Andre Nel
email: anel@mnhn.fr

Bruno Vallois
email: bruno.vallois@wanadoo.fr

Hervé Duquesne
email: hduquesne@wanadoo.fr

A new archaeorthopteran family from the late Carboniferous of La Mure (France)

Keywords: Insecta, ?Cnemidolestodea, fam., gen. et sp. nov., Kasimovian, French Alps

The new archaeorthopteran family Roqueiidae is defined for the new genus and species Roqueia alpine, described from the Pennsylvanian (Kasimovian) of La Mure region (Isère, Alps, France). This new taxon is characterized by the set of characters: basal fusion of MA with R, its distal re-emergence from RP, and ending into vein MP. The Roqueiidae are tentatively assigned to the order Cnemidolestodea together with the family Cnemidolestidae.

Introduction

The superorder Archaeorthoptera [START_REF] Béthoux | Venation pattern and revision of Orthoptera sensu nov. and sister groups. Phylogeny of Palaeozoic and Mesozoic Orthoptera sensu nov[END_REF] (total group of the extinct and extant Orthoptera) reached a maximum of diversity during the late Paleozoic, with no less than four major orders (Cnemidolestodea, Caloneurodea, Titanoptera, crown Orthoptera) plus a series of families and genera representative of the stem group of the Panorthoptera. This diversity greatly decreased during the Triassic with only the Titanoptera and crown Orthoptera surviving and again after the extinction of the Titanoptera near the end of this period. An impressive series of recent discoveries of new Archaeorthoptera is going on, always confirming this general tendency of a highest diversity of the group during the late Carboniferous and the Permian (e.g., [START_REF] Schubnel | Sound vs. light: wing-based communication in Carboniferous insects[END_REF]).

Here we describe a new fossil Archaeorthoptera with a unique forewing venation from the Kasimovian of the French Alps. It is probably related to the order Cnemidolestodea sensu [START_REF] Béthoux | Cnemidolestodea (Insecta): an ancient order reinstated[END_REF], but corresponds to a new family, genus, and species.

Material and methods

The fossil was found by one of us (H.D.) in the slag heap of the Villaret. It was examined under a Nikon SMZ1500 and photographed with an AmScope camera MU900. This outcrop corresponds to the Kasimovian (Baruellian, Stephanian A), with Crenulopteris lamuriana (Heer) as typical plant of the biozone [START_REF] Wittry | A revision of the Pennsylvanian marattialean fern Lobatopteris vestita auct. and related species[END_REF]. We follow the wing venation terminology of [START_REF] Béthoux | Venation pattern and revision of Orthoptera sensu nov. and sister groups. Phylogeny of Palaeozoic and Mesozoic Orthoptera sensu nov[END_REF], modified by [START_REF] Schubnel | To be or not to be: postcubital vein in insects revealed by microtomography[END_REF].

Wing vein terminology: A, anal vein; C, costa; CuA, cubitus anterior; CuP, cubitus posterior; CuPa, anterior branch of CuP; CuPb, posterior branch of CuP; MA, median anterior vein; MP, median posterior vein; PCu, postcubital vein; RA, radius anterior; RP, radius posterior; ScP, subcosta posterior. urn:lsid:zoobank.org:pub:2D28E9D1-82FC-4351-B7AF-AD6C3950F08F

Systematic Palaeontology

Superorder Archaeorthoptera [START_REF] Béthoux | Venation pattern and revision of Orthoptera sensu nov. and sister groups. Phylogeny of Palaeozoic and Mesozoic Orthoptera sensu nov[END_REF]?Order Cnemidolestodea Handlirsch, 1937(sensu Béthoux 2005) Family Roqueiidae fam. nov. Hind wing poorly preserved, lying over second forewing, ca. 33.7 mm long, ca. 11.9 mm wide, without visible anal fan; no triangular elongate area between R and first anterior branch of MP+CuA+CuPa present.

Leg fragments poorly preserved, but tibia and femur elongate and relatively thin (Fig. 2B).

Discussion

This fossil is attributed to the Archaeorthoptera as it shares the main diagnostic characters of this superorder, namely the basal fusion of CuA with M (only its distal part MP+CuA being preserved) and subsequent connection of CuA with an anterior branch CuPa of CuP [START_REF] Béthoux | Venation pattern and revision of Orthoptera sensu nov. and sister groups. Phylogeny of Palaeozoic and Mesozoic Orthoptera sensu nov[END_REF] fig. 1). The elongate CuPa and the absence of an elongate vein between CuPa and CuPb exclude any affinities with the Panorthoptera. Roqueia gen. nov. has some similarities with the Oedischiidae that have also a triangular area between RP and M. But the presence of four posterior branches of MP also excludes affinities with this orthopteran group in which there is a single vein MP separating from the anterior branch MA that is itself parallel to R/RP and ending into RP. Also the Oedischiidae have an anal fan in the hind wing, unlike Roqueia Furthermore, Roqueia gen. nov. has some characters very similar to those of the order Cnemidolestodea (sensu [START_REF] Béthoux | Cnemidolestodea (Insecta): an ancient order reinstated[END_REF], to include the Cnemidolestidae only), such as a specialized elongate triangular area between RP/MA and a long vein emerging from M+CuA, distally closed by the fusion of these veins; plus the vein MP emitting several parallel posterior branches. Notice that [START_REF] Aristov | Classification of the order Cnemidolestida (Insecta: Perlidea) with descriptions of new taxa[END_REF] proposed a different definition of the Cnemidolestodea to include much more families in this order, but there is no clear synapomorphy supporting this order sensu Aristov (see [START_REF] Dvořák | New archaeorthopteran insects from the Pennsylvanian of Piesberg reveal unexpected mosaic of morphological traits and colouration pattern of the tegmina[END_REF][START_REF] Nel | A new representative of the 'orthopteroid' family Cnemidolestidae (Archaeorthoptera) from the Early Permian of Germany[END_REF].

