EPPDC: An Efficient Privacy-Preserving Scheme for Data Collection in Smart Grid

Abstract

Different from the traditional grid, smart grid builds a real-time connection network between the user and the grid company by smart terminals, which can achieve bidirectional data transmission and information control. In smart grid, the smart meters send various information to the power generators and substations. Frequent data collection meets real-time management, but it tends to raise privacy concerns from the users about privacy information leakage. Based on the blind signature and the key distribution scheme, an efficient and privacy-preserving data collection (EPPDC) scheme is proposed for smart grid to cope with the above problems. In EPPDC scheme, the users' data information is transmitted to the local aggregator by building gateway with privacy preserving. In addition, the security analysis indicates that EPPDC scheme not only can resist replay attack, but also has source authentication and data integrity, confidentiality, unforgeability, nonrepudiation, and evolution of shared keys. Furthermore, performance analysis shows that EPPDC scheme has less computation cost than existing scheme.

1. Introduction

Smart grid is one of the most important public infrastructures for smart cities. It builds a real-time connection network between the user and the grid company by smart terminals and supports bidirectional data transmission and information control. Depending on it, smart cities could ensure resilient supply and delivery of energy, which help smart cities to fulfil many enhanced and innovative functions and even more efficiencies compared with traditional cities. Furthermore, smart grid can also facilitate coordination among people who are responsible for public safety and the public, such as urban officials and infrastructure operators [1]. The advantage of smart grid is attracting more and more attention and research in smart city projects. Currently, around one-third of the smart city projects are primarily focused on smart grid or other energy innovations. Almost half of smart city strategies include energy-focused projects [2].

Smart grid can support the bidirectional information flow between the power consumer and the utility provider [3]. This two-way interaction allows electricity to be generated in real-time based on consumers' demands and power requests. As an important technique in smart cities, the advanced metering will affect not only the power sector but also other utilities such as gas/heating and water which will make use of smart meters to read and process consumption data remotely [4]. In smart cities, each house may contain a smart meter connecting to all electric appliances in the house. The utility transmits requests and commands to the smart meters and gathers and analyzes power usage data responded by each smart meter. If being leaked, that information will indicate not only the amount of energy consumed by each user but also behaviors like when they are at home, at work, or traveling [5]. Furthermore, it is possible to infer what types of home appliances are used by attackers who compromise users' home area networks. If a criminal or malicious attacker can determine when a user is not at home, they may break into his/her house at such a time. And energy information can support burglars or provide business intelligence to competitors [6]. By this information, the users' habits or lifestyles can be tracked. And a series of problems arises in case of information leakage. Thus, authentication and user privacy preservation are two important security issues on the information flow in smart grid.

Thus, there is need to design schemes which can achieve data transmission between smart meters and smart grid provider with privacy preserving. This paper just studies the privacy-preserving data collection scheme for smart grid.

2. Related Works

The proposed privacy-preserving schemes about smart grid are mainly constructed by two kinds of cryptographic tools, homomorphic encryption [7–9] and signcryption [10, 11]. By homomorphic encryption, smart meters (SMs) encrypt the messages and send them to gateway (BGW), but gateway cannot get any users' messages without the system private key. Then, gateway signs encrypted messages and sends them to control center (CC). Based on the property of homomorphic encryption, control center can make use of the system private key to recover every user's messages.

Secure data aggregation schemes in smart grid have been investigated by several researchers. Lu et al. proposed a privacy-preserving aggregation scheme [7], which is based on the homomorphic Paillier cryptosystem. But in [7], it is assumed that the session keys between SM and BGW are unchanged. Once an adversary $\mathcal{A}$ compromises the session keys, $\mathcal{A}$ can decrypt any previous response message. Based on [7], Li et al. proposed a privacy-preserving demand and response scheme with adaptive key evolution [9]. Both [7, 9] make use of homomorphic encryption to achieve privacy preserving, and they can meet aggregation for some data. In addition, several researchers focused on privacy-preserving aggregation in different conditions by using multiparty computation [12, 13], differential privacy [14], and the aggregated pseudostatus variation [15]. As signcryption based schemes, they can complete digital signature and encryption for a message in one time. In particular, SMs signcrypt the messages and send them to gateway. Gateway cannot get any users' messages from the encrypted messages. Then, gateway signs and sends encrypted messages to control center. Control center can recover every user's messages by the shared key between CC and SMs. In [10], an identity-based signcryption scheme for smart grid was proposed. But in [10], the management of pseudonymous ID is a problem. Reference [11] adopted the pseudonym technology to achieve the user identity anonymity and adopted the signcryption to complete digital signature and encryption in one time in smart grid.

However, the smart grid needs not only to protect users' sensitive information but also to meet their demands for personalized data application with multilevel and multigranularity. Thus many users' messages cannot be aggregated, which should be sent to control center detail by detail. And existing homomorphic encryption to achieve privacy preserving is based on the computational expensive operations [7, 9], which may not be desirable for smart grids with limited resources in terms of both bandwidth and computation. And the existing signcryption based schemes in smart grid [10, 11] cannot meet forward secrecy.

This paper proposes an efficient privacy-preserving data collection scheme for smart grid, which is based on the blind signature and the key distribution scheme. In this scheme, users' data information is transmitted to the local aggregator via gateway, while gateway cannot get any users' messages. Moreover, this scheme can achieve forward secrecy of SM's session key, and evolution of SM's private keys.

The remainder of paper is organized as follows. Section 3 introduces models and design goal. Section 4 describes preliminaries. Section 5 presents the proposed EPPDC scheme. Section 6 shows the security analysis and the computation overhead of the scheme in this paper, respectively. Finally, Section 7 makes a conclusion.

3. Models and Design Goal

In this section, we give the system model, security model, and the design goal.

3.1. System Model

As shown in Figure 1, smart grid is divided into a number of hierarchical networks, which is comprised of control center (CC), district area network (DAN), building area network (BAN), and home area network (HAN). The CC covers $n_1$ DANs. For the sake of simplicity, we assume that each DAN comprises $n_2$ BANs and each BAN comprises $n_3$ HANs. Each HAN is assigned a smart meter (SM) enabling an automated, bidirectional communication between the CC and the HAN users. Meantime, each BAN is equipped with a gateway (BGW) and each DAN is equipped with a local aggregator (LAG). And each SM can directly communicate with LAG via the BGW.

Figure 1

Hierarchical architecture of smart grid.

In this paper, the system model of smart grid contains 5 parties, including trusted authority (TA), central aggregator (CAG), LAG, BGW, and SM. LAG is the entity that can directly communicate with CAG on behalf of those geographically dispersed HANs. TA belongs to some independent organizations like Regional Transmission Organizations (RTO) or Independent System Operators (ISO). TA does the system initiation, such as generating public system parameters and assigning private key for each entity.

