A bilinear pairing map $\tilde{e}:{\mathbb{G}}_1\times {\mathbb{G}}_1\to {\mathbb{G}}_2$ is defined on the elliptic curve $E$ on the finite field $F_p$, where $p$ is a large prime. In this context, ${\mathbb{G}}_1$ denotes an additive cyclic group of order $q$ derived from the elliptic curve $E$, while ${\mathbb{G}}_2$ represents a multiplicative cyclic group of identical order $q$. The bilinear pairing map exhibits the following properties:

1) Bilinearity: For every $P,V\in {\mathbb{G}}_1$ and $a,b\in {\mathbb{Z}}_q^{\text{*}}$, it holds that $e\left(aP,bV\right)=e{\left(P,V\right)}^{ab}$.

2) Non-degeneracy: There are two elements $P,V\in {\mathbb{G}}_1$ such that $e\left(P,V\right)\ne 1$, where 1 denotes the identity element of ${\mathbb{G}}_2$.

3) Computability: For any $P,V\in \mathbb{G}$, there exists an efficient algorithm to compute $e\left(P,V\right)$.

The Paillier cryptosystem [9] , after optimizing the power operation $g^m$ in its original encryption process, encounters its most resource-intensive computation in the evaluation of the higher-order power function $r^n$. In 2010, Ivan Damgård [26] proposed an optimization strategy to streamline the calculation of $r^n$, demonstrating that this enhancement preserves the security level of the original Paillier algorithm. Therefore, the security of the modified Paillier encryption algorithm will be analyzed by imitating the original Paillier encryption algorithm.

1) Key Generation: To ensure security, it is required that $p\equiv q\equiv 3\mathrm{mod}4$, and $\text{gcd}\left(p-1,q-1\right)=2$.

Compute $\lambda =\frac{\left(p-1\right)\left(q-1\right)}{2}$. Select a random number $x$ such that $x\in {\mathbb{Z}}_n^{\text{*}}$, and calculate $h=-x^2\mathrm{mod}n$. Choose a natural number $s$. In the original Paillier scheme, this corresponds to setting $s=1$. Compute $h_s=h^{n^s}\mathrm{mod}{n}^{s+1}$. The optimized public key is defined as: $\text{PublicKey}=\left(n,h_s\right)$ and the private key is: $\text{PrivateKey}=\left(\lambda ,\mu \right)$.

2) Encryption: Generate a random number $\alpha$, where $\alpha \in {\mathbb{Z}}_2\left[k/2\right]$, and $k$ is the key length. The optimized encryption formula is: $c=\left(n\times m+1\right)\times h_s^{\alpha }\mathrm{mod}{n}^{s+1}$. By choosing $\alpha \ll n$, the computational efficiency of $h_s^{\alpha }$ is significantly improved compared to $r^n$ in the original encryption process.

3) Decryption: To decrypt the ciphertext $c$, the plaintext $m$ is recovered using the equation: $m=D\left(c\right)=L\left(c^{\lambda }\mathrm{mod}{n}^2\right)\mu \mathrm{mod}n$, where $L\left(u\right)=\frac{u-1}{n}$ is the decryption function used in the Paillier cryptosystem.

Our proposed method emphasizes the secure aggregation of sensor data within a Fog computing-based Smart Grid system while ensuring the privacy of sensitive information. Our system model involves four participating entities: a group of SMs, $S{M}_j=\left\{S{M}_{1j},S{M}_{2j},\cdots ,S{M}_{nj}\right\}$ located at the network edge; FNs situated near smart devices; a Remote CC; and a Key Generation Center (KGC), as depicted in Figure 1 .

1) SMs: SMs, denoted as $S{M}_{ij}$, are terminal devices within the Internet of Things (IoT) network. The meters in question possess sensors, computational parts, to gather real-time data from their environment. The collected data is periodically reported to the nearest FN for further processing.

2) FNs: FNs are positioned nearby smart devices to enable communication between $S{M}_{ij}$ and the CC. FN offers critical services, including data validation, the process, and storage for the CC. In our suggested method, the FN acquires data from $S{M}_{ij}$ within its jurisdiction, authenticates and consolidates the data, and subsequently transmits the aggregated ciphertext to the CC for additional examination.