Roqueia gen. nov. strongly differs from the Cnemidolestidae in the absence of a free MA separating from MP+CuA. The specialized triangular area in Roqueia gen. nov. is between RA and MP, not between MA and the first anterior branch of MP+CuA+CuP; and MP is separating from CuA basal to fusion of CuA with CuPa. In this area of Roqueia gen. nov., there is a very strong oblique vein emerging from RP and ending into MP, which can only correspond to MA basally fused with R and re-emerging distally from RP, a character also present in few other Archaeorthoptera (e.g., Cacurgidae, see below). In the Cnemidolestidae, the vein MA is basally separating from MP+CuA and closely parallel to R/RP [START_REF] Langiaux | Faune entomologique du bassin de Blanzy-Montceau[END_REF][START_REF] Whalley | New species of Protorthoptera and Protodonata (Insecta) from the Upper Carboniferous of Britain, with a comment on the origin of wings[END_REF][START_REF] Pinto | Upper Carboniferous insects from Argentina. 2. Familia Narkemocacurgidae (Paraplecoptera)[END_REF][START_REF] Béthoux | Some Palaeozoic 'Protorthoptera' are 'ancestral' orthopteroids: major wing braces as clues to a new split among the 'Protorthoptera[END_REF][START_REF] Béthoux | Cnemidolestodea (Insecta): an ancient order reinstated[END_REF][START_REF] Martins-Neto | A review of the South American Palaeozoic entomofauna. Part I: the Ischnoneuroidea and Cacurgoidea, with description of new taxa[END_REF][START_REF] Gu | Longzhua loculata n. gen. n. sp., one of the most completely documented Pennsylvanian Archaeorthoptera (Insecta; Ningxia, China)[END_REF][START_REF] Gu | A new cnemidolestodean stem-orthopteran insect from the Late Carboniferous of China[END_REF][START_REF] Aristov | New and little-known Eoblattida (Insecta) from the Paleozoic of Russia[END_REF][START_REF] Aristov | Classification of the order Cnemidolestida (Insecta: Perlidea) with descriptions of new taxa[END_REF][START_REF] Dvořák | New archaeorthopteran insects from the Pennsylvanian of Piesberg reveal unexpected mosaic of morphological traits and colouration pattern of the tegmina[END_REF][START_REF] Nel | A new representative of the 'orthopteroid' family Cnemidolestidae (Archaeorthoptera) from the Early Permian of Germany[END_REF]. The narrow area between MA and R/RP of the Cnemidolestidae is no longer present in Roqueia gen. nov. Roqueia gen. nov. could have some similarities with Ivkinus Aristov, 2014 (currently in the family Sylvabestiidae [START_REF] Aristov | A new family of early Permian grylloblattids (Insecta: Grylloblattida) from the Ural Mountains[END_REF] in the presence of a triangular area between R/RP and M with several oblique crossveins in-between, but this last taxon is based on a rather poorly preserved fossil in which the vein CuPa is not preserved. Also Aristov (2014: fig. 13) considered that the vein M of Ivkinus is basally separated from CuA and distally forked into MA (ending into RP) and a free MP, which is a pattern completely different from that of Roqueia gen. nov.

A further, less important difference of Roqueia gen. nov. is the ScP ending in C, instead of RA in the genera of Cnemidolestidae (this character is subject to several homoplasies in the Archaeorthoptera).

The hind wings of the Cnemidolestidae are generally less well-known than their forewings. They are also less 'complex', without a well-defined triangular elongate area between MA and first anterior branch of MP+CuA+CuPa [START_REF] Béthoux | Some Palaeozoic 'Protorthoptera' are 'ancestral' orthopteroids: major wing braces as clues to a new split among the 'Protorthoptera[END_REF]. Their anal area are generally unknown, even in the well-preserved genus Protodiamphipnoa Brongniart,

1885.

The genera of the panorthopteran family Cacurgidae [START_REF] Handlirsch | New Paleozoic insects from the vicinity of Mazon creek, Illinois[END_REF] share with Roqueia gen. nov. the two characters 'fusion of MA with R and its distal re-emergence independently of MP+CuA' and 'separation of MP from CuA basal of its fusion with CuPa' [START_REF] Schubnel | Moscovian fossils shed light on the enigmatic polyneopteran families Cacurgidae and Eoblattidae (Insecta: 'Eoblattida', Archaeorthoptera)[END_REF]. They also share the characters 'ScP ending into C', 'presence of a posterior branch of MP basal of its distal fusion with MA', and 'presence of posterior branches of MA+MP basal to its fusion with RP'. The main differences between Cacurgus Handlirsch, 1911 and Roqueia gen. nov. are the presence of a first posterior branch CuPa of CuPa (characteristic of the Panorthoptera), and the re-emergence of MA directly from R in the former, while it re-emerges from RP in the latter. Cacurgus also differs from Roqueia gen. nov. in the very long stem of MP before its first posterior branch.