Then we give a partial relationship for smart grid in China, which is shown in Figure 2. The provincial operator is viewed as central aggregator CAG, and municipal operator is viewed as LAG. For example, there is focus on the Northwest China. It has a CAG located in Shaanxi and multiple LAGs dispersed in Xi'an, Hanzhong, Yulin, and other towns. And ISO, Northwest China, plays the role of TA. The provincial operator is responsible for generating and transmitting parameters of CAG, predicting flexible power demand and managing renewable generation in its province. Generally, the provincial operator can refer to municipal electricity demand curve to make power supply plan and generation dispatching plan with a day ahead. The municipal operator is responsible for generating networks parameters and aggregating the power demand. At present in China, the communication between the provincial operator and the municipal operator is used by fiber optic link which is assumed to be safe. The municipal operator can refer to load curve. According to preferred load curve, time of use (TOU) prices, and customers demand, each BAN makes bids in the electricity market. Both municipal and BAN operator need real-time communication and data management. Usually, wireless communication is used to transfer data between BGW and SM.

Figure 2

An envisioned relationship diagram for smart grid in China.

3.2. Security Model

In our security model, CAG and LAG are trusted by all parties and are infeasible for any adversary to compromise. BGW can comply with the scheme but with diligent curiosity. Thus BGW possibly gets the user's privacy information in the process of implementing the scheme. We consider the following security goals.

• (1)

Confidentiality: the messages sent to LAG from SM should be confidential; that is, if an adversary $\mathcal{A}$ captures the messages, it cannot identify the encrypted messages.

(2)

Authenticity and data integrity: BGW and HAN users should be authenticated by LAG and BGW each other, respectively. Meanwhile, if an adversary $\mathcal{A}$ modifies the messages, the malicious operations can be detected.

(3)

Privacy preservation: the users' electricity information should not be disclosed to the undesirable entities. Privacy preservation should meet the anonymous authentication and data encryption, which make attacker not able to get any information from any of the users. In smart grid, if an adversary $\mathcal{A}$ hacks into the database of BGWs, it cannot determine the contents of ciphertexts. In order to protect the users' privacy, even BGW cannot determine the detailed electrical information to certain users.

(4)

Evolution of users' private keys: the evolution of users' private keys should be achieved. If an adversary $\mathcal{A}$ compromises any previous private key of a HAN user, $\mathcal{A}$ cannot use it currently or in the future.

3.3. Design Goal

Under the above models, our design goal is to develop an efficient privacy-preserving scheme for data collection in smart grid. Specifically, the following two desirable objectives will be achieved.

• (1)

The proposed privacy-preserving scheme should achieve the message source authentication, data integrity, and the confidentiality of the messages.

(2)

The proposed scheme should be cost-effective in terms of computation and communication overheads.

4. Preliminaries

In this section, we review bilinear pairings, hash function and HMAC [16], group key distribution scheme [17], and Nyberg-Rueppel blind signature technology [18], which will serve as the basis of the proposed scheme.

4.1. Bilinear Pairings

Let $G_1$ be a cyclic additive group of prime order q and let $G_T$ be a cyclic multiplicative group of the same order. A map e: $G_1\times G_1\to G_T$ is called a bilinear map if it satisfies the following properties:

(1) bilinearity: $e(Q,W+Z)=e(Q,W)e(Q,Z)$ and $e(Q+W,Z)=e(Q,Z)e(W,Z)$ , for all $Q,W,Z\in G_1$ ;

(2) nondegeneracy: there exists $P,Q\in G_1$ such that $e(P,Q)\ne 1$ ;

(3) computability: there is an efficient algorithm to compute $e(P,Q)$ for $P,Q\in G_1$ .

4.2. Hash Function and HMAC

A one-way hash function $h(·)$ is said to be secure if the following properties are satisfied.

• (1)

$h(·)$ can take a message of arbitrary length as input and produce a message digest of a fixed-length output.

(2)

Given x, it is easy to compute $h(x)=y$ . However, it is hard to compute $h^{-1}(y)=x$ given y.

(3)

Given x, it is computationally infeasible to find $x^{\prime }\ne x$ such that $h(x^{\prime })=h(x)$ .

Hash-based message authentication code (HMAC) is a specific construction for computing a message authentication code (MAC) using a cryptographic hash function in combination with a secret key. Both data integrity and authenticity of a message can be achieved using such a technique. Due to the property of hash functions, an HMAC value can be computed in a much shorter time than a traditional digital signature. In this paper, we denote the HMAC value on message M is HMAC _K (M) using the secret key K.

4.3. Group Key Distribution Scheme

The purpose of group key distribution is to distribute keys to selected group members so that each of the selected group members shares a distinct personal key with the group manager, but the other group members cannot get any information of the keys. In [17], the group manager broadcasted a message, and all the selected group members could derive their keys from the message. The approach of [17] chose a random t-degree polynomial $f(x)$ from $F_q[x]$ and selected $f(i)$ for each group member $U_i$ as the shared person key. The group manager constructed a single broadcast polynomial $w(x)$ such that, for a selected group member $U_i$ , $f(i)$ could be recovered from the knowledge of $w(x)$ and the personal secret $S_i$ . But for any revoked group member, $U_{i^{\prime }}$ , $f(i^{\prime })$ could not be determined from $w(x)$ and $S_{i^{\prime }}$ .

In [17], $w(x)=g(x)f(x)+h(x)$ was constructed by $f(x)$ with the help of a revocation polynomial $g(x)$ and a masking polynomial $h(x)$ . The revocation polynomial $g(x)$ was constructed in such a way that $g(i)\ne 0$ for any selected group member $U_i$ , but $g(i^{\prime })=0$ for any revoked group member $U_{i^{\prime }}$ . During setup phase, each group member $U_v$ had its own personal secret $S_v=\{h(v)\}$ , which might be distributed by the group manager through the secure communication channel between each group member and the group manager. Thus, for any selected group member $U_i$ , new personal key $f(i)$ could be computed by $f(i)=[w(i)-h(i)]/g(i)$ , but for any revoked group member $U_{i^{\prime }}$ , new personal key could not be computed because $g(i^{\prime })=0$ . Specific steps were as follows.

• (1)

Setup: the group manager randomly picked a $2t$ -degree masking polynomial, $h(x)=h_0+h_{1}x+\cdots +h_{2t}{x}^{2t}$ , from $F_q[x]$ . Each group member $U_i$ got the personal secret $S_i=\{h(i)\}$ from the group manager.

(2)

Broadcast: given a set of revoked group members $R=\{r_1,r_2,\dots ,r_w\}\hspace{0.17em}\hspace{0.17em}(\left|R\right|\le t)$ , the group manager distributed the shares of t-degree polynomial $f(x)$ to nonrevoked group members via the following broadcast message: $B=\{R\}\cup \{w(x)=g(x)f(x)+h(x)\}$ , where the revocation polynomial $g(x)=(x-r_1)(x-r_2)\cdots (x-r_w)$ .

(3)

Personal key recovery: if any nonrevoked group member $U_i$ received such a broadcast message, it evaluated the polynomial $w(x)$ at point i and got $w(i)=g(i)f(i)+h(i)$ . Because $U_i$ knew $h(i)$ and $g(i)\ne 0$ , it could compute the new personal key $f(i)=[w(i)-h(i)]/g(i)$ .

4.4. Nyberg-Rueppel Blind Signature

Blind signatures enable users to obtain valid signatures on a message without revealing its content to the signer. Nyberg-Rueppel blind signature scheme was proposed by Camenisch et al., which was based on the discrete logarithm problem [18]. The scheme had three parts as follows.

• (1)

Setup system parameters: the system parameters consisted of a prime p, a prime factor q of $p-1$ , and an element $g\in Z_q^{*}$ of order q. The signer's private key was a random element $x\in Z_q^{*}$ , while the corresponding public key was $y=g^x(\mathrm{mod}p)$ .

