be taken in both the United States and Canada to ensure that our electric system was more reliable. It puts forth a challenge for us. When a problem appears, how should we find it and solve it in time?

To overcome the problems caused by aging power grids, smart grid is developed. The earlier emerging smart grid technologies are electronic control, metering, and monitoring. The term smart grid has been used since at least 2005, when it appeared in [1]. There are many smart grid definitions in the recent literature in different flavors. However, a common factor in these definitions is the application of digital processing and communications to the power grid, making data flow and information management central to the smart grid.

The objective of smart grid is to provide end users or consumers with power in a more flexible, stable, and reliable manner. It makes end users know real-time electricity usage so as to actively adjust use of electricity. Therefore, the smart grid is characterized by a two-way flow of electricity and information between the provider and consumer of electric power. It achieves an automated, distributed energy delivery network and helps end users to balance power supply and demand by distributed computing and communications to deliver real-time information. Meanwhile, it also can detect and respond to weaknesses or failures in the power system in real time such that potential dangers are prevented.

Communication framework in smart grid is shown in Figure 1, where power transmission and distribution systems are separated from the communication system. In the communication system in smart grid, smart meter is an important component in smart grid it can record consumption of electric energy in a time interval and communicate the information back to the utility for monitoring and billing purposes. However, current smart metering technologies which are applied in smart meters may result in privacy leak issues because they depend upon centralizing personal consumption information of the consumers at their smart meters. In 2009, The Netherlands enacted relevant laws to force to consider privacy issues in case of using smart meters [2]. Similarly, in the United States, NIST dictated that there privacy issues be taken into account in the design of smart grid communications [3]. These privacy concerns may be addressed by adequately authenticating the smart meters. However, smart meter is a rather limited resources device with low memory and computational capacity. Thus, we cannot put too much burden on the constrained smart metering resources in the time of designing an authentication mechanism for smart grid communication.

Figure 1

The conceptual architecture of smart grid.

Because communication in smart grid is based on the public data communication networks such as Internet. there exist a wide variety of malicious attacks, such as replay, eavesdropper, tamper of data, traffic analysis, tracing of the locations, and denial of service (DOS) attacks. Thus, before putting the application of smart grid into practice, the corresponding security and privacy issues must be resolved. For example, without the security and privacy guarantees, an adversary in smart grid can forge a fraudulent electricity usage data or breakdown information to mislead operation center. In terms of end users, privacy is a most concerned problem. It includes privacy of identity and privacy of data. Power-consuming data may reveal family income and physical activities. For example, power consumption of a household in a certain time is very low or zero; it implies that no one is at home. The user's identity is sensitive information. If it is leaked, it may result in potential unsafe factor. Then home address and the number of apartments of the user are known. Thus, this privacy-sensitive information must be anonymous.

To achieve data privacy, encryption algorithm is used to ensure the safety of data. However, it may result in data expansion. How do we resist data expansion in the case of keeping data privacy? It brings a challenge to the smart meter with constraint resource. To solve this issue, we adopt homomorphic encryption technique [4] since it can achieve data aggregation under the condition that the data is encrypted. In other words, data can be aggregated in the ciphertext form. In 2005, Castelluccia et al. [5] adopted homomorphic encryption techniques to realize the aggregation of encrypted data without decryption at intermediate nodes. Subsequently, Westhoff et al. showed that the scheme [6] may result in an increased message overhead in per monitoring node since the ID list of the encrypting nodes must be transmitted when every node used different keys. Thus, a symmetric homomorphic encryption technique was applied to increase the efficiency in [6]. In [7], Shi et al. was based on Castelluccia's scheme to put forth a privacy-preserving data aggregation scheme to preserve user privacy. Most of the previous works mainly focus on one-dimensional data. Recently, Lu et al. proposed a multidimensional data aggregation approach based on the homomorphic Paillier cryptosystem by using superincreasing sequence [8]. However, the computation overhead of local gateway is rather high. And the identity of end user is revealed in the communication between user and local gateway. According to [9], the memory size of the local GW is up to 128 KB random access memory (RAM), 1 MB flash memory, and 160 MHz CPU. Thus, the computational cost of the local gateway should be low as soon as possible.

Since the communication between the end user and the local gateway (GW) usually adopts wireless technology, it makes the end user suffer from the different attacks due to the open wireless network. Privacy protection of the end user's identity is particularly important. To guarantee end user's privacy, two important approaches are pseudonym mechanisms and group signature technique. The pseudonymity-based approach needs to periodically change a pseudonym. The group signature-based approach results in longer length of a signature than that of original signature, and computation cost of verifying a signature is very large. These approaches are suitable for smart metering with limited resource.

Self-certified public key cryptosystem was introduced by Marc [10]. In the self-certified public key system, verification and management of certificates are not required, and the key escrow problem can also be eliminated. The main idea is that certificate of public key is replaced by a witness, and the public key is implicitly embedded in it. Anyone who holds a witness along with an attributive identity can recover the corresponding public key to verify a signature. Thus, it leads to the reduction of communication, computation, and storage amount.

Our Contributions. To construct a scheme which is suitable for the device with low communication and computation resources in smart grid and achieve privacy protection of the end user's identity, in this paper, we propose a novel self-certified PKC privacy-preserving data aggregation (SP²DA) scheme. This scheme supports the aggregation of multidimensional power usage data by converting multidimensional data into a single-dimensional data. The main works of this paper are three-fold.

• (1)

To support aggregation of multidimensional data, we adopt the Chinese Remainder Theorem to achieve the conversion of multidimensional data to single-dimensional data.

(2)

To support privacy of identity, the scheme adopts self-certified public key cryptography to achieve it. It makes the scheme have the following advantages: short length of the signature and low computation.

(3)

In the scheme, we realize that the computational cost of the local gateway is constant. It makes our scheme have more advantage over Lu et al.'s scheme [8] in terms of computational cost.

2. Communication System Model in Smart Grid

In the following, we give formal communication system model, security requirements, and our design goals.

2.1. Communication Model

The communication model, it mainly consists of operation center and local area network (LAN). Operation center is responsible for dynamically balancing power supply. In general, a trusted operation authority (OA) manages it at operation center. All residential users in a special residential area (RA) and the local gateway (GW) form an LAN. Smart appliances and smart meters form a home area network (HAN). The communication between the user and the local gateway is achieved by the communication between smart meters in an HAN and the local gateway. Smart meters transmit the collected real-time electricity usage data to the local gateway. After aggregating all electricity usage data, the local gateway reports the result to operation authority. On receiving the reports from the local gateway in the residential area RA, the OA analyzes the received reports and sends the corresponding to feedback information to the local gateway in the residential area. Then the local gateway broadcasts the feedback information to all users in the residential area. Finally, the users dynamically adjusts power consumption of smart appliance.

2.2. Security Requirements

Security protection is essential in smart grid communication. It is an important condition before deploying smart grid. In the security model, the main aim is to ensure integrity and validity of the transmitted data and the privacy of user's identity.

Here, we assume that the OA is trustable and the local gateway GW is semitrustable, and the users $\text{U}=({\text{U}}_{\mathrm{1}},{\text{U}}_{\mathrm{2}},\dots ,{\text{U}}_w)$ in the residential area are honest. Because the connection of local gateway with the users adopts wireless techniques, there may exist an adversary 𝒜 to eavesdrop the residential users' communication to obtain message. In addition, we allow the adversary 𝒜 to launch active attacks on the residential users. To resist attacks of the adversary 𝒜, we require that the communication in smart grid should satisfy the following security requirements.

• (1)

Authentication: it includes authentication of the user identity and message integrity. The user identity authentication means that the encrypted report is from a legal user. Message integrity authentication means that the transmitted data has not been altered. Any tempered data can be detected.

(2)

Private: it also includes two points. The first point indicates that the data which is sent by the residential user is private since it is encrypted and the final data is aggregated. Only the operation authority OA can recover it. The other point indicates that the identity of the residential user is privacy for the local gateway. Any one cannot obtain the relevant information to the identity of the user from the transmitted data. Even the OA cannot also obtain any relevant information to the user from the aggregated data.

2.3. Design Goal

Based on the previous communication model and security requirements, our design goal is to construct an efficient data aggregation protocol to achieve the following three objectives.

• (1)

Multidimensional data aggregation: in smart grid, the data which smart meters collect includes various types, such as the amount of the consumed power, and temperature and so on. The data in each dimension do not reflect the use of the global situation; thus, we must take into account all the dimensions in order to realize finer-grained control and optimization. At the same time, smart meters of hundred and thousand residential users periodically send the multidimensional data. To efficiently deal with the huge communication cost and multidimensional data, we need to construct an efficient aggregation scheme to support multidata aggregation.

