Our system model consists of three types of entities: CC, ENs, and TDs, as illustrated in Figure 1. In this architecture, TDs collect and encrypt data, and then transmit the resulting ciphertexts to ENs. ENs aggregate the ciphertexts, and the CC performs the decryption. The detailed responsibilities of each entity are described as follows.

Figure 1.System model.

Control Center (CC): The CC performs system initialization, including the generation of cryptographic key pairs and the construction of the modulus set. It decrypts the aggregated ciphertexts and manages the process of dynamic data dimension extension. Furthermore, the CC oversees secure key distribution and conducts regular key updates to ensure system security and scalability.Terminal Devices (TDs): TDs collect raw data using multidimensional sensors and pack the collected data. They utilize the Paillier homomorphic encryption algorithm to ensure data privacy. Furthermore, TDs generate zero-knowledge proofs and digital signatures over the encrypted data to ensure data authenticity and integrity.Edge Nodes (ENs): ENs aggregate the received ciphertexts and verify both the digital signatures and zero-knowledge proofs. Upon successful verification, they forward the aggregated results to the CC, ensuring the confidentiality and integrity of the data processing chain.

To ensure the deterministic execution of the non-interactive BN signature and batch verification, we assume a time-slotted synchronization mechanism for the aggregation epochs. At the beginning of each epoch, the serving EN determines an active terminal list L according to the currently registered and reachable TDs in its coverage domain, and broadcasts L together with the epoch/version information and an authentication tag (or digital signature) to all participating TDs. Before computing the BN challenge, each TD verifies the authenticity and freshness of the received list. Consequently, all TDs in the same epoch compute their cryptographic challenges based on the same trusted and globally synchronized L . We assume the network topology remains quasi-static within the short aggregation window. If any terminal disconnects or fails to upload its ciphertext, the EN detects the state mismatch during batch verification and deterministically triggers the recursive group rollback mechanism to isolate the missing or invalid proofs. Severe synchronization failures within an epoch may lead to challenge inconsistency and packet rejection. Likewise, if a large number of TDs drop out during the same epoch, the aggregation process may experience increased verification overhead and reduced service availability.

In our security model, the CC and ENs are regarded as semi-honest (i.e., honest-but-curious) entities. Specifically, they adhere to the prescribed protocol, where ENs perform batch verification and ciphertext aggregation, and the CC decrypts the results. However, they may attempt to infer the private multidimensional data of individual TDs from the processed ciphertexts. We assume that communication between the CC and other entities occurs over secure channels and that no collusion occurs between the CC and ENs, or between ENs and TDs. Therefore, collusion between the CC and the serving EN is not considered in the present threat model.

While the majority of TDs are benign, we assume the existence of a Probabilistic Polynomial-time (PPT) adversary A . A may act as an external attacker or compromise a fraction of the TDs. Specifically, A is capable of launching the following attacks.

Privacy Violation: A may eavesdrop on public communication channels to intercept ciphertexts, attempting to distinguish or recover the underlying multidimensional plaintext data without the master private key.Data Forgery and Impersonation: A may attempt to forge digital signatures to impersonate legitimate TDs or tamper with the aggregated ciphertexts and signatures during transmission.Data Pollution: Through compromised TDs, A may attempt to forge zero-knowledge proofs to inject invalid, out-of-range data into the aggregation pool, bypassing range verification and distorting the final statistical results at the CC.

Guided by the system and threat models, we design the proposed scheme to satisfy the following core requirements.

Dynamic Dimension Scalability. The scheme must support the on-demand addition of data dimensions, ensuring uninterrupted system services through flexible modulus set management.Data Authenticity and Integrity. Lightweight BN signatures must be incorporated to enable the real-time verification of data integrity, preventing data tampering and impersonation attacks.Privacy-Preserving Aggregation. The scheme must prevent the disclosure of raw data during aggregation by exploiting Paillier homomorphic encryption, complemented by Bulletproofs to verify data compliance.Efficient Data Processing. The scheme must achieve high computational and communication efficiency. Specifically, CRT-based packing reduces the encryption burden on TDs, while BN half-aggregation and batch verification minimize communication overhead at the ENs, supporting concurrent access from numerous TDs.Robustness against Malicious Entities. The scheme must resist inference attacks from semi-honest ENs and active attacks from compromised TDs. The integration of BN signatures prevents rogue-key attacks during aggregation, while Bulletproofs block the injection of invalid data, ensuring robust security under strong adversarial conditions.