3) CC: The CC is tasked with producing system parameters during initialization and analyzing the aggregated data uploaded by the FN. The CC is crucial in overseeing and administering the system’s overall functionality, utilizing the consolidated data obtained from the FNs.

4) KGC: The Key Generation Center (KGC) functions as a reliable intermediary in the cryptosystem, tasked with distributing public system parameters and private keys for SMs and CC, while also producing pseudonyms for each SM to safeguard user identity privacy.

Our objective is to introduce an effective and anonymous privacy-preserving multidimensional data aggregation scheme for SG based on Fog Computing. The objective is to safeguard critical information transmitted by smart terminal devices while maintaining user privacy. The subsequent objectives must be accomplished:

1) Security: The proposal must ensure the secrecy, integrity, and authenticity of data transition among system entities. Outside adversaries ( $\mathbb{A}$) must be denied access to decrypted data. Any modifications to messages should be detectable, and the authentication of transmitting data, along with the verification of legal entity identities, should be performed by FNs and the CC.

2) Privacy Protection: User privacy is paramount in SG. Decryption keys are known only to the CC. Ciphertext computations are performed exclusively by the FN. KGC is aware of users’ real identities, ensuring isolation between keys, ciphertext, and identity. This isolation guarantees that total power consumption can be obtained without revealing user privacy. Individual privacy in IoT applications is crucial. In this proposal, individual privacy is an unrevealed secret to $\mathbb{A}$. Even if there is collusion between the FN and CC, individual privacy is protected when user $S{M}_{ij}$ employs anonymous privacy encryption.

3) Fault Tolerance: In Smart Grids, $S{M}_{ij}$ may experience communication failures. The proposal must include fault tolerance mechanisms to ensure correct aggregation and decryption in the event of certain $S{M}_{ij}$ failures.

4) Performance: Performance is crucial for both SMs and FNs to meet the practical demands of data aggregation in Smart Grids. This requires keeping computation and communication costs as low as possible to ensure system efficiency. Performance is essential for data aggregation in extensive SG, facilitating the prompt and efficient processing of significant data volumes.

Based on the security parameter $\kappa$, KGC is required to generate two $\kappa$-bit prime numbers, $p_0$ and $q_0$, which satisfy the conditions: $p_0\equiv q_0\equiv 3\left(\mathrm{mod}4\right)$, $\gcd \left(p_0-1,q_0-1\right)=2$. The KGC subsequently chooses two large $\kappa$-bit primes, $p_0$ and $q_0$, and calculates the public key of the Paillier encryption system as $n=p_0{q}_0$, $g=1+n$. The associated private key is expressed as. Subsequently, the $\lambda =\frac{\left(p_0-1\right)\left(q_0-1\right)}{2}$KGC constructs a function $L\left(u\right)=\frac{u-1}{n}$ and computes $\mu$ as $\mu ={\left(L\left(g^{\lambda }\mathrm{mod}{n}^2\right)\right)}^{-1}\mathrm{mod}n$ A random number $x$ is then chosen, where $x\in {\mathbb{Z}}_n^{\text{*}}$, and $h=-x^2\mathrm{mod}n$. A natural number $s$ is chosen, and for the original Paillier system, $s=1$. For $h_s=h^{n^s}\mathrm{mod}{n}^2$, we have $h_1=h^n\mathrm{mod}{n}^2$. The public key is denoted as the tuple $\left(n,h_1\right)$, whereas the associated private key is represented by the tuple $\left(\lambda ,\mu \right)$. The KGC defines a bilinear pairing map $e:{\mathbb{G}}_1\times {\mathbb{G}}_1\to {\mathbb{G}}_2$, where ${\mathbb{G}}_1$ and ${\mathbb{G}}_2$ are two multiplicative cyclic groups of identical order $p$, and $P$ serves as the generator of ${\mathbb{G}}_1$. The KGC further establishes four collision-resistant hash functions: $H:{\left\{0,1\right\}}^{\text{*}}\to {\mathbb{G}}_1$ and $H_1:{\left\{0,1\right\}}^{\text{*}}\times {\mathbb{G}}_1\to {\mathbb{G}}_1$.