(2)

Global security. The smart meter-generated data should be authenticated to guarantee that they are from real sources and have not been tampered with during transmission. A tampered fraudulent data must be caught by the OA.

(3)

Privacy of the residential user: if a residential user behaves honestly and follows the protocol, its identity privacy should be guaranteed against attackers who can eavesdrop communication in smart grid. It means that the identities of the residential users were not revealed during the transmission of the data. However the OA cannot also obtain the identity information of the residential users from the transmitted real-time reports.

3. Preliminaries

In the following, we first review the bilinear pairing technique [11] and the Paillier Cryptosystem [9] as well as some mathematics problems. They are the basis of the proposed SP²DA scheme. Then some security assumptions which are the basis of security proof are given.

3.1. Bilinear Map and Paillier Cryptosystem

In this subsection, we briefly review the properties of the bilinear pairings.

Let ${𝔾}_1$ ,  ${𝔾}_2$ ,  and ${𝔾}_T$ be three cyclic multiplicative groups with the prime order q. Let $g_{\mathrm{1}}$ , and $g_{\mathrm{2}}$ be the generator of groups ${𝔾}_1$ and ${𝔾}_2$ . An admissible pairing $e:$ ${𝔾}_1\times {𝔾}_2\to {𝔾}_T$ , which satisfies the following three properties:

• (i)

bilinear: if $u\in {𝔾}_{\mathrm{1}},v\in {𝔾}_{\mathrm{2}}$ and $a,b\in Z_q^{*}$ , then $e(u^a,v^b)=e(u,v{)}^{ab}$ ;

(ii)

nondegenerate: there exists a $g_{\mathrm{1}}\in {𝔾}_{\mathrm{1}},\hspace{0.17em}{g}_{\mathrm{2}}\in {𝔾}_{\mathrm{2}}$ such that $e(g_{\mathrm{1}},g_{\mathrm{2}})\ne \mathrm{1}$ ;

(iii)

computable: if $u\in {𝔾}_{\mathrm{1}},v\in {𝔾}_{\mathrm{2}}$ , one can compute $e(u,v)\in {𝔾}_T$ in polynomial time.

The modified Weil pairing and the Tate pairing are admissible maps of this kind. Please the interested readers refer to [12] for the details.

The Paillier Cryptosystem [9] is a classic homomorphic encryption. Its homomorphic property takes advantage of the homomorphic property of the exponentiation function and makes an encryption of message $m_{\mathrm{1}}+m_{\mathrm{2}}$ be obtained from any encryption of messages $m_{\mathrm{1}}$ and $m_{\mathrm{2}}$ , as $E(m_{\mathrm{1}},r_{\mathrm{1}})E(m_{\mathrm{2}},r_{\mathrm{2}})=E(m_{\mathrm{1}}+m_{\mathrm{2}},r_{\mathrm{1}}{r}_{\mathrm{2}})$ . And the security of the scheme is based on a discrete logarithm trapdoor modulo a large integer. In the following, we briefly review it.

• (1)

Key generation phase: let $N=p_{\mathrm{1}}{q}_{\mathrm{1}}$ be an RSA modulus where $p_{\mathrm{1}}$ , and $q_{\mathrm{1}}$ are two large prime numbers. Let g be an element of order at least N in the multiplicative group $Z_{N^{\mathrm{2}}}$ . Then the public key is $\text{pk}=(N,g)$ , and the corresponding private key is $(p_{\mathrm{1}},q_{\mathrm{1}})$

(2)

Encryption phase: let m be an encrypted message and $m\in Z_N$ , and randomly choose $r\in Z_N$ to compute a ciphertext $C=E(m)=g^m{r}^N\mathrm{mod}{N}^{\mathrm{2}}$ .

(3)

Decryption phase: given a ciphertext $C\in Z_{N^{\mathrm{2}}}$ , the corresponding plaintext $m=D(C)$ can be recovered by the private key $(p_{\mathrm{1}},q_{\mathrm{1}})$ . Please refer to [4] for the detailed process.

3.2. Security Assumption

Decisional Bilinear Diffie-Hellman Problem (DBDH). The DBDH problem in $({𝔾}_{\mathrm{1}}$ , ${𝔾}_{\mathrm{2}}$ , ${𝔾}_T)$ is stated as follows: given four elements

$$\begin{array}{cc}& \left(g_{\mathrm{2}},g_{\mathrm{2}}^a,g_{\mathrm{2}}^b,g_{\mathrm{2}}^c\right)\in {𝔾}_{\mathrm{2}}^{\mathrm{4}}\end{array}$$

(1)

for unknown $a,b,c\in Z_q$ , and $Z\in {𝔾}_T$ , determine whether $Z=?=e(g_{\mathrm{1}},g_{\mathrm{2}}{)}^{abc}$ .

The Weak Computational Diffie-Hellman Problem (WCDH). Let ${𝔾}_{\mathrm{1}}$ be a multiplicative cyclic group of order q;  $g_{\mathrm{1}}$ is a generator of group ${𝔾}_{\mathrm{1}}$ . $Z_q$ is a finite field. Given $k+\mathrm{1}$ values $(g_{\mathrm{1}},g_{\mathrm{1}}^a,g_{\mathrm{1}}^{a^{\mathrm{2}}},\dots ,g_{\mathrm{1}}^{a^k})$ , where k is an integer and $a\in Z_q$ , the goal of k-weak CDH problem is to compute $g_{\mathrm{1}}^{a^{-\mathrm{1}}}$ .

The k-wCDH problem is $(t,ϵ)$ -hard, if there is no PPT algorithm 𝒜 that can solve the k-wCDH problem in time at most t with probability ϵ if

$$\begin{array}{cc}& Ad{v}_{k,𝒜}=\text{Pr}\left[g_{\mathrm{1}}^{a^{-\mathrm{1}}}⟵𝒜\left(g_{\mathrm{1}},g_{\mathrm{1}}^a,\dots ,g_{\mathrm{1}}^{a^k}\right):a{\in }_R{Z}_q\right]\ge ϵ.\end{array}$$

(2)

The k-wCDH problem is a new hard problem. The hardness of the problem is based on the difficulty of solving Collusion Attack Algorithm with k traitors.

The $k+1$ Exponent Problem (EP). Let ${𝔾}_{\mathrm{1}}$ be a multiplicative cyclic group of order q; $g_{\mathrm{1}}$ is a generator of group ${𝔾}_{\mathrm{1}}$ . $Z_q$ is a finite field. Given $k+\mathrm{1}$ values $(g_{\mathrm{1}},g_{\mathrm{1}}^a,g_{\mathrm{1}}^{a^{\mathrm{2}}},\dots ,g_{\mathrm{1}}^{a^k})$ , where k is an integer and $a\in Z_q$ , its goal is to compute $g_{\mathrm{1}}^{a^{k+\mathrm{1}}}$ .

The $k+\mathrm{1}$ EP is $(t,ϵ)$ -hard, if there is no PPT algorithm 𝒜 can solve the $k+\mathrm{1}$ EP in time at most t with probability ϵ if

$$\begin{array}{cc}& Ad{v}_{k,𝒜}=\text{Pr}\left[g_{\mathrm{1}}^{a^{k+\mathrm{1}}}⟵𝒜\left(g_{\mathrm{1}},g_{\mathrm{1}}^a,\dots ,g_{\mathrm{1}}^{a^k}\right):a{\in }_R{Z}_q\right]\ge ϵ.\end{array}$$

(3)

The hardness of $k+\mathrm{1}$ exponent problem is proved that it is polynomial time equal to the k-wCDHP.

The Extended $k+1$ Exponent Problem (EP). Let ${𝔾}_{\mathrm{1}}$ and ${𝔾}_{\mathrm{2}}$ be two multiplicative cyclic groups of order q; $g_{\mathrm{2}}$ is a generator of group ${𝔾}_{\mathrm{2}}$ . $Z_q$ is a finite field, and ψ is a computable isomorphism from group ${𝔾}_{\mathrm{2}}$ onto group ${𝔾}_{\mathrm{1}}$ such that $\psi (g_{\mathrm{2}})=g_{\mathrm{1}}$ . Given $k+\mathrm{1}$ values $(g_{\mathrm{2}},g_{\mathrm{2}}^a,g_{\mathrm{2}}^{a^{\mathrm{2}}},\dots ,g_{\mathrm{2}}^{a^k})$ and an isomorphism map ψ, where k is an integer and $a\in Z_q$ , its goal is to compute $g_{\mathrm{1}}^{a^{k+\mathrm{1}}}$ .