The character 'MA captured by R and distally re-emerging independently of MP+CuA' occurred at least two times in the superorder Archaeorthoptera. The very distal re-emergence of MA from RP instead of stem of R is a putative autapomorphy of Roqueia gen. nov. The general pattern of the presence of an elongate triangular area anteriorly and distally limited by R and RP and posteriorly by MP could be a putative synapomorphy of Roqueia gen. nov. with the Cnemidolestidae. Nevertheless, this hypothesis would need to be tested by a phylogenetic analysis of the whole Archaeorthoptera.

Conclusion

The present description of the new family Roqueiidae, for the genus Roqueia gen. nov., adds to the impressive diversity of the superorder Archaeorthoptera in the Late Carboniferous.

Nevertheless, a phylogenetic analysis of the whole clade is more and more necessary to clarify the relationships between the different groups inside.

  urn:lsid:zoobank.org:act:C87D6416-9EB8-40CD-8A51-8BADF019AFB1 Type genus Roqueia gen. nov. Diagnosis Wing characters only. In forewing, fusion of MA with R and distal re-emergence independently of MP+CuA (putative apomorphy, convergently present in the Cacurgidae); MA re-emerging from RP and ending into MP (putative autapomorphy); separation of MP from CuA basal of its fusion with CuPa; short stem of MP before its first posterior branch; ScP ending into C. . Genus Roqueia gen. nov. urn:lsid:zoobank.org:act:2A691E2A-8496-468F-BE84-193D42BEB7A8 Type species Roqueia alpina sp. nov. Etymology Named after Patrick Roques, for his very efficient and kind help in the research on Carboniferous insects. Gender Feminine. Diagnosis As for the family, plus the following forewing characters: two posterior branches of MP basal of its distal fusion with MA; two posterior branches of MA+MP basal to its fusion with RP Roqueia alpina sp. nov. (Figs 1, 2) urn:lsid:zoobank.org:act:546938FF-8C99-401B-A8AD-3AD8E98A37BC Etymology Named after the Alp mountains. Holotype Specimens Fa 0145 (imprint) and Fa 0145b (counterimprint) (fragments of legs, a nearly complete forewing, a less well-preserved forewing and a hind wing), stored at the Musée d'Histoire Naturelle of Grenoble, France. Type locality Slag heap of the Villaret, Susville, La Mure, Matheysine region, Isére, France Stratigraphic occurrence Kasimovian (Stephanian A), 'étage productif du houiller' of La Mure. Diagnosis As for the genus by monotypy. Description Forewing 35.4 mm long, 12.0 mm wide; area between C and ScP 1.5 mm wide; ScP straight, apically weakening and ending in C 23.8 mm from wing base; area between ScP and R as broad as that between C and ScP, with poorly preserved crossveins in basal part and elongate anterior branches of RA in distal part; area between C and RA broad with a series of complex branched veinlets in-between; base of RP 13.1 mm from wing base; RA weakly curved posteriorly; RP emitting a very strong posterior branch very close to its base, this branch ending into MP, interpreted as MA captured by R, fused with RP, and re-emerging distally to end into MP; main branch of RP long before its distal fusion with MA+MP; RP with three to four posterior branches; an elongate broadly triangular area limited by RP, MA and MP, apparently free of crossveins; MP+CuA basally fused with R, separating from it ca. 4.5 mm from wing base; stem of MP+CuA 4.1 mm long; MP weakly sigmoidal, very long before its fusion with MA, defining an elongate triangular area with R, RP+MA, and MA, this area with four faint crossveins; MP with two posterior branches basal to its fusion with MA; MA+MP with two posterior branches basal to its fusion with RP; basal free part of CuA very short, 1.4 mm long; an elongate CuPa ending into CuA; CuA+CuPa nearly straight, with two posterior branches; a broad area between CuA+CuPa, CuPa and CuPb; CuPb simple and nearly straight; PCu strongly arched and touching CuP in one point; two anal veins visible.

  gen. nov. Roqueia gen. nov. shows important similarities with the archaeorthopteran genera Omaliella Béthoux and Nel, 2005 (O. ramosa Béthoux and Nel, 2005 and O. polonica Dvořák et al., 2019) and Omalia Van Beneden & Coemans, 1867 in the following characters: ScP not ending into RA, CuPa fused with CuA distal of the base of M, M shortly touching RP. But Omaliella and Omalia have branches MP and MA distally separating from a long stem M and no strong oblique vein in area between M and RP[START_REF] Béthoux | Some Palaeozoic 'Protorthoptera' are 'ancestral' orthopteroids: major wing braces as clues to a new split among the 'Protorthoptera[END_REF][START_REF] Dvořák | New archaeorthopteran insects from the Carboniferous of Poland: insights into tangled taxonomy[END_REF].

Figure 1 .

 1 Figure 1. Roqueia alpina gen. et sp. nov. Nel & Duquesne, holotype. (A) Forewing Fa 0145b (counterimprint), white arrowheads bases of posterior branches of MP; (B) Second forewing Fa 0145 (imprint), black arrowhead base of CuPb, white arrowhead MA. Scale bars = 10 mm.

