Xiao Wei
School of Mathematics and Statistics, Guilin University of Technology, Guilin, China.
DOI: 10.4236/jcc.2026.144003   PDF    HTML   XML   28 Downloads   175 Views   Citations

Abstract

With the rapid increase of terminal devices in the Internet of Things (IoT), it has become a significant challenge to achieve real-time and privacy-preserving data aggregation. To address this challenge, edge computing has emerged as an effective paradigm to reduce latency, where a privacy-preserving data aggregation scheme is exploited to preserve data privacy. However, most existing privacy-preserving data aggregation schemes are limited by fixed data dimensions, low scalability, and high communication or computational overhead. To address these shortcomings, this paper proposes a multidimensional privacy-preserving data aggregation scheme that supports flexible dimension expansion and privacy protection in edge computing systems. The scheme integrates the Chinese Remainder Theorem (CRT) with an elastic modulus set to efficiently pack multidimensional data. This design enables terminal devices to add new data dimensions without interrupting current operations or modifying historical data. Furthermore, by exploiting Bulletproofs-based zero-knowledge proofs and Bellare-Neven (BN) signatures with half-aggregation, the proposed scheme enables lightweight and scalable batch verification of data integrity and authenticity. These mechanisms effectively reduce the verification workload and communication bandwidth in large-scale deployments. In addition, an optimized Paillier homomorphic encryption algorithm is used to enable efficient aggregation of encrypted multidimensional data. Experimental results and theoretical analysis show that the proposed scheme significantly reduces computational and communication costs compared with existing methods.

Keywords

Data Aggregation, Edge Computing, Chinese Remainder Theorem, Dynamic Dimension Expansion

Share and Cite:

1. Introduction

As a fundamental component of the digital economy, the Internet of Things (IoT) has entered a period of rapid development. In fields such as smart healthcare [1] [2], smart grids [3] [4], and industrial automation [5], real-time data collection is enabled by the utilization of multidimensional sensors in IoT. However, conventional cloud computing models are often inadequate for real-time applications, mainly because of high transmission latency, limited bandwidth, and inherent privacy risks [6]. These challenges can be effectively addressed by the edge computing framework, which is composed of a three-layer architecture consisting of terminal devices (TDs), edge nodes (ENs), and a control center (CC) [7]. The main advantages of edge computing are low-latency response, improved bandwidth utilization, and enhanced privacy protection [8] [9].

However, due to the openness and distributed deployment of edge nodes, the risks of privacy leakage and data tampering have increased [10] [11]. For example, sensitive data may be extracted by semi-honest edge nodes through collusion, and adversaries with forged identities can inject malicious data. To achieve a balance between data availability and privacy protection, researchers have proposed single-dimension privacy-preserving data aggregation (PDA) schemes [12]-[14] and multidimensional privacy-preserving data aggregation (MPDA) schemes [15]-[19]. Most existing schemes utilize homomorphic encryption [20] or the Chinese Remainder Theorem (CRT) [21]-[23] to achieve ciphertext aggregation. However, several challenges remain, such as limited dynamic scalability, low computational efficiency, and high communication overhead [24]. These schemes are generally designed for fixed data dimensions. As a result, the addition of a new dimension typically requires the reconstruction of global parameters, such as the modulus set, which results in considerable computational and communication overhead.

To address these challenges, this paper proposes a multidimensional privacy-preserving data aggregation scheme with dynamic dimension scalability. Specifically, the proposed scheme exploits CRT-based packing and an elastic modulus set to achieve flexible dimension expansion. To ensure lightweight verification and efficient aggregation, the proposed scheme integrates Bulletproofs-based zero-knowledge proofs, Bellare-Neven (BN) signatures with half-aggregation, and an optimized Paillier encryption algorithm. Based on these mechanisms, the main contributions of this work are summarized as follows.

1. A dynamic multidimensional data extension mechanism is proposed by introducing an elastic modulus set for CRT. In the proposed scheme, when the data dimension needs to be extended, ongoing operations are not interrupted because redundant coprime primes are preallocated. Therefore, when a new dimension needs to be added, appropriate primes can be directly selected from the modulus set, which eliminates the requirement to reconstruct historical data packings. Furthermore, the coprime property of CRT ensures unique decoding and constrains the data size, thereby preventing overflow.

2. To ensure data integrity and authenticity, Bulletproofs-based zero-knowledge proofs are integrated with BN signatures to provide multi-layered verification. In the proposed scheme, half-aggregation is exploited to reduce communication and computational overhead at the edge. Furthermore, the BN signature mechanism naturally binds the public key into the challenge hashing. As a result, robustness against false data injection, rogue-key attacks, and insider privilege abuse is ensured, even under a stronger adversarial model.

3. Efficient and scalable system-level optimizations are achieved through a hierarchical batch processing mechanism and a fault rollback strategy. In the event of batch verification failure, a grouped rollback procedure, such as dividing data into groups of ten, is triggered to quickly identify and eliminate invalid data, thereby ensuring processing efficiency and system stability.

4. Experimental results and theoretical analysis demonstrate that the proposed scheme significantly reduces both computational and communication costs compared with existing methods, thereby improving scalability and practicality in large-scale IoT deployments.

The remainder of this paper is organized as follows. Section II reviews related work. Section III describes the system model, adversary model, and design objectives. Section IV outlines the necessary preliminaries. Section V provides a detailed description of the proposed scheme. Sections VI and VII present the security analysis and performance evaluation, respectively. Finally, Section VIII concludes the paper.

2. Related Works

Privacy-preserving data aggregation plays a vital role in IoT, since it enables efficient data collection while safeguarding user privacy. Extensive research has been devoted to both single-dimensional and multidimensional aggregation schemes, with the goal of achieving a balance among security, efficiency, and flexibility. This section provides a concise overview of several representative privacy-preserving data aggregation approaches.

In the field of single-dimensional data aggregation, several core schemes have been proposed. Fan et al. [13] proposed a scheme in which an offline trusted third party distributes blinding factors to each smart meter. The scheme combines BLS short signatures with batch verification to ensure that the aggregator cannot access individual data. However, this scheme lacks fault tolerance and depends on the trusted third party to manage the blinding factors. To overcome these limitations, Liu et al. [25] proposed the $\left(k,n\right)$ -PDA scheme, which uses Shamir’s $\left(k,n\right)$ secret sharing to distribute the decryption key without requiring an online trusted authority. This approach, however, introduces high computational overhead and relies on the cloud server. To achieve real-time and low-latency aggregation, Guo et al. [26] proposed a fog-based edge architecture, in which efficient symmetric homomorphic encryption replaces public-key operations at the smart meter side. This design enables a lightweight scheme that supports ciphertext-domain aggregation in real-time without relying on any online trusted party. Nevertheless, these approaches are limited to single-dimensional aggregation, which restricts fine-grained data analysis and high-frequency reporting in IoT applications.

To overcome the limitations of single-dimensional aggregation, researchers have proposed multidimensional privacy-preserving data aggregation (MPDA) schemes. Early schemes, such as the EPPA proposed by Lu et al. [15], exploited Paillier homomorphic encryption and super-increasing sequences to achieve multidimensional aggregation. However, these schemes generally suffered from cross-dimensional interference, data overflow risks, high computational costs, and limited support for non-linear aggregation functions. To address these issues, Chen et al. [27] improved the encoding strategy, which allowed a single ciphertext to represent multiple data types and support variance and one-way ANOVA analysis. Liu et al. [28] introduced a dual-trapdoor encryption mechanism in a fog computing environment to balance data controllability and functionality, although the system complexity remains high. Boudia et al. [19] proposed a lightweight aggregation scheme based on elliptic curve cryptography, avoiding expensive bilinear pairing operations. Subsequently, developed under a fog computing architecture, the ESMA scheme [29] further enhanced multidimensional data encoding and fault tolerance. More recently, Peng et al. [30] proposed a CRT-based packing method with a counter to prevent data overflow and support complex functions. Xu et al. [31] combined CRT with symmetric encryption in an edge computing environment, improving scalability and fault tolerance. Moreover, their schemes leveraged the distributed computing capabilities of edge nodes to achieve low-latency and real-time data aggregation.