The extended $k+\mathrm{1}$ EP is $(t,ϵ)$ -hard, if there is no PPT algorithm 𝒜 that can solve the extended $k+\mathrm{1}$ EP in time at most t with probability ϵ if

$$\begin{array}{l}Ad{v}_{k,𝒜}=\text{Pr}[g_{\mathrm{1}}^{a^{k+\mathrm{1}}}⟵𝒜\left(g_{\mathrm{2}},g_{\mathrm{2}}^a,\dots ,g_{\mathrm{2}}^{a^k},g_{\mathrm{1}}=\psi \left(g_{\mathrm{2}}\right)\right)\\ \hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}\phantom{211}:a{\in }_R{Z}_q,\psi \left(·\right)\phantom{g_{\mathrm{1}}^{a^{k+\mathrm{1}}}}]\ge ϵ\end{array}$$

(4)

Chinese Remainder Theorem [13]. Suppose $n_{\mathrm{1}},n_{\mathrm{2}},\dots ,n_k$ are positive integers which are pairwise coprime. Then, for any given sequence of integers $a_{\mathrm{1}},a_{\mathrm{2}},\dots ,a_k$ , there exists an integer x solving the following system of simultaneous congruences:

$$\begin{array}{cc}& x\equiv a_{\mathrm{1}}\hspace{0.17em}\mathrm{mod}\hspace{0.17em}{n}_{\mathrm{1}},\\ x\equiv a_{\mathrm{2}}\hspace{0.17em}\mathrm{mod}\hspace{0.17em}{n}_{\mathrm{2}},\\ ⋮\\ x\equiv a_k\hspace{0.17em}\mathrm{mod}\hspace{0.17em}{n}_k.\end{array}$$

(5)

Let the product $N=n_{\mathrm{1}}{n}_{\mathrm{2}}\cdots n_k$ be defined. Then a solution x can be found as follows: For each i, the integers $n_i$ and $N/n_i$ are coprime. Using the extended Euclidean algorithm we can find integers $r_i$ and $s_i$ such that $r_i{n}_i+s_{i}N/n_i=\mathrm{1}$ . Let $y_i=s_{i}N/n_i$ . Then a solution x is solved as follows:

$$\begin{array}{cc}& x={\sum }_{i=\mathrm{1}}^k‍a_i{y}_i\hspace{0.17em}\mathrm{mod}\hspace{0.17em}N.\end{array}$$

(6)

4. Our Anonymous Self-Certified Signature Scheme

In this section, we will give a novel self-certified anonymous signature scheme which is the basis to achieve the anonymity of the residential user's identity in our SP²DA scheme.

4.1. System Setup

Let ${𝔾}_{\mathrm{1}}$ , ${𝔾}_{\mathrm{2}}$ , and ${𝔾}_T$ are three cyclic groups with the same prime order p. $e:{𝔾}_{\mathrm{1}}\times {𝔾}_{\mathrm{2}}\to {𝔾}_T$ is a pairing map. $g_{\mathrm{2}}$ is a generator of group ${𝔾}_{\mathrm{2}}$ . $\psi :{𝔾}_{\mathrm{2}}\to {𝔾}_{\mathrm{1}}$ is an isomorphism map. The TTP chooses two hash functions $H_{\mathrm{1}}:\{\mathrm{0,1}{\}}^{*}\to {𝔾}_{\mathrm{1}}$ and $H_{\mathrm{2}}:\{\mathrm{0,1}{\}}^{*}\to Z_p$ . Then it randomly chooses $\alpha \in Z_p$ as his private key $\text{msk}=\alpha$ and computes the corresponding public key $\text{mpk}=g_{\mathrm{2}}^a$ . Finally, the system parameters are published as follows:

$$\begin{array}{cc}& \left({𝔾}_{\mathrm{1}},{𝔾}_{\mathrm{2}},{𝔾}_T,g_{\mathrm{2}},\psi ,p,e,H_{\mathrm{1}},H_{\mathrm{2}},\text{mpk}\right).\end{array}$$

(7)

4.2. KeyGen

For a user with identity ID, it first randomly selects $x\in Z_p$ to compute $\text{pk}=e(g_{\mathrm{1}},g_{\mathrm{2}}{)}^x$ . Then the public-private key pair is $(\text{pk},x)$ .

4.3. WitReg

When a user with identity ID wants to register, it computes a proof of zero-knowledge π of its private key $\text{PK}\{x\mid v=g_{\mathrm{2}}^{\alpha x}\}$ and sends $(\text{ID},\text{pk},v,\pi )$ to the TTP.

The TTP first checks whether $e(g_{\mathrm{1}},v)\stackrel{?}{=}\text{p}{\text{k}}^{\alpha }$ and π is valid. If they hold, then it produces the following witness

$$\begin{array}{cc}& W={\left(v^{\mathrm{1}/\alpha }{H}_{\mathrm{1}}\left(\text{ID}\right)\right)}^{\mathrm{1}/\alpha }\end{array}$$

(8)

and sends it to the user. Then the user's private key is $(W,x)$ .

4.4. Anonymous Signing

To produce a signature on message m, the user with identity ID computes as follows.

• (1)

First, it randomly chooses a number $l\in Z_p$ to compute $\widehat{W}=\psi (W{)}^l$ and $\widehat{R}=\psi (H_{\mathrm{1}}(\text{ID}){)}^l$ in order to conceal the witness $\widehat{W}$ of the user and his identity “ID”.

(2)

Then randomly choose $r\in Z_p$ to compute

$$\begin{array}{cc}& \widehat{u}={\left(g_{\mathrm{1}}\right)}^r,\hspace{1em}\hspace{1em}\widehat{t}=\frac{\mathrm{1}-r{H}_{\mathrm{2}}\left(m\parallel {\widehat{u}}_{\hspace{0.17em}}\parallel \widehat{R}\parallel \widehat{W}\right)\mathrm{\hspace{0.17em}\hspace{0.17em}}}{lx}.\end{array}$$

(9)

(3)

Finally, the resultant anonymous signature on message m is $\sigma =(\widehat{W},\widehat{R},\widehat{u},\widehat{t})$ .

4.5. Verifying

After receiving a signature σ on message m, a verifier can execute the following process for each signature.

• (1)

Firstly, the verifier parses σ into $(\widehat{W},\widehat{R},\widehat{u},\widehat{t})$ and computes $h_{\mathrm{2}}=H_{\mathrm{2}}(m\parallel \widehat{u}\parallel \widehat{R}\parallel \widehat{W})$ .

(2)

Then it checks

$$\begin{array}{cc}& e\left({\widehat{W}}^{\widehat{t}},\text{mpk}\right)e\left({\widehat{u}}^{h_{\mathrm{2}}}{\widehat{R}}^{-\widehat{t}},g_{\mathrm{2}}\right)=e\left(g_{\mathrm{1}},g_{\mathrm{2}}\right).\end{array}$$

(10)

4.6. Security Analysis

In the following, we show that the previously mentioned anonymous self-certified signature scheme is secure against existential universal forgery under adaptive chosen message attack.

Lemma 1.

If there exists an adversary 𝒜 can forge the previous anonymous signature on a message m, then the $k+\mathrm{1}$ EP problem can be solved in the polynomial time.

Proof.

Here, we will show that if an adversary 𝒜 could forge a valid message signature in our scheme, then there exists another adversary ℬ that can solve the $k+\mathrm{1}$ -EP instance $(\widehat{h},h,h^a,h^{a^{\mathrm{2}}},h^{a^{\mathrm{3}}})$ in groups ${𝔾}_{\mathrm{1}}$ and ${𝔾}_{\mathrm{2}}$ . Let us recall the $k+\mathrm{1}$ EP problem; given $h\in {𝔾}_{\mathrm{2}}$ , $\widehat{h}\in {𝔾}_{\mathrm{1}}$ and k distinct elements $(h,h^a,h^{a^{\mathrm{2}}},\dots ,h^{a^k})\in {𝔾}_{\mathrm{2}}$ where $a\in Z_q$ , its goal is to output ${\widehat{h}}^{a^{k+\mathrm{1}}}\in {𝔾}_{\mathrm{1}}$ . In the following, we will give the detailed process.

To answer the different queries from the adversary 𝒜, we need to run ℬ to set up the system parameters. Let ${𝔾}_{\mathrm{1}}$ , ${𝔾}_{\mathrm{2}}$ , and ${𝔾}_T$ be three cyclic groups with order q. $e:{𝔾}_{\mathrm{1}}\times {𝔾}_{\mathrm{2}}\to {𝔾}_T$ is a bilinear pairing map. ℬ sets $g_{\mathrm{2}}=h^a$ as the generator of group ${𝔾}_{\mathrm{2}}$ and $\text{MPK}=h$ as the master public key of the TTP, where the master private key $\alpha =a^{-\mathrm{1}}$ of TTP is unknown. Let ψ be a computable isomorphism from group ${𝔾}_{\mathrm{2}}$ to ${𝔾}_{\mathrm{1}}$ such that $\psi (g_{\mathrm{2}})=g_{\mathrm{1}}$ . $H_{\mathrm{1}}:\{\mathrm{0,1}{\}}^{*}\to {𝔾}_{\mathrm{2}}$ and $H_{\mathrm{2}}:{𝔾}_{\mathrm{1}}^{\mathrm{5}}\to Z_q$ are two hash functions. Finally, ℬ sends the system parameters $\text{Para}=({𝔾}_{\mathrm{1}},{𝔾}_{\mathrm{2}},e,H_{\mathrm{1}},H_{\mathrm{2}},\text{MPK},g_{\mathrm{2}},\psi (·))$ to the attacker 𝒜.