Figure 2 .

 2 Figure 2. Roqueia alpina gen. et sp. nov. Nel & Duquesne, holotype. (A) Fa 0145b (counterimprint); (B) Fa 0145 (imprint), F.W. forewing, H.W. hind wing. Scale bars = 10 mm.

Acknowledgments

We sincerely thank an anonymous referee, Dr. Jakub Prokop and Dr. Andrew Ross for their useful comments on the first version of the paper.


Omar Rafik Merad-Boudia

Member, IEEE Sidi Mohammed Senouci

Omar Rafik Merad-Boudia

An Efficient and Secure Multidimensional Data Aggregation for Fog-Computing-Based Smart Grid

Keywords: Data aggregation, fault tolerance (FT), fog computing, security and privacy, smart cities, smart grid

The secure multidimensional data aggregation (MDA) has been widely investigated in smart grid for smart cities. However, previous proposals use heavy computation operations either to encrypt or to decrypt the multidimensional data. Moreover, previous fault-tolerant mechanisms lead to an important computation cost, and also a high communication cost when considering a separate identification phase. In this article, we propose an efficient and secure MDA scheme, named ESMA. Unlike existing schemes, the multidimensional data in ESMA are structured and encrypted into a single Paillier ciphertext and thereafter, the data are efficiently decrypted. For privacy preserving, the Paillier cryptosystem is adopted in a fog computing-based architecture, and to achieve efficient authentication, the batch verification technique is applied. Besides, ESMA is fault tolerant, i.e., even if some of the smart meters fail to send their data, the final aggregation result will not be affected. Furthermore, ESMA can be adapted to respond to other queries than the summation of data. The performance analysis demonstrates the cost efficiency of ESMA both in computation and communication and the scalability as well. For instance, with a 16-bits size for each data type and 500 reporting smart meters, 40 data types can be supported in a single Paillier ciphertext. ESMA also resists various security attacks and preserves the user's privacy.

smart meters (SMs) to gather real-time consumption data and other information. The SM is considered as the most critical element placed at the user side. It enables customers to report their real-time consumption data (e.g., every quarter hour) to the control center (CC), and based on these data, the CC can anticipate power demands and adjust power generation, dynamic pricing, and so on. For instance, Kumari et al. [START_REF] Kumari | Redills: Deep learning-based secure data analytic framework for smart grid systems[END_REF] proposed a solution that accurately predicts future load consumption based on historical data using deep learning to save energy at the demand side and reduce energy production at the supply side of the system. However, SG is subject to several threats against security and privacy, e.g., by analyzing the real-time electricity usage data, an attacker would be able to threaten the user's privacy, and thus, inferring the user's life habits such as when a user exits the house. Consequently, some cryptographic techniques should be used to preserve the user's privacy [START_REF] Shateri | Real-time privacypreserving data release for smart meters[END_REF].

The concept of data aggregation in the context of SG is introduced in [START_REF] Li | Secure information aggregation for smart grids using homomorphic encryption[END_REF]. A traditional data aggregation scheme considers a gateway node that aggregates the SMs reports and sends the result to the CC, enabling the utility company to get the total consumption data. This gives the company the capability to dynamically adjust power distribution according to these data and to protect users' privacy as well. Recently, a fog computing architecture has been considered in SG for efficient aggregation [START_REF] Kumari | Fog computing for smart grid systems in the 5G environment: Challenges and solutions[END_REF]. With the help of such architecture, Nazmudeen et al. [START_REF] Nazmudeen | Improved throughput for power line communication (PLC) for smart meters using fog computing based data aggregation approach[END_REF] proposed a framework for a distributed data aggregation. As stated in [START_REF] Lyu | PPFA: Privacy preserving fog-enabled aggregation in smart grid[END_REF], traditional in-network aggregation' architectures face resource and scalability problems. They employ less powerful intermediate nodes and a large number of end nodes are usually connected with one intermediate node. By considering fog nodes (FNs), we can exploit FN's intrinsic abilities in terms of communication, computation, and storage, leading, therefore, to the optimal use of these nodes for aggregation purposes. This can also resolve the bandwidth and latency issues that arise in a cloud computing architecture [START_REF] Kumari | Fog computing for smart grid systems in the 5G environment: Challenges and solutions[END_REF].

Although previous solutions [START_REF] Li | Secure information aggregation for smart grids using homomorphic encryption[END_REF], [START_REF] Lyu | PPFA: Privacy preserving fog-enabled aggregation in smart grid[END_REF]- [START_REF] Zhao | Smart and practical privacy-preserving data aggregation for fog-based smart grids[END_REF] can prevent the disclosure of sensitive information to the adversary or the utility company, there are, however, some unresolved issues. First, the data aggregated are likely to be multidimensional (electricity consumption record, time, consumption purpose, etc.). Hence, more data provided more efficient is the analysis. Some works only enable one-dimensional aggregation (ODA), i.e., every dimension is processed separately. Moreover, existing multidimensional aggregation (MDA) schemes use complex cryptographic operations to encrypt or to decrypt the multidimensional data. Second, in some schemes, there is no mechanism for FT, in fact, in SG, SMs could malfunction for a certain amount of time and thus could not send their reports to the FN. In previous schemes, the CC has to ask FNs for the nonresponding SMs that leads to an important delay, and the aggregation process is then halted. Finally, previous schemes are only conceived to respond to the sum query. However, the CC may need other statistical functions than summation such as variance to further analyze power consumption. This could allow the detection of abnormal situations and load imbalance. Moreover, the CC may need to learn about the number of customers whose SM's reading is higher than a threshold, and also the total usage of these customers for predicting better power generation.