In the field of PDA, studies have focused on enhancing data integrity and verifiability. To this end, digital signatures or lightweight verification mechanisms have been integrated into aggregation frameworks to enable result verification while preserving data privacy. Boschini et al. [32] proposed a progressive and efficient verification framework that supports partial verification even under interruptions. Similarly, Zhang et al. [33] designed a post-quantum identity-based signature scheme for IoT networks, which enhances both signature security and authentication performance. To extend these algorithmic improvements to system-level applications, Shrivastava et al. [34] combined quantum-resistant signatures with blockchain to ensure data integrity in cloud and IoE systems. However, most of these methods still rely on static signature models and lack flexible coordination among multiple terminals. Consequently, balancing verification efficiency and system robustness under strong adversarial conditions remains challenging for these methods.

The above-mentioned existing studies have advanced along three primary directions: functional extension, efficiency optimization, and architectural evolution. Although significant progress has been made in security and efficiency, three common limitations remain: i) the data dimensions are fixed, making dynamic expansion difficult; ii) static signature schemes cannot withstand attacks under strong adversarial conditions; and iii) the lack of system-level fault recovery and rollback mechanisms hinders reliability.

3. System Design

3.1. System Model

Our system model consists of three types of entities: CC, ENs, and TDs, as illustrated in Figure 1. In this architecture, TDs collect and encrypt data, and then transmit the resulting ciphertexts to ENs. ENs aggregate the ciphertexts, and the CC performs the decryption. The detailed responsibilities of each entity are described as follows.

Figure 1. System model.

• Control Center (CC): The CC performs system initialization, including the generation of cryptographic key pairs and the construction of the modulus set. It decrypts the aggregated ciphertexts and manages the process of dynamic data dimension extension. Furthermore, the CC oversees secure key distribution and conducts regular key updates to ensure system security and scalability.

• Terminal Devices (TDs): TDs collect raw data using multidimensional sensors and pack the collected data. They utilize the Paillier homomorphic encryption algorithm to ensure data privacy. Furthermore, TDs generate zero-knowledge proofs and digital signatures over the encrypted data to ensure data authenticity and integrity.

• Edge Nodes (ENs): ENs aggregate the received ciphertexts and verify both the digital signatures and zero-knowledge proofs. Upon successful verification, they forward the aggregated results to the CC, ensuring the confidentiality and integrity of the data processing chain.

To ensure the deterministic execution of the non-interactive BN signature and batch verification, we assume a time-slotted synchronization mechanism for the aggregation epochs. At the beginning of each epoch, the serving EN determines an active terminal list $L$ according to the currently registered and reachable TDs in its coverage domain, and broadcasts $L$ together with the epoch/version information and an authentication tag (or digital signature) to all participating TDs. Before computing the BN challenge, each TD verifies the authenticity and freshness of the received list. Consequently, all TDs in the same epoch compute their cryptographic challenges based on the same trusted and globally synchronized $L$ . We assume the network topology remains quasi-static within the short aggregation window. If any terminal disconnects or fails to upload its ciphertext, the EN detects the state mismatch during batch verification and deterministically triggers the recursive group rollback mechanism to isolate the missing or invalid proofs. Severe synchronization failures within an epoch may lead to challenge inconsistency and packet rejection. Likewise, if a large number of TDs drop out during the same epoch, the aggregation process may experience increased verification overhead and reduced service availability.

3.2. Threat Model

In our security model, the CC and ENs are regarded as semi-honest (i.e., honest-but-curious) entities. Specifically, they adhere to the prescribed protocol, where ENs perform batch verification and ciphertext aggregation, and the CC decrypts the results. However, they may attempt to infer the private multidimensional data of individual TDs from the processed ciphertexts. We assume that communication between the CC and other entities occurs over secure channels and that no collusion occurs between the CC and ENs, or between ENs and TDs. Therefore, collusion between the CC and the serving EN is not considered in the present threat model.

While the majority of TDs are benign, we assume the existence of a Probabilistic Polynomial-time (PPT) adversary $A$ . $A$ may act as an external attacker or compromise a fraction of the TDs. Specifically, $A$ is capable of launching the following attacks.

• Privacy Violation: $A$ may eavesdrop on public communication channels to intercept ciphertexts, attempting to distinguish or recover the underlying multidimensional plaintext data without the master private key.

• Data Forgery and Impersonation: $A$ may attempt to forge digital signatures to impersonate legitimate TDs or tamper with the aggregated ciphertexts and signatures during transmission.

• Data Pollution: Through compromised TDs, $A$ may attempt to forge zero-knowledge proofs to inject invalid, out-of-range data into the aggregation pool, bypassing range verification and distorting the final statistical results at the CC.

3.3. Design Goals

Guided by the system and threat models, we design the proposed scheme to satisfy the following core requirements.

• Dynamic Dimension Scalability. The scheme must support the on-demand addition of data dimensions, ensuring uninterrupted system services through flexible modulus set management.

• Data Authenticity and Integrity. Lightweight BN signatures must be incorporated to enable the real-time verification of data integrity, preventing data tampering and impersonation attacks.

• Privacy-Preserving Aggregation. The scheme must prevent the disclosure of raw data during aggregation by exploiting Paillier homomorphic encryption, complemented by Bulletproofs to verify data compliance.

• Efficient Data Processing. The scheme must achieve high computational and communication efficiency. Specifically, CRT-based packing reduces the encryption burden on TDs, while BN half-aggregation and batch verification minimize communication overhead at the ENs, supporting concurrent access from numerous TDs.

• Robustness against Malicious Entities. The scheme must resist inference attacks from semi-honest ENs and active attacks from compromised TDs. The integration of BN signatures prevents rogue-key attacks during aggregation, while Bulletproofs block the injection of invalid data, ensuring robust security under strong adversarial conditions.

4. Preliminaries

In this section, we outline the cryptographic assumptions and primitives underlying our proposed scheme.

4.1. Cryptographic Hardness Assumptions

The formal security proofs of our scheme rely on two standard cryptographic hardness assumptions.

1) Decisional Composite Residuosity (DCR) Assumption: Let $N=pq$ be a Paillier modulus, where $p$ and $q$ are two large prime numbers of equal bit-length. The DCR problem states that given a random element $z\in {\mathbb{Z}}_{N^2}^{\text{*}}$ , it is computationally intractable for any probabilistic polynomial-time (PPT) algorithm to determine whether $z$ is an $N$ -th residue modulo $N^2$ . Specifically, it is computationally hard to distinguish whether there exists an $x\in {\mathbb{Z}}_{N^2}^{\text{*}}$ such that $z\equiv x^N\left(\mathrm{mod}{N}^2\right)$ or if $z$ is uniformly distributed in ${\mathbb{Z}}_{N^2}^{\text{*}}$ .

2) Elliptic Curve Discrete Logarithm Problem (ECDLP): Let $\mathbb{G}$ be a cyclic elliptic curve group of prime order $l$ , and let $G$ be a generator of $\mathbb{G}$ . Given a tuple $\left(G,Y\right)$ , where $Y=xG$ for a randomly chosen secret scalar $x\in {\mathbb{Z}}_l^{\text{*}}$ , the ECDLP asserts that extracting $x$ is computationally infeasible for any PPT adversary.

4.2. Paillier Cryptosystem and CRT Packing

To enable privacy-preserving data aggregation at the edge, our scheme utilizes the Paillier cryptosystem integrated with the Chinese Remainder Theorem (CRT).

1) Paillier Cryptosystem: Paillier [35] is an asymmetric encryption scheme featuring an additive homomorphic property. To optimize computational efficiency, our scheme adopts the variant where the generator is fixed as $g=N+1$ .

• Key Generation: Compute the modulus $N=pq$ and the Carmichael function $\lambda =\text{lcm}\left(p-1,q-1\right)$ . The decryption parameter is $\mu ={\lambda }^{-1}\left(\mathrm{mod}N\right)$ . The public key is $N$ , and the private key is $\left(\lambda ,\mu \right)$ .

• Encryption: To encrypt a message $m\in {\mathbb{Z}}_N$ , choose a random $r\in {\mathbb{Z}}_N^{\text{*}}$ and compute the ciphertext as $c=\left(1+m\cdot N\right)\cdot r^N\left(\mathrm{mod}{N}^2\right)$ .