(2)

Sign: Bob could obtain a valid signature on a message m from Alice without revealing its content to Alice.

• (a)

Alice randomly selected $k^{\prime }\in Z_q^{*}$ , computed $r^{\prime }=g^{k^{\prime }}(\mathrm{mod}p)$ , and sent $r^{\prime }$ to Bob.

(b)

Bob selected $\alpha ,\beta \in Z_q^{*}$ at random and computed $r=m{g}^{\alpha }{r}^{\prime \beta }(\mathrm{mod}p)$ and $m^{\prime }=r{\beta }^{-\mathrm{1}}(\mathrm{mod}q)$ . Bob checked whether it was satisfied with $m^{\prime }\in Z_p^{*}$ . If this was not the case, a new ( $\alpha ,\beta$ ) would be chosen until it was satisfied with $m^{\prime }\in Z_p^{*}$ . Then, Bob sent $m^{\prime }$ to Alice.

(c)

Alice computed $s^{\prime }=m^{\prime }x+k^{\prime }(\mathrm{mod}q)$ and sent $s^{\prime }$ to Bob.

(d)

Bob computed $s=s^{\prime }\beta +\alpha (\mathrm{mod}q)$ . $(r,s)$ was the signature of Alice on message m.

(3)

Verify: anyone could verify the validity of the signature ( $r,s$ ) on message m by

$$\begin{array}{l}{g}^{-s}{y}^{r}r=m{g}^{-s^{\prime }\beta -\alpha +xr+k^{\prime }\beta +\alpha }\\ =m{g}^{-m^{\prime }x\beta -k^{\prime }\beta +xr+k^{\prime }\beta }=m\left(\mathrm{mod}p\right).\end{array}$$

(1)

5. EPPDC Scheme

Based on the blind signature and the key distribution scheme, this section gives the EPPDC scheme for smart grid. This scheme can achieve that the users' data is transmitted to the LAG via BGW with privacy preserving. In this section, we propose the scheme, which consists of five phases: system initialization, certificate issuing, user registration, data collection, and key evolution.

5.1. System Initialization

We assume that TA will initialize the whole system. TA chooses the following:

• (1)

primes p and q such that $q\hspace{0.17em}|\hspace{0.17em}p-1$ ,    $q\ge 2^{140}$ and $p\ge 2^{512}$ ;

(2)

an element $g\in Z_p^{*}$ with order q; that is, $g^q=1(\mathrm{mod}p)$ , and $g\ne 1$ ;

(3)

a one-way hash function $h\text{:}{\left(\mathrm{0,1}\right)}^{*}\to {\left(\mathrm{0,1}\right)}^l$ ;

(4)

a security parameter $\lambda \in N$ and bilinear group ( $G,G_T$ ) with prime order $p>{\mathrm{2}}^{\lambda }$ , which satisfies with g being a generator of G;

(5)

a random number $s\in Z_q^{*}$ as TA's private key so that $\text{S}{\text{K}}_{\text{TA}}=s$ .

Then, TA computes its public key $\text{P}{\text{K}}_{\text{TA}}=g^s$ and publishes the tuple $(p,q,g,h,\text{P}{\text{K}}_{\text{TA}})$ as the system parameters.

5.2. Certificate Issuing

During this phase, TA verifies the identity and issues the certificate for every entity. These entities include all the CAGs, LAGs, and BGWs. As an example, TA issues the certificate for a certain ${\text{LAG}}_i$ as follows.

• (1)

TA chooses a random number $\text{S}{\text{K}}_{\text{LA}{\text{G}}_i}\in Z_q^{*}$ as the ${\text{LAG}}_i$ 's private key and computes the ${\text{LAG}}_i$ 's public key $\text{P}{\text{K}}_{\text{LA}{\text{G}}_i}=g^{\text{S}{\text{K}}_{\text{LA}{\text{G}}_i}}(\mathrm{mod}p)$ .

(2)

TA generates the signature ${\sigma }_{\text{TA},\text{LA}{\text{G}}_i}$ , where ${\sigma }_{\text{TA},\text{LA}{\text{G}}_i}=\text{Si}{\text{g}}_{\text{S}{\text{K}}_{\text{TA}}}(\text{P}{\text{K}}_{\text{LA}{\text{G}}_i})$ is a signature on $\text{P}{\text{K}}_{\text{LA}{\text{G}}_i}$ using TA's private key SK_TA.

(3)

TA delivers $\text{S}{\text{K}}_{\text{LA}{\text{G}}_i}$ and $\text{Cer}{\text{t}}_{\text{LA}{\text{G}}_i}$ to ${\text{LAG}}_i$ , where $\text{Cer}{\text{t}}_{\text{LA}{\text{G}}_i}=(\text{P}{\text{K}}_{\text{LA}{\text{G}}_i},{\sigma }_{\text{TA},\text{LA}{\text{G}}_i})$ . The delivery of $\text{S}{\text{K}}_{\text{LA}{\text{G}}_i}$ must be via a secure channel, such as a Secure Socket Layer.

5.3. User Registration

Before accessing smart grid, every SM needs to get a certificate from TA and register in certain LAG which SM belongs to. Assume $\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}$ indicates that a certain SM belongs to ${\text{LAG}}_i$ . In Figure 3, an example of user registration for $\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}$ is as follows.

Figure 3

The flow chart of $\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}$ registration.

• (1)

  After TA verifies the identity of $\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}$ , TA delivers the $\text{S}{\text{K}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}$ and certificate $\text{Cer}{\text{t}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}$ to $\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}$ , which is the same as the process in Section 5.2.

• (2)

  $\text{S}{\text{M}}_{i-\text{LG}{\text{A}}_i}$ encrypts the message $\text{Cer}{\text{t}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}\parallel T\parallel \text{Si}{\text{g}}_{\text{S}{\text{K}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}}\left(\text{Cer}{\text{t}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}\parallel T\right)$ by $\text{P}{\text{K}}_{\text{LA}{\text{G}}_i}$ and sends it to ${\text{LAG}}_i$ , where T is the current timestamp.

• (3)

  ${\text{LAG}}_i$ decrypts the received message by its private key $\text{S}{\text{K}}_{\text{LA}{\text{G}}_i}$ . ${\text{LAG}}_i$ verifies the validity of timestamp T, $\text{Cer}{\text{t}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}$ and $\text{Si}{\text{g}}_{\text{S}{\text{K}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}}\left(\text{Cer}{\text{t}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}\parallel T\right)$ . If all those are available, go to step (4). Otherwise, go back to Step (2).

• (4)

  ${\text{LAG}}_i$ chooses a random number $S_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}\in \mathrm{\hspace{0.17em}\hspace{0.17em}}{Z}_q^{*}$ and computes $P_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}=g^{S_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}}$ , $K_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}=(\text{P}{\text{K}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}{)}^{S_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}}$ , and $H_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}=\text{HMA}{\text{C}}_{K_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}}(P_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i})$ . Then, ${\text{LAG}}_i$ sends $P_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}$ and $H_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}$ to $\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}$ .

• (5)

  $\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}$ can get noninteractively shared key $K_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}=(P_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}{)}^{\text{S}{\text{K}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}}$ and can verify the correctness of $H_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}$ . If $H_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}$ is consistent, go to Step (6). Otherwise, go back to Step (2).

