A Lightweight Authenticated Key Establishment Scheme for Secure Smart Grid Communications

Nowadays, the most prominent defects that affect the traditional network are that it is one-way communication, blackouts resulting from human error that is due to damage in electric transmission lines, and other defects such as the increased demand for electricity. Hence, the trend towards the so-called smart grid begins.

Smart grid is the next generation of the electric power system that uses computer technology to improve communication between different components and increase the use of digital information to improve the reliability and security of the grid. Smart grids progress the most efficient electric grid operations based on the received client data via two-way communications between the different entities in the grid. Customers can choose the most appropriate way to use the energy facilities based on the dynamic price data obtained from the smart grid in every period [1].

Smart grids consist of many components, with three most distinct and main components: Smart meters, aggregators, and service providers. The smart meter is a solid-state programmable device that is responsible for recording the amount of energy consumed and provide the electricity price information for the customers [2]. Usually, smart meters record power frequently and report daily at least. Data aggregator is responsible for collecting data from different smart meters and forwards them to the service provider [3]. Then it directs the data coming from the service provider to the smart meters. Service provider is responsible for giving each user the required amount of power according to the message received from the smart meters through the aggregator [4].

Smart meters are usually placed outside of the home and protected with a box [5]. Therefore, the attacker could penetrate the box and get the data from the smart meter, in addition to the information exchange between the smart meter and the other components communicate with each other is via the wireless communication channel [1]. Due to the nature of the wireless connection, the smart grid is exposed to many security issues. These issues might allow attackers to threaten network security. Some of the most important of these types are: a) Impersonation attack: an attack in which the opponent tries to impersonate one of the legitimate components of the network, and b) Replay attack: it is a shape of network attack that occurs when an attacker tries to eavesdrop on messages that are exchanged between network components, intercept them, and then resend them again or delay them.

To protect the security of data transmission and maintain the network's privacy, several security services must be met. The most prominent of these services are that:

- Mutual authentication: it is a process in which both components authenticate each other. Usually, the authentication process takes place between the smart meter and the data collector, or between the data collector and the service provider.

- Anonymity of smart meter: this service prevents the attacker from knowing the identity of the smart meter that sent the metering data in the network.

- Untraceability of smart meter: this service prevents the attacker from monitoring the amount of power consumed by the smart meter that is collected and sent in the network. The anonymity and untraceability can protect the privacy of consumers.

- Forward secrecy: this service prevents any attacker from breaking into session keys even if the private key of the entity is compromised.

1.1 Related work

Many researchers have sought to provide many different schemes to achieve security services and get rid of different types of attacks. A secure Key distribution scheme [6] has been proposed between smart meter and service provider for the smart grid. The proposed scheme has succeeded to prevent replay attack; however, it has not only failed to achieve perfect secrecy, mutual authentication, anonymity, untractability, but also the authors claimed that their scheme could prevent impersonation attack; however, this was found to be incorrect. A fault-tolerant and scalable key management scheme [7] has been proposed; the proposed scheme combines symmetric key technique and elliptic curve public key technique. Although, it has failed to provide mutual authentication, anonymity, forward secrecy and intractability, but it has succeeded in preventing replay and impersonation attack.

Maier et al. [8] proposed a message authentication based on hash message authentication code and Diffie-Hellman key agreement protocol. The proposed scheme has achieved mutual authentication, but has not achieved anonymity and untractability, in addition to very high communication cost because of RSA. Mahmood et al. [9] achieved forward secrecy, mutual authentication between home area network gateways and building area network gateways using hybrid Diffie-Hellman key agreement protocol, and the authentication of message based on hash message authentication code by proposing a lightweight message authentication scheme. Although the proposed scheme has failed to achieve anonymity and un-traceability, it has succeeded in reducing the communication cost compared to Maier et al.'s scheme [8]. Aziz et al. [10] applied a lightweight scheme to achieve the authentication between the smart breaker and the control center and preventing several types of attacks in the smart grid. Although this scheme has succeeded in reducing the communication cost compared to Mahmood et al's scheme [9]. Despite that, the authors claimed to achieve anonymity, which is not true. 

A new anonymous metering scheme [3] has been proposed based on direct anonymous attestation and identity-based signatures. The proposed scheme has succeeded in achieving the mutual authentication, anonymity and untraceability; however, the scheme has failed to resist replay attack and impersonation attack and has failed to achieve forward secrecy. An authentication scheme based on the Merkle hash tree technique [11] has been implemented to achieve the authentication and resist of replay attacks. This scheme is more efficient of the schemes depended on RSA. This scheme also has failed to achieve anonymity and un-traceability. The authentication between smart meters and the neighborhood gate way based on a lightweight authentication scheme and Lagrange interpolation formula [12]. The communication cost for this scheme is much better than the previous schemes. It also has succeeded in getting rid of replay attack.