• Decryption: Given $c$ , the plaintext is recovered as $m=L\left(c^{\lambda }\left(\mathrm{mod}{N}^2\right)\right)\cdot \mu \left(\mathrm{mod}N\right)$ , where $L\left(x\right)=\frac{x-1}{N}$ .

• Additive Homomorphism: For ciphertexts $c_1=\text{Enc}\left(m_1\right)$ and $c_2=\text{Enc}\left(m_2\right)$ , the product of ciphertexts decrypts to the sum of their plaintexts: $c_1\cdot c_2\left(\mathrm{mod}{N}^2\right)=\text{Enc}\left(m_1+m_2\left(\mathrm{mod}N\right)\right)$ .

2) CRT Packing Mechanism: The CRT provides an isomorphic mapping to pack multidimensional small integers into a single large integer. Let $\Psi =\left\{{\psi }_1,\cdots ,{\psi }_k\right\}$ be a set of pairwise coprime moduli, and let $M={\displaystyle {\prod }_{i=1}^k{\psi }_i}$ . A multidimensional data vector $\left(d_1,\cdots ,d_k\right)$ , where each $d_i<{\psi }_i$ , can be uniquely packed into a single integer $D\in {\mathbb{Z}}_M$ as

$D={\displaystyle \sum }_{i=1}^k{d}_i\cdot M_i\cdot {M^{\prime }}_i\left(\mathrm{mod}M\right),$ (1)

where $M_i=M/{\psi }_i$ , and ${M^{\prime }}_i$ is the modular inverse of $M_i$ modulo ${\psi }_i$ . After homomorphically aggregating the packed integers, the aggregated sum for each dimension $i$ can be extracted using the modulo operation $D_{agg}\left(\mathrm{mod}{\psi }_i\right)$ , provided that the aggregated plaintext does not exceed the Paillier modulus $N$ .

4.3. Bellare-Neven Signatures and Half-Aggregation

To ensure data authenticity while minimizing communication overhead, we employ the BN signature mechanism. Unlike standard Schnorr multi-signatures that require interactive rounds, the BN scheme allows a verifier to non-interactively compress multiple independent signatures into a single compact representation.

Let $H$ be a cryptographic hash function. A terminal device generates a secret key $sk\in {\mathbb{Z}}_l^{*}$ and a public key $pk=sk\cdot G$ . To sign a message $M$ , the device chooses a random nonce $r\in {\mathbb{Z}}_l^{\text{*}}$ , computes $R=r\cdot G$ , and derives the challenge $c=H\left(L\parallel pk\parallel R\parallel M\right)$ , where $L$ is the list of participating public keys. The signature scalar is $s=r+c\cdot sk\left(\mathrm{mod}l\right)$ , yielding the signature $\sigma =\left(R,s\right)$ .

Given $n$ signatures ${\sigma }_i=\left(R_i,s_i\right)$ from $n$ distinct devices, the half-aggregation technique compresses the scalars into $s_{agg}={\displaystyle {\sum }_{i=1}^n{s}_i}\left(\mathrm{mod}l\right)$ . The aggregate signature becomes $\left(R_1,\cdots ,R_n,s_{agg}\right)$ , reducing bandwidth requirements by approximately half. Because the distinct public key $p{k}_i$ is hashed into the challenge $c_i$ , this mechanism prevents rogue-key attacks, in which an adversary crafts public keys to cancel out legitimate signatures.

4.4. Pedersen Commitments and Bulletproofs

To prevent data pollution attacks without compromising privacy, our scheme integrates Pedersen commitments with Bulletproofs.

1) Pedersen Commitment: The Pedersen commitment is a homomorphic commitment scheme providing perfectly hiding and computationally binding properties under the ECDLP. For a data value $d$ and a random blinding factor $r\in {\mathbb{Z}}_l^{\text{*}}$ , the commitment is defined as $com=d\cdot G+r\cdot H$ , where $G$ and $H$ are independent generators of $\mathbb{G}$ . It satisfies additive homomorphism: $co{m}_1+co{m}_2=\left(d_1+d_2\right)G+\left(r_1+r_2\right)H$ .

2) Bulletproofs Range Proof: Bulletproofs is a non-interactive zero-knowledge proof protocol that requires no trusted setup [36]. In our scheme, for the multidimensional data vector of a terminal device $T{D}_i$ , we use $co{m}_i$ to denote the corresponding commitment object, which may be instantiated as a vector commitment or an equivalent set of per-dimension commitments. Based on $co{m}_i$ , $T{D}_i$ generates a proof ${\pi }_i$ to convince the ENs that each committed dimension lies within its valid range $\left[0,{\Gamma }_j\right]$ without revealing the plaintext values. The verifier checks ${\pi }_i$ with respect to the corresponding $co{m}_i$ , so that the multidimensional range proof is explicitly bound to the same committed data instance.

5. Our Proposed Scheme

Our scheme includes four phases: system initialization, data collection, data aggregation, and data decryption. The symbols used in our scheme are defined in Table 1.

Table 1. Symbol definitions.

Symbol	Description
$N=pq$	Paillier modulus ($p,q$ are large secure primes)
$g=N+1$	Generator for the Paillier cryptosystem
$\lambda ,\mu$	Carmichael function $\lambda =\text{lcm}\left(p-1,q-1\right)$ , and decryption parameter $\mu ={\lambda }^{-1}\left(\mathrm{mod}N\right)$
$l$	Prime order of the elliptic curve group $\mathbb{G}$
$\Psi ,{\psi }_j$	System modulus set, and $j$ -th dimensional coprime modulus
${\Gamma }_j$	Maximum legitimate boundary value for the $j$ -th dimension
$T_{cap}$	Secure capacity threshold to prevent plaintext overflow
$n_{\max }$	Maximum physical capacity of TDs connected to a single EN
$d_{ij}$	The plaintext data of the $j$ -th dimension for terminal $T{D}_i$
$S^{\left(k\right)},M^{\left(k\right)}$	The $k$ -th chunk of active moduli and its corresponding product
$\left(s{k}_i,p{k}_i\right)$	Digital signature private and public key pair of $T{D}_i$
$L$	List of public keys from all participating terminals
$co{m}_i,{\pi }_i$	Commitment object for the multidimensional data of $T{D}_i$ , and the corresponding Bulletproofs range proof
$C_i^{\left(k\right)},C_{agg}^{\left(k\right)}$	Individual and aggregated ciphertext for the $k$ -th chunk
${\sigma }_i,{\sigma }_{agg}$	Bellare-Neven signature and aggregated half-signature

5.1. System Initialization

The CC initializes the system and publishes the public parameters as follows.

• Step 1: Let $\mathbb{G}$ be an elliptic curve group of prime order $l$ with generators $G$ and $H$ . The CC randomly selects two large prime numbers $p,q\leftarrow \text{GenPrime}\left(\kappa \right)$ , computes the Paillier modulus $N=pq$ and the Carmichael function $\lambda =\text{lcm}\left(p-1,q-1\right)$ , and sets $g=N+1$ as the generator for the Paillier cryptosystem. Additionally, the CC computes the decryption parameter $\mu ={\lambda }^{-1}\left(\mathrm{mod}N\right)$ .

• Step 2: The CC initializes the modulus set by selecting $K_{\max }+20\%$ extra prime numbers using a prime generation function, denoted as the set $\Psi =\left\{{\psi }_1,\cdots ,{\psi }_K\right\}$ . These primes will be used for CRT packing.

• Step 3: Each terminal device $T{D}_i$ independently generates a key pair $\left(s{k}_i,p{k}_i\right)$ for the digital signature algorithm to ensure data authenticity and non-repudiation. The secret key $s{k}_i$ is kept local and is never shared.

• Step 4: To prevent plaintext overflow during homomorphic aggregation, the CC establishes a packing capacity boundary. Let $n_{\max }$ denote the maximum number of terminal devices connected to a single Edge Node (EN). The CC computes the secure capacity threshold $T_{cap}$ as

$T_{cap}=\lfloor \frac{N}{n_{\max }}\rfloor .$ (2)

This threshold guarantees that the aggregated sum of any valid packed data chunk does not exceed the Paillier modulus $N$ , thereby preventing modular truncation during decryption.