• (6)

  $\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}$ sends $P_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}\parallel \text{TS}\parallel \text{Si}{\text{g}}_{\text{S}{\text{K}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}}(P_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}\parallel \text{TS})$ to ${\text{LAG}}_i$ , where TS is the current timestamp.

• (7)

  ${\text{LAG}}_i$ verifies the validity of signature in Step (6). If it is available, go to Step (8). Otherwise, go back to Step (4).

• (8)

  ${\text{LAG}}_i$ stores the $\text{Cer}{\text{t}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}$ , $S_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}$ , and $K_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}$ in its database. Then ${\text{LAG}}_i$ sends the permit defined as $\text{P}{\text{K}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}\parallel \text{T}{\text{S}}_{permit}\parallel d\parallel {\text{Sig}}_{\text{S}{\text{K}}_{\text{LA}{\text{G}}_i}}(\text{P}{\text{K}}_{\text{S}{\text{M}}_{i-\text{LG}{\text{A}}_i}}\parallel \text{T}{\text{S}}_{permit}\parallel d)$ to $\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}$ , where $\text{T}{\text{S}}_{permit}$ is the current timestamp and d is the expiry length of time.

5.4. Data Collection

When a certain ${\text{LAG}}_i$ needs to make statistical analysis and collect energy information in its DAN, ${\text{LAG}}_i$ broadcasts the data collection command to its subordinate BGWs_. Similarly, each BGW will broadcast the data collection command to its subordinate SMs. As an example, the process of data collection from $\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}$ to ${\text{LAG}}_i$ is as follows.

(I) Each BGW Collects Eligible SMs' Permits

• (1)

After receiving the data collection command from $\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}$ , $\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}$ chooses a random number $u_{\text{S}{\text{M}}_i-\text{LA}{\text{G}}_i}\in {\text{Z}}_q^{*}$ and computes $K_{{\mathrm{1}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}}=g^{u_{\text{S}{\text{M}}_i-\text{LA}{\text{G}}_i}}$ . Here $\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}$ is a certain BGW who is ${\text{LAG}}_i$ 's subordinate and $\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}$ 's superior. Then, $\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}$ encrypts the message $C_{{\mathrm{1}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}}=permit\parallel K_{1_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}}\parallel T_1\parallel \text{Si}{\text{g}}_{\text{S}{\text{K}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}}(permit\parallel K_{{\mathrm{1}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}}\parallel T_1)$ by $\text{P}{\text{K}}_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}$ and sends it to $\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}$ , where $T_1$ is the current timestamp.

(2)

$\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}$ verifies the validity of $C_{{\mathrm{1}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}}$ using Algorithm 1. For eligible $\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}$ , $\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}$ chooses two random numbers $u_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}$ , $k_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\prime }\in Z_q^{*}$ and computes $r_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\prime }$ , $K_{{\mathrm{2}}_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}}$ , $K_{\text{S}{\text{M}}_i-\text{BG}{\text{W}}_j-\text{LA}{\text{G}}_i}$ , where $r_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\prime }=g^{k_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\prime }}(\mathrm{mod}p)$ , $K_{{\mathrm{2}}_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}}=g^{u_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}}(\mathrm{mod}p)$ , and $K_{\text{S}{\text{M}}_i-\text{BG}{\text{W}}_j-\text{LA}{\text{G}}_i}={K_{{\mathrm{1}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}}}^{u_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}}(\mathrm{mod}p)$ .

(3)

$\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}$ sends the message $C_{{\mathrm{2}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}}=r_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\prime }\parallel K_{{\mathrm{2}}_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}}\parallel T_2\parallel \mathrm{\hspace{0.17em}\hspace{0.17em}}\text{HMA}{\text{C}}_{K_{\text{S}{\text{M}}_i-\text{BG}{\text{W}}_j-\text{LA}{\text{G}}_i}}(r_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\prime }\parallel K_{{\mathrm{2}}_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}}\parallel T_2)$ to $\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}$ , where $T_2$ is the current timestamp.

(4)

After receiving $C_{{\mathrm{2}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}}$ , $\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}$ can get noninteractively shared key $K_{\text{S}{\text{M}}_i-\text{BG}{\text{W}}_j-\text{LA}{\text{G}}_i}={K_{{\mathrm{2}}_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}}}^{u_{\text{S}{\text{M}}_i-\text{LA}{\text{G}}_{\text{i}}}}(\mathrm{mod}p)$ and compute $\text{HMA}{\text{C}}_{K_{\text{S}{\text{M}}_i-\text{BG}{\text{W}}_j-\text{LA}{\text{G}}_i}}(r_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\prime }\parallel K_{{\mathrm{2}}_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}}\parallel T_2)$ .

(5)

If the value of HMAC is consistent, go to Step (5). Otherwise, go back to Step (1).

(6)

$\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}$ sends $permit\parallel T_3\parallel \text{HMA}{\text{C}}_{K_{\text{S}{\text{M}}_i-\text{BG}{\text{W}}_j-\text{LA}{\text{G}}_i}}(permit\parallel T_3)$ to $\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}$ , where $T_3$ is the current timestamp.

(7)

When $T_{\mathrm{3}}-T_{\mathrm{2}}<\Delta T$ , $\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}$ verifies the correctness of received messages in Step (5) by HMAC, where $\Delta T$ is the limit for time difference. Then, $\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}$ collects all eligible SMs' permits and sends them to ${\text{LAG}}_i$ .

Algorithm 1: The process of verifying $$C_{{\mathrm{1}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}}$$ .

Require: $$\text{En}{\text{c}}_{\text{P}{\text{K}}_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}}{[C}_{{\mathrm{1}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}}]$$

(1) Decrypt $$\text{En}{\text{c}}_{\text{P}{\text{K}}_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}}[C_{{\mathrm{1}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}}]$$ by $$\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}$$ 's private key $$\text{S}{\text{K}}_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}$$ .

(2) Verify $$T_1$$ − $$\text{T}{\text{S}}_{permit}$$ < d, d is the expiry length of time.

(3) if   $$T_1$$ is valid then

    Verify $$\text{Si}{\text{g}}_{\text{S}{\text{K}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}}(permit\parallel K_{{\mathrm{1}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}}\parallel T_{\mathrm{1}})$$ by $$\text{P}{\text{K}}_{\text{S}{\text{M}}_i-\text{LA}{\text{G}}_i}$$ .

    if   $$\text{Si}{\text{g}}_{\text{S}{\text{K}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}}(permit\parallel K_{{\mathrm{1}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}}\parallel T_{\mathrm{1}})$$ is valid then

     Verify $$\text{Si}{\text{g}}_{\text{S}{\text{K}}_{{\mathrm{\hspace{0.17em}\hspace{0.17em}}}_{\text{LA}{\text{G}}_i}}}\text{(P}{\text{K}}_{\text{S}{\text{M}}_{i-\text{LG}{\text{A}}_i}}\parallel \text{T}{\text{S}}_{permit}\parallel d)$$ by $$\text{P}{\text{K}}_{\text{LA}{\text{G}}_i}$$ .

     if   $$\text{Si}{\text{g}}_{\text{S}{\text{K}}_{{\mathrm{\hspace{0.17em}\hspace{0.17em}}}_{\text{LA}{\text{G}}_i}}}\text{(P}{\text{K}}_{\text{S}{\text{M}}_{i-\text{LG}{\text{A}}_i}}\parallel \text{T}{\text{S}}_{permit}\parallel d)$$ is valid then

     accept $$C_{{\mathrm{1}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}}$$ .