An identity-based key establishment scheme [13] has been proposed to provide mutual authentication and forward secrecy in addition to preventing the replay attacks and impersonation attacks. However, it has failed to achieve anonymity and untraceability. Also, an anonymous key distribution scheme based on utilized identity-based encryption and signature [14] has been proposed to achieve the mutual authentication between the smart meter and service provider. Moreover, it can provide smart meters' anonymity and perfect forward secrecy. However, this scheme has failed to achieve the strong credentials’ privacy of the smart meter and failed to resist against replay attack, impersonation attack, and the ephemeral secret leakage attack.

A new secure authenticated shared key establishment scheme [15] has been proposed to beat the security weaknesses of the pervious scheme, also it has succeeded in reducing the communication cost compared to the previous scheme. However, the authors claimed that their scheme has achieved untraceability of the smart meter and has prevented the impersonation attack, which has proved to be incorrect. Later, an anonymous authentication and key establish scheme has been proposed [16] to avoid the disadvantages of the previous scheme [15], but the computational cost of this scheme is very high where it depends on bilinear maps and the computational Diffie–Hellman problem.

A lightweight anonymous key distribution scheme [17] has been implemented based on Elliptic Curve Cryptography (ECC); the proposed scheme has achieved the mutual authentication between smart meter and service provider and also has achieved smart meter anonymity. Moreover, the scheme also has succeeded in preventing the replay attacks and impersonation attacks and provided less communication cost compared to scheme [14, 15]. Despite all the accomplishments of this scheme, it has failed to achieve untraceability of smart meter. Kumar et al. [5] proposed a different scheme of lightweight authentication and key agreement for smart metering in smart energy network. They have utilized hybrid cryptography (the ECC and symmetric encryption) to achieve the mutual authentication, anonymity, perfect forward secrecy, preventing the several types of attacks, and has provided less communication cost compared to the schemes [14, 15, 17]. Despite all the advantages and security services achieved by Kumar et al.'s scheme [5], it has failed to achieve untraceability of smart meter.

Zhang et al. [18] have applied ECC-based authentication with identity protection; their scheme is secure against replay attacks and impersonation attacks. Moreover, the scheme has achieved the mutual authentication between smart meter and control center, and anonymity. However, this scheme has failed to achieve forward secrecy. The proposed ECC-based lightweight authentication scheme [19] has succeeded in achieving several security services and provided less communication cost compared to the schemes [8, 18], but it failed to achieve anonymity.

Farhadi et al. [20] have approached a lightweight key management protocol for secure communication in smart grids based on time constraints for two sensitive protocols (GOOSE, SV) in communication between substations and a data center. This scheme has provided the mutual authentication and forward secrecy. Other features have been provided by this scheme such as anonymity, thwarting replay and impersonation attacks; however, it has failed to achieve the untraceability. Moreover, the authors claimed that their scheme has provided less communication cost compared to the schemes [8, 14, 17-19], which is untrue.

Abbasinezhad-mood [21] proposed an anonymous key distribution scheme based on ECC which counteracts against replay and impersonation attacks, and has provided mutual authentication, forward secrecy and anonymity, and reduced the communication cost compared to schemes [8, 14, 15, 17]; but it has failed to achieve untraceability. Garg et al. [22] proposed a lightweight authentication scheme which has provided less communication cost compared to Abbasinezhad-mood's scheme [21]. This scheme was also able to solve the problems of the pervious scheme, but it has failed to achieve untraceability of smart meter.

An EEC-based privacy preserving data aggregation scheme has been proposed [23]; the proposed scheme has succeeded in achieving privacy preserving and authentication, but it has failed to achieve anonymity and untraceability of smart meter, and forward secrecy. In addition, it could not resist against replay and impersonation attack. Kong et al. [24] proposed a group blind signature scheme for privacy protection in smart grid based on RSA; the proposed scheme relays on data aggregator to achieve anonymity and untraceability; the scheme could also provide mutual authentication, but it has failed to achieve forward secrecy and failed also in preventing replay attack and impersonation attack. Wu et al. [25] introduced a different approach to preserve privacy with identity traceable property; the scheme can provide less communication cost compared to Kong et al.'s scheme [24]. However, both schemes have failed to achieve untraceability and forward secrecy.