• Step 5: To guarantee the state machine consistency and forward compatibility of the dynamic aggregation protocol, the CC initializes the global system epoch with a genesis version tag $V_{id}^{\left(0\right)}$ . Consequently, the CC broadcasts the complete public parameters to all ENs and TDs according to Equation (3).

$PP=\left\{N,g,\Psi ,\mathbb{G},l,G,H,T_{cap},V_{id}^{\left(0\right)}\right\}$ (3)

5.2. Data Collection

Each terminal device $T{D}_i$ performs the following operations on its multidimensional data vector $d_i=\left(d_{i1},\cdots ,d_{im}\right)$ .

• Step 1: $T{D}_i$ selects $m$ prime numbers from the modulus set Ψ to form the active set corresponding to its current data dimensions, denoted by $S_{active}=\left\{{\psi }_{s_1},\cdots ,{\psi }_{s_m}\right\}$ . To prevent plaintext overflow caused by a single large modulus product, $T{D}_i$ performs an adaptive capacity check using $T_{cap}$ . $T{D}_i$ partitions $S_{active}$ into $B$ chunks, denoted by $\left\{S^{\left(1\right)},\cdots ,S^{\left(B\right)}\right\}$ , using a greedy algorithm. For any chunk $k\in \left\{1,\cdots ,B\right\}$ , the product of its moduli must satisfy the capacity threshold:

$M^{\left(k\right)}={\displaystyle \prod }_{\psi \in S^{\left(k\right)}}\psi \le T_{cap}.$ (4)

• Step 2: For each chunk $k$ , $T{D}_i$ computes the specific CRT packing coefficients. For a given prime ${\psi }_{s_j}\in S^{\left(k\right)}$ , the coefficients are calculated as

$M_j^{\left(k\right)}=\frac{M^{\left(k\right)}}{{\psi }_{s_j}},{\left(M_j^{\left(k\right)}\right)}^{\prime }\equiv {\left(M_j^{\left(k\right)}\right)}^{-1}\left(\mathrm{mod}{\psi }_{s_j}\right).$ (5)

• Step 3: $T{D}_i$ generates the data commitment $co{m}_i=\text{commit}\left(d_{i1},\cdots ,d_{im}\right)$ , where $d_{ij}\le {\Gamma }_j<{\psi }_{s_j}/2$ . Then, it uses the Bulletproofs protocol to generate a zero-knowledge range proof covering all dimensions, computed as

${\pi }_i=\text{Bulletproofs}.\text{Prove}\left(d_{i1},\cdots ,d_{im},{\Gamma }_1,\cdots ,{\Gamma }_m,co{m}_i\right).$ (6)

• Step 4: Rather than computing a single integer, $T{D}_i$ constructs a set of packed values. For each chunk $k\in \left\{1,\cdots ,B\right\}$ , the packed value is computed as

$D_i^{\left(k\right)}={\displaystyle \sum }_{{\psi }_{s_j}\in S^{\left(k\right)}}{d}_{ij}\cdot M_j^{\left(k\right)}\cdot {\left(M_j^{\left(k\right)}\right)}^{\prime }\left(\mathrm{mod}{M}^{\left(k\right)}\right).$ (7)

• Step 5: $T{D}_i$ encrypts each packed chunk independently using the optimized Paillier encryption algorithm. For each $k\in \left\{1,\cdots ,B\right\}$ , the ciphertext is generated as

$C_i^{\left(k\right)}=\left(1+D_i^{\left(k\right)}\cdot N\right)\cdot {\left(r_i^{\left(k\right)}\right)}^N\left(\mathrm{mod}{N}^2\right),$ (8)

where $r_i^{\left(k\right)}\leftarrow {\mathbb{Z}}_N^{\text{*}}$ . Consequently, the terminal generates a ciphertext vector $C_i=\left\{C_i^{\left(1\right)},\cdots ,C_i^{\left(B\right)}\right\}$ .

• Step 6: To ensure data authenticity and prevent forgery without requiring online interaction, $T{D}_i$ applies the BN signature mechanism. It generates a random nonce $r_i\leftarrow {\mathbb{Z}}_l^{\text{*}}$ , computes $R_i=r_{i}G$ , and obtains the authenticated public key list $L=\left\{p{k}_1,\cdots ,p{k}_n\right\}$ broadcast by the serving EN for the current epoch. After verifying the validity and freshness of $L$ , $T{D}_i$ binds the active version tag $V_{id}^{\left(0\right)}$ into the cryptographic challenge $c_i$ , which is computed as

$c_i=H\left(L\parallel p{k}_i\parallel R_i\parallel C_i\parallel {\pi }_i\parallel co{m}_i\parallel V_{id}^{\left(0\right)}\right)$ (9)

The terminal computes $s_i=r_i+c_i\cdot s{k}_i\left(\mathrm{mod}l\right)$ . The resulting BN signature is ${\sigma }_i=\left(R_i,s_i\right)$ .

• Step 7: $T{D}_i$ transmits the data packet $\left\{C_i,{\pi }_i,{\sigma }_i,co{m}_i\right\}$ to the EN.

5.3. Data Aggregation

ENs aggregate the messages received from terminal devices ($T{D}_i$ ) and forward the aggregated results to the CC.

• Step 1: The EN collects data packets from $n$ active devices:

$\left\{\left\{V_{id}^{\left(0\right)},C_1,{\pi }_1,{\sigma }_1,co{m}_1\right\},\cdots ,\left\{V_{id}^{\left(0\right)},C_n,{\pi }_n,{\sigma }_n,co{m}_n\right\}\right\}.$ (10)

Upon receiving the data packets from the terminals, the EN first checks the plaintext version tag of each packet. It verifies whether the tag matches the current system version (initially $V_{id}^{\left(0\right)}$ ). If a packet contains a mismatched version tag, the EN discards it to prevent cross-version interference. For the remaining valid packets, the EN proceeds with batch verification and ciphertext aggregation.

• Step 2: The EN performs batch verification of the individual BN signatures to authenticate device identities and data integrity:

$Vali{d}_{sig}={\text{BatchVerify}}_{\text{BN}}\left(p{k}_i,C_i,{\sigma }_i\right).$ (11)

Subsequently, the EN performs batch verification of the Bulletproofs range proofs. This step ensures that all hidden multidimensional data fall within legitimate ranges without requiring decryption according to Equation (12).

$Vali{d}_{proof}={\text{BatchVerify}}_{\text{bulletproofs}}\left({\pi }_i,co{m}_i,{\text{Γ}}_j\right).$ (12)

Here, each proof ${\pi }_i$ is verified with respect to its corresponding commitment object $co{m}_i$ and the prescribed range bounds $\left\{{\text{Γ}}_j\right\}$ , thereby ensuring that the verified range statement is bound to the same multidimensional data instance committed by $T{D}_i$ .

• Step 3: If batch verification fails, the EN applies a group rollback mechanism to efficiently locate the invalid data. The failed batch is divided into smaller groups for independent re-verification. This process is recursively subdivided until malicious or faulty devices are accurately identified and excluded.

• Step 4: Upon successful verification, the EN aggregates the ciphertexts from all valid terminals on a chunk-by-chunk basis. For each chunk index $k\in \left\{1,\cdots ,B\right\}$ , the aggregated ciphertext is computed utilizing the homomorphic property of the Paillier cryptosystem:

$C_{agg}^{\left(k\right)}={\displaystyle \prod }_{i=1}^n{C}_i^{\left(k\right)}\left(\mathrm{mod}{N}^2\right).$ (13)

This yields an aggregated ciphertext vector $C_{agg}=\left\{C_{agg}^{\left(1\right)},\cdots ,C_{agg}^{\left(B\right)}\right\}$ .

• Step 5: To compress the signatures, the EN applies the non-interactive half-aggregation technique of the BN scheme. After validating the individual signatures, the EN aggregates the scalar components into a single compact scalar as

$s_{agg}={\displaystyle \sum }_{i=1}^n{s}_i\left(\mathrm{mod}l\right).$ (14)

The resulting aggregate signature is ${\sigma }_{agg}=\left(R_1,\cdots ,R_n,s_{agg}\right)$ . This process compresses the $n$ individual signatures by approximately half, thereby optimizing the communication overhead to the CC.