For these reasons, we propose ESMA, an Efficient and Secure Multidimensional data Aggregation for fog computingbased smart grid (FCSG). The main contributions of this article can be summarized as follows.

1) We propose an efficient MDA for FCSG. In ESMA, even if the data of each SM are multidimensional, the data reported to FN would still be a single Paillier ciphertext. Besides, we employ an encoding function that gives the CC the capability to efficiently recover the aggregated data from the ciphertext. The computation and communication resources are then conserved in comparison to previous schemes. 2) We employ the Paillier Cryptosystem and its homomorphic property to preserve user's privacy. So, the FN performs aggregation on ciphertexts, which prevents the disclosure of sensitive data. Also, we propose a faulttolerant mechanism to ensure that the final aggregated data recovered at CC are correct even if some nodes are malfunctioning. 3) We illustrate how ESMA can be adapted to answer other queries than summation. We also provide security analysis and performance evaluation to show the security and the efficiency of ESMA in comparison with the previous work. The remainder of this article is organized as follows. Section II introduces the related work. Section III presents the system models and design goals. Section IV describes the preliminaries of ESMA before presenting its technical details in Section V. Section VI presents how ESMA can respond to other queries and Section VII discusses security analysis. Finally, Sections VIII and IX give the performance evaluation and conclusion, respectively.

II. RELATED WORK

In this section, we present an overview of traditional solutions to secure data aggregation in SG [START_REF] Lu | EPPA: An efficient and privacy-preserving aggregation scheme for secure smart grid communications[END_REF]- [START_REF] Badra | Lightweight and efficient privacy-preserving data aggregation approach for the smart grid[END_REF], and also the recently proposed ones in the context of FCSG [START_REF] Lyu | PPFA: Privacy preserving fog-enabled aggregation in smart grid[END_REF], [START_REF] Liu | Enabling efficient and privacy-preserving aggregation communication and function query for fog computing based smart grid[END_REF]- [START_REF] Zhao | Smart and practical privacy-preserving data aggregation for fog-based smart grids[END_REF]. Introduced in [START_REF] Li | Secure information aggregation for smart grids using homomorphic encryption[END_REF], protecting the user's privacy via data aggregation has recently become one of the most attractive research topics. Li et al. [START_REF] Li | Secure information aggregation for smart grids using homomorphic encryption[END_REF] introduced secure in-network aggregation in the context of SG; they employ homomorphic encryption (HE) to avoid the disclosure of user's private data to intermediate aggregator nodes. Lu et al. [START_REF] Lu | EPPA: An efficient and privacy-preserving aggregation scheme for secure smart grid communications[END_REF] used Paillier HE and employed a super-increasing sequence to secure MDA, an additional exponentiation operation is computed for every dimension by SM. Boudia et al. [START_REF] Boudia | Elliptic curve-based secure multidimensional aggregation for smart grid communications[END_REF] proposed an elliptic curve-based secure MDA using El Gamal HE with multiple public keys. Their scheme does not require complex cryptographic operations en route and leads to lower overhead. However, an additional elliptic curve scalar multiplication is computed for every dimension by SM. Ming et al. [START_REF] Ming | Efficient privacy-preserving multidimensional data aggregation scheme in smart grid[END_REF] and Zuo et al. [START_REF] Zuo | Privacy-preserving multidimensional data aggregation scheme without trusted authority in smart grid[END_REF] employed a super-increasing sequence with El Gamal HE to achieve MDA. In these two schemes, the CC has to solve the discrete logarithm problem (DLP) to retrieve the aggregated data. Badra and Zeadally [START_REF] Badra | Lightweight and efficient privacy-preserving data aggregation approach for the smart grid[END_REF] proposed a lightweight secure ODA using symmetric HE and Diffie-Hellman methods. Shen et al. [START_REF] Shen | An efficient aggregation scheme resisting on malicious data mining attacks for smart grid[END_REF] introduced the malicious data mining attack and proposed a secure ODA using Paillier HE and bilinear maps.