The KGC establishes the upper limit of FNs at $J$, and defines $S{M}_{ij}\subseteq \left\{1j,2j,\cdots ,Nj\right\}$ as the indexed collection of operational SMs. A pseudo-random number producer generates $N\times J$ secret shares $a_{ij}\in {\mathbb{Z}}_n^{\text{*}}$, where $i=1,\cdots ,N$, and $j=1,\cdots ,J$. The KGC then computes $a_{0j}$:

$a_{0j}=\underset{ij\in S{M}_{ij}}{{\displaystyle \sum }}{a}_{ij}\mathrm{mod}n,\text{where}j=1,\cdots ,J$(1)

1) $S{M}_{ij}$ Registration and Pseudonym Selection: Each SM $S{M}_{ij}$ produces its unique identity $I{D}_{ij}$, randomly chooses a private key $s{k}_{ij}\in {\mathbb{Z}}_q^{*}$, and derives its public key as $p{k}_{ij}=s{k}_{ij}\cdot P$, with $P$ representing the group’s generator. The pseudonym $PI{D}_{ij}$ is computed as: $PI{D}_{ij}=H_1\left(RI{D}_{ij}\left|\right|s{k}_{ij}\right)$ The signature ${\bar{\sigma }}_{ij}$ is then calculated as: ${\bar{\sigma }}_{ij}=H_1\left(PI{D}_{ij}\parallel p{k}_{ij}\parallel TS\right)\cdot s{k}_{ij}$ The SM $S{M}_{ij}$ sends $\left\{RI{D}_{ij},PI{D}_{ij},p{k}_{ij}\right\}$ to KGC along with the timestamp $TS$.

Upon receiving the registration request, the KGC first verifies the signature:

${\bar{\sigma }}_{ij}\cdot P=H_1\left(PI{D}_{ij}\parallel p{k}_{ij}\parallel TS\right)\cdot p{k}_{ij}$

If the signature is valid, the KGC generates a list of pseudonyms $L_{ij}$ based on the real identity $RI{D}_{ij}$. The pseudonym list corresponding to $PI{D}_{ij}$ of $S{M}_{ij}$ is as follows: $L_{ij}=\left\{PI{D}_{ij1},PI{D}_{ij2},\cdots ,PI{D}_{ijl},\cdots \right\}$.

During the $l$-th anonymous update cycle, the KGC selects a random number $z_l\in {\mathbb{Z}}_q^{\text{*}}$ (where $l=1,2,\cdots ,N$) to modify the pseudo-identity of $S{M}_{ij}$. The updated pseudonym is computed as: $PI{D}_{ijl}=PI{D}_{ij}\oplus H_1\left(PI{D}_{ij}\parallel z_l\cdot P\right)$ The new signature ${\sigma }_{ijl}$ is calculated as:

${\sigma }_{ijl}=H1\left(PI{D}_{ijl}\parallel p{k}_{ij}\parallel TS\right)\cdot s{k}_{ij}$(2)

The KGC verifies the following equation to ensure consistency:

$H1\left(PI{D}_{ij}\parallel p{k}_{ij}\parallel TS\right)\cdot p{k}_{ij}={\sigma }_{ijl}\cdot P$(3)

If the formula is satisfied, the tuple $\left\{PI{D}_{ijl},p{k}_{ij},{\sigma }_{ijl}\right\}$ is recorded. After successful verification and registration, the KGC sends $\left\{PI{D}_{ijl},p{k}_{ij},{\sigma }_{ijl}\right\}$ to the FN and CC for further processing.

2) FN Registration: FN is registered, randomly selected $s{k}_j\in Z_q^{\text{*}}$ as the private key, and computed the public key $p{k}_j=s{k}_{j}P$, where $\left\{I{D}_j,p{k}_j\right\}$ sent to KGC.

3) CC Registration: CC randomly selects $s{k}_{\text{CC}}\in Z_q^{\text{*}}$ as the private key and computes the public key $p{k}_{\text{CC}}=s{k}_{\text{CC}}P$. Then, CC sends $\left\{I{D}_{\text{CC}},p{k}_{\text{CC}}\right\}$ to KGC.