A Dynamic Membership Data Aggregation (DMDA) protocol [26] has been proposed based on the homomorphic encryption and ID-based signature; the proposed scheme has provided mutual authentication, privacy and forward secrecy, but it has failed to prevent replay and impersonation attacks and failed to achieve anonymity, untraceability. Tahir et al. [27] introduced a new scheme depending on data aggregation; the scheme has succeeded in preventing the replay attacks and impersonation attacks, but it has failed to achieve anonymity, untraceability and forward secrecy. Boudia et al. [28] implemented an ECC-based multidimensional aggregation scheme; the idea of the proposed scheme is based on determining the type of data and collecting readings from all smart meters. After that, the data aggregator sends data of all smart meters to the service provider. The proposed scheme has been proved to be more efficient compared to Tahir et al.'s scheme [27]. However, Boudia et al. [28] has failed to achieve anonymity, untraceability and forward secrecy.

A privacy-preserving scheme for data collection in smart grid has been proposed [29]; the proposed scheme is depending on the blind signature and the key distribution to achieve mutual authentication and forward secrecy and preventing the replay attacks, but it has failed to achieve anonymity, untraceability and could not prevent impersonation attack. Zhang and Shen [30] proposed an efficient privacy-preserving multi-dimensional data aggregation scheme; the performance evaluations of this scheme have showed that it is more efficient and low- computational cost for no map-to-point hash and bilinear pairing operations are used. However, it has failed to achieve anonymity, untraceability and forward secrecy.

1.2 Contributions

The proposed scheme in this paper succeeds in offering the following significant contributions in the field of smart grid communications.

- We utilized the elliptic curve cryptography to design a lightweight authenticated key establishment scheme depending on data aggregation.

- Our proposed scheme provides the required security services for smart grid communications and resists against impersonation attack and replay attack.

- The performance of the proposed scheme is also better than existing schemes that depend on data aggregation idea.

First, the required notations and their descriptions throughout the paper are listed in Table 1. The proposed scheme is consisted of three stages: initialization stage, registration stage, mutual authentication and key establishment stage which are explained as follows:

3.1 Initialization

In this stage, the TTP chooses an elliptic curve over a finite field E(F_P ), a random generator (G), a secret key (S), and one-way hash functions. The TTP computes its public key as:

PK= SG                  (1)

And subsequently, the TTP broadcasts the parameters {PK,G,E(F_P),H(.)}.

3.2 Registration

In this stage, service providers, data aggregators, and smart meters are registered in the system.

3.2.1 SP registration

A service provider SP_k chooses its identity ID_k and computes IDS_k according to Eq. (2), where TSP defines the entity type as service provider. Then it sends its IDS_k to TTP in a secure channel.

$\mathrm{IDS}_{\mathrm{k}}=\mathrm{TSP} \| \mathrm{ID}_{\mathrm{k}}$         (2)

The $T T P$ chooses a nonce value $a_{S P_{k}} \in Z_{p}$ and computes the public and private keys of $S P_{k}$ according to Eq. (3) and $\mathrm{Eq}$. (4). Then, the $T T P$ sends the private key $\left(S K_{S P_{k}}\right)$ in a secure channel to $S P_{k},$ and broadcasts the public key $\left(P K_{S P_{k}}\right)$ of $S P_{k}$.

$\mathrm{PK}_{\mathrm{SP}_{\mathrm{k}}}=\mathrm{a}_{\mathrm{SP}_{\mathrm{k}}} \mathrm{G}$            (3)

$\mathrm{SK}_{\mathrm{SP}_{\mathrm{k}}}=\mathrm{a}_{\mathrm{SP}_{\mathrm{k}}}+\mathrm{S.H}\left(\mathrm{IDS}_{\mathrm{k}}, \mathrm{PK}_{\mathrm{SP}_{\mathrm{k}}}\right)$      (4)

Table 1. Table of notations

A data aggregator DA_j chooses its identity ID_j and computes IDA_j according to Eq. (5), where TDA defines the entity type as data aggregator. Then, it sends IDA_j to TTP in a secure channel.

$\mathrm{IDA}_{\mathrm{j}}=\mathrm{TDA} \| \mathrm{ID}_{\mathrm{j}}$         (5)

The TTP chooses a nonce value $a_{D A_{j}} \in Z_{p}$  and computes the public and private keys of DA_j as.