The formal security proofs of our scheme rely on two standard cryptographic hardness assumptions.

1) Decisional CompositeResiduosity(DCR) Assumption: Let N = p q be a Paillier modulus, where p and q are two large prime numbers of equal bit-length. The DCR problem states that given a random element z ∈ ℤ N 2 * , it is computationally intractable for any probabilistic polynomial-time (PPT) algorithm to determine whether z is an N -th residue modulo N 2 . Specifically, it is computationally hard to distinguish whether there exists an x ∈ ℤ N 2 * such that z ≡ x N ( mod N 2 ) or if z is uniformly distributed in ℤ N 2 * .

2) Elliptic Curve Discrete Logarithm Problem (ECDLP): Let G be a cyclic elliptic curve group of prime order l , and let G be a generator of G . Given a tuple ( G , Y ) , where Y = x G for a randomly chosen secret scalar x ∈ ℤ l * , the ECDLP asserts that extracting x is computationally infeasible for any PPT adversary.

To enable privacy-preserving data aggregation at the edge, our scheme utilizes the Paillier cryptosystem integrated with the Chinese Remainder Theorem (CRT).

1)PaillierCryptosystem: Paillier [35] is an asymmetric encryption scheme featuring an additive homomorphic property. To optimize computational efficiency, our scheme adopts the variant where the generator is fixed as g = N + 1 .

Key Generation: Compute the modulus N = p q and the Carmichael function λ = lcm ( p − 1 , q − 1 ) . The decryption parameter is μ = λ − 1 ( mod N ) . The public key is N , and the private key is ( λ , μ ) .Encryption: To encrypt a message m ∈ ℤ N , choose a random r ∈ ℤ N * and compute the ciphertext as c = ( 1 + m ⋅ N ) ⋅ r N ( mod N 2 ) .Decryption: Given c , the plaintext is recovered as m = L ( c λ ( mod N 2 ) ) ⋅ μ ( mod N ) , where L ( x ) = x − 1 N .Additive Homomorphism: For ciphertexts c 1 = Enc ( m 1 ) and c 2 = Enc ( m 2 ) , the product of ciphertexts decrypts to the sum of their plaintexts: c 1 ⋅ c 2 ( mod N 2 ) = Enc ( m 1 + m 2 ( mod N ) ) .

2) CRT Packing Mechanism: The CRT provides an isomorphic mapping to pack multidimensional small integers into a single large integer. Let Ψ = { ψ 1 , ⋯ , ψ k } be a set of pairwise coprime moduli, and let M = ∏ i = 1 k ψ i . A multidimensional data vector ( d 1 , ⋯ , d k ) , where each d i < ψ i , can be uniquely packed into a single integer D ∈ ℤ M as

where M i = M / ψ i , and M ′ i is the modular inverse of M i modulo ψ i . After homomorphically aggregating the packed integers, the aggregated sum for each dimension i can be extracted using the modulo operation D a g g ( mod ψ i ) , provided that the aggregated plaintext does not exceed the Paillier modulus N .

To ensure data authenticity while minimizing communication overhead, we employ the BN signature mechanism. Unlike standard Schnorr multi-signatures that require interactive rounds, the BN scheme allows a verifier to non-interactively compress multiple independent signatures into a single compact representation.

Let H be a cryptographic hash function. A terminal device generates a secret key s k ∈ ℤ l * and a public key p k = s k ⋅ G . To sign a message M , the device chooses a random nonce r ∈ ℤ l * , computes R = r ⋅ G , and derives the challenge c = H ( L ∥ p k ∥ R ∥ M ) , where L is the list of participating public keys. The signature scalar is s = r + c ⋅ s k ( mod l ) , yielding the signature σ = ( R , s ) .

Given n signatures σ i = ( R i , s i ) from n distinct devices, the half-aggregation technique compresses the scalars into s a g g = ∑ i = 1 n s i ( mod l ) . The aggregate signature becomes ( R 1 , ⋯ , R n , s a g g ) , reducing bandwidth requirements by approximately half. Because the distinct public key p k i is hashed into the challenge c i , this mechanism prevents rogue-key attacks, in which an adversary crafts public keys to cancel out legitimate signatures.

To prevent data pollution attacks without compromising privacy, our scheme integrates Pedersen commitments with Bulletproofs.