5.4. Data Decryption

The CC verifies and decrypts the aggregated data to extract the multidimensional statistical results.

• Step 1: Upon receiving the aggregated packet, the CC verifies the validity of the BN aggregate signature. The CC recalculates the independent challenges $c_i$ for each terminal and executes the batch verification equation as

$s_{agg}G={\displaystyle \sum }_{i=1}^n{R}_i+{\displaystyle \sum }_{i=1}^n{c}_i\cdot p{k}_i.$ (15)

If the equation holds, it cryptographically guarantees that no rogue key attacks have occurred and that the integrity of the aggregated ciphertext $C_{agg}$ is intact.

• Step 2: If the verification passes, the CC processes the aggregated data from each Edge Node independently to prevent homomorphic plaintext overflow. Let $E$ denote the total number of active ENs, and let $C_{agg,e}^{\left(k\right)}$ denote the $k$ -th aggregated ciphertext chunk received from the $e$ -th EN ($1\le e\le E$ ). For each EN $e$ and each chunk $k\in \left\{1,\cdots ,B\right\}$ , the CC performs Paillier decryption as follows:

$L_e^{\left(k\right)}=\frac{{\left(C_{agg,e}^{\left(k\right)}\right)}^{\lambda }\left(\mathrm{mod}{N}^2\right)-1}{N},$ (16)

$D_{agg,e}^{\left(k\right)}=\left(L_e^{\left(k\right)}\cdot \mu \right)\left(\mathrm{mod}N\right).$ (17)

Because the adaptive chunking mechanism enforces $M^{\left(k\right)}\le T_{cap}$ during the data collection phase, and the number of devices aggregated by a single EN is bounded by $n_e\le n_{\max }$ , the arithmetic sum for each EN satisfies:

$D_{ag{g}_{real},e}^{\left(k\right)}={\displaystyle \sum }_{i=1}^{n_e}{D}_i^{\left(k\right)}\le n_{\max }\cdot T_{cap}<N.$ (18)

Therefore, no modular truncation occurs during the decryption of any individual EN’s packet, ensuring data integrity at the edge level.

• Step 3: To obtain the global statistical results across the entire system, the CC aggregates the decrypted chunks from all ENs in the plaintext domain as

$D_{globa{l}_{agg}}^{\left(k\right)}={\displaystyle \sum }_{e=1}^E{D}_{agg,e}^{\left(k\right)}.$ (19)

• Step 4: Finally, the CC performs CRT decoding to recover the aggregated value for each specific dimension. For a given dimension $j$ , the CC identifies the specific chunk $k$ containing the modulus ${\psi }_{s_j}$ (i.e., ${\psi }_{s_j}\in S^{\left(k\right)}$ ) and extracts the value as

$d_{total,j}=D_{globa{l}_{agg}}^{\left(k\right)}\left(\mathrm{mod}{\psi }_{s_j}\right).$ (20)

For multi-EN deployment, Eq. (20) is directly applicable only when the modulus ${\psi }_{s_j}$ is sufficient to bound the system-wide sum of dimension $j$ . Otherwise, each EN should first decode its local per-dimension aggregate, after which the CC computes the final global sum by adding the decoded results from all ENs.

5.5. Dynamic Dimension Update

1. Trigger Conditions

• Expanding data dimensions may be necessary to accommodate new business requirements, such as adding new sensor types or statistical indicators.

• Unused redundant prime numbers must remain available in the existing modulus set Ψ (i.e., the total number of dimensions has not exceeded $K_{\max }+20\%$ ).

2. Dimension Update Process

Once the trigger conditions are met, the dimension update process is executed as follows, integrating with the adaptive chunking mechanism.

• Step 1: The CC selects a prime ${\psi }_{\text{new}}$ from the unused modulus set Ψ that satisfies ${\psi }_{\text{new}}>n_{\text{max}}\cdot {\text{Γ}}_{\text{new}}$ , where ${\Gamma }_{\text{new}}$ is the maximum boundary for the new dimension and $n_{\text{max}}$ is the maximum number of terminal devices. The CC increments the global system version to $V_{id}^{\text{new}}$ and broadcasts $\left\{V_{id}^{\text{new}},{\psi }_{\text{new}},{\text{Γ}}_{\text{new}}\right\}$ to all ENs and TDs.

• Step 2: Upon receiving the update, $T{D}_i$ updates its active version to $V_{id}^{\text{new}}$ and adds ${\psi }_{\text{new}}$ to its active dimension set: $S_{\text{active}}^{\text{new}}=S_{\text{active}}\cup \left\{{\psi }_{\text{new}}\right\}$ . To prevent overflow, $T{D}_i$ re-runs the greedy capacity check against $T_{cap}$ . If the addition of ${\psi }_{\text{new}}$ causes a chunk to exceed $T_{cap}$ , $T{D}_i$ automatically allocates ${\psi }_{\text{new}}$ to a new chunk $B+1$ , ensuring the system remains overflow-free.

• Step 3: $T{D}_i$ updates its local CRT packing parameters for the specific chunk $k$ containing ${\psi }_{\text{new}}$ . When uploading the updated data vector $d_i=\left(d_{i1},\cdots ,d_{im},d_{i\text{new}}\right)$ , it computes the new packed values $\left\{D_i^{\left(k\right)}\right\}$ and encrypts them into a new ciphertext vector $C_i^{\text{new}}$ .

• Step 4: To prove the validity of the new dimension, $T{D}_i$ generates an updated Bulletproofs range proof ${\pi }_{\text{new}}$ covering all dimensions (including $d_{i\text{new}}\le {\text{Γ}}_{\text{new}}$ ) and an updated commitment $co{m}_i^{\text{new}}$ . To ensure consistent security, $T{D}_i$ maintains the BN signature mechanism for the updated packet. It generates a random nonce $r_i\leftarrow {\mathbb{Z}}_l^{\text{*}}$ , computes $R_i=r_{i}G$ , and calculates the cryptographic challenge as

$c_i=H\left(L\parallel p{k}_i\parallel R_i\parallel C_i^{\text{new}}\parallel {\pi }_{\text{new}}\parallel co{m}_i^{\text{new}}\parallel V_{id}^{\text{new}}\right).$ (21)

The terminal uses its private key $s{k}_i$ to compute $s_{i,\text{new}}=r_i+c_i\cdot s{k}_i\left(\mathrm{mod}l\right)$ , resulting in the updated signature ${\sigma }_{i,\text{new}}=\left(R_i,s_{i,\text{new}}\right)$ .

• Step 5: The ENs filter packets by the new version tag $V_{id}^{\text{new}}$ , perform the vectorized aggregation, and execute the BN half-aggregation as defined in Section V.C. Subsequently, the CC verifies the aggregate signature, decrypts the chunks, and decodes the new dimension using the CRT as

$d_{\text{new}}^{\text{total}}=D_{agg}^{\left(k\right)}\left(\mathrm{mod}{\psi }_{\text{new}}\right),$ (22)

where $k$ is the index of the chunk containing ${\psi }_{\text{new}}$ .

6. Security Analysis

In this section, we analyze the security of the proposed dimension-scalable data aggregation scheme under standard cryptographic assumptions. Rather than relying solely on informal attack scenarios, we provide theorem-based security arguments and proof sketches for data privacy, authenticity, and integrity. The following arguments are developed under the system and threat assumptions defined in Section III.

6.1. Data Confidentiality (IND-CPA Security)

Theorem 1. Under the decisional composite residuosity (DCR) assumption, the Paillier-based encryption component of the proposed scheme achieves IND-CPA security for the packed multidimensional data.

Proof sketch. The argument follows the standard IND-CPA security intuition of Paillier encryption under the DCR assumption. In the proposed scheme, each multidimensional data vector is first deterministically packed into a plaintext integer by the public CRT-based encoding rule and is then encrypted by the Paillier cryptosystem. Therefore, any PPT adversary that can distinguish between encryptions of two packed multidimensional plaintexts with non-negligible advantage can be used to distinguish Paillier encryptions under the same public key, contradicting the IND-CPA security of Paillier under the DCR assumption. Hence, the confidentiality of the packed multidimensional data reduces to the IND-CPA security of the Paillier encryption component. In addition, the adaptive chunking mechanism keeps each packed plaintext within the admissible encoding bound, thereby avoiding ambiguity caused by modular overflow during aggregation and decoding.