(4)   end if

(5)  end if

(6) end if

(II) Generate the Shared Blind Factors between LAG and Every SM

• (1)

After receiving all the permits from $\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}$ , ${\text{LAG}}_i$ confirms the total of permits as $N_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}$ . Then ${\text{LAG}}_i$ finds the corresponding $K_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}$ in its database, where $K_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}$ is the shared key of ${\text{LAG}}_i$ with $\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}$ . And ${\text{LAG}}_i$ generates the message $\{B_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}},K_{{\mathrm{3}}_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}}\}$ by using Algorithm 2.

(2)

${\text{LAG}}_i$ sends message $\{B_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}},K_{{\mathrm{3}}_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}}\}$ to $\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}$ .

(3)

After receiving the message from ${\text{LAG}}_i$ , $\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}$ stores $K_{{\mathrm{3}}_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}}$ in its database and broadcasts $B_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}$ to its every subordinate SM. If SM's permit is eligible, SM can recover $K_{\text{LA}{\text{G}}_i-\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\mathrm{1}}$ and $K_{\text{LA}{\text{G}}_i-\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\mathrm{2}}$ . As an example, $\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}$ can get $K_{\text{LA}{\text{G}}_i-\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\mathrm{1}}=g_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}(K_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i})$ + $K_{\text{LA}{\text{G}}_i-\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\mathrm{1}}$ and $K_{\text{LA}{\text{G}}_i-\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\mathrm{2}}=g_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}(K_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i})+K_{\text{LA}{\text{G}}_i-\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\mathrm{2}}$ , respectively. In the following, $\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}$ is an example of data collection, which is the same as other SMs.

(4)

$\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}$ computes two blind factors ${\alpha }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}=H\left(K_{\text{LA}{\text{G}}_i-\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\mathrm{1}}\parallel K_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}\right)$ and ${\beta }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}=H\left(K_{\text{LA}{\text{G}}_i-\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\mathrm{2}}\parallel K_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}\right)$ , where H is a one-way hash function.

Algorithm 2: Message generation algorithm for LAG.

Require: g, p, q, $$K_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_{\mathrm{1}}},\dots ,K_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_{N_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}}}$$

(1) Construct function $$g_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}(x)=(x-K_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_{\mathrm{1}}})·(x-K_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_{\mathrm{2}}})\cdots (x-K_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_{N_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}}})$$ ,

   where from $$K_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_{\mathrm{1}}}$$ to $$K_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_{N_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}}}$$ indicates $$N_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}$$

   shared keys of LAG with SMs which permit past validation.

(2) Select random numbers $$K_{\text{LA}{\text{G}}_i-\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\mathrm{1}}\in$$   $$Z_q^{*}$$ and $$K_{\text{LA}{\text{G}}_i-\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\mathrm{2}}\in Z_q^{*}$$ .

(3) Generate $${\mathrm{B}}_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}=\{g_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}(x)+K_{\text{LA}{\text{G}}_i-\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\mathrm{1}}$$ ,  $$g_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}(x)+K_{\text{LA}{\text{G}}_i-\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\mathrm{2}}\}$$ .

(4) Select a random number $$u_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\prime }\in Z_q^{*}$$ .

(5) Compute $$K_{{\mathrm{3}}_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}}={\mathrm{g}}^{u_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\prime }}(\text{mod\hspace{0.17em}}p)$$ .

Return   $$\{{\mathrm{B}}_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}},K_{{\mathrm{3}}_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}}\}$$

(III) LAG Collects Data from SM via BGW

• (1)

$\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}$ reads the current electricity information $m_{i-\text{LA}{\text{G}}_i}$ and computes $r_{i-\text{LA}{\text{G}}_i}=m_{i-\text{LA}{\text{G}}_i}{g}^{{\alpha }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}}{r_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\prime }}^{{\beta }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}}(\mathrm{mod}p),\hspace{0.17em}\hspace{0.17em}{m}_{i-\text{LA}{\text{G}}_i}^{\prime }=r_{i-\text{LA}{\text{G}}_i}{\beta }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}^{-\mathrm{1}}$ . $\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}$ sends $C_{{\mathrm{3}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}}=m_{i-\text{LA}{\text{G}}_i}^{\prime }\parallel T_{\mathrm{4}}\parallel \text{Si}{\text{g}}_{\text{S}{\text{K}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}}(m_{i-\text{LA}{\text{G}}_i}^{\prime }\parallel T_{\mathrm{4}})$ to $\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}$ , where $T_4$ is the current timestamp.

(2)

$\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}$ verifies the validity of signature in Step (1). If the signature is valid, go to Step (3). Otherwise, $\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}$ requires $\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}$ resending the message as in Step (1) within the valid time range.

(3)

$\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}$ chooses a random number $u_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\mathrm{\prime \prime }}\in Z_q^{*}$ and computes $K_{{\mathrm{4}}_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}}$ = $g^{{u_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\mathrm{\prime \prime }}}_{}}(\mathrm{mod}p)$ , $K_{\text{S}{\text{M}}_i-\text{BG}{\text{W}}_j-\text{LA}{\text{G}}_i}^{\prime }$ = ${K_{{\mathrm{3}}_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}}}^{{u_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\mathrm{\prime \prime }}}_{}}(\mathrm{mod}p)$ . $\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}$ signs the message $m_{i-\text{LA}{\text{G}}_i}^{\prime }$ with $s_{\text{S}{\text{M}}_i-\text{BG}{\text{W}}_j-\text{LA}{\text{G}}_i}^{\prime }$ = $m_{i-\text{LA}{\text{G}}_i}^{\prime }\text{S}{\text{K}}_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}$ + $k_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\prime }(\mathrm{mod}p)$ using blind signature.

(4)

$\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}$ sends $C_{{\mathrm{4}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}}=r_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\prime }\parallel s_{\text{S}{\text{M}}_i-\text{BG}{\text{W}}_j-\text{LA}{\text{G}}_i}^{\prime }\parallel \text{P}{\text{K}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}\parallel m_{i-\text{LA}{\text{G}}_i}^{\prime }\parallel T_4\parallel \text{Si}{\text{g}}_{\text{S}{\text{K}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}}\left(m_{i-\text{LA}{\text{G}}_i}^{\prime }\parallel T_4\right)\parallel K_{{\mathrm{4}}_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}}\parallel T_{\mathrm{5}}$ and $\text{HMA}{\text{C}}_{K_{\text{S}{\text{M}}_i-\text{BG}{\text{W}}_j-\text{LA}{\text{G}}_i}^{\prime }}\left(C_{{\mathrm{4}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}}\right)$ to ${\text{LAG}}_i$ .

(5)

${\text{LAG}}_i$ can get $\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}$ 's current electricity information $m_{i-\text{LA}{\text{G}}_i}$ using Algorithm 3.

Algorithm 3: The process of recovering message for LAG.

(1)   Verify $$T_{\mathrm{5}}-T_{\mathrm{4}}<\mathrm{\Delta }T$$ , where $$\mathrm{\Delta }T$$ is the limit for time difference.