1) Pedersen Commitment: The Pedersen commitment is a homomorphic commitment scheme providing perfectly hiding and computationally binding properties under the ECDLP. For a data value d and a random blinding factor r ∈ ℤ l * , the commitment is defined as c o m = d ⋅ G + r ⋅ H , where G and H are independent generators of G . It satisfies additive homomorphism: c o m 1 + c o m 2 = ( d 1 + d 2 ) G + ( r 1 + r 2 ) H .

2) Bulletproofs Range Proof: Bulletproofs is a non-interactive zero-knowledge proof protocol that requires no trusted setup [36]. In our scheme, for the multidimensional data vector of a terminal device T D i , we use c o m i to denote the corresponding commitment object, which may be instantiated as a vector commitment or an equivalent set of per-dimension commitments. Based on c o m i , T D i generates a proof π i to convince the ENs that each committed dimension lies within its valid range [ 0 , Γ j ] without revealing the plaintext values. The verifier checks π i with respect to the corresponding c o m i , so that the multidimensional range proof is explicitly bound to the same committed data instance.

The CC initializes the system and publishes the public parameters as follows.

Step 1: Let G be an elliptic curve group of prime order l with generators G and H . The CC randomly selects two large prime numbers p , q ← GenPrime ( κ ) , computes the Paillier modulus N = p q and the Carmichael function λ = lcm ( p − 1 , q − 1 ) , and sets g = N + 1 as the generator for the Paillier cryptosystem. Additionally, the CC computes the decryption parameter μ = λ − 1 ( mod N ) .Step 2: The CC initializes the modulus set by selecting K max + 20 % extra prime numbers using a prime generation function, denoted as the set Ψ = { ψ 1 , ⋯ , ψ K } . These primes will be used for CRT packing.Step 3: Each terminal device T D i independently generates a key pair ( s k i , p k i ) for the digital signature algorithm to ensure data authenticity and non-repudiation. The secret key s k i is kept local and is never shared.Step 4: To prevent plaintext overflow during homomorphic aggregation, the CC establishes a packing capacity boundary. Let n max denote the maximum number of terminal devices connected to a single Edge Node (EN). The CC computes the secure capacity threshold T c a p as

This threshold guarantees that the aggregated sum of any valid packed data chunk does not exceed the Paillier modulus N , thereby preventing modular truncation during decryption.

Step 5: To guarantee the state machine consistency and forward compatibility of the dynamic aggregation protocol, the CC initializes the global system epoch with a genesis version tag V i d ( 0 ) . Consequently, the CC broadcasts the complete public parameters to all ENs and TDs according to Equation (3).

Each terminal device T D i performs the following operations on its multidimensional data vector d i = ( d i 1 , ⋯ , d i m ) .

Step 1: T D i selects m prime numbers from the modulus set Ψ to form the active set corresponding to its current data dimensions, denoted by S a c t i v e = { ψ s 1 , ⋯ , ψ s m } . To prevent plaintext overflow caused by a single large modulus product, T D i performs an adaptive capacity check using T c a p . T D i partitions S a c t i v e into B chunks, denoted by { S ( 1 ) , ⋯ , S ( B ) } , using a greedy algorithm. For any chunk k ∈ { 1 , ⋯ , B } , the product of its moduli must satisfy the capacity threshold:

Step 2: For each chunk k , T D i computes the specific CRT packing coefficients. For a given prime ψ s j ∈ S ( k ) , the coefficients are calculated as

Step 3: T D i generates the data commitment c o m i = commit ( d i 1 , ⋯ , d i m ) , where d i j ≤ Γ j < ψ s j / 2 . Then, it uses the Bulletproofs protocol to generate a zero-knowledge range proof covering all dimensions, computed as

Step 4: Rather than computing a single integer, T D i constructs a set of packed values. For each chunk k ∈ { 1 , ⋯ , B } , the packed value is computed as

Step 5: T D i encrypts each packed chunk independently using the optimized Paillier encryption algorithm. For each k ∈ { 1 , ⋯ , B } , the ciphertext is generated as

where r i ( k ) ← ℤ N * . Consequently, the terminal generates a ciphertext vector C i = { C i ( 1 ) , ⋯ , C i ( B ) } .