At the end of this phase, KGC publishes the system parameters as

$\text{Γ}=\left(e,{\mathbb{G}}_1,{\mathbb{G}}_2,p,P,n,g,h_1,z,H,H_1,p{k}_{\text{CC}},{\left\{p{k}_j\right\}}_{1\le j\le J},{\left\{p{k}_{ij}\right\}}_{1\le i\le N,1\le j\le J}\right)$

During the time period $T$, each $S{M}_{ij}$ encrypts the $l$-dimensional data $\left(m_{ij,1},m_{ij,2},\cdots ,m_{ij,l}\right)$ and simultaneously creates the corresponding signature in Figure 2 .

Step 1: $S{M}_{ij}$ encodes $\left(m_{ij,1},m_{ij,2},\cdots ,m_{ij,l}\right)$ into the binary string $\left(b_{ij,1},b_{ij,2},\cdots ,b_{ij,l}\right)$ where each of the $b_{ij,d}={\left(m_{ij,d}\right)}_2\parallel 0^{z\ast \left(d-1\right)},d=1,2,\cdots ,l$ and assigns its private information as $m_{ij}={\displaystyle {\sum }_{d=1}^l{b}_{ij,d}}$. $B_{ij}=b_{ij,1}+b_{ij,2}+\cdots +b_{ij,l}$. Then encode, $S{M}_{ij}$ to compute $\overline{B_{ij}}$.

$\overline{B_{ij}}=B_{ij}+a_{ij}\mathrm{mod}n$(4)

Step 2: In the preceding Paillier encryption method, $S{M}_{ij}$ selects a random number $r_{ij}\in {\mathbb{Z}}_n^{\text{*}}$ and calculates the encrypted content as

$C_{ij}=g^{\overline{B_{ij}}}\cdot r_{ij}^n\mathrm{mod}{n}^2$(5)

In our Paillier cryptosystem, randomly generate ${\alpha }_{ij},{\alpha }_{ij}\in Z_2\left[k/2\right]$, where k is the key length

$\begin{array}{c}{C}_{ij}=g^{\overline{B_{ij}}}\cdot g^{{\alpha }_{ij}}\mathrm{mod}{n}^2\\ ={(}^n\cdot h_1^{{\alpha }_{ij}}\mathrm{mod}{n}^2\\ =\left(n\ast \overline{B_{ij}}+1\right)h_1^{{\alpha }_{ij}}\mathrm{mod}{n}^2\\ =\left(n\ast \overline{B_{ij}}+1\right)h_1^{{\alpha }_{ij}}\mathrm{mod}{n}^2\\ =\left(n\ast \left(B_{ij}+a_{ij}\mathrm{mod}n\right)+1\right)h_1^{{\alpha }_{ij}}\mathrm{mod}{n}^2\end{array}$(6)

Step 3: $S{M}_{ij}$ Utilize the private key $s{k}_{ij}$ to generate the signature as described below. ${\sigma }_{ij}=s{k}_{ij}H\left(C_{ij}\left|\right|TS\left|\right|I{D}_j\left|\right|PI{D}_{ijl}\right)$ where TS means the present timestamp.

Step 4: $S{M}_{ij}$ transmits the verified data report information $\left(C_{ij},TS,{\sigma }_{ij},PI{D}_{ijl}\right)$ to the corresponding $F_j$.

1) All-Inclusive Data Aggregation: During the period $T$, we posit the occurrence of certain SM failures within the SG, and use $S{M}_j\subseteq \left\{PI{D}_{1jl},PI{D}_{2jl},\cdots ,PI{D}_{Njl}\right\}$ to denote the index set of working SMs. Let $w_j=\left|S{M}_j\right|$ describe the quantity of operational SMs under $F_j$, and let $t$ signify the minimum threshold of the effective sample size. When $w_j\ge t$, verified data report messages (e.g., $\left(C_{ij},TS,{\sigma }_{ij},PI{D}_{ijl}\right)$) are received from legitimate SMs, $F_j$ conducts a batch validation by verifying the subsequent calculation:

( $e\left({\displaystyle {\sum }_{ij\in S{M}_j}{\sigma }_{ij}},P\right)={\displaystyle {\prod }_{ij\in S{M}_j}e}\left(H\left(C_{ij}\parallel TS\parallel I{D}_j\parallel PI{D}_{ijl}\right),p{k}_{ij}\right)$

The ${\text{FN}}_j$ will initially conduct bulk verification to authenticate the received signature by determining if the subsequent equation is satisfied:

$\begin{array}{c}e\left(\underset{ij\in S{M}_j}{{\displaystyle \sum }}{\sigma }_{ij},P\right)=\underset{ij\in S{M}_j}{{\displaystyle \prod }}e\left(H\left(C_{ij}\parallel TS\parallel I{D}_j\parallel PI{D}_{ijl}\right),p{k}_{ij}\right)\\ =\underset{ij\in S{M}_j}{{\displaystyle \prod }}e\left(H\left(C_{ij}\parallel TS\parallel I{D}_j\parallel PI{D}_{ijl}\right),s{k}_{ij}P\right)\\ =\underset{ij\in S{M}_j}{{\displaystyle \prod }}e\left(s{k}_{ij}H\left(C_{ij}\parallel TS\parallel I{D}_j\parallel PI{D}_{ijl}\right),P\right)\\ =\underset{ij\in S{M}_j}{{\displaystyle \prod }}e\left({\sigma }_{ij},P\right)\end{array}$(7)

$e\left(P,\underset{i=1}{\overset{w_j}{{\displaystyle \sum }}}{\sigma }_{ij}\right)=\underset{i=1}{\overset{w_j}{{\displaystyle \prod }}}e\left(p_{k_{ij}},H\left(C_{ij}\parallel I{D}_{ij}\parallel TS\right)\right).$(8)

Batch verification decreases the quantity of pairing processes from $w_j$ to $w_j+1$. Upon validation, ${\text{FN}}_j$ aggregates all encrypted data and transmits the aggregated data to CC. Execute the subsequent steps.

Step 1: ${\text{FN}}_j$ aggregates $w_j$ encrypted ciphertexts into

$\begin{array}{c}{C}_j=\underset{i=1}{\overset{w_j}{{\displaystyle \prod }}}{C}_{ij}\mathrm{mod}{n}^2\\ =\underset{i=1}{\overset{w_j}{{\displaystyle \prod }}}{g}^{\overline{B_{ij}}}\cdot h_1^{{\alpha }_{ij}}\mathrm{mod}{n}^2\\ =g^{{\displaystyle {\sum }_{i=1}^{w_j}\overline{B_i}}}\cdot \left(\underset{i=1}{\overset{w_j}{{\displaystyle \prod }}}{h}_1^{{\alpha }_{ij}}\right)\mathrm{mod}{n}^2\\ =g^{{\displaystyle {\sum }_{i=1}^{w_j}\left(B_{ij}+a_{ij}\right)\mathrm{mod}n}}\cdot \left(h_1^{{\displaystyle {\sum }_{i=1}^{w_j}{\alpha }_{ij}}}\right)\mathrm{mod}{n}^2\\ =\left(1+n\cdot \left(\underset{i=1}{\overset{w_j}{{\displaystyle \sum }}}\left(B_{ij}+a_{ij}\right)\mathrm{mod}n\right)\right)\cdot \left(h_1^{{\displaystyle {\sum }_{i=1}^{w_j}{\alpha }_{ij}}}\right)\mathrm{mod}{n}^2\end{array}$(9)

Step 2: The function ${\text{FN}}_j$ generates the signature utilizing its private key $s{k}_j$ in the following manner.

${\sigma }_j=s{k}_{j}H\left(C_j\parallel TS\parallel I{D}_j\right)$(10)

where TS denotes the recent timestamp.

Step 3: ${\text{FN}}_j$ sends a full report to CC containing

$\left\{C_j,TS,{\sigma }_j,I{D}_j\right\}$(11)

If some SMs break down, ${\text{FN}}_j$ will not receive the corresponding packets.