(2)   if   $$T_{\mathrm{5}}-T_{\mathrm{4}}<\mathrm{\Delta }T$$   then

     compute $$K_{\text{S}{\text{M}}_i-\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\prime }$$ = $${K_{{\mathrm{4}}_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}}}^{u_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\prime }}(\text{mod\hspace{0.17em}}p)$$ .

(3)   Verify the validity of $$\text{HMA}{\text{C}}_{K_{\text{S}{\text{M}}_i-\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\prime }}(C_{{\mathrm{4}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}})$$ .

(4)   if HMAC is valid then

     find $$K_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}$$ in its database according to $$\text{P}{\text{K}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}$$ .

(5)   Computes $${\alpha }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}=H{(K}_{\text{LA}{\text{G}}_i-\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\mathrm{1}}\parallel K_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i})$$ , $${\beta }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}=H{(K}_{\text{LA}{\text{G}}_i-\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\mathrm{2}}\parallel K_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i})$$ .

(6)   Get $$s_{\text{S}{\text{M}}_i-\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}=s_{\text{S}{\text{M}}_i-\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\prime }{\beta }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}+{\alpha }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}$$ ,

      $$r_{i-\text{LA}{\text{G}}_i}={m_{i-\text{LA}{\text{G}}_i}}^{\prime }{\beta }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}$$ ,

      $$m_{i-\text{LA}{\text{G}}_i}=r_{i-\text{LA}{\text{G}}_i}{g}^{-{\alpha }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}}{r_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\prime }}^{-{\beta }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}}(\mathrm{mod}p)$$ .

(7)   Judge $$g^{-s_{\text{S}{\text{M}}_i-\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}}\text{P}{{\text{K}}_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}}^{r_{i-\text{LA}{\text{G}}_i}}{r}_{i-\text{LA}{\text{G}}_i}(\mathrm{mod}p)=m_{i-\text{LA}{\text{G}}_i}$$

     if equation holds then

     Record the message $$m_{i-\text{LA}{\text{G}}_i}$$ and signature ( $$s_{\text{S}{\text{M}}_i-\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}$$ , $$r_{i-\text{LA}{\text{G}}_i}$$ ) in the corresponding database.

(8)   end if

(9)   end if

(10)   end if

5.5. Key Evolution

The $\text{SM}$ 's permit is only valid from $\text{T}{\text{S}}_{permit}$ to $\text{T}{\text{S}}_{permit}+d$ . After $\text{T}{\text{S}}_{permit}+d$ , the permit is automatically revoked if $\text{SM}$ does not apply for a new permit. Assuming $d^{\prime }$ is the corresponding number of days for d, here we extend the shared key $K_{\text{LAG}-\text{SM}}$ to $d^{\prime }$ dimensional vector $K_{\text{LAG}-\text{SM}}=(K_1,K_2,\dots ,K_{d^{\prime }})$ . For $d^{\prime }$ dimensional vector $K_{\text{LAG}-\text{SM}}$ , $K_1=K_{\text{LAG}-\text{SM}}$ , $K_2=H(K_1)$ , and $K_3=H(K_2),\dots ,K_{d^{\prime }}=H(K_{d^{\prime }-1})$ , where H is a one-way hash function. Note that the extension does not influence the previous EPPDC scheme. Then, both $\text{SM}$ and $\text{LAG}$ can deduce $d^{\prime }$ dimensional shared key $K_{\text{LAG}-\text{SM}}=(K_1,K_2,\dots ,K_{d^{\prime }})$ within the terms of permit.

Here we assume that every shared key is valid for one day. $d^{\prime }$ dimensional shared key is valid for $d^{\prime }$ days during the validity of permit. Accordingly, both $\text{SM}$ and $\text{LAG}$ can confirm the intraday shared key $K_{\text{LAG}-\text{SM}}$ from $d^{\prime }$ dimensional key $K_{\text{LAG}-\text{SM}}$ .

Every $\text{SM}$ only stores the intraday shared key $K_{\text{LAG}-\text{SM}}$ within permit validity period. The day before the expiration of $permit$ , $\text{SM}$ applies for registration in $\text{LAG}$ again. For eligible $\text{SM}$ , $\text{LAG}$ will issue the new permit and form the new shared key $K_{\text{LAG}-\text{SM}}$ to $\text{SM}$ . When previous permit has expired, $\text{SM}$ deletes previous permit and $K_{\text{LAG}-\text{SM}}$ . Thus, the shared key $K_{\text{LAG}-\text{SM}}$ evolution is achieved.

6. Security Analysis and Computation Overhead

In this section, we analyze the security properties and the computation of the EPPDC scheme.

6.1. Security Analysis

EPPDC scheme can achieve data collection from $\text{SM}$ to $\text{LAG}$ via $\text{BGW}$ . And EPPDC scheme not only can resist replay attack, but also has source authentication and data integrity, confidentiality, unforgeability, nonrepudiation, and evolution of shared keys.

Property 1 (correctness).

In EPPDC scheme, $\text{LAG}$ can verify the blind signature of $\text{BGW}$ and recover the message sent by $\text{SM}$ .

Proof.

During Stage III of data collection in EPPDC scheme, $\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}$ sends the $(r_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\prime },s_{\text{S}{\text{M}}_i-\text{BG}{\text{W}}_j-\text{LA}{\text{G}}_i}^{\prime })$ message $m_{i-\text{LA}{\text{G}}_i}^{\prime }$ and $\text{P}{\text{K}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}$ to $\text{LA}{\text{G}}_i$ . $\text{LA}{\text{G}}_i$ can find the corresponding $K_{{\text{LAG}}_i-{\text{SM}}_i}$ in its database according to $\text{P}{\text{K}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}$ and the current timestamp. Then, $\text{LA}{\text{G}}_i$ recovers the current electricity information $m_{i-\text{LA}{\text{G}}_i}$ using Algorithm 3, which is proved by

$$\begin{array}{l}{r}_{i-\text{LA}{\text{G}}_i}·g^{-{\alpha }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}}·{r_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\prime }}^{-{\beta }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}}\left(\mathrm{mod}p\right)\\ \hspace{1em}=\left(m_{i-\text{LA}{\text{G}}_i}·g^{{\alpha }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}}·{r_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\prime }}^{{\beta }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}}\right)\\ \hspace{1em}\hspace{1em}\times g^{-{\alpha }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}}·{r_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\prime }}^{-{\beta }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}}\left(\mathrm{mod}p\right)\\ \hspace{1em}=m_{i-\text{LA}{\text{G}}_i}.\end{array}$$

(2)