Step 6: To ensure data authenticity and prevent forgery without requiring online interaction, T D i applies the BN signature mechanism. It generates a random nonce r i ← ℤ l * , computes R i = r i G , and obtains the authenticated public key list L = { p k 1 , ⋯ , p k n } broadcast by the serving EN for the current epoch. After verifying the validity and freshness of L , T D i binds the active version tag V i d ( 0 ) into the cryptographic challenge c i , which is computed as

The terminal computes s i = r i + c i ⋅ s k i ( mod l ) . The resulting BN signature is σ i = ( R i , s i ) .

Step 7: T D i transmits the data packet { C i , π i , σ i , c o m i } to the EN.

ENs aggregate the messages received from terminal devices ( T D i ) and forward the aggregated results to the CC.

Step 1: The EN collects data packets from n active devices:

Upon receiving the data packets from the terminals, the EN first checks the plaintext version tag of each packet. It verifies whether the tag matches the current system version (initially V i d ( 0 ) ). If a packet contains a mismatched version tag, the EN discards it to prevent cross-version interference. For the remaining valid packets, the EN proceeds with batch verification and ciphertext aggregation.

Step 2: The EN performs batch verification of the individual BN signatures to authenticate device identities and data integrity:

Subsequently, the EN performs batch verification of the Bulletproofs range proofs. This step ensures that all hidden multidimensional data fall within legitimate ranges without requiring decryption according to Equation (12).

Here, each proof π i is verified with respect to its corresponding commitment object c o m i and the prescribed range bounds { Γ j } , thereby ensuring that the verified range statement is bound to the same multidimensional data instance committed by T D i .

Step 3: If batch verification fails, the EN applies a group rollback mechanism to efficiently locate the invalid data. The failed batch is divided into smaller groups for independent re-verification. This process is recursively subdivided until malicious or faulty devices are accurately identified and excluded.Step 4: Upon successful verification, the EN aggregates the ciphertexts from all valid terminals on a chunk-by-chunk basis. For each chunk index k ∈ { 1 , ⋯ , B } , the aggregated ciphertext is computed utilizing the homomorphic property of the Paillier cryptosystem:

This yields an aggregated ciphertext vector C a g g = { C a g g ( 1 ) , ⋯ , C a g g ( B ) } .

Step 5: To compress the signatures, the EN applies the non-interactive half-aggregation technique of the BN scheme. After validating the individual signatures, the EN aggregates the scalar components into a single compact scalar as

The resulting aggregate signature is σ a g g = ( R 1 , ⋯ , R n , s a g g ) . This process compresses the n individual signatures by approximately half, thereby optimizing the communication overhead to the CC.

The CC verifies and decrypts the aggregated data to extract the multidimensional statistical results.

Step 1: Upon receiving the aggregated packet, the CC verifies the validity of the BN aggregate signature. The CC recalculates the independent challenges c i for each terminal and executes the batch verification equation as

If the equation holds, it cryptographically guarantees that no rogue key attacks have occurred and that the integrity of the aggregated ciphertext C a g g is intact.

Step 2: If the verification passes, the CC processes the aggregated data from each Edge Node independently to prevent homomorphic plaintext overflow. Let E denote the total number of active ENs, and let C a g g , e ( k ) denote the k -th aggregated ciphertext chunk received from the e -th EN ( 1 ≤ e ≤ E ). For each EN e and each chunk k ∈ { 1 , ⋯ , B } , the CC performs Paillier decryption as follows:

Because the adaptive chunking mechanism enforces M ( k ) ≤ T c a p during the data collection phase, and the number of devices aggregated by a single EN is bounded by n e ≤ n max , the arithmetic sum for each EN satisfies:

Therefore, no modular truncation occurs during the decryption of any individual EN’s packet, ensuring data integrity at the edge level.

Step 3: To obtain the global statistical results across the entire system, the CC aggregates the decrypted chunks from all ENs in the plaintext domain as

Step 4: Finally, the CC performs CRT decoding to recover the aggregated value for each specific dimension. For a given dimension j , the CC identifies the specific chunk k containing the modulus ψ s j (i.e., ψ s j ∈ S ( k ) ) and extracts the value as

For multi-EN deployment, Eq. (20) is directly applicable only when the modulus ψ s j is sufficient to bound the system-wide sum of dimension j . Otherwise, each EN should first decode its local per-dimension aggregate, after which the CC computes the final global sum by adding the decoded results from all ENs.