$\mathrm{PK}_{\mathrm{DA}_{\mathrm{j}}}=\mathrm{a}_{\mathrm{DA}_{\mathrm{j}}} \mathrm{G}$         (6)

$\mathrm{SK}_{\mathrm{DA}_{\mathrm{j}}}=\mathrm{a}_{\mathrm{DA}_{\mathrm{i}}}+\mathrm{S.H}\left(\mathrm{IDA}_{\mathrm{j}}, \mathrm{PK}_{\mathrm{DA}_{\mathrm{j}}}\right)$          (7)

Then, the TTP sends the private key (SK_DAj) in a secure channel to DA_j, and broadcasts the public key (PK_DAj) of DA_j and its certificate.

3.2.3 SM registration

A smart meter SM_i chooses its identity ID_iand computes $I D S M_{i}$ according to Eq. (8), where TSM defines the entity type as smart meter, and sends it to TTP in a secure channel.

$\mathrm{IDSM}_{\mathrm{i}}=\mathrm{TSM} \| \mathrm{ID}_{\mathrm{i}}$            (8)

The TTP chooses a nonce value $a_{S M_{i}} \in Z_{p}$ and computes the public and private keys for SM_i according to Eq. (9) and Eq. (10).

$\mathrm{PK}_{\mathrm{SM}_{\mathrm{i}}}=\mathrm{a}_{\mathrm{SM}_{\mathrm{i}}} \mathrm{G}$          (9)

$\mathrm{SK}_{\mathrm{SM}_{\mathrm{i}}}=\mathrm{a}_{\mathrm{SM}_{\mathrm{i}}}+\mathrm{S} \cdot \mathrm{H}\left(\mathrm{IDSM}_{\mathrm{i}} \| \mathrm{PK}_{\mathrm{SM}_{\mathrm{i}}}\right)$       (10)

Then, the $T T P$ sends the private key $\left(S K_{S M_{i}}\right)$ in a secure channel to $S M_{i},$ and encrypts and sends the identity and the public $\quad \mathrm{key} \quad\left(P K_{S M_{i}}\right)$of$E_{S}\left(\operatorname{IDSM}_{i} \| P K_{S M_{i}}\right) \| H\left(\operatorname{IDSM}_{i} \| P K_{S M_{i}}\right)$ to $D A_{j}$.

DA_j  verifies the identity and public key of each smart meter SM_i in its community and stores the verified identities and public keys in its data base.

3.3 Authentication and key agreement

In this stage, an authenticated session key will be established between SM_i and DA_j (Figure 2 describes the steps of this stage), and another authenticated session key will be established between DA_j and SP_k (Figure 3 describes the steps of this stage).

3.3.1 Mutual authentication between SM_iand DA_j

Firstly, SM_i chooses a nonce value $w \in Z_{p}$ and computes

A₁, A₂, A₃, and C₁ as:

$A_{1}=w G$              (11)

$A_{2}=H\left(w P K_{D A_{j}}+w H\left(I D A_{j} \| P K_{D A_{j}}\right) P K\right)\oplus I D S M_{i}$           (12)

$A_{3}=H\left(A_{1}\left\|P K_{S M_{i}}\right\| P K_{D A_{j}}\left\|I D S M_{i}\right\| I D A_{j} \| t_{1}\right)$         (13)

$C_{1}=E_{a_{S M_{i}}}\left(A_{3}\right)$         (14)

Then, $S M_{i}$ sends $\left\{A_{1}, A_{2}, C_{1}, t_{1}\right\}$ to $D A_{j}$.

Secondly, when $D A_{j}$ receives the message from $S M_{i},$ it starts off checking $t_{1}-t_{2} \leq \Delta t,$ it rejects the message if not fresh; otherwise, it extracts the identity of $S M_{i}$ and gets the public key of $S M_{i}$ from its data base to extract $A_{3}{ }^{*}$ as:

$I D S M_{i}=A_{2} \oplus H\left(S K_{D A j}, A_{1}\right)$    (15)

$A_{3}^{*}=D_{P K_{S M_{i}}}\left(C_{1}\right)$         (16)

Then, $\quad$ it $\quad$ checks $\quad D_{P K_{S M_{i}}}\left(C_{1}\right) \stackrel{\text { ? }}{=}H\left(A_{1}\left\|P K_{S M_{i}}\right\| P K_{D A_{j}}\left\|I D S M_{i}\right\| I D A_{j} \| t_{1}\right) ;$ if true, $D A_{j}$ chooses a nonce value $x \in Z_{p}$ and computes $A_{4}, S K_{j i}, A_{5}, A_{6},$ and $C_{2}$ as:

$A_{4}=x G$      (17)

$S K_{i i}=H\left(A_{1}\left\|A_{4}\right\| x A_{1}\right)$      (18)

$A_{5}=H\left(x P K_{S M_{i}}+x H\left(I D_{i} \| P K_{S M_{i}}\right) P K\right) \oplus I D A_{j}$       (19)

$A_{6}=H\left(I D S M_{i}\left\|I D A_{j}\right\| A_{1}\left\|A_{4}\right\| S K_{D A_{j}}\right)$        (20)

$C_{2}=E_{a_{D A_{i}}}\left(A_{6}\right)$            (21)

Then, it sends $\left\{A_{4}, A_{5}, C_{2}, t_{2}\right\}$ to $S M_{i}$.

Finally, when $S M_{i}$ receives the message from $D A_{j},$ it starts off checking $t_{2}-t_{3} \leq \Delta t,$ it rejects the message if not fresh; otherwise, extracts the identity of $D A_{j}$ and extracts $A_{6}^*$ as:

$I D A_{j}=A_{5} \oplus H\left(S K_{S M_{i}}, A_{4}\right)$          (22)

$A_{6}^{*}=D_{P K_{D A_{j}}}\left(C_{2}\right)$          (23)

Then, it checks if ${A_{6}}^* \stackrel{?}{=} \underline{H}\left(\operatorname{IDSM}_{i}\left\|I D A_{j}\right\| A_{1}\left\|A_{4}\right\| S K_{S M_{i}}\right)$ if true, $S M_{i}$ computes:

$S K_{i j}=H\left(A_{1}\left\|A_{4}\right\| w A_{4}\right)$       (24)

This shared key will be used to encrypt the messages and to provide secure communication between $S M_{i}$ and $D A_{j}$.

3.3.2 Mutual authentication between $D A_{j}$ and $S P_{k}$

Firstly, $D A_{j}$ chooses a nonce value $b_{1} \in Z_{p}$ and computes $B_{1}$ and $R_{1}$ according to Eq. (25)$\&$ Eq. $(26) .$ Then, it sends $\left\{B_{1}, R_{1}, I D A_{j}, P K_{D A_{j}}, t_{3}\right\}$ to $S P_{k}$.

$B_{1}=b_{1} G$                 (25)

$R_{1}=b_{1}+S K_{D A_{j}} \cdot H\left(I D S_{k}, B_{1}, t_{3}\right)$              (26)

$B_{2}=b_{2} G$         (27)

$R_{2}=b_{2}+S K_{S P_{k}} \cdot H\left(I D A_{j}, B_{2}, t_{4}\right)$        (28)

$S K_{j k}=H\left(b_{2} \cdot B_{1}\right)$         (29)

Then, it sends $\left\{B_{2}, R_{2}, I D S_{k}, P K_{S P_{k}}, t_{4}\right\}$ to $D A_{j}$.

Finally, when DA receives the message from $S P_{k}$, it starts ff checking $\mathrm{t}_{4}-\mathrm{t}_{5} \leq \Delta \mathrm{t},$ it rejects the message if not fresh; therwise, $\quad$ it $\quad$ checks $\quad R_{2} . G \stackrel{?}{=}\left(B_{2}+P K_{S P_{k}}+\right.\left.H\left(I D S_{k}, P K_{S P_{k}}\right) P K\right) \cdot\left(H\left(I D A_{j}, B_{2}, t_{4}\right)\right) .$ Then, it computes $S K_{k j}$ as:

$S K_{k j}=H\left(b_{1} \cdot B_{2}\right)$         (30)

This shared key will be used to encrypt the messages and to provide secure communication between $S P_{k}$ and $D A_{j}$.

In this section, we analyze the performance of the proposed scheme and compare it with a number of recent considerable schemes in terms of security services and complexity.

5.1 Performance analysis

The important notations required for performance analysis of our proposed scheme and for the comparison with the recent related schemes and its execution time are given in Table 2.