The $\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}$ 's signature on $m_{i-\text{LA}{\text{G}}_i}$ is $(s_{\text{S}{\text{M}}_i-\text{BG}{\text{W}}_j-\text{LA}{\text{G}}_i},r_{i-\text{LA}{\text{G}}_i})$ , which can be proved by

$$\begin{array}{l}{g}^{-\left(s_{\text{S}{\text{M}}_i-\text{BG}{\text{W}}_j-\text{LA}{\text{G}}_i}\right)}{\left(\text{P}{\text{K}}_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}\right)}^{r_{i-\text{LA}{\text{G}}_i}}·r_{i-\text{LA}{\text{G}}_i}\left(\mathrm{mod}p\right)\\ =g^{-\left[\left(s_{\text{S}{\text{M}}_i-\text{BG}{\text{W}}_j-\text{LA}{\text{G}}_i}^{\prime }\right){\beta }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}+{\alpha }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}\right]}·\\ g^{\text{S}{\text{K}}_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}·{m_{i-\text{LA}{\text{G}}_i}^{\prime }}_{}·{\beta }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}}·r_{i-\text{LA}{\text{G}}_i}\left(\mathrm{mod}p\right)\\ =g^{-\left\{\right[{m_{i-\text{LA}{\text{G}}_i}^{\prime }}_{}\text{S}{\text{K}}_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}+{k_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\prime }}_{}]·{\beta }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}+{\alpha }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}\}}·\\ g^{(\text{S}{\text{K}}_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}·{m_{i-\text{LA}{\text{G}}_i}^{\prime }}_{}·{\beta }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i})}·r_{i-\text{LA}{\text{G}}_i}\left(\mathrm{mod}p\right)\\ =g^{-{{k_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\prime }}^{}}_{}·{\beta }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}-{\alpha }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}}·r_{i-\text{LA}{\text{G}}_i}\left(\mathrm{mod}p\right)\\ ={{r_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\prime }}_{}}^{-{\beta }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}}·g^{-{\alpha }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}}·\\ \left(m_{i-\text{LA}{\text{G}}_i}{g}^{{\alpha }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}}{r_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}^{\prime }}^{{\beta }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}}\right)\left(\mathrm{mod}p\right)\\ =m_{i-\text{LA}{\text{G}}_i}.\end{array}$$

(3)

Property 2 (to resist replay attack).

In EPPDC scheme, we assume that there is an adversary $\mathcal{A}$ who can intercept and capture the messages sent by $\text{SM}$ s. When adversary $\mathcal{A}$ resends the messages, $\text{BGW}$ can detect the replay attack based on the $\text{SM}$ 's signature or $\text{HMAC}$ with the current timestamp. For the same reason, $\text{LAG}$ can also detect the replay attack, when an adversary $\mathcal{A}$ resends the $\text{BGW}$ 's messages.

Property 3 (confidentiality).

In EPPDC scheme, the messages maintain their confidentiality when messages are sent to $\text{LAG}$ from $\text{SM}$ .

Proof.

During Stage III of data collection in EPPDC scheme, $\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}$ has processed the information $m_{i-\text{LA}{\text{G}}_i}$ into $m_{i-\text{LA}{\text{G}}_i}^{\prime }$ by blind factors ${\alpha }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}$ and ${\beta }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}$ , before $\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}$ sends the messages to $\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}$ .

We consider the following game played between a challenge $\mathcal{C}$ and an adversary $\mathcal{A}$ . $\mathcal{C}$ runs the system initialization and sends the system parameters to $\mathcal{A}$ . $\mathcal{A}$ performs a polynomial bounded number of queries (these queries may be made adaptively; that is, each query may depend on the answer to the previous queries). By queries, $\mathcal{A}$ can get many couples of $(m_{i-\text{LA}{\text{G}}_i}{)}^{*}$ and $(m_{i-\text{LA}{\text{G}}_i}^{\prime }{)}^{*}$ , where $(m_{i-\text{LA}{\text{G}}_i}{)}^{*}\ne m_{i-\text{LA}{\text{G}}_i}$ . Based on discrete logarithm problem, $\mathcal{A}$ cannot get the blind factors ${\alpha }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}$ and ${\beta }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}$ from $(m_{i-\text{LA}{\text{G}}_i}{)}^{*}$ and $(m_{i-\text{LA}{\text{G}}_i}^{\prime }{)}^{*}$ . For the same reason, $\mathcal{A}$ cannot get $m_{i-\text{LA}{\text{G}}_i}$ if it does not know ${\alpha }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}$ and ${\beta }_{\text{LA}{\text{G}}_i-\text{S}{\text{M}}_i}$ .

Therefore, an adversary $\mathcal{A}$ cannot get $m_{i-\text{LA}{\text{G}}_i}$ , even if $\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}$ cannot get $m_{i-\text{LA}{\text{G}}_i}$ too. Thus the messages maintain their confidentiality when messages are sent to $\text{LAG}$ from $\text{SM}$ .

Property 4 (nonrepudiation and unforgeability).

During Stage III of data collection in EPPDC scheme, $\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}$ sends $m_{i-\text{LA}{\text{G}}_i}^{\prime }\parallel T_{\mathrm{4}}$ and its signature to $\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}$ , which is sent to $\text{LA}{\text{G}}_i$ by $\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}$ at a later step.

We consider the following game played between a challenge $\mathcal{C}$ and an adversary $\mathcal{A}$ . $\mathcal{A}$ performs a polynomial bounded number of adaptive queries. By queries, $\mathcal{A}$ can get many couples of $(m_{i-\text{LA}{\text{G}}_i}^{\prime }\parallel T_4{)}^{*}$ and $\text{Si}{\text{g}}_{\text{S}{\text{K}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}}(m_{i-\text{LA}{\text{G}}_i}^{\prime }\parallel T_4{)}^{*}$ . Based on the properties of signature [19], $\mathcal{A}$ cannot forge the $\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}$ 's signature $\text{Si}{\text{g}}_{\text{S}{\text{K}}_{\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}}}(m_{i-\text{LA}{\text{G}}_i}^{\prime }\parallel T_{\mathrm{4}})$ on message $(m_{i-\text{LA}{\text{G}}_i}^{\prime }\parallel T_4{)}^{*}$ . Thus, $\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}$ cannot repudiate $m_{i-\text{LA}{\text{G}}_i}^{\prime }\parallel T_{\mathrm{4}}$ being sent by himself.

In the following steps, $\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}$ signs the message $m_{i-\text{LA}{\text{G}}_i}^{\prime }$ via blind signature with its private key $\text{S}{\text{K}}_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}$ . By adaptive queries, $\mathcal{A}$ can get many couples of $m_{i-\text{LA}{\text{G}}_i}^{\prime *}$ and $(s_{\text{S}{\text{M}}_i-\text{BG}{\text{W}}_j-\text{LA}{\text{G}}_i}^{*},r_{i-\text{LA}{\text{G}}_i}^{*})$ . Based on discrete logarithm problem, $\mathcal{A}$ cannot get $\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}$ 's private key $\text{S}{\text{K}}_{\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}}$ . Based on discrete logarithm problem, if $\mathcal{A}$ forges $\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}$ 's blind signature, the signature will not be authenticated by $\text{LA}{\text{G}}_i$ making use of (3). Thus, $\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}$ cannot repudiate ( $m_{i-\text{LA}{\text{G}}_i}^{\prime },s_{\text{S}{\text{M}}_i-\text{BG}{\text{W}}_j-\text{LA}{\text{G}}_i},r_{i-\text{LA}{\text{G}}_i}$ ) being sent by himself.

Furthermore, based on the properties of signature, the messages sent by $\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}$ and $\text{BG}{\text{W}}_{j-\text{LA}{\text{G}}_i}$ are provided with the source authentication and data integrity.

Property 5 (forward security).