2) Fault-Tolerant Data Aggregation: When certain SMs are unable to transmitting data, ${\text{FN}}_j$ will not obtain the relevant packets. Let $S{M}_j\subseteq \left\{PI{D}_{1jl},PI{D}_{2jl},\cdots ,PI{D}_{Njl}\right\}$ denote the collection of all operational SM units in ${\text{FN}}_j$, and let $S{M^{\prime }}_j$ represent the subset of defective SM devices ( $S{M^{\prime }}_j\in S{M}_j$). Consequently, we get

$a_{0j}\ne \underset{ij\in S{M}_j/S{M^{\prime }}_j}{{\displaystyle \sum }}{a}_{ij}\mathrm{mod}n.$(12)

Consequently, this phenomenon will directly influence the accuracy of the ultimate decryption result. The entity ${\text{FN}}_j$ must transmit the set $S{M^{\prime }}_j$ to the KGC. Subsequently, the KGC generates a new ${a^{\prime }}_{0j}$ based on $S{M^{\prime }}_j$ and transmits it to the CC.

1) All-Inclusive Data reading: Upon obtaining a whole report from ${\text{FN}}_j$, CC initially authenticates the signature in accordance with the subsequent equation:

$e\left(P,{\sigma }_j\right)=e\left(p{k}_j,H\left(C_j\parallel TS\parallel I{D}_j\right)\right)$(13)

When the equation is satisfied, it indicates that the signature is legitimate. Upon verifying the authenticity, CC decrypts the aggregated ciphertext $C_j$ and extracts the aggregated data by executing the subsequent phases:

Step 1: CC decrypts the aggregated ciphertext by first retrieving the encrypted data $C_j$. From Equation (8), take:

$M=\underset{ij\in S{M}_j}{{\displaystyle \sum }}\left(B_{ij}+a_{ij}\right)\mathrm{mod}n$(14)

The report $\left(1+M\cdot n\right)\cdot {\left(h_1\right)}^{{\displaystyle {\sum }_{i=1}^{w_j}{\alpha }_{ij}}}\mathrm{mod}{n}^2$ is still the ciphertext of the Paillier encryption system. It can be equated to $g^M\cdot R^n\mathrm{mod}{n}^2$ with $R={\displaystyle {\prod }_{i=1}^{w_j}{r}_{ij}}$ and CC uses the tuple $\left(\lambda ,\mu \right)$ to recover $M$: as

$M=L\left(C_j^{\lambda }\mathrm{mod}{n}^2\right)\mu \mathrm{mod}n$(15)

Step 2: After decryption, CC uses $a_{0j}$ to obtain ${\displaystyle {\sum }_{ij\in S{M}_j}{B}_{ij}}$ as follows:

$\underset{ij\in S{M}_j}{{\displaystyle \sum }}{B}_{ij}=M-a_{0j}\mathrm{mod}n$(16)

Step 3: CC Retrieve each aggregated data ${\displaystyle {\sum }_{ij\in S{M}_j}{b}_{ij,d}}$, $d=1,2,\cdots ,l$ using the decoding function.

The CC divides the binary representation of ${\displaystyle {\sum }_{ij\in S{M}_j}{B}_{ij}}$ into $l$ bit chunks of maximal length less than $z$, so that the aggregated data $M_{ij}={\displaystyle {\sum }_{ij\in S{M}_j,d=1}^l{m}_{ij,d}}$ can be written as

${\left(\underset{ij\in S{M}_j}{{\displaystyle \sum }}{B}_{ij}\right)}_2=\underset{ij\in S{M}_j}{{\displaystyle \sum }}{m}_{ij,l}\parallel \cdots \parallel \underset{ij\in S{M}_j}{{\displaystyle \sum }}{m}_{ij,2}\parallel \underset{ij\in S{M}_j}{{\displaystyle \sum }}{m}_{ij,1}$(17)

2) Fault-Tolerant Data Reading: Upon receipt of the fault-tolerant report from ${\text{FN}}_j$, CC initially authenticates the signature in accordance with the subsequent equation:

$e\left(P,{\sigma }_j\right)=e\left(p{k}_j,H\left(C_j\parallel TS\parallel I{D}_j\right)\right)$(13)

However, the released $M$ ( $M={\displaystyle {\sum }_{ij\in S{M^{\prime }}_j}\left(B_{ij}+a_{ij}\right)\mathrm{mod}n}$) contains only a subset of the $a_{ij}$ values, and thus we cannot use $a_{0j}$ to eliminate the blind factor. Consequently, we utilize the ${a^{\prime }}_{0j}$ generated by the KGC to obtain ${\displaystyle {\sum }_{ij\in S{M^{\prime }}_j}{B}_{ij}}$.