Table 2. Required notations and execution time for all the crypto-operation

Table 3. Complexity of our proposed scheme

5.2 Security comparison

As the proposed authenticated key establishment scheme depends on the idea of data aggregation to reduce the burden on smart meters and transfers consumption data safely, we compare our proposed scheme with the schemes that depend on data aggregation [3, 28] in Table 4. From Table 4, it is obvious that our scheme and the other schemes support the authentication service. However, only our scheme and the anonymous metering scheme [3] can provide anonymity and untraceability of SM, while only our proposed scheme and Boudia et al.'s scheme [28] can resist against impersonation attack and replay attack. Finally, only our scheme can provide forward secrecy. From the previous comparison, we can conclude that our proposed scheme can provide more security services than other schemes [3, 28] that depend on using the same idea of data aggregation.

Table 4. Security comparison

In Table 5, we compare our scheme with the anonymous metering scheme [3] and multidimensional aggregation scheme [28]. In our proposed scheme, SM requires four ECC scalar multiplication operations, one-point addition operation, six hash function operations, and two asymmetric key encryption/decryption operations. Hence the SM’s complexity is $\left(4 T_{s}+T_{P A}+6 T_{h}+2 T_{A E D}\right)$ which needs 17.9082 ms to be executed. For the anonymous metering scheme [3], SM requires one bilinear pairing operation, six bilinear scalar multiplication operations, one modular exponentiation operation, and three map-to-point function operations. Hence the SM’s complexity is $\left(1 T_{p r}+6 T_{m u l}+1 T_{e x p}+3 T_{h p}\right)$ which needs 60.271 ms to be executed. It is well known that bilinear pairing operation is very complex than any other computations. For the multidimensional aggregation scheme [28], SM requires (2n+2) ECC scalar multiplication operations where n is the number of data types. Hence the SM’s complexity is $(2 n+2) T_{S}$ which needs 4.452n+4.452 ms to be executed.

Secondly, the complexity of DA in each scheme is obtained. In our scheme, the DA requires nine ECC scalar multiplication operations, four-point addition operations, ten hash function operations, and two asymmetric key encryption/decryption operations. Hence, the DA’s complexity is $\left(9 T_{s}+4 T_{P A}+10 T_{h}+2 T_{A E D}\right)$ which will be executed in 29.1338 ms. In the anonymous metering scheme [3], the DA requires one bilinear pairing operation, six bilinear scalar multiplication operations, five modular exponentiation operation, and five map-to-point function operations. Hence, the DA’s complexity is $\left(1 T_{p r}+6 T_{m u l}+5 T_{e x p}+5 T_{h p}\right)$ which will be executed in 100.507 ms. In the multidimensional aggregation scheme [28], the DA requires (w+2) ECC scalar multiplication operations where w is the number of SMs. Hence the DA’s complexity is $(w+2) T_{s}$ which will be executed in 4.452w+4.452 ms. 

Finally, the complexity at SP in each scheme is computed successively. In our scheme, SP requires five scalar multiplication operation in ECC, three-point addition operation, and four hash function operations. Hence the SP’s complexity is $\left(5 T_{s}+3 T_{P A}+4 T_{h}\right)$ which will be executed in 11.2256ms. In the anonymous metering scheme [3], SP requires one bilinear pairing operation, one bilinear scalar multiplication operation, one modular exponentiation operation, and two map-to-point function operations. Hence the SP’s complexity is $\left(1 T_{p r}+1 T_{m u l}+1 T_{e x p}+2 T_{h p}\right)$ which will be executed in 36.723 ms. In the multidimensional aggregation scheme [28], SP requires (w+2) ECC scalar multiplication operations and n solving the DL operation mod p . Hence, the SP’s complexity is $(w+2) T_{s}+n T_{\log }$. Solving the DL operation needs too long time to be executed; however, parallel Pollard‟s Rho method can be used to speed up the computations. By implementing the algorithm on a cluster of 256 octa-core computers having PFLOPs capacity, solving the ECDLP requires 190189.061 sec. Hence, the execution of Boudia et al.'s scheme [28] requires $4.4524 .452(w+2)+190189061$ ms.

The real time complexity of our proposed scheme, the anonymous metering scheme [3], and multidimensional aggregation scheme [28] are given in Table 6. The real time complexity of Boudia et al.'s scheme [28] at the SM is dependent on the number of data types n, and it will be equivalent to our scheme at n=3. However, the real time complexity of Boudia et al.'s scheme [28] at the DA is dependent on the number of SMs (w), and it will be equivalent to our scheme at w=6. Lastly, the time complexity of Boudia et al.'s scheme [28] at the SP is dependent on the number of data type, the number of SMs, and the complexity of solving the DL. However, the real time of solving the DL operation which too long compared to the real time complexity of our proposed scheme at the SP regardless of the number of data type or the number of SMs.

Table 5. Complexity comparison