Recently, many solutions have been proposed in the context of FCSG. Lyu et al. [START_REF] Lyu | PPFA: Privacy preserving fog-enabled aggregation in smart grid[END_REF] proposed a privacy-preserving fog-enabled aggregation scheme using one-time pad HE. The authors consider ODA and an FN that aggregates the collected data, decrypts, and then encrypts noisy aggregation. They propose a fault-tolerant mechanism to achieve resilience to node failures. However, an additional phase is required for this purpose, which leads to additional communication cost. Moreover, data integrity is not ensured in their scheme. Liu et al. [START_REF] Liu | Enabling efficient and privacy-preserving aggregation communication and function query for fog computing based smart grid[END_REF] presented a fog-enabled aggregation scheme that employs a double trapdoor HE to encrypt one-dimensional data. Note that their scheme can achieve MDA by using a super-increasing sequence. However, similarly to the work in [START_REF] Lu | EPPA: An efficient and privacy-preserving aggregation scheme for secure smart grid communications[END_REF], an additional heavy computation cost will be added for every dimension. Okay et al. [START_REF] Okay | Fog computing-based privacy preserving data aggregation protocols[END_REF] proposed two efficient and lightweight secure aggregation protocols for FCSG. The authors employ Domingo-Ferrer HE and Paillier HE to encrypt ODA. They present mathematical models for these protocols and give extensive simulations and comparisons. Saleem et al. [START_REF] Saleem | FESDA: Fog-enabled secure data aggregation in smart grid IoT network[END_REF] proposed an efficient and privacy-preserving ODA for FCSG. The authors exploit a modified version of Paillier HE in order to encrypt the metering data and use MAC for DI. They propose a fault-tolerant mechanism to achieve resilience to node failures. However, the CC has to compute the discrete logarithm to retrieve the aggregated data. Furthermore, the fault-tolerant decryption cost increases with the increasing number of faulty SMs. Zhao et al. [START_REF] Zhao | Smart and practical privacy-preserving data aggregation for fog-based smart grids[END_REF] proposed an ODA scheme for FCSG that achieves multifunctional statistics; the authors employ somewhat homomorphic encryption (SHE) to preserve the user's privacy. However, their proposal incurs high overheads in terms of communication and computation.

We compare in Table I the aforementioned works in terms of the data type (DT), the considered architecture (CA), the used technique (UT), fault tolerance (FT), source authentication (SA), and data integrity (DI). The authors of these works either consider data aggregation with one dimension [START_REF] Li | Secure information aggregation for smart grids using homomorphic encryption[END_REF], [START_REF] Lyu | PPFA: Privacy preserving fog-enabled aggregation in smart grid[END_REF], [START_REF] Liu | Enabling efficient and privacy-preserving aggregation communication and function query for fog computing based smart grid[END_REF]- [START_REF] Zhao | Smart and practical privacy-preserving data aggregation for fog-based smart grids[END_REF] or use heavy computation operations to encrypt or to decrypt the multidimensional data [START_REF] Lu | EPPA: An efficient and privacy-preserving aggregation scheme for secure smart grid communications[END_REF]- [START_REF] Zuo | Privacy-preserving multidimensional data aggregation scheme without trusted authority in smart grid[END_REF]. Note that these schemes are only conceived to respond to the sum query. Also, the FT mechanisms proposed in some schemes, e.g., the scheme in [START_REF] Lyu | PPFA: Privacy preserving fog-enabled aggregation in smart grid[END_REF], requires a separate phase to identify the faulty SMs and thus incurs a high communication cost. To overcome these drawbacks, we introduce in ESMA an encoding function to efficiently structure and secure the multidimensional data. ESMA can be adapted to respond to other queries than the summation of data without additional overhead. Moreover, the proposed FT mechanism preserves network resources.

III. MODELS AND DESIGN GOAL

In this section, we define our network model, attacker model, and identify the design goal of ESMA.

A. Network Model

Similar to the previous work based on a fog computing architecture proposed for SG [START_REF] Kumari | Fog computing for smart grid systems in the 5G environment: Challenges and solutions[END_REF]- [START_REF] Lyu | PPFA: Privacy preserving fog-enabled aggregation in smart grid[END_REF], [START_REF] Liu | Enabling efficient and privacy-preserving aggregation communication and function query for fog computing based smart grid[END_REF]- [START_REF] Zhao | Smart and practical privacy-preserving data aggregation for fog-based smart grids[END_REF], we consider in ESMA a three-level system. Fig. 1 shows a large number of SMs in the first level, FNs in the second level, and the CC in the third level. We consider that the CC covers k 2 FNs and each FN in turn covers k 1 SMs. The CC is responsible for collecting the users' data to anticipate power demands and to adjust power generation, dynamic pricing, and so on. Each SM ij (i = 1, . . . , k 1 , j = 1, . . . , k 2 ) collects the multidimensional data, performs cryptographic operations, and sends a report to the corresponding FN j . Once received, the reports are homomorphically aggregated by FN j . The result is then forwarded to the CC. After the reception of the FN j ' report, the CC performs decryption and gets the aggregation result. This can help the CC to make appropriate decisions. For generating the public/private keys used in the Paillier cryptosystem and other secret parameters, we consider a trust authority (TA), which is a fully reliable entity. After providing the corresponding secret parameters to all of the entities in the system, TA will no longer be required in the MDA process.

B. Attacker Model

In our attacker model, we consider that FNs and CC are honest-and-curious, i.e., they follow the protocol faithfully but are curious about the multidimensional data contained in the reports, e.g., by keeping all of the reported data to optimize the chance to retrieve user's private data. Besides, we consider that the users are honest and will not report false consumption data. However, there exists an external adversary A that can eavesdrop the communication flows and try to identify the report's content. A can also launch active attacks, such as In addition to the aforementioned attacks and due to the SM wastage, we also assume that certain SMs could be in failure status and thereby will fail to send their data to FN.

C. Design Goal

Our design goal is to propose a fault-tolerant, efficient, and privacy-preserving MDA scheme for FCSG such that the CC can obtain multiple real-time data from one single aggregated data. Specifically, the following goals should be satisfied.

1) The user's private data cannot be compromised by A.