1. Trigger Conditions

Expanding data dimensions may be necessary to accommodate new business requirements, such as adding new sensor types or statistical indicators.Unused redundant prime numbers must remain available in the existing modulus set Ψ (i.e., the total number of dimensions has not exceeded K max + 20 % ).

2. Dimension Update Process

Once the trigger conditions are met, the dimension update process is executed as follows, integrating with the adaptive chunking mechanism.

Step 1: The CC selects a prime ψ new from the unused modulus set Ψ that satisfies ψ new > n max ⋅ Γ new , where Γ new is the maximum boundary for the new dimension and n max is the maximum number of terminal devices. The CC increments the global system version to V i d new and broadcasts { V i d new , ψ new , Γ new } to all ENs and TDs.Step 2: Upon receiving the update, T D i updates its active version to V i d new and adds ψ new to its active dimension set: S active new = S active ∪ { ψ new } . To prevent overflow, T D i re-runs the greedy capacity check against T c a p . If the addition of ψ new causes a chunk to exceed T c a p , T D i automatically allocates ψ new to a new chunk B + 1 , ensuring the system remains overflow-free.Step 3: T D i updates its local CRT packing parameters for the specific chunk k containing ψ new . When uploading the updated data vector d i = ( d i 1 , ⋯ , d i m , d i new ) , it computes the new packed values { D i ( k ) } and encrypts them into a new ciphertext vector C i new .Step 4: To prove the validity of the new dimension, T D i generates an updated Bulletproofs range proof π new covering all dimensions (including d i new ≤ Γ new ) and an updated commitment c o m i new . To ensure consistent security, T D i maintains the BN signature mechanism for the updated packet. It generates a random nonce r i ← ℤ l * , computes R i = r i G , and calculates the cryptographic challenge as

The terminal uses its private key s k i to compute s i , new = r i + c i ⋅ s k i ( mod l ) , resulting in the updated signature σ i , new = ( R i , s i , new ) .

Step 5: The ENs filter packets by the new version tag V i d new , perform the vectorized aggregation, and execute the BN half-aggregation as defined in Section V.C. Subsequently, the CC verifies the aggregate signature, decrypts the chunks, and decodes the new dimension using the CRT as

where k is the index of the chunk containing ψ new .

Theorem 1. Under the decisional composite residuosity (DCR) assumption, the Paillier-based encryption component of the proposed scheme achieves IND-CPA security for the packed multidimensional data.

Proof sketch. The argument follows the standard IND-CPA security intuition of Paillier encryption under the DCR assumption. In the proposed scheme, each multidimensional data vector is first deterministically packed into a plaintext integer by the public CRT-based encoding rule and is then encrypted by the Paillier cryptosystem. Therefore, any PPT adversary that can distinguish between encryptions of two packed multidimensional plaintexts with non-negligible advantage can be used to distinguish Paillier encryptions under the same public key, contradicting the IND-CPA security of Paillier under the DCR assumption. Hence, the confidentiality of the packed multidimensional data reduces to the IND-CPA security of the Paillier encryption component. In addition, the adaptive chunking mechanism keeps each packed plaintext within the admissible encoding bound, thereby avoiding ambiguity caused by modular overflow during aggregation and decoding.

Theorem 2. In the random oracle model, the BN half-aggregation mechanism of the proposed scheme is existentially unforgeable against chosen-message attacks under the hardness of the discrete logarithm (DL) problem in G .

Proof sketch. The argument follows the standard Bellare–Neven-style security intuition in the random oracle model. Suppose that a PPT adversary can forge a valid BN aggregate signature for the target public-key list with non-negligible probability. Then, by replaying the adversary under the same randomness but with a different oracle response, one can obtain two valid aggregate signatures corresponding to the same nonce values and different challenge values. Their difference yields a non-trivial linear relation over the involved public keys, from which the secret scalar associated with the target public key can be extracted using the standard forking-based argument. Because a successful forgery with non-negligible probability would imply an efficient solver for the DL problem in G , this contradicts the stated hardness assumption. Hence, under the stated assumptions, the BN half-aggregation mechanism provides authenticity and integrity protection against chosen-message forgery. Moreover, because all terminals in the same epoch compute their challenges over the same authenticated public-key list, the attack surface for rogue-key-style manipulation is reduced during EN-side batch verification.