$H_{\mathrm{1}}$ -Oracle. when an adversary 𝒜 makes a query with message $\text{I}{\text{D}}_i$ , ℬ outputs $H_{\mathrm{1}i}=H_{\mathrm{1}}(\text{I}{\text{D}}_i)$ if $\text{I}{\text{D}}_i$ appears in the list $L_{\mathrm{1}}$ which is initially empty. Otherwise, ℬ tosses a coin with the probability $\text{Pr}[\text{coi}{\text{n}}_i=\mathrm{1}]=\zeta$ and randomly chooses $b_i{\in }_R{Z}_q$ to answer the following query.

• (1)

If $\text{coi}{\text{n}}_i=\mathrm{0}$ , then ℬ sets $h_{\mathrm{1}i}=H_{\mathrm{1}}(\text{I}{\text{D}}_i)=h^{a{b}_i}$ .

(2)

If $\text{coi}{\text{n}}_i=\mathrm{1}$ , then ℬ sets $h_{\mathrm{1}i}=H_{\mathrm{1}}(\text{I}{\text{D}}_i)=h^{a^{\mathrm{3}}{b}_i}$ .

Finally, ℬ returns $h_{\mathrm{1}i}$ to the adversary 𝒜 and adds $(\text{I}{\text{D}}_i,b_i,\text{coi}{\text{n}}_i,h_{\mathrm{1}i})$ in the $L_{\mathrm{1}}$ -list.

$H_{\mathrm{2}}$ -Oracle: when an adversary makes a query with string $S_i$ , ℬ outputs $h_{\mathrm{2}i}=H_{\mathrm{2}}(S_i)$ if $S_i$ is in the list $L_{\mathrm{2}}$ which is initially empty. Otherwise, ℬ randomly chooses $c_i\in Z_q$ to set $c_i=H_{\mathrm{2}}(S_i)$ and returns $c_i$ to the adversary; then it adds $(S_i,c_i)$ to the $L_{\mathrm{2}}$ -list.

Corruption Oracle. When 𝒜 makes a corruption query with identity $\text{I}{\text{D}}_i$ . If $\text{I}{\text{D}}_i$ exists in the list $L_c$ which is initially empty, then ℬ outputs $x_i$ . Otherwise, ℬ randomly chooses $x_i\in Z_q$ to return to 𝒜 and adds $(\text{I}{\text{D}}_i,x_i)$ to the list $L_c$ .

WitReg Oracle. 𝒜 issues a witness register query on input $(\text{I}{\text{D}}_i,\text{p}{\text{k}}_i,v_i)$ , and ℬ outputs a $W_i^{\prime }$ if $\text{I}{\text{D}}_i$ is in the List $L_r$ which is initially empty. Otherwise, ℬ searches the private key $x_i$ in the list $L_c$ and $b_i$ in the list $L_{\mathrm{1}}$ , respectively, and returns the corresponding $x_i$ and $b_i$ . If $\text{coi}{\text{n}}_i=\mathrm{0}$ , then ℬ computes the following witness:

$$\begin{array}{c}{W}_i^{\prime }=h^{a^{\mathrm{2}}\left(x_i+bi\right)}={\left({\left(g_{\mathrm{2}}^{x_i·\alpha }\right)}^{{\alpha }^{-\mathrm{1}}}{h}^{a{b}_i}\right)}^{\mathrm{1}/\alpha }\\ ={\left(v_i^{\mathrm{1}/\alpha }{H}_{\mathrm{1}}\left(\text{I}{\text{D}}_i\right)\right)}^{\mathrm{1}/\alpha },\end{array}$$

(11)

where $\alpha =a^{-\mathrm{1}}$ . Then, ℬ returns $W_i^{\prime }$ to the adversary 𝒜 and adds $(\text{I}{\text{D}}_i,\text{p}{\text{k}}_i,v_i,W_i^{\prime })$ in the list $L_r$ . If $\text{coi}{\text{n}}_i=\mathrm{1}$ , then ℬ claims failure and aborts the simulation.

Anonymous signing oracle. When the adversary 𝒜 issues an anonymous signature query with $(m_i,\text{I}{\text{D}}_i)$ . If $\text{I}{\text{D}}_i$ exists in the lists $L_r$ and $L_c$ , then ℬ retrieves the corresponding $x_i$ and $W_i^{\prime }$ and runs anonymous signing algorithm to produce a signature δ. Otherwise, ℬ executes as follows.

• (1)

ℬ firstly retrieves $h_{\mathrm{1}i}=H_{\mathrm{1}}(\text{I}{\text{D}}_i)$ from the $L_{\mathrm{1}}$ -list. Note we assume that $\text{I}{\text{D}}_i$ is queried for $H_{\mathrm{1}}$ -Oracle before other oracles were queried with $\text{I}{\text{D}}_i$ .

(2)

Then, ℬ randomly picks $d\in Z_q$ to set $R=h_{\mathrm{1}i}^d$ .

(3)

And ℬ randomly selects $e,f\in Z_q$ to compute $W=h^{e^{-\mathrm{1}}f{a}^{\mathrm{2}}}$ and sets $t=e$ .

(4)

ℬ picks at random to compute $u=(h^{(f-\mathrm{1})a}{h}_{\mathrm{1}i}^{-dt}{)}^{k^{-\mathrm{1}}}$ .

(5)

ℬ checks whether string $m_i\parallel u\parallel R\parallel W$ exists in the $L_{\mathrm{2}}$ -list. If it exists, ℬ outputs Fail and aborts it. Otherwise, it sets $k=H_{\mathrm{2}}(m_i\parallel u\parallel R\parallel W)$ .

(6)

Finally, the resultant signature $\delta =(u,R,W,t)$ is returned to 𝒜.

Forgery. Eventually, 𝒜 outputs a forgery ${\delta }^{*}=(u^{*},R^{*},W^{*},t^{*})$ on message $m^{*}$ under the identity $\text{I}{\text{D}}^{*}$ . 𝒜 wins the game if and only if the following conditions hold.

• (1)

${\delta }^{*}=(u^{*},R^{*},W^{*},t^{*})$ is a valid signature.

(2)

$(m^{*},\text{I}{\text{D}}^{*})$ is never an input of anonymous authentication oracle.

(3)

$\text{I}{\text{D}}^{*}$ is not an input of vehicle register oracle.

(4)

The corresponding $\text{coi}{\text{n}}_{i^{*}}$ with $\text{I}{\text{D}}^{*}$ is equal to 1 in the $L_{\mathrm{1}}$ -list.

(5)

The corresponding $x^{*}$ with $\text{I}{\text{D}}^{*}$ exists in the $L_c$ -list.

According to the forking lemma [14], ℬ makes a replay with the same random tap but different choice of $H_{\mathrm{2}}$ ; then it outputs another valid signature ${\delta }^{*}=(u^{\text{'}*},R^{\text{'}*},W^{\text{'}*},t^{\text{'}*})$ on the same message $m^{*}$ , where $u^{\text{'}*}=u^{*}$ , $R^{*}=R^{\text{'}*}$ , and $W^{*}=W^{\text{'}*}$ . We assume that $b^{*}$ is in the $L_{\mathrm{1}}$ -list. Then we have

$$\begin{array}{cc}& e\left({W^{*}}^{t^{*}},\text{MPK}\right)e\left({u^{*}}^{h_{\mathrm{2}}^{*}}{R^{*}}^{-t^{*}},g_{\mathrm{2}}\right)=e\left(g_{\mathrm{1}},g_{\mathrm{2}}\right)\\ e\left({{W^{\prime }}^{*}}^{{t^{\prime }}^{*}},\text{MPK}\right)e\left({{u^{\prime }}^{*}}^{{h^{\prime }}_{\mathrm{2}}^{*}}{R^{*}}^{-{t^{\prime }}^{*}},g_{\mathrm{2}}\right)=e\left(g_{\mathrm{1}},g_{\mathrm{2}}\right),\end{array}$$

(12)

where $h_{\mathrm{2}}^{*}=H_{\mathrm{2}}(m^{*},u^{*},R^{*},W^{*})$ and $h_{\mathrm{2}}^{*}=H_{\mathrm{2}}(m^{\text{'}*},u^{\text{'}*},R^{\text{'}*},W^{\text{'}*})$ .