6.2. Data Authenticity and Integrity (EUF-CMA Security)

Theorem 2. In the random oracle model, the BN half-aggregation mechanism of the proposed scheme is existentially unforgeable against chosen-message attacks under the hardness of the discrete logarithm (DL) problem in $\mathbb{G}$ .

Proof sketch. The argument follows the standard Bellare–Neven-style security intuition in the random oracle model. Suppose that a PPT adversary can forge a valid BN aggregate signature for the target public-key list with non-negligible probability. Then, by replaying the adversary under the same randomness but with a different oracle response, one can obtain two valid aggregate signatures corresponding to the same nonce values and different challenge values. Their difference yields a non-trivial linear relation over the involved public keys, from which the secret scalar associated with the target public key can be extracted using the standard forking-based argument. Because a successful forgery with non-negligible probability would imply an efficient solver for the DL problem in $\mathbb{G}$ , this contradicts the stated hardness assumption. Hence, under the stated assumptions, the BN half-aggregation mechanism provides authenticity and integrity protection against chosen-message forgery. Moreover, because all terminals in the same epoch compute their challenges over the same authenticated public-key list, the attack surface for rogue-key-style manipulation is reduced during EN-side batch verification.

6.3. Consistency of Commitments and Range Proofs

In the proposed scheme, $co{m}_i$ denotes the commitment object associated with the multidimensional data of $T{D}_i$ , and ${\pi }_i$ denotes the corresponding Bulletproofs range proof. Owing to the hiding and binding properties of the underlying commitment mechanism, together with the soundness of Bulletproofs, the EN can verify that each committed dimension satisfies its prescribed range constraint without learning the plaintext values. Since the verifier checks ${\pi }_i$ with respect to the corresponding $co{m}_i$ , the range proof is bound to the same multidimensional data instance contained in the packet generated by $T{D}_i$ .

7. Performance Evaluation

7.1. Experimental Setup

This section evaluates the performance of the proposed scheme regarding computational and communication costs, followed by a comparison with four existing schemes: ESMA [29], MMSDA [30], EPPA [15], and LPPDA [37].

To ensure fairness, the security level is set to 112 bits across all evaluated schemes. The Paillier cryptosystem adopts 1024-bit primes ($p,q$ ) and a 2048-bit modulus $N$ . For the elliptic curve operations, the NIST P-224 curve is utilized to provide a 224-bit prime field, where group elements are 448 bits in length (uncompressed). For schemes involving bilinear pairings (e.g., ESMA), an equivalent Barreto-Naehrig (BN-254) curve is employed to maintain a consistent security strength. Identifier and timestamp sizes are fixed at 32 bits and 64 bits, respectively.

Key cryptographic operations are simulated using the PBC and OpenSSL libraries. The experiments are conducted on a PC running a 64-bit Windows 11 operating system, equipped with an Intel Core i5-1035G1 CPU (1.00 GHz) and 16 GB RAM. The execution times of the basic operations, averaged over 1000 trials, are summarized in Table 2.

Table 2. Basic operation execution time (milliseconds).

Symbol	Definition	Time (ms)
$T_{Pai{l}_{En}}$	Standard Paillier encryption time	164.826
$T_M$	Modular multiplication in ${\mathbb{Z}}_{N^2}$	0.085
$T_E$	Modular exponentiation in ${\mathbb{Z}}_{N^2}$	1.821
$T_{bp}$	Bilinear pairing operation time	3.851
$T_{PM}$	Elliptic curve point multiplication time	0.281
$T_{Pa}$	Elliptic curve point addition time	0.004
$T_h$	Generic hash function computation time	0.001
$T_H$	Hash-to-point operation time	0.096
$T_P$	Local point multiplication verification time	0.050
$T_{enc}$	Optimized Paillier encryption time	5.200
$T_{sig}$	BN signature generation time	0.300
$T_{crt}$	Single CRT packing time	0.010

7.2. Computational Costs

It is typically assumed that the CC possesses sufficient computational and communication resources. Therefore, the analysis of computational complexity is primarily focused on TDs and ENs.

In our scheme, TDs first pack multidimensional data into a single integer using the CRT, which is equivalent to data representation in a composite modulus system. Each terminal then encrypts the packed data using an optimized Paillier homomorphic encryption algorithm and generates a BN signature alongside a Bulletproofs range proof to verify data validity and authenticity. After receiving the ciphertexts, ENs perform batch verification of the signatures and range proofs, followed by ciphertext aggregation.

Therefore, the total computational costs for TDs and ENs are $m{T}_{crt}+T_{enc}+T_{sig}$ $+\left(2m+2{\log }_{2}m\right)T_{PM}$ and $\left(n-1\right)T_M+n{T}_h+\left(n+1\right)T_{PM}+n\left(2{\log }_{2}m\right)T_{PM}$ , respectively.

For the comparison schemes, in ESMA [29], the total computational costs for the terminal and aggregator are $T_M+T_{Pai{l}_{En}}$ and $\left(n-1\right)T_M+\left(n+1\right)T_{bp}$ , respectively. In MMSDA [30], the terminal performs $\left(m+\lceil m/31\rceil \right)$ exponentiations and $m$ multiplications in ${\mathbb{Z}}_{N^2}$ , for a total cost of $\left(m+\lceil m/31\rceil \right)T_E+m{T}_M$ , while the aggregator cost is $\left(n-1\right)\lceil m/31\rceil T_M$ . In the EPPA [15] scheme, the terminal’s total cost is $\left(m+\lceil m/16\rceil \right)T_E$ , and the aggregator’s cost is $\left(n-1\right)\lceil m/16\rceil T_M$ . In LPPDA [37], the total computational costs for the terminal and aggregator are $3m{T}_E+m{T}_h$ and $\left(n+3\right)T_E+\left(3n+1\right)T_h+5n{T}_M$ , respectively.

The computational costs of each scheme are summarized in Table 3. As shown in Figure 2, the proposed scheme provides a significant advantage in terminal-side computational cost compared with MMSDA [30], EPPA [15], and LPPDA [37], which suffer from rapid overhead growth due to repeated modular exponentiations for each data dimension. In contrast, our scheme mitigates this overhead by executing only a single optimized Paillier encryption regardless of dimensionality. Furthermore, the growth in our scheme is predominantly driven by Bulletproofs generation, maintaining a superior efficiency profile over the constant-cost ESMA [29] across the evaluated dimension range ($m\le 200$ ).

In contrast, as illustrated in Figure 3, the computational cost for ENs in the proposed scheme is higher than that of MMSDA, EPPA, and LPPDA, and closely parallels ESMA. This increase is an inherent and justifiable trade-off for integrating Bulletproofs and BN signatures to achieve robust verifiability, a critical security feature absent in MMSDA and EPPA. Specifically, our EN performs rigorous cryptographic batch verification of zero-knowledge proofs and digital signatures, preventing data pollution and impersonation attacks. However, since the execution time for aggregating and verifying 200 terminals remains approximately 1000 ms, this overhead is highly practical for typical edge nodes possessing substantial computational resources. Especially when the number of terminals becomes large, the batch verification operations with logarithmic complexity $O\left(\text{log}\left(nm\right)\right)$ keep the computational burden manageable compared to strictly linear verification approaches.

It is worth noting that the logarithmic computational advantage $O\left(\text{log}\left(nm\right)\right)$

Figure 2. Terminal computational cost comparison.

Figure 3. Edge node computational cost comparison.

of our batch verification is primarily achieved under an attack-free or low-fault environment. In adversarial scenarios where malicious terminals inject invalid proofs, the recursive group rollback mechanism is repeatedly triggered, temporarily degrading the verification efficiency towards a linear complexity $O\left(n\right)$ in the worst case. However, considering that the proportion of compromised devices in practical deployments is typically sparse, the amortized computational cost of our scheme across long-term operations remains strictly bounded. Therefore, our scheme achieves a robust balance between rigorous security guarantees and high-dimensional aggregation efficiency.

Table 3. Computational cost comparison of each scheme.