In the proposed scheme, c o m i denotes the commitment object associated with the multidimensional data of T D i , and π i denotes the corresponding Bulletproofs range proof. Owing to the hiding and binding properties of the underlying commitment mechanism, together with the soundness of Bulletproofs, the EN can verify that each committed dimension satisfies its prescribed range constraint without learning the plaintext values. Since the verifier checks π i with respect to the corresponding c o m i , the range proof is bound to the same multidimensional data instance contained in the packet generated by T D i .

This section evaluates the performance of the proposed scheme regarding computational and communication costs, followed by a comparison with four existing schemes: ESMA [29], MMSDA [30], EPPA [15], and LPPDA [37].

To ensure fairness, the security level is set to 112 bits across all evaluated schemes. The Paillier cryptosystem adopts 1024-bit primes ( p , q ) and a 2048-bit modulus N . For the elliptic curve operations, the NIST P-224 curve is utilized to provide a 224-bit prime field, where group elements are 448 bits in length (uncompressed). For schemes involving bilinear pairings (e.g., ESMA), an equivalent Barreto-Naehrig (BN-254) curve is employed to maintain a consistent security strength. Identifier and timestamp sizes are fixed at 32 bits and 64 bits, respectively.

Key cryptographic operations are simulated using the PBC and OpenSSL libraries. The experiments are conducted on a PC running a 64-bit Windows 11 operating system, equipped with an Intel Core i5-1035G1 CPU (1.00 GHz) and 16 GB RAM. The execution times of the basic operations, averaged over 1000 trials, are summarized in Table 2.

Table 2.Basic operation execution time (milliseconds).

It is typically assumed that the CC possesses sufficient computational and communication resources. Therefore, the analysis of computational complexity is primarily focused on TDs and ENs.

In our scheme, TDs first pack multidimensional data into a single integer using the CRT, which is equivalent to data representation in a composite modulus system. Each terminal then encrypts the packed data using an optimized Paillier homomorphic encryption algorithm and generates a BN signature alongside a Bulletproofs range proof to verify data validity and authenticity. After receiving the ciphertexts, ENs perform batch verification of the signatures and range proofs, followed by ciphertext aggregation.

Therefore, the total computational costs for TDs and ENs are m T c r t + T e n c + T s i g + ( 2 m + 2 log 2 m ) T P M and ( n − 1 ) T M + n T h + ( n + 1 ) T P M + n ( 2 log 2 m ) T P M , respectively.

For the comparison schemes, in ESMA [29], the total computational costs for the terminal and aggregator are T M + T P a i l E n and ( n − 1 ) T M + ( n + 1 ) T b p , respectively. In MMSDA [30], the terminal performs ( m + ⌈ m / 31 ⌉ ) exponentiations and m multiplications in ℤ N 2 , for a total cost of ( m + ⌈ m / 31 ⌉ ) T E + m T M , while the aggregator cost is ( n − 1 ) ⌈ m / 31 ⌉ T M . In the EPPA [15] scheme, the terminal’s total cost is ( m + ⌈ m / 16 ⌉ ) T E , and the aggregator’s cost is ( n − 1 ) ⌈ m / 16 ⌉ T M . In LPPDA [37], the total computational costs for the terminal and aggregator are 3 m T E + m T h and ( n + 3 ) T E + ( 3 n + 1 ) T h + 5 n T M , respectively.

The computational costs of each scheme are summarized in Table 3. As shown in Figure 2, the proposed scheme provides a significant advantage in terminal-side computational cost compared with MMSDA [30], EPPA [15], and LPPDA [37], which suffer from rapid overhead growth due to repeated modular exponentiations for each data dimension. In contrast, our scheme mitigates this overhead by executing only a single optimized Paillier encryption regardless of dimensionality. Furthermore, the growth in our scheme is predominantly driven by Bulletproofs generation, maintaining a superior efficiency profile over the constant-cost ESMA [29] across the evaluated dimension range ( m ≤ 200 ).

In contrast, as illustrated in Figure 3, the computational cost for ENs in the proposed scheme is higher than that of MMSDA, EPPA, and LPPDA, and closely parallels ESMA. This increase is an inherent and justifiable trade-off for integrating Bulletproofs and BN signatures to achieve robust verifiability, a critical security feature absent in MMSDA and EPPA. Specifically, our EN performs rigorous cryptographic batch verification of zero-knowledge proofs and digital signatures, preventing data pollution and impersonation attacks. However, since the execution time for aggregating and verifying 200 terminals remains approximately 1000 ms, this overhead is highly practical for typical edge nodes possessing substantial computational resources. Especially when the number of terminals becomes large, the batch verification operations with logarithmic complexity O ( log ( n m ) ) keep the computational burden manageable compared to strictly linear verification approaches.