Thus, we have

$$\begin{array}{l}e\left({W^{*}}^{{h^{\prime }}_{\mathrm{2}}^{*}{t}^{*}-h_{\mathrm{2}}^{*}{t^{\prime }}^{*}},\text{MPK}\right)e\left({R^{*}}^{-t^{*}{h^{\prime }}_{\mathrm{2}}^{*}+{t^{\prime }}^{*}{h}_{\mathrm{2}}^{*}},g_{\mathrm{2}}\right)\\ \hspace{1em}\hspace{1em}=e\left(g_{\mathrm{1}}^{{h^{\prime }}_{\mathrm{2}}^{*}-h_{\mathrm{2}}^{*}},g_{\mathrm{2}}\right)\\ \hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}\Updownarrow \\ h^{a^{\mathrm{4}}}={\left(\frac{{{W^{\prime }}^{*}}^{{h^{\prime }}_{\mathrm{2}}^{*}{t}^{*}-h_{\mathrm{2}}^{*}{t^{\prime }}^{*}}}{\psi {\left(h^{a^{\mathrm{2}}}\right)}^{{h^{\prime }}_{\mathrm{2}}^{*}-h_{\mathrm{2}}^{*}}}\right)}^{x^{*}/\left(b^{*}\left({h^{\prime }}_{\mathrm{2}}^{*}-h_{\mathrm{2}}^{*}\right)\right)},\end{array}$$

(13)

where $t^{*}{h}_{\mathrm{2}}^{\text{'}*}-t^{\text{'}*}{h}_{\mathrm{2}}^{*}=(h_{\mathrm{2}}^{\text{'}*}-h_{\mathrm{2}}^{*})/l{x}^{*}$ and l is an unknown number which is a blinded factor in the signing phase, namely, $R^{*}=H_{\mathrm{1}}(\text{I}{\text{D}}^{*}{)}^l$ .

Lemma 2.

Our signature satisfies anonymity of signer's identity.

Proof.

Given a signature $\sigma =(\widehat{W},\widehat{R},\widehat{u},\widehat{t})$ on message m, we cannot obtain any information of the signer. According to the previous signature scheme, we know that $(W,H_{\mathrm{1}}(\text{ID}))$ are the relevant identity information of the signer. However, in our signature, W and $H_{\mathrm{1}}(\text{ID})$ are blinded by a random number l. Thus, it is impossible to obtain any information of $H_{\mathrm{1}}(\text{ID})$ and W from $(\widehat{W},\widehat{R})$ of the signature $\sigma =(\widehat{W},\widehat{R},\widehat{u},\widehat{t})$ . Furthermore, W is an unknown number in terms of the attacker; it cannot obtain the relation of $e(\widehat{W},H_{\mathrm{1}}(\text{ID}))$ and $e(W,\widehat{R})$ . For $\widehat{u}$ in the signature σ, it does not reveal any information of the signer. For $\widehat{t}$ in the signature σ, it is expressed as the following form:

$$\begin{array}{cc}& \widehat{t}=\frac{\mathrm{1}-r{H}_{\mathrm{2}}\left(m\parallel {\widehat{u}}_{\hspace{0.17em}}\parallel \widehat{R}\parallel \widehat{W}\right)}{lx}.\end{array}$$

(14)

Although the private key x of the signer is included, x is randomized by two random numbers l, and r. Thus, t has not also reveal any information of the signer's identity. According to the previous statement, any one cannot obtain the identity of the signer from a signature. Therefore, our scheme achieves anonymity.

5. Our Privacy-Preserving Data Aggregation Scheme

In the following, we will put forth a novel privacy-presrving aggregation scheme in smart by utilizing the proposed self-certified anonymous signature scheme. Three types of entities, That is, the trusted operation authority (OA), a local gateway (GW), and the residential users (U), are involved in the scheme. It mainly consists of the following six phases: system initialization, GW register, user register, user report generation phase, privacy-preserving report aggregation phase, secure report reading, and response phase.

5.1. System Initialization

The trusted operation authority (OA) set up the system as follows. Let ${𝔾}_{\mathrm{1}}$ , ${𝔾}_{\mathrm{2}}$ , and ${𝔾}_T$ be three multiplicative cyclic groups of the same big prime order q. $g_{\mathrm{2}}\in {𝔾}_{\mathrm{2}}$ is a generator of group ${𝔾}_{\mathrm{2}}$ . ψ is a computable isomorphism from group ${𝔾}_{\mathrm{2}}$ onto group ${𝔾}_{\mathrm{1}}$ such that $\psi (g_{\mathrm{2}})=g_{\mathrm{1}}$ . $e:{𝔾}_{\mathrm{1}}\times {𝔾}_{\mathrm{2}}\to {𝔾}_T$ is a bilinear map. The trusted operation authority (OA) randomly chooses $\alpha ,{\alpha }_{\mathrm{0}}\in Z_q^{*}$ as master key; then the corresponding public keys $\text{MPK}=g_{\mathrm{2}}^{\alpha }$ and $\text{MP}{\text{K}}_{\mathrm{0}}=g_{\mathrm{2}}^{{\alpha }_{\mathrm{0}}}$ are computed. $P_{\mathrm{1}}$ is a random element of group ${𝔾}_{\mathrm{1}}$ . And it chooses three collision-resistant hash functions $H:\{\mathrm{0,1}{\}}^{*}\to {\text{G}}_{\mathrm{1}}$ , $H_{\mathrm{1}}:\{\mathrm{0,1}{\}}^{*}\to {\text{G}}_{\mathrm{1}}$ , and $H_{\mathrm{2}}:\{\mathrm{0,1}{\}}^{*}\to Z_q$ .

In addition, OA initializes Paillier cryptosystem. Therefore, it chooses two large primes $p_{\mathrm{1}}$ , and $q_{\mathrm{1}}$ with equal length, then it computes RSA modulus $n=p_{\mathrm{1}}{q}_{\mathrm{1}}$ and $\lambda =\text{lcm}(p_{\mathrm{1}}-\mathrm{1},q_{\mathrm{1}}-\mathrm{1})$ . Define a function $L(x)=(x-\mathrm{1})/n$ and choose a generator $g\in Z_{n^{\mathrm{2}}}$ . OA computes $\mu =(L(g^{\lambda \mathrm{mod}{n}^{\mathrm{2}}}){)}^{-\mathrm{1}}\mathrm{mod}n$ . At the same time, we assume that the number of households in a residential area is at most w and l denotes the number of the different type of reported electricity usage data $(d_{\mathrm{1}},\dots ,d_l)$ in smart grid, where $T_i$ is less than a constant d. Then, OA chooses l coprime number $(n_{\mathrm{1}},\dots ,n_l)$ . Let $A(a_{\mathrm{1}},\dots ,a_l)={\sum }_{j=\mathrm{1}}^l‍a_j{y}_j$ and ${\sum }_{j=\mathrm{1}}^w‍d_{ji}\le n_i$ and $w·d·{\sum }_{j=\mathrm{1}}^l‍y_j<n$ , where $y_i$ is derived by the previous Chinese Remainder Theorem and $d_{ji}$ denotes the ith electricity usage data of the user j. After that, for $i=\mathrm{1}$ to l, OA computes ${\widehat{g}}_i=g^{y_i}$ .

Finally, OA publishes the system parameters

$$\begin{array}{l}\text{params}=(q,{𝔾}_{\mathrm{1}},{𝔾}_{\mathrm{2}},{𝔾}_T,e,g_{\mathrm{2}},\psi ,\text{MPK},\\ \hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}\phantom{2}\hspace{0.17em}\text{MP}{\text{K}}_{\mathrm{0}},H,H_{\mathrm{1}},H_{\mathrm{2}},{\widehat{g}}_{\mathrm{1}},\dots ,{\widehat{g}}_l)\end{array}$$

(15)

and keeps the master keys $(\lambda ,\mu ,n_{\mathrm{1}},\dots ,n_l,\alpha )$ .

5.2. GW Registration

When a local gateway (GW) of the residential area wants to register itself in the system, it randomly chooses a number $x_G$ as the private key and computes the corresponding public key $Y_G=g_{\mathrm{1}}^{x_G}$ .

5.3. User Registration

When a user ${\text{U}}_i$ of residential area wants to join this system, the user ${\text{U}}_i$ with real identity $\text{I}{\text{D}}_{\text{U}}$ must interactively communicate with OA by a confidential channel by the following steps.

• (1)

The user ${\text{U}}_i$ with identity $\text{I}{\text{D}}_i$ first chooses a $x_{ui}\in Z_q$ as his private key $s{k}_{ui}$ and computes the corresponding public key $\text{p}{\text{k}}_{ui}=e(g_{\mathrm{1}},g_{\mathrm{2}}{)}^{x_{ui}}$ .