Scheme	Terminal Cost	Edge Node (Aggregator) Cost
ESMA	$T_M+T_{Pai{l}_{E_n}}$	$\left(n-1\right)T_M+\left(n+1\right)T_{bp}$
MMSDA	$\left(m+\lceil m/31\rceil \right)T_E+m{T}_M$	$\left(n-1\right)\lceil m/31\rceil T_M$
EPPA	$\left(m+\lceil m/16\rceil \right)T_E$	$\left(n-1\right)\lceil m/16\rceil T_M$
LPPDA	$3m{T}_E+m{T}_h$	$\left(n+3\right)T_E+\left(3n+1\right)T_h+5n{T}_M$
Ours	$\underset{\text{CRT}}{\underbrace{m{T}_{crt}}}+\underset{\text{Enc}}{\underbrace{T_{enc}}}+\underset{\text{BN\_Sig}}{\underbrace{T_{sig}}}+\underset{\text{BP\_Prove}}{\underbrace{2m{T}_{PM}+\left(2{\log }_{2}m\right)T_{PM}}}$	$\underset{\text{Agg}}{\underbrace{\left(n-1\right)T_M}}+\underset{\text{BatchBN}}{\underbrace{n{T}_h+\left(n+1\right)T_{PM}}}+\underset{\text{BatchBP}}{\underbrace{n\left(2{\log }_{2}m\right)T_{PM}}}$

7.3. Communication Costs

The communication overhead is evaluated across two primary transmission stages: from TDs to ENs, and from ENs to the CC. A comprehensive comparison of the communication costs for each scheme is summarized in Table 4.

Table 4. Communication cost comparison of each scheme (bits).

Scheme	Terminal Cost	Edge Node Cost
ESMA	$\left(m+3\right)\times 224+320$	$\left(m+3\right)\times 224+320$
MMSDA	$\lceil m/31\rceil \times 4096+512$	$\lceil m/31\rceil \times 4096+512$
EPPA	$\lceil m/16\rceil \times 4096+512$	$\lceil m/16\rceil \times 4096+512$
LPPDA	8288	10,336
Ours	$448\lceil {\log }_{2}m\rceil +5664$	4544

1. From TDs to ENs: In the proposed scheme, each TD transmits a comprehensive data packet $\left\{C_i,{\pi }_i,{\sigma }_i,co{m}_i\right\}$ to the EN. This packet inherently encapsulates the Paillier ciphertext, the Bulletproofs range proof, the BN signature, and the commitment, yielding a total communication cost of $2\times 2048+\left(2\lceil {\log }_{2}m\rceil +4\right)\times 224+2$ $\times 224+224=448\lceil {\log }_{2}m\rceil +5664$ bits. For the baselines, the ESMA [29] scheme requires each terminal to send $\left\{C_{ij},I{D}_{ij},TS,{\sigma }_{ij}\right\}$ , incurring an overhead of $\left(m+3\right)$ $\times 224+320$ bits. MMSDA [30] and EPPA [15] transmit payloads of $\left\{C_i,{\sigma }_i\right\}$ and $\left\{C_i\parallel RA\parallel U_i\parallel TS\parallel {\sigma }_i\right\}$ , which generate communication costs of $\lceil m/31\rceil \times 4096+512$ bits and $\lceil m/16\rceil \times 4096+512$ bits, respectively. Meanwhile, LPPDA [37] involves sending $\left\{C{T}_{i,j},S_{i,j},R_i,T_{i,j},I{D}_i\right\}$ , resulting in a fixed cost of 8288 bits.

2. From ENs to the CC: In our scheme, the EN forwards only the aggregated result $\left\{C_{agg},{\sigma }_{agg}\right\}$ to the CC. Due to the inherent properties of ciphertext aggregation and BN half-aggregation, this process incurs a strictly constant communication cost of $2\times 2048+2\times 224=4544$ bits. In contrast, the ESMA [29] scheme forwards $\left\{C_{ij},I{D}_{ij},TS,{\sigma }_{ij}\right\}$ to the CC, requiring $\left(m+3\right)\times 224+320$ bits. The MMSDA [30] and EPPA [15] aggregators send $\left\{C,\sigma \right\}$ and $\left\{C\parallel RA\parallel GW\parallel TS\parallel {\sigma }_g\right\}$ , demanding $\lceil m/31\rceil \times 4096+512$ bits and $\lceil m/16\rceil \times 4096+512$ bits, respectively. Finally, LPPDA [37] forwards $\left\{C{T}_{k,j},S_{k,j},R_k,U_{k,j},T_{k,j},I{D}_k\right\}$ , maintaining a constant overhead of 10336 bits.

Figure 4. Terminal communication cost comparison.

Figure 5. Edge node communication cost comparison.

As shown in Figure 4, the communication overhead from TDs to ENs in the proposed scheme exhibits a logarithmic growth pattern $O\left(\log m\right)$ with respect to the data dimension $m$ . Although the baseline payload is marginally higher than MMSDA and EPPA in low-dimensional settings (e.g., $m<30$ ) due to the inclusion of Bulletproofs and BN signatures, our scheme inherently suppresses the severe step-linear increases caused by massive ciphertext expansions in other schemes. Consequently, it establishes a decisive bandwidth advantage as $m$ scales for high-dimensional IoT applications.

Furthermore, as shown in Figure 5, the communication cost from ENs to the CC in our scheme remains strictly constant, completely independent of the data dimension $m$ . While ESMA, MMSDA, and EPPA suffer from dimension-dependent overheads, our scheme maintains the lowest cost across the entire evaluated range. This optimal bandwidth efficiency is achieved because the edge node forwards only a single aggregated Paillier ciphertext and one-half-aggregated BN signature, ensuring that the rigorous batch verification process introduces zero additional communication burden to the backbone network.

8. Conclusion

This paper proposes an efficient and verifiable multidimensional data aggregation scheme featuring dynamic dimension scalability and privacy protection in edge computing systems. In the proposed scheme, TDs apply CRT packing to combine multidimensional data into a single integer and encrypt it using an optimized Paillier homomorphic encryption algorithm. Consequently, ENs directly aggregate the ciphertexts without decryption, protecting data privacy. Furthermore, Bulletproofs-based zero-knowledge proofs and BN signatures with half-aggregation are integrated to ensure the integrity, authenticity, and range compliance of the encrypted data. This enables the CC to verify data authenticity and conduct an in-depth analysis of high-dimensional aggregated data. Overall, the proposed scheme achieves a balance among privacy protection, computational efficiency, and dynamic scalability. Finally, security proofs and performance evaluations demonstrate that the proposed scheme reduces computational and communication overhead while ensuring robust security.

Conflicts of Interest

The author declares no conflicts of interest regarding the publication of this paper.