It is worth noting that the logarithmic computational advantage O ( log ( n m ) )

Figure 2.Terminal computational cost comparison.

Figure 3. Edge node computational cost comparison.

of our batch verification is primarily achieved under an attack-free or low-fault environment. In adversarial scenarios where malicious terminals inject invalid proofs, the recursive group rollback mechanism is repeatedly triggered, temporarily degrading the verification efficiency towards a linear complexity O ( n ) in the worst case. However, considering that the proportion of compromised devices in practical deployments is typically sparse, the amortized computational cost of our scheme across long-term operations remains strictly bounded. Therefore, our scheme achieves a robust balance between rigorous security guarantees and high-dimensional aggregation efficiency.

Table 3.Computational cost comparison of each scheme.

The communication overhead is evaluated across two primary transmission stages: from TDs to ENs, and from ENs to the CC. A comprehensive comparison of the communication costs for each scheme is summarized in Table 4.

Table 4.Communication cost comparison of each scheme (bits).

1. From TDs to ENs: In the proposed scheme, each TD transmits a comprehensive data packet { C i , π i , σ i , c o m i } to the EN. This packet inherently encapsulates the Paillier ciphertext, the Bulletproofs range proof, the BN signature, and the commitment, yielding a total communication cost of 2 × 2048 + ( 2 ⌈ log 2 m ⌉ + 4 ) × 224 + 2 × 224 + 224 = 448 ⌈ log 2 m ⌉ + 5664 bits. For the baselines, the ESMA [29] scheme requires each terminal to send { C i j , I D i j , T S , σ i j } , incurring an overhead of ( m + 3 ) × 224 + 320 bits. MMSDA [30] and EPPA [15] transmit payloads of { C i , σ i } and { C i ∥ R A ∥ U i ∥ T S ∥ σ i } , which generate communication costs of ⌈ m / 31 ⌉ × 4096 + 512 bits and ⌈ m / 16 ⌉ × 4096 + 512 bits, respectively. Meanwhile, LPPDA [37] involves sending { C T i , j , S i , j , R i , T i , j , I D i } , resulting in a fixed cost of 8288 bits.

2. From ENs to the CC: In our scheme, the EN forwards only the aggregated result { C a g g , σ a g g } to the CC. Due to the inherent properties of ciphertext aggregation and BN half-aggregation, this process incurs a strictly constant communication cost of 2 × 2048 + 2 × 224 = 4544 bits. In contrast, the ESMA [29] scheme forwards { C i j , I D i j , T S , σ i j } to the CC, requiring ( m + 3 ) × 224 + 320 bits. The MMSDA [30] and EPPA [15] aggregators send { C , σ } and { C ∥ R A ∥ G W ∥ T S ∥ σ g } , demanding ⌈ m / 31 ⌉ × 4096 + 512 bits and ⌈ m / 16 ⌉ × 4096 + 512 bits, respectively. Finally, LPPDA [37] forwards { C T k , j , S k , j , R k , U k , j , T k , j , I D k } , maintaining a constant overhead of 10336 bits.

Figure 4.Terminal communication cost comparison.

Figure 5.Edge node communication cost comparison.

As shown in Figure 4, the communication overhead from TDs to ENs in the proposed scheme exhibits a logarithmic growth pattern O ( log m ) with respect to the data dimension m . Although the baseline payload is marginally higher than MMSDA and EPPA in low-dimensional settings (e.g., m < 30 ) due to the inclusion of Bulletproofs and BN signatures, our scheme inherently suppresses the severe step-linear increases caused by massive ciphertext expansions in other schemes. Consequently, it establishes a decisive bandwidth advantage as m scales for high-dimensional IoT applications.

Furthermore, as shown in Figure 5, the communication cost from ENs to the CC in our scheme remains strictly constant, completely independent of the data dimension m . While ESMA, MMSDA, and EPPA suffer from dimension-dependent overheads, our scheme maintains the lowest cost across the entire evaluated range. This optimal bandwidth efficiency is achieved because the edge node forwards only a single aggregated Paillier ciphertext and one-half-aggregated BN signature, ensuring that the rigorous batch verification process introduces zero additional communication burden to the backbone network.