(2)

Then it computes a zero-knowledge proof $\text{ZK}{\text{P}}_{\mathrm{0}}$ of private key $V=g_{\mathrm{2}}^{\alpha x_{ui}}$ and sends $(\text{I}{\text{D}}_i,V,\text{p}{\text{k}}_{ui},\text{ZK}{\text{P}}_{\mathrm{0}})$ to OA.

(3)

The OA verifies the validity of $e(V,g)=\text{p}{\text{k}}_{ui}^{\alpha }$ and the zero-knowledge proof $\text{ZK}{\text{P}}_{\mathrm{0}}$ . If they hold, then the OA computes

$$\begin{array}{cc}& W_{ui}^{\prime }={\left(V^{\mathrm{1}/\alpha }{H}_{\mathrm{1}}\left(\text{I}{\text{D}}_i\right)\right)}^{\mathrm{1}/\alpha },\hspace{1em}\hspace{1em}\text{p}{\text{r}}_i=H_{\mathrm{1}}{\left(\text{I}{\text{D}}_i\right)}^{{\alpha }_{\mathrm{0}}}·P_{\mathrm{1}}^{\alpha }\end{array}$$

(16)

and returns $(W_{ui}^{\prime },p{r}_i)$ to the resident user i and keeps $(\text{I}{\text{D}}_i,W_{ui}^{\prime })$ in the database.

(4)

Upon receiving $(\text{I}{\text{D}}_i,W_{ui}^{\prime })$ , the user first checks whether it is valid by the following equation:

$$\begin{array}{cc}& e\left(\psi \left(W_{ui}^{\prime }\right),\text{MPK}\right)e\left(\psi \left(H_{\mathrm{1}}{\left(\text{I}{\text{D}}_i\right)}^{-\mathrm{1}}\right),g_{\mathrm{2}}\right)=\text{p}{\text{k}}_{ui}.\end{array}$$

(17)

If it is valid, then $(\text{I}{\text{D}}_i,W_{ui}^{\prime })$ is the membership certificate of the user ${\text{U}}_i$ , and it is added into the local database.

5.4. User Report Generation

To periodically report electricity usage data of the residential user, each user ${\text{U}}_i$ collects l types of data $(d_{i\mathrm{1}},\dots ,d_{il})$ by using the smart meters to execute the following steps.

• (1)

Randomly choose $k_i\in Z_n$ to compute the Paillier encryption

$$\begin{array}{cc}& C_i={\widehat{g}}_{\mathrm{1}}^{d_{i\mathrm{1}}}·{\widehat{g}}_{\mathrm{2}}^{d_{i\mathrm{2}}}\cdots {\widehat{g}}_l^{d_{il}}·k_i^n\hspace{0.17em}\mathrm{mod}\hspace{0.17em}{n}^{\mathrm{2}}.\end{array}$$

(18)

(2)

Then, it randomly chooses $l_i\in Z_q$ to compute $W_i=\psi (W_{ui}^{\prime }{)}^{l_i}$ and $R_i=\psi (H_{\mathrm{1}}(\text{I}{\text{D}}_{u_i}){)}^{l_{ui}}$ in order to conceal the certificate $W_{ui}^{\prime }$ and his identity $\text{I}{\text{D}}_i$ of the residential user ${\text{U}}_i$ .

(3)

And randomly choose $r_i\in Z_q$ to compute

$$\begin{array}{cc}& u_i={\left(g_{\mathrm{1}}\right)}^{r_i},\hspace{1em}\hspace{1em}{t}_i=\frac{\mathrm{1}-r_i{H}_{\mathrm{2}}\left(C_i\parallel u_i\parallel R_i\parallel W_i{T}_i\right)}{l_i{x}_{ui}},\end{array}$$

(19)

where $T_i$ is a timestamp.

(4)

The resultant anonymous signature on message m is ${\sigma }_i=(W_i,R_i,u_i,t_i)$ .

(5)

Finally, the encrypted electricity usage data $C_i\mid \mid T_i\mid \mid {\sigma }_i\mid \mid \text{RA}$ is reported to be the local gateway GW in the residential area RA. Note that the reported electricity usage data of the user ${\text{U}}_i$ do not reveal any information of the user's identity.

5.5. Privacy-Preserving Report Verification and Aggregation of GW

After receiving all electricity usage data $C_i\parallel T_i\parallel {\sigma }_i\parallel \text{RA}$ , $i=\mathrm{1,2},\dots ,w$ from RA, the local gateway GW first checks whether $T_i$ belongs to a valid time slots, then it verifies the validity of signature ${\sigma }_i$ , $(i=\mathrm{1,2},\dots ,w)$ by the following processes.

• (1)

Firstly, GW parses ${\sigma }_i$ into $(W_i,R_i,u_i,t_i)$ and computes $h_{\mathrm{2}}=H_{\mathrm{2}}(C_i\parallel u_i\parallel R_i\parallel W_i)$ .

(2)

Then check

$$\begin{array}{cc}& e\left(W_i^{t_i},\text{MPK}\right)e\left(u_i^{h_{\mathrm{2}}}{R}_i^{-t_i},g_{\mathrm{2}}\right)=e\left(g_{\mathrm{1}},g_{\mathrm{2}}\right).\end{array}$$

(20)

To increase efficiency of verifying signatures, the local gateway GW can make use of the following batch verification:

$$\begin{array}{cc}& e\left(\prod _{i=\mathrm{1}}^w{W}_i^{t_i},\text{MPK}\right)e\left(\prod _{i=\mathrm{1}}^w{u}_i^{{\widehat{h}}_{\mathrm{2}i}}{R}_i^{-t_i},g_{\mathrm{2}}\right)=e{\left(g_{\mathrm{1}},g_{\mathrm{2}}\right)}^w,\end{array}$$

(21)

where ${\widehat{h}}_{\mathrm{2}i}=H_{\mathrm{2}}(C_i\parallel u_i\parallel R_i\parallel W_i),i=\mathrm{1,2},\dots ,w$ .

We can find that the computation overhead in the batch verification is approximate to that in the verification of a signature. It only needs three pairing operations which are the most time-consuming operators.

After all previously mentioned verifying is valid, the gateway GW performs the following aggregation process to aggregate all electricity usage reports.

• (1)

It aggregates all encrypted data $C_{\mathrm{1}},C_{\mathrm{2}},\dots ,C_w$ into C by computing

$$\begin{array}{l}C=\prod _{i=\mathrm{1}}^w{C}_i\mathrm{mod}{n}^{\mathrm{2}}={\widehat{g}}_{\mathrm{1}}^{{\sum }_{i=\mathrm{1}}^w‍d_{i\mathrm{1}}}\\ \hspace{1em}\hspace{1em}·{\widehat{g}}_{\mathrm{2}}^{{\sum }_{i=\mathrm{1}}^w‍d_{i\mathrm{2}}}\cdots {\widehat{g}}_l^{{\sum }_{i=\mathrm{1}}^w‍d_{il}}·{\left(\prod _{i=\mathrm{1}}^w{k}_i\right)}^n.\end{array}$$

(22)

(2)

Then, it produces a BLS signature ${\sigma }_G$ by his private key $x_G$ :

$$\begin{array}{cc}& {\sigma }_G=H{\left(C\parallel \text{RA}\parallel \text{GW}\parallel T_G\right)}^{x_G},\end{array}$$

(23)

where $T_G$ denotes a timestamp.

(3)

Finally, send the aggregated data $C\parallel \text{RA}\parallel \text{GW}\parallel T_G\parallel {\sigma }_G$ to the operation authority OA.

5.6. Secure Report Reading and Response

After receiving an aggregated σ on message C, the authority operation OA first checks whether the signature ${\sigma }_G$ is valid by the equation $e(P,{\sigma }_G)=e(Y_G,H(C\parallel \text{RA}\parallel \text{GW}\parallel T_G))$ . Then it decrypts the aggregated and encrypted electricity usage report C by the Paillier decryption algorithm.