$\underset{ij\in S{M^{\prime }}_j}{{\displaystyle \sum }}{B}_{ij}=M-a_{0j}\mathrm{mod}n$(18)

CC Retrieve each aggregated data ${\displaystyle {\sum }_{ij\in S{M^{\prime }}_j}{b}_{ij,d}}$, $d=1,2,\cdots ,l$ using the decoding function.

The CC divides the binary representation of ${\displaystyle {\sum }_{ij\in S{M^{\prime }}_j}{B}_{ij}}$ into $l$ bit chunks of maximal length less than $z$, so that the aggregated data $M_{ij}={\displaystyle {\sum }_{ij\in S{M^{\prime }}_j,d=1}^l{m}_{ij,d}}$ can be written as

${\left(\underset{ij\in S{M^{\prime }}_j}{{\displaystyle \sum }}{B}_{ij}\right)}_2=\underset{ij\in S{M^{\prime }}_j}{{\displaystyle \sum }}{m}_{ij,l}\parallel \cdots \parallel \underset{ij\in S{M^{\prime }}_j}{{\displaystyle \sum }}{m}_{ij,2}\parallel \underset{ij\in S{M^{\prime }}_j}{{\displaystyle \sum }}{m}_{ij,1}$(19)

Thus, we can convert the aggregated data into a binary bit string, and then separate out the substrings of length $z$ bits starting from the lower bit to retrieve the aggregated data for each dimension.

In EAMA, when $S{M}_{ij}$ produces its output, it necessitates $T_{mu}+T_{ex}$ to generate $C_{ij}$ and $T_H+T_{pm}$ to produce ${\sigma }_{ij}$. Consequently, the whole computational expense on the SM side is represented by $T_{mu}+T_{ex}+T_H+T_{pm}$. Our approach considerably decreases the computing expense for the user. ( $l$ represents multidimensional data.)

In data aggregation, upon receiving $\left\{C_{ij},{\sigma }_{ij},TS,PI{D}_{ijl}\right\},i=1,2,\cdots ,N$ from all the SMs, ${\text{FN}}_j$ performs $n+1$ bilinear pairwise operations and one ECC hash-to-dot for data verification. Subsequently, it consolidates the encrypted data and produces a signature, requiring $3n-3$ conventional multiplication operations to form the aggregated ciphertext, one ECC hash-to-point operation, and one ECC pointwise multiply operation to create a new signature on the aggregated the encrypted data. The overall computational expense of FN is expressed as $\left(n+1\right)\cdot T_{bp}+\left(3n-3\right)\cdot T_{mu}+2T_H+T_{pm}$. Within the Fog computing paradigm, Fog Nodes has greater processing capabilities than traditional nodes. Consequently, the aggregate procedure may be executed efficiently. Subsequently, we evaluate the computational expense of the current schemes with regard to each SM and AG individually. In the approach proposed by Zhang et al. [25] , offer a data reporting method where in the computation is expressed as ${\omega }_1{m}_{i1}+{\omega }_{k+1}{m}_{i1}^2+{\omega }_2{m}_{i2}+{\omega }_{k+2}{m}_{i2}^2+\cdots +{\omega }_k{m}_{ik}+{\omega }_{2k}{m}_{ik}^2$, each SM requires $3k$ multiplication operations, in addition to two exponentiation operations, one hash operation, and one multiplication to generate $C{T}_i$. Generating the authenticator ${\sigma }_i$ requires two exponentiation operations, two hash operations, and one multiplication. Thus, the total computation costs on the SM side total $4T_{ex}+3T_h+\left(3k+2\right)\cdot T_{mu}$. In Data Aggregation, after AG receives $\left\{C{T}_i,{\sigma }_i,T\right\},i=1,2,\cdots ,n$, from all SMs, it requires $n-1$ multiplication operations to generate the aggregated ciphertext CT. It requires one exponentiation, one hash operation to compute ${\tau }_n$, $n$ multiplication operations to generate $\xi$, and $n$ exponentiation operations coupled with $2n-1$ multiplication operations to get $\sigma$. The total computational costs of AG are represented as $\left(n+1\right)\cdot T_{ex}+\left(4n-2\right)\cdot T_{mu}+T_h$. Using a comparable analytical method, Zuo et al.’s framework [23] indicates that the overall computational expense for each SM component is $k\cdot T_{mu}+T_h+5T_{ex}$, while the total computational expense for the AG component is $\left(n+1\right)\cdot T_{bp}+\left(4n-4\right)\cdot T_{mu}+\left(n+1\right)\cdot T_h+T_{ex}$. Ultimately, the overall computational expense for each SM and aggregator in Boudia et al.’s framework [17] is $2T_{ex}+1T_H+1T_{pm}$ and $\left(n+1\right)\cdot T_{bp}+\left(3n-3\right)\cdot T_{mu}+2T_H+1T_{pm}$, respectively.