In EPPDC scheme, the permit has a validity period d. When permit is valid, both $\text{SM}$ and $\text{LAG}$ can noninteractively share $d^{\prime }$ dimensional key $K_{\text{LAG}-\text{SM}}=(K_1,K_2,\dots ,K_{d^{\prime }})$ , where $d^{\prime }$ is the corresponding number of days for d. Thereby in $d^{\prime }$ days, $\text{SM}$ and $\text{LAG}$ use different shared key every day.

In the key evolution phase, $\text{SM}$ deletes the previous shared key after it has computed the new shared key $K_{\text{LAG}-\text{SM}}$ . If an adversary $\mathcal{A}$ compromises a HAN user's $\text{SM}$ , it gets the current shared key $H(K_{\text{LAG}-\text{SM}})$ . Assume that an adversary $\mathcal{A}$ can perform a polynomial bounded number of adaptive queries for a challenge $\mathcal{C}$ . By queries, $\mathcal{A}$ can get many shared keys $K_{\text{LAG}-\text{SM}}^{*}$ . Based on the property of one-way for hash function, $\mathcal{A}$ cannot get any previous shared key $K_{\text{LAG}-\text{SM}}$ making using of the current shared key $H(K_{\text{LAG}-\text{SM}})$ . Thus adversary $\mathcal{A}$ cannot compute the previous blind factor, and then it cannot get previous message m sent by SM. Therefore, EPPDC scheme provides the evolution and forward secrecy of shared key $K_{\text{LAG}-\text{SM}}$ .

Finally, we present the comparison results of security levels in Table 1. It can be seen that scheme [7] and scheme [10] achieve confidentiality, authenticity, and data integrity and scheme [9] cannot resist replay attack.

Table 1

Comparison of security level.

	[7]	[9]	[10]	EPPDC
Confidentiality	Yes	Yes	Yes	Yes
Authenticity	Yes	Yes	Yes	Yes
Data integrity	Yes	Yes	Yes	Yes
To resist replay attack	No	No	No	Yes
Forward secrecy	No	Yes	No	Yes
Private key evolution	No	Yes	No	Yes

6.2. Computation Overhead

In EPPDC scheme, every $\text{SM}$ sends its processed messages $m^{\prime }$ and its corresponding signatures to BGW. BGW verifies the validity of SM's signature. For available signature, BGW signs message $m^{\prime }$ making use of blind signature and sends it to LAG. LAG can verify that the message is indeed sent by BGW and SM. Furthermore, LAG can recover the original message m.

In EPPDC, we assume that the SM's signature can be converted into the same as the existing literatures such as [7–11] using bilinear pairing, which can also perform the bath verification [7]. So here we mainly discuss the computation complexity of messages m turning to $m^{\prime }$ , the signature of BGW, verification of BGW's signature, and recovery for the original message m. Because the computation complexity is similar in [7, 9] which are both realized by homomorphic encryption, we only consider [7] in the following comparisons.

In EPPDC scheme, $\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}$ needs 2 exponentiation operations, 3 multiplication operations, and 1 inverse operation in $Z_p^{*}$ to blind message m to $m^{\prime }$ . In [7], $\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}$ needs 2 exponentiation operations and 1 multiplication operation in $Z_n^2$ to encrypt message m to C using homomorphic encryption. In [10], $\text{S}{\text{M}}_{i-\text{LA}{\text{G}}_i}$ encrypts message m to C making use of AES block cipher.

In EPPDC scheme, BGW can perform the bath verification. BGW makes use of blind signature to sign blinded messages which are authenticated. Here BGW only needs 1 addition operation and 1 multiplication operation in $Z_p^{*}$ . In [7], BGW needs 1 multiplication operation in $G_1$ and 1 hash operation. In [10], BGW needs 1 addition operation and 2 multiplication operations in $G_1$ .

In EPPDC scheme, LAG verifies that the message is indeed sent by BGW and recovers the original message m which needs 4 exponentiation operations, 6 multiplication operations, 1 addition operation, and 2 inverse operations in $Z_p^{*}$ . In [7], LAG can verify that the message is indeed sent by BGW and recover the original message m, which needs 1 exponentiation operation, 1 multiplication operation in $Z_n^2$ , 2 pairing operations, and 1 hash operation. In [10], LAG can verify that the message is indeed sent by BGW and recover the original message m, which needs 2 pairing operations, 1 multiplication operation in $G_1$ , 1 exponentiation operation in $G_T$ , 2 exponentiation operations in $Z_p$ , and AES decryption.

Since the AES encryption or decryption and hash function are negligible compared with exponentiation and pairing operations, here we mainly consider the computation overhead for other operations. Table 2 gives the test time for the involved cryptography operations [20]. The experiments are conducted on a computer with Intel i5-3210-2.5 GHz CPU and 4-GB RAM.

Table 2

Cryptographic operations execution time.

	Denotation	Time (ms)
$$T_{\text{EX}}$$	An exponentiation in $$Z_p^{*}$$	0.067
$$T_{\text{Ad}}$$	An addition in $$Z_p$$	0.001
$$T_{\text{Mu}}$$	A multiplication in $$Z_p^{*}$$	0.001
$$T_{\mathrm{In}}$$	An inverse operation in $$Z_p^{*}$$	0.004
$$T_{\text{Add}}$$	An addition in $$G_1$$	0.038
$$T_{\text{PM}}$$	A multiplication in $$G_1$$	8.006
$$T_{\text{Mul}}$$	A multiplication in $$G_T$$	0.013
$$T_{\text{EXp}}$$	An exponentiation in $$G_T$$	1.882
$$T_P$$	A pairing operation	16.064

When a message is sent by SM, the comparisons of computation complexity for SM, BGW, and LAG are shown in Table 3.

Table 3

The comparisons of computation complexity.

SM	BGW	LAG	Reference
$$2T_{\text{EX}}$$ + $$T_{\text{Mu}}$$	$$T_{\text{PM}}$$	$$T_{\text{EX}}$$ + $$T_{\text{Mu}}$$ + $$2T_P$$	[7]
0	$$2T_{\text{PM}}$$ + $$T_{\text{Add}}$$	$$2T_{\text{EX}}$$ + $$T_{\text{EXp}}$$ + $$T_{\text{PM}}$$ + $$2T_P$$	[10]
$$2T_{\text{EX}}$$ + $$3T_{\text{Mu}}$$ + $$T_{\mathrm{In}}$$	$$T_{\text{Mu}}$$ + $$T_{\text{Ad}}$$	$$4T_{\text{EX}}$$ + $$6T_{\text{Mu}}$$ + $$T_{\text{Ad}}$$ + $$2T_{\mathrm{In}}$$	This paper

When n messages are sent by different SMs to the same LAG, LAG can make use of the bath verification to reduce pairing operation from $2n$ to $n+1$ [7, 10].

With the exact operation costs, we depict the variation of computation costs in terms of the message number n in Figures 4 and 5, which is for BGW and LAG, respectively. From the figures, it can be obviously shown that the EPPDC scheme largely reduces the computation complexity for both BGW and LAG.

Figure 4

Computation cost of BGW.

Figure 5

Computation cost of LAG.

7. Conclusions

This paper proposes an efficient and privacy-preserving data collection scheme for smart grid, which is based on the blind signature and the key distribution scheme. This scheme can achieve that the users' data information is transmitted to the local aggregator through building gateway. And we analyze the EPPDC scheme. The analysis shows that the scheme not only provides privacy preserving but also has less computation cost than existing schemes.