Since

$$\begin{array}{c}C=\prod _{i=\mathrm{1}}^w{C}_i\mathrm{mod}{n}^{\mathrm{2}}\\ \hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}={\widehat{g}}_{\mathrm{1}}^{{\sum }_{i=\mathrm{1}}^w‍d_{i\mathrm{1}}}·{\widehat{g}}_{\mathrm{2}}^{{\sum }_{i=\mathrm{1}}^w‍d_{i\mathrm{2}}}\cdots {\widehat{g}}_l^{{\sum }_{i=\mathrm{1}}^w‍d_{il}}·{\left(\prod _{i=\mathrm{1}}^w{k}_i\right)}^n\\ \hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}=g^{y_{\mathrm{1}}{\sum }_{i=\mathrm{1}}^w‍d_{i\mathrm{1}}}\cdots g^{y_l{\sum }_{i=\mathrm{1}}^w‍d_{l\mathrm{1}}}·{\left(\prod _{i=\mathrm{1}}^w{k}_i\right)}^n.\end{array}$$

(24)

then the recovered message is $M=y_{\mathrm{1}}{\sum }_{i=\mathrm{1}}^w‍d_{i\mathrm{1}}+y_{\mathrm{2}}{\sum }_{i=\mathrm{1}}^w‍d_{i\mathrm{2}}+\cdots +y_l{\sum }_{i=\mathrm{1}}^w‍d_{il}$ .

By the Chinese Remainder Theorem, we can obtain the electricity usage data as follows:

for $i=\mathrm{1}$ to l

compute $D_i=M\mathrm{mod}{n}_i={\sum }_{i=\mathrm{1}}^w‍d_{i\mathrm{1}}\mathrm{mod}{n}_i$ .

All derived electricity usage data $(D_{\mathrm{1}},D_{\mathrm{2}},\dots ,D_l)$ are the aggregation of w residential user's electricity usage. After analyzing these data, the OA sends the feedback data $m\in {𝔾}_T$ to notify all residential users in residential area RA for adjusting the usage of electricity quantity. The process is done as follows.

• (1)

It randomly chooses $r\in Z_q$ to compute $\stackrel{-}{\text{U}}=g_{\mathrm{2}}^r$ and $\stackrel{-}{V}=\text{MP}{\text{K}}_{\mathrm{0}}^r$ .

(2)

And it computes $\stackrel{-}{Z}=m·H(e(P_{\mathrm{1}},\text{MPK}{)}^r)$ .

(3)

The resultant cipher is $\stackrel{-}{C}=(\stackrel{-}{\text{U}},\stackrel{-}{V},\stackrel{-}{Z})$ . In fact, it is a broadcast encryption from Step 1 to Step 3.

(4)

Then the OA produces a BLS signature $\stackrel{-}{\sigma }=H(\stackrel{-}{C}\parallel \text{RA}\parallel \text{OA}\parallel \stackrel{-}{T}{)}^{\alpha }$ where $\stackrel{-}{T}$ is a timestamp and feedback $\stackrel{-}{C}\parallel \stackrel{-}{\sigma }$ to the local gateway GW in the residential area.

(5)

Upon receiving the transmitted $\stackrel{-}{C}\parallel \stackrel{-}{\sigma }$ , the GW can check whether it is valid by the following equation

$$\begin{array}{cc}& e\left(\stackrel{-}{\sigma },g_{\mathrm{2}}\right)=e\left(H\left(\stackrel{-}{C}\parallel \text{RA}\parallel \text{OA}\parallel \stackrel{-}{T}\right),\text{MPK}\right).\end{array}$$

(25)

If is holds, then it broadcasts $\stackrel{-}{C}$ to all residential users in the residential area RA.

(6)

After receiving the broadcasted $\stackrel{-}{C}$ , each residential user ${\text{U}}_i$ can decrypt as follows.

• (a)

  It computes

  $$\begin{array}{c}\lambda =\frac{e\left(\stackrel{-}{\text{U}},\text{p}{\text{r}}_i\right)}{e\left(\stackrel{-}{V},g_{\mathrm{2}}\right)}\\ \hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}=\frac{e\left(\stackrel{-}{\text{U}},H_{\mathrm{1}}{\left(\text{I}{\text{D}}_i\right)}^{{\alpha }_{\mathrm{0}}}·P_{\mathrm{1}}^{\alpha }\right)}{e\left(\stackrel{-}{V},H_{\mathrm{1}}\left(\text{I}{\text{D}}_i\right)\right)}\\ \hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}=e{\left(P_{\mathrm{1}},\text{MPK}\right)}^r.\end{array}$$

  (26)

• (b)

  Then it recovers the message m as $m=\stackrel{-}{Z}/(H(\lambda ))$ .

With the recovered electricity usage feedback report m, the user ${\text{U}}_i$ can control power use of household appliances from peak times to nonpeak times for saving electrical energy and rational utilization.

6. Security Analysis

In this section, we show that our scheme satisfies the previous security requirements.

• (1)

Global security requirement: obviously, this security requirement is satisfied since each user's report is signed by our anonymous signature algorithm and the aggregated report is signed by BLS signature algorithm in our scheme. Furthermore, Lemma 1 shows that our anonymous signature is secure against adaptive chosen message attack, and the BLS short signature is provably secure under the CDH problem. Thus, we can efficiently identify the identity of the resident user, and it is impossible that exists a valid signature on a tempered data.

(2)

Multidimensional data aggregation: in our SP²DA scheme, we adopt the Chinese Remainder Theorem and Paillier Cryptosystem. It can achieve multidimensional data aggregation in the ciphertext form. For a user's transmitted data $(d_{i\mathrm{1}},\dots ,d_{il})$ , they are represented as

$$\begin{array}{c}{C}_i={\widehat{g}}_{\mathrm{1}}^{d_{i\mathrm{1}}}·{\widehat{g}}_{\mathrm{2}}^{d_{i\mathrm{2}}}\cdots {\widehat{g}}_l^{d_{il}}·k_i^n\hspace{0.17em}\mathrm{mod}\hspace{0.17em}{n}^{\mathrm{2}}\\ \hspace{1em}\hspace{1em}=g^{y_{\mathrm{1}}{d}_{i\mathrm{1}}}·g^{y_{\mathrm{2}}{d}_{i\mathrm{2}}}\cdots g^{y_l{d}_{il}}·k_i^n\hspace{0.17em}\mathrm{mod}{\hspace{0.17em}n}^{\mathrm{2}}\\ =g^{y_{\mathrm{1}}{d}_{i\mathrm{1}}+\cdots +y_l{d}_{il}}{k}_i^n\hspace{0.17em}\mathrm{mod}\hspace{0.17em}{n}^{\mathrm{2}}.\end{array}$$

(27)

$y_{\mathrm{1}}{d}_{i\mathrm{1}}+\cdots +y_l{d}_{il}$ can be considered as single-dimensional data to process. When receiving w data $(C_{\mathrm{1}},\dots ,C_w)$ , the local gateway GW can aggregate these w data as

$$\begin{array}{c}C=C_{\mathrm{1}}·C_{\mathrm{2}}\cdots C_w\\ \hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}\hspace{1em}=g^{y_{\mathrm{1}}{\sum }_{i=\mathrm{1}}^w‍d_{i\mathrm{1}}+\cdots +y_l{\sum }_{i=\mathrm{1}}^w‍d_{il}}{\left(\prod _{i=\mathrm{1}}^w{k}_i\right)}^n\mathrm{mod}{n}^{\mathrm{2}}.\end{array}$$

(28)

Since for $j=\mathrm{1}$ to l, the relation ${\sum }_{i=\mathrm{1}}^w‍d_{ij}<n_j$ holds, thus, the OA can obtain ${\sum }_{i=\mathrm{1}}^w‍d_{ij}$ by computing $y_{\mathrm{1}}{\sum }_{i=\mathrm{1}}^w‍d_{i\mathrm{1}}+\cdots +y_l{\sum }_{i=\mathrm{1}}^w‍d_{il}\mathrm{mod}{n}_j$ according to the Chinese Remainder Theorem. Therefore, our scheme can achieve multidimensional data aggregation.

(3)

Privacy of the residential user: Because the transmitted report of the residential user is signed by adopting our anonymous signing algorithm in our SP²DA scheme, each residential user's identity is protected. Furthermore, the transmitted report is encrypted by Paillier Encryption algorithm, it means even if the attacker 𝒜 eavesdrops the transmitted report, it still cannot obtain the individual user's data. For a feedback message m of the OA, OA sends the ciphertext $\stackrel{-}{C}=(\stackrel{-}{\text{U}},\stackrel{-}{V},\stackrel{-}{Z})$ of this feedback message m to all residential users in residential area RA by adopting broadcast encryption. Only the residential user in the RA can recover the corresponding feedback message m. In the following security proof, we will show that the confidentiality of the transmitted feedback message m can be achieved.

Lemma 3.

The broadcast encryption scheme in our SP²A scheme is semantic secure against chosen-plaintext attack under the DBDH problem.

Proof.

Suppose that there exists an adversary 𝒜 that can break the broadcast encryption in SP²DA scheme; then we can construct an algorithm ℬ that can solve the DBDH problem with advantage ϵ by using 𝒜 as a subroutine.