The CC is the only entity that can read the aggregated multidimensional data in ESMA, and no one can have access to the sensitive individual data, including the CC. 2) FNs and CC should be able to verify the authenticity of the received reports. They should also detect if a report has been modified during the transmission and comes really from the legal entity.

3) The proposed scheme should be fault tolerant. When certain SMs fail to communicate their data, they should be detected by the corresponding FN and reported to the CC. 4) The computation cost of cryptographic operations performed at SM, FN, and CC should be efficient. Moreover, the multidimensional data should be encrypted into one single ciphertext to reduce the cost of communication.

IV. PRELIMINARIES

In this section, we briefly introduce the security techniques used in ESMA, such as the Paillier homomorphic cryptosystem and bilinear maps.

A. Paillier Homomorphic Cryptosystem

The Paillier homomorphic cryptosystem is a classic encryption [START_REF] Paillier | Public-key cryptosystems based on composite degree residuosity classes[END_REF] that can achieve additive homomorphism property. The encryption is proved to be semantically secure against chosen-plaintext attacks. Thus, it has been widely exploited in secure data aggregation protocols (see Table I).

The key generation, encryption, and decryption processes operate as follows.

1) Key Generation: Given a security parameter κ, two κ bit prime numbers p 0 and q 0 are randomly selected. Let the RSA modulus n = p 0 q 0 and λ = lcm(p 0 -1, q 0 -1).We define a function

L(u) = u -1/n and calculate μ = (L(g λ mod n 2 )) -1 mod n, where g is the generator of Z * n 2 such that gcd(L(g λ mod n 2 ), n) = 1.
The public key is the tuple (n, g) and the corresponding private key is the tuple (λ, μ).

2) Encryption

: Choose a random number r ∈ Z * n to encrypt a given message m ∈ Z n : c = E(m) = g m • r n mod n 2 .
3) Decryption: For the ciphertext c, the corresponding plaintext is calculated by m = D(c) = L(c λ mod n 2 ) μ mod n.

B. Bilinear Maps

Let G 1 be an additive group and G 2 be a multiplicative group, both of prime order q, i.e., |G

1 | = |G 2 | = q. A bilinear map e : G 1 × G 1 = G 2 , which has the following properties. 1) Bilinearity: ∀P, Q ∈ G 1 and ∀a, b ∈ Z * q , e(aP, bQ) = e(P, Q) ab 2) Non Degeneracy: ∃P ∈ G 1 where e(P, Q) = 1 G2 3) Computability: ∀P, Q ∈ G 1 ,
there exists an efficient algorithm to compute e (P, Q) in polynomial time. We use the notation Gen to denote the algorithm, taken as input a security parameter κ 1 , which outputs a 5-tuple (q, P, G 1 , G 2 , e), where q is κ 1 -bit prime, G 1 and G 2 are two cyclic groups with order q, P ∈ G 1 is a generator, and e is a nondegenerated and computable bilinear map.

V. OUR PROPOSED ESMA SCHEME

In this section, we present ESMA for FCSG; it mainly consists of five main parts: 1) system initialization; 2) registration; 3) SM report generation; 4) data aggregation; and 5) data reading. A list of acronyms and symbols used in this article along with their meaning is shown in Table II.

A. System Initialization

For the fog-based SG system under consideration, we suppose that TA bootstraps the whole system and in charge of system parameters configuration. The parameter generation and the secret shares generation processes operate as follows.

1) Parameter Generation: Besides producing two security parameters (κ, κ 1 ), as mentioned in Section IV, the TA randomly selects two κ-bit large prime numbers p 0 and q 0 and computes n = p 0 q 0 and λ = lcm(p 0 -1, q 0 -1). Then, the TA constructs a function L(u) = u -1/n and calculates μ = (L(g λ mod n 2 )) -1 mod n, where g is the generator of Z * n 2 such that gcd(L(g λ mod n 2 ), n) = 1. The public key is the tuple (n, g) and the corresponding private key is the tuple (λ, μ). Furthermore, given κ 1 , TA generates the bilinear parameters (q, P, G 1 , G 2 , e) by running Gen(κ 1 ). Then, TA defines a secure cryptographic hash function

H : {0, 1} * → G 1 .
2) Secret Shares Generation: Using a pseudorandom number generator function, TA generates

k 1 * k 2 secret shares x ij ∈ Z * n , (i = 1, . . . , k 1 , j = 1, . . . , k 2 )
and computes x 0j such that

x 0j = k 1 i=1 x ij mod n, where j = 1, . . . , k 2 .
(

Note that the adversary cannot calculate x 0j without knowing all secret shares x ij .

B. Registration

All SM ij , FN j, and CC need to be registered in the TA, we illustrate this phase as follows.

1) Registration of SM ij : The SM ij (for all i ∈ {1, 2, . . . , k 1 }) first chooses an identity ID ij . Then, TA randomly chooses a number sk ij ∈ Z * q and computes pk ij = sk ij P, and securely delivers sk ij to SM ij . Moreover, TA transmits the secret x ij . 2) Registration of FN j : The FN j (for all j ∈ {1, 2, . . . , k 2 }) first chooses an identity ID j . Then, TA randomly chooses a number sk j ∈ Z * q and computes pk j = sk j P. Finally, the TA securely delivers sk j to FN j .