A comparison of the computational overhead in terms of SMs is presented in Figure 3 .

Given that SMs are equipped with resource-constrained storage and computational devices, each SM encrypts $l$ categories of data and transmits them to the respective aggregator. The communication cost can be categorized into two components: communication from the SM to the FN and communication from the FN to the CC. Given that SMs are equipped with resource-constrained storage and computational equipment, we concentrate on assessing the communication

expenses from SMs to FN. In EAMA, the variables, $\left\{C_{ij},TS,{\sigma }_{ij},PI{D}_{ijl}\right\}$ are sent from the SM to ${\text{FN}}_j$, where $C_{ij}\in {\mathbb{Z}}_{n^2}$ and ${\sigma }_{ij}\in {\mathbb{G}}_1$. To provide uniformity, we designate the size of the $PI{D}_{ijl}$ and timestamp as 160 bits and 64 bits, respectively, across all methods. Consequently, the transmission expense from SM to FN amounts to $2048+64+160+160=2432$ bits. Subsequently, we examine the correspondence from FN to CC. In EAMA, the elements, $\left\{C_j,TS,{\sigma }_j,I{D}_j\right\}$ are transmitted from ${\text{FN}}_j$ to CC, where $C_{ij}\in {\mathbb{Z}}_{n^2}$ and ${\sigma }_{ij}\in {\mathbb{G}}_1$. The communication cost from FN to CC is calculated as $2048+64+160+64=2336$ bits. In the system proposed by Zhang et al. [25] , each $S{M}_i$ transmits $\left\{C{T}_i,{\sigma }_i,T\right\}$ to AG. Consequently, the transmission expense from $n$ SMs to AG amounts to $\left(2048+512+64\right)\cdot n=2624n$ bits. In the approach proposed by Zuo et al. [23] , each $S{M}_i$ transmits $\left\{I{D}_i,C_i^a,C_i^b,T_i,{\sigma }_i,p{k}_i\right\}$ to AG. The transmission expense from $n$ SMs to AG is $\left(64+512+512+64+1024+512\right)\cdot n=2688n$ bits. In the framework suggested by Boudia et al. [17] , $\left\{C_{ij},I{D}_{ij},TS,{\sigma }_{ij}\right\}$ is transmitted from $S{M}_{ij}$ to the respective FN, where $C_{ij}$ represents the ciphertext of the Paillier encryption system and ${\sigma }_{ij}$ denotes a signature, resulting in a total communication cost of $\left(2048+64+64+160\right)\cdot n=2336n$ bits. Ultimately, the comparison of communication costs is illustrated in Figure 4 .

To evaluate our enhanced scheme against current ones, we established $n=400$ as the real value and performed a comprehensive comparison of the communication costs from $n$ SMs to the FN, as illustrated in Figure 4 . The figure indicates that the communication cost of our design is inferior to that of other schemes, with the exception of the scheme proposed by Boudia et al. [17] . While the transmission cost from SM to FN in the strategy proposed by Boudia et al. is somewhat cheaper than ours, their scheme lacks pseudonyms, potentially compromising its security.