Let ℬ be given a DBDH problem instance

$$\begin{array}{cc}& \left(g_{\mathrm{2}},g_{\mathrm{2}}^a,g_{\mathrm{2}}^b,g_{\mathrm{2}}^c,Z\right).\end{array}$$

(29)

Its goal is to determine $e(g_{\mathrm{1}}^a,g_{\mathrm{2}}^b{)}^c\stackrel{?}{=}Z$ . ℬ runs 𝒜 as a subroutine to solve the DBDH problem.

ℬ sets $\text{MPK}=g_{\mathrm{2}}^a$ and randomly chooses $f\in Z_q$ to set $\text{MP}{\text{K}}_{\mathrm{0}}=g_{\mathrm{2}}^f$ . Let $P_{\mathrm{1}}=\psi (g_{\mathrm{2}}^c)$ . Then ℬ publishes MPK, $\text{MP}{\text{K}}_{\mathrm{0}}$ , $P_{\mathrm{1}}$ , $g_{\mathrm{1}}$ , $g_{\mathrm{2}}$ , e and the other system parameters.

In the challenge phase, the adversary 𝒜 chooses two messages $m_{\mathrm{0}}$ and $m_{\mathrm{1}}$ and sends them to ℬ. ℬ randomly selects a bit $b\in \{\mathrm{0,1}\}$ to produce a ciphertext $C^{*}=({\widehat{\text{U}}}^{*},{\widehat{V}}^{*},{\widehat{Z}}^{*})$ of message $m_b$ , where

$$\begin{array}{cc}& {\widehat{\text{U}}}^{*}=g_{\mathrm{2}}^b,\\ {\widehat{V}}^{*}={\left({\widehat{\text{U}}}^{*}\right)}^f,\\ {\widehat{Z}}^{*}=m_{b}H\left(Z\right).\end{array}$$

(30)

and sends $C^{*}$ to the adversary 𝒜. Finally, the adversary 𝒜 outputs a bit $b^{\prime }$ . If $b^{\prime }=b$ , it means that $Z=e(g_{\mathrm{1}},g_{\mathrm{2}}{)}^{abc}$ since

$$\begin{array}{cc}& {\widehat{\text{U}}}^{*}=g_{\mathrm{2}}^b,\end{array}$$

(31)

$$\begin{array}{c}{\widehat{Z}}^{*}=m·H\left(e{\left(P_{\mathrm{1}},\text{MPK}\right)}^b\right)=m_b·H\left(e{\left(\psi \left(g_{\mathrm{2}}^c\right),g_{\mathrm{2}}^a\right)}^b\right)=m_b·H\left(e{(\psi \left(g_{\mathrm{2}}{)}^c,g_{\mathrm{2}}^a\right)}^b\right)=m_b·H\left(e{\left(g_{\mathrm{1}},g_{\mathrm{2}}\right)}^{abc}\right).\end{array}$$

(32)

${\widehat{Z}}^{*}$ is a valid component of the ciphertext $C^{*}$ . In this case, the probability which 𝒜 outputs $b^{\prime }=b$ is $(\mathrm{1}/\mathrm{2})+ϵ$ . When Z is a random number, to the probability in which 𝒜 outputs $b^{\prime }=b$ is $\mathrm{1}/\mathrm{2}$ . According to the previous statement, we have

$$\begin{array}{cc}& \text{Pr}\left[ℬ\hspace{0.17em}\text{success}\right]=\frac{\mathrm{1}}{\mathrm{2}}\left(\frac{\mathrm{1}}{\mathrm{2}}+ϵ\right).\end{array}$$

(33)

It means that, the DBDH problem can be solved in the nonnegligible probability $(\mathrm{1}/\mathrm{2})((\mathrm{1}/\mathrm{2})+ϵ)$ . However, it is in contradiction with the difficulty of solving the DBDH problem.

6.1. Efficiency Analysis

Until now, Lu et al.'s scheme [8] is only a privacy-preserving aggregation scheme (EPPA) in smart grid which supports multidimensional data aggregation. In the following table, we give a comparison of our scheme with Lu et al.'s scheme. Let $C_e$ , $C_m$ , $C_{et}$ , and $C_p$ denote an exponentiation operation in $Z_{n^{\mathrm{2}}}$ , a multiplication operation in group ${𝔾}_{\mathrm{1}}$ or ${𝔾}_{\mathrm{2}}$ , an exponentiation operation in group ${𝔾}_T$ , and a pairing operation, respectively. In the whole SP²DA scheme, the computational costs of each user, GW and OA, are shown in Table 1.

Table 1

Comparison of Lu et al.'s scheme [8] with our scheme.

	[8] scheme	Our scheme
Multi-dimension	√	√
Anonymity	×	√
Computation cost of the user	$(l+\mathrm{1})C_e+C_m+\mathrm{4}{C}_p$	$(l+\mathrm{1})C_e+\mathrm{3}{C}_m+\mathrm{2}{C}_p$
Computation cost of GW	$(w+\mathrm{3})C_p+C_m$	$\mathrm{1}{C}_e+\mathrm{1}{C}_m+\mathrm{2}{C}_p$
Computation cost of OA	$\mathrm{3}{C}_p+C_e+\mathrm{4}{C}_m+C_{et}$	$\mathrm{3}{C}_p+C_e+\mathrm{3}{C}_m+C_{et}$

If experiments were performed on a Pentium IV personal computer with 3.0 GHz CPU, 512 MB RAM, and window XP operating system, and based on PBC cryptography libraries [12] and MIRACL libraries [15]. The experimental results show that to compute a single exponentiation operation in $Z_{n^{\mathrm{2}}}$ $(|n|=\mathrm{1024})$ , a single multiplication operation in ${𝔾}_{\mathrm{2}}$ or ${𝔾}_{\mathrm{1}}$ , and pairing operation needs 12.4 ms, 6.4 ms, and 20 ms, respectively. In Figure 2, we discuss the variation of computational cost in terms of l and w. Obviously, from the figure we can find that our scheme has more advantages over Lu et al.'s scheme in terms of computational cost of the user and the GW. It is more suitable for the real-time data process for the local gateway GW and the residential user.

Figure 2

Computational costs of users and GW.

6.2. Communication Overhead

According to the afarementioned communication construction, the whole communication is divided into user-to-GW communication, GW-to-OA communication, and OA-to-GW communication. In the user-to-GW communication, the reported data is the form of $C_i||T_i||{\delta }_i||\text{RA}$ . Because type 2 pairing is adopted in the proposed scheme, its length is $L_{u\mathrm{2}g}=\mathrm{2048}+|\text{RA}|+|T_i|+\mathrm{640}$ if we choose 1,024-bit n, 160-bit prime p, and 160-bit ${𝔾}_{\mathrm{1}}$ . However, a symmetric pairing is used in Lu et al.'s scheme [8]; the length of element in 𝔾 will be 512 bits long under the same security strength. Thus, the length is $L_{u\mathrm{2}g}=\mathrm{2048}+|\text{RA}|+|T_i|+\mathrm{512}$ bits. In the GW-to-OA communication, the aggregated report to the OA by GW is in the form of $C\mid \mid \text{RA}\mid \mid \text{GW}\mid \mid T_G\mid \mid {\delta }_G$ , and its length is $L_{g\mathrm{2}o}=\mathrm{2048}+|\text{RA}|+|\text{GW}|+|T_G|+\mathrm{160}$  bits. It is the same as that of Lu et al.'s scheme bits when the system parameters are used. In the OA-to-GW communication, OA needs bits to send back a responding message which is in the form of $\stackrel{-}{C}\mid \mid \delta$ , and its length is $\mathrm{3}|G_{\mathrm{1}}|+\mathrm{160}$ . However, the length of the responding message in Lu et al.'s scheme is $\mathrm{4}|G_{\mathrm{1}}|+\mathrm{160}$ . According to the previous statement, communication overhead in Lu et al.'s scheme is slightly more efficient than that of our scheme in the user-to-GW communication. However, communication overhead in our scheme is slightly more efficient than that of Lu et al.'s scheme in the OA-to-GW communication.

7. Conclusion

In this paper, we have proposed an efficient self-certified PKC-based privacy-preserving data aggregation scheme to satisfy the requirement of efficiency in smart grid communication. By adopting the Chinese Remainder Theorem technique and homomorphic property of Paillier cryptosystem, it achieves a multidimensional data aggregation approach under the ciphertext form. And it applies our proposed anonymous signature scheme to achieve anonymity of the real identities of end users in end-user-to-GW communication. It efficiently resists the end user's identity leakage problem which is not considered in other literatures. Compared with Lu et al.'s multidimensional data aggregation scheme, our scheme can significantly reduce computational cost of the local gateway GW. And we have also provided security analysis to demonstrate that the proposed scheme can satisfy the desirable security requirements. It is a future work to trace the malicious behavior of a dishonest residential user (end user) in a residential area.