References

[1]	Ahmadi, Z., Haghi Kashani, M., Nikravan, M. and Mahdipour, E. (2021) Fog-Based Healthcare Systems: A Systematic Review. Multimedia Tools and Applications, 80, 36361-36400.[CrossRef] [PubMed]
[2]	Wang, B. (2025) Construction of an Intelligent Medical Monitoring System Network for Exercise Rehabilitation Based on the Internet of Things. International Journal of High Speed Electronics and Systems.[CrossRef]
[3]	Lu, R. (2016) Privacy-Enhancing Aggregation Techniques for Smart Grid Communications. Springer.
[4]	El-deep, S.E., Abohany, A.A., Sallam, K.M. and El-Mageed, A.A.A. (2025) A Comprehensive Survey on Impact of Applying Various Technologies on the Internet of Medical Things. Artificial Intelligence Review, 58, Article No. 86.[CrossRef]
[5]	Kouari, O.E., Lazaar, S. and Achoughi, T. (2025) Fortifying Industrial Cybersecurity: A Novel Industrial Internet of Things Architecture Enhanced by Honeypot Integration. International Journal of Electrical and Computer Engineering (IJECE), 15, 1089-1098.[CrossRef]
[6]	sun, G., Xing, X., Qian, Z. and Li, W. (2021) Edge Computing Assisted Privacy-Preserving Data Computation for IoT Devices. Computer Communications, 166, 208-215.[CrossRef]
[7]	Dastjerdi, A.V. and Buyya, R. (2016) Fog Computing: Helping the Internet of Things Realize Its Potential. Computer, 49, 112-116.[CrossRef]
[8]	Dong, J., Cheng, J., Wu, J., Zhang, C., Zhao, S. and Tang, X. (2025) Real-Time AIoT for AAV Antenna Interference Detection via Edge-Cloud Collaboration. IEEE Internet of Things Journal, 12, 10664-10680.[CrossRef]
[9]	Liu, Y., Peng, M., Shou, G., Chen, Y. and Chen, S. (2020) Toward Edge Intelligence: Multiaccess Edge Computing for 5G and Internet of Things. IEEE Internet of Things Journal, 7, 6722-6747.[CrossRef]
[10]	Xie, D., Yang, J., Bian, W., Chen, F. and Wang, T. (2023) An Improved Identity-Based Anonymous Authentication Scheme Resistant to Semi-Trusted Server Attacks. IEEE Internet of Things Journal, 10, 734-746.[CrossRef]
[11]	Roman, R., Zhou, J. and Lopez, J. (2013) On the Features and Challenges of Security and Privacy in Distributed Internet of Things. Computer Networks, 57, 2266-2279.[CrossRef]
[12]	Liu, Y., Guo, W., Fan, C., Chang, L. and Cheng, C. (2019) A Practical Privacy-Preserving Data Aggregation (3PDA) Scheme for Smart Grid. IEEE Transactions on Industrial Informatics, 15, 1767-1774.[CrossRef]
[13]	Fan, C., Huang, S. and Lai, Y. (2014) Privacy-Enhanced Data Aggregation Scheme against Internal Attackers in Smart Grid. IEEE Transactions on Industrial Informatics, 10, 666-675.[CrossRef]
[14]	Ali, W., Din, I.U., Almogren, A. and Kim, B. (2022) A Novel Privacy Preserving Scheme for Smart Grid-Based Home Area Networks. Sensors, 22, Article 2269.[CrossRef] [PubMed]
[15]	Lu, R.X., Liang, X.H., Li, X., Lin, X.D. and Shen, X.M. (2012) EPPA: An Efficient and Privacy-Preserving Aggregation Scheme for Secure Smart Grid Communications. IEEE Transactions on Parallel and Distributed Systems, 23, 1621-1631.[CrossRef]
[16]	Li, S., Xue, K., Yang, Q. and Hong, P. (2018) PPMA: Privacy-Preserving Multisubset Data Aggregation in Smart Grid. IEEE Transactions on Industrial Informatics, 14, 462-471.[CrossRef]
[17]	Mohammadali, A. and Haghighi, M.S. (2021) A Privacy-Preserving Homomorphic Scheme with Multiple Dimensions and Fault Tolerance for Metering Data Aggregation in Smart Grid. IEEE Transactions on Smart Grid, 12, 5212-5220.[CrossRef]
[18]	Zhang, X., You, L. and Hu, G. (2022) An Efficient and Robust Multidimensional Data Aggregation Scheme for Smart Grid Based on Blockchain. IEEE Transactions on Network and Service Management, 19, 3949-3959.[CrossRef]
[19]	Merad Boudia, O.R., Senouci, S.M. and Feham, M. (2017) Elliptic Curve-Based Secure Multidimensional Aggregation for Smart Grid Communications. IEEE Sensors Journal, 17, 7750-7757.[CrossRef]
[20]	Marcolla, C., Sucasas, V., Manzano, M., Bassoli, R., Fitzek, F.H.P. and Aaraj, N. (2022) Survey on Fully Homomorphic Encryption, Theory, and Applications. Proceedings of the IEEE, 110, 1572-1609.[CrossRef]
[21]	Wolf, J.K. (1986) The Chinese Remainder Theorem and Applications. In: Blake, I.F. and Poor, H.V., Eds., Communications and Networks, Springer, 390-405.[CrossRef]
[22]	Wu, Z., Liu, Y. and Jia, X. (2020) A Novel Hierarchical Secret Image Sharing Scheme with Multi-Group Joint Management. Mathematics, 8, Article 448.[CrossRef]
[23]	Zhu, B., Li, Y., Hu, G. and Zhang, M. (2023) A Privacy-Preserving Data Aggregation Scheme Based on Chinese Remainder Theorem in Mobile Crowdsensing System. IEEE Systems Journal, 17, 4257-4266.[CrossRef]
[24]	Wu, L., Xu, M., Fu, S., Luo, Y. and Wei, Y. (2022) FPDA: Fault-Tolerant and Privacy-Enhanced Data Aggregation Scheme in Fog-Assisted Smart Grid. IEEE Internet of Things Journal, 9, 5254-5265.[CrossRef]
[25]	Liu, H., Gu, T., Liu, Y., Song, J. and Zeng, Z. (2020) Fault-Tolerant Privacy-Preserving Data Aggregation for Smart Grid. Wireless Communications and Mobile Computing, 2020, Article ID: 8810393.[CrossRef]
[26]	Guo, C., Tian, P. and Choo, K.R. (2021) Enabling Privacy-Assured Fog-Based Data Aggregation in E-Healthcare Systems. IEEE Transactions on Industrial Informatics, 17, 1948-1957.[CrossRef] [PubMed]
[27]	Chen, Y., Martinez-Ortega, J., Castillejo, P. and Lopez, L. (2019) A Homomorphic-Based Multiple Data Aggregation Scheme for Smart Grid. IEEE Sensors Journal, 19, 3921-3929.[CrossRef]
[28]	Liu, J., Weng, J., Yang, A., Chen, Y. and Lin, X. (2020) Enabling Efficient and Privacy-Preserving Aggregation Communication and Function Query for Fog Computing-Based Smart Grid. IEEE Transactions on Smart Grid, 11, 247-257.[CrossRef]
[29]	Merad-Boudia, O.R. and Senouci, S.M. (2021) An Efficient and Secure Multidimensional Data Aggregation for Fog-Computing-Based Smart Grid. IEEE Internet of Things Journal, 8, 6143-6153.[CrossRef]
[30]	Peng, C., Luo, M., Vijayakumar, P., He, D., Said, O. and Tolba, A. (2022) Multifunctional and Multidimensional Secure Data Aggregation Scheme in WSNs. IEEE Internet of Things Journal, 9, 2657-2668.[CrossRef]
[31]	Xu, S., Fan, J., Wei, X. and Zhang, Y. (2025) FGAMD: A Flexible-Group-Based Privacy-Preserving Aggregation Scheme for Multidimensional Data in Edge-Enhanced IoT. IEEE Internet of Things Journal, 12, 13961-13971.[CrossRef]
[32]	Boschini, C., Fiore, D., Pagnin, E., Torresetti, L. and Visconti, A. (2024) Progressive and Efficient Verification for Digital Signatures: Extensions and Experimental Results. Journal of Cryptographic Engineering, 14, 551-575.[CrossRef]
[33]	Zhang, Y., Tang, Y., Li, C., Zhang, H. and Ahmad, H. (2024) Post-Quantum Secure Identity-Based Signature Scheme with Lattice Assumption for Internet of Things Networks. Sensors, 24, Article 4188.[CrossRef] [PubMed]
[34]	Shrivastava, P., Alam, B. and Alam, M. (2024) Blockchain Based Quantum Resistant Signature Algorithm for Data Integrity Verification in Cloud and Internet of Everything. ICST Transactions on Scalable Information Systems, 11, 1-6.[CrossRef]
[35]	Paillier, P. (2019) Public-Key Cryptosystems Based on Composite Degree Residuosity Classes. In: Stern, J., Ed., Advances in Cryptology—EUROCRYPT’99, Springer, 223-238.[CrossRef]
[36]	Zhou, L., Diro, A., Saini, A., Kaisar, S. and Hiep, P.C. (2024) Leveraging Zero Knowledge Proofs for Blockchain-Based Identity Sharing: A Survey of Advancements, Challenges and Opportunities. Journal of Information Security and Applications, 80, Article ID: 103678.[CrossRef]
[37]	Ding, Y., Wang, B., Wang, Y., Zhang, K. and Wang, H. (2020) Secure Metering Data Aggregation with Batch Verification in Industrial Smart Grid. IEEE Transactions on Industrial Informatics, 16, 6607-6616.[CrossRef]