3) Registration of CC:

The CC first chooses an identity ID CC . Then, TA transmits the tuple (λ, μ), and the secret shares x ij along with x 0j . At the end of this phase, TA publishes the system parameters as {e, q, n, g, P, pk ij , pk j , G 1 , G 2 , H}.

C. Smart Meter Report Generation

As the client's consumption information is periodically reported to FN, e.g., every quarter hour, to protect consumer privacy from exposure, an SM needs to encrypt such private information. Thus, each SM ij measures and generates its l types of data (m i1 , m i2 , . . . , m il ). The following specific steps are performed.

Step-1: Let z be the maximum number of bits that could represent a DT m, SM ij encodes its l types of data (m i1 , m i2 , . . . , m il ) into (d i1 , d i2 , . . . , d il ) and constructs D ij as follows:

d ik = (m ik ) 2 0 θ , k = 1, . . . , l (2) where θ = log 2 (k 1 ) + z * (k -1) D ij = d i1 + d i2 + • • • + d il . ( 3
)
After encoding, SM ij computes D ij

D ij = D ij + x ij mod n. ( 4
)
Step-2: SM ij chooses a random number r ij ∈ Z * n , and computes the ciphertext as follows:

C ij = g D ij • r n ij mod n 2 . ( 5
)
Step-3: SM ij uses its private key sk ij to compute the signature as follows:

σ ij = sk ij H C ij ID ij TS ( 6
)
where TS is the current timestamp.

Step-4: SM ij sends, to the corresponding FN j , the data packet that contains {C ij , ID ij , TS, σ ij }. It is necessary to stress that every SM ij should produce and encrypt a message D ij as above. An example with l = 3 is depicted in Fig. 2.

D. Data Aggregation

This part consists of two possible phases. In the case if all of the SM ij send their reports, FN j will perform an all-inclusive data aggregation; otherwise, it will perform a fault-tolerant data aggregation.

1) All-Inclusive Data Aggregation: If all of the SM ij report their data to the corresponding FN j , FN j will first perform the batch verification to verify the received signatures, i.e., check whether

e ⎛ ⎝ P, k 1 i=1 σ ij ⎞ ⎠ = k 1 i=1 e pk ij , H C ij ID ij TS . ( 7
)
If the equation does hold, it means the signatures are valid. The correctness is as follows:

e ⎛ ⎝ P, k 1 i=1 σ ij ⎞ ⎠ = e ⎛ ⎝ P, k 1 i=1 sk ij H C ij ID ij TS ⎞ ⎠ = k 1 i=1 e P, sk ij H C ij ID ij TS = k 1 i=1 e pk ij , H C ij ID ij TS .
Note that the batch verification reduces the number of pairing operations from 2k 1 to k 1 + 1. After checking the validity, FN j aggregates all the ciphertexts and sends the aggregated message to the CC. The following steps are performed.

Step-1: FN j aggregates the k 1 encrypted ciphertexts as =

C j = k 1 i=1 C ij mod n 2
k 1 i=1 g D ij • r n ij mod n 2 = g k 1 i=1 D ij • ⎛ ⎝ k 1 i=1 r ij ⎞ ⎠ n mod n 2 = g k 1 i=1 (Dij+xij) mod n • ⎛ ⎝ k 1 i=1 r ij ⎞ ⎠ n mod n 2 . ( 8
)
Step-2: FN j uses its private key sk j to compute the signature as follows:

σ j = sk j H C j ID j TS ( 9
)
where TS is the current timestamp.

Step-3: FN j sends, to the CC, an all-inclusive report that contains {C j , ID j , TS, σ j }.

2) Fault-Tolerant Data Aggregation: If some SMs breakdown, FN j will not receive the corresponding packets. Let U ij be the set of all legitimate SM devices and U ij be the set of failed SM devices (U ij ∈ U ij ). Consequently, we have

x 0j = i∈U ij /U ij x ij mod n. ( 10
)
Thus, this phenomenon will directly affect the correctness of the final decryption result. FN j needs to send the set U ij to the CC. Therefore, in this case, FN j first validates the received signatures, i.e., check whether e ⎛ ⎜ ⎝P,

i∈U ij /U ij σ ij ⎞ ⎟ ⎠ = i∈U ij /U ij e pk ij , H C ij ID ij TS . (11)
If the equation does hold, it means the signatures are valid. Then, it performs aggregation on the received ciphertexts and computes the fault-tolerant aggregated ciphertext. The following specific steps are performed.

Step-1: FN j aggregates the received ciphertexts as

C j = i∈U ij /U ij C ij mod n 2 = g i∈U ij /U ij (Dij+xij) mod n • ⎛ ⎜ ⎝ i∈U ij /U ij r ij ⎞ ⎟ ⎠ n mod n 2 . ( 12
)
Step-2: FN j uses its private key sk j to compute the signature as follows:

σ j = sk j H C j ID j TS ( 13
)
where TS is the current timestamp.

Step-3: FN j sends, to the CC, a fault-tolerant report that contains {C j , ID j , TS, σ j , U ij }.

E. Data Reading

This part consists of two possible phases. If the CC receives an all-inclusive report from FN j , it will perform an all-inclusive data reading; otherwise, it will perform a faulttolerant data reading.

1) All-Inclusive Data Reading: Upon receiving the allinclusive report from FN j , CC first verifies the signature according to the following equation: e P, σ j = e pk j , H C j ID j TS .

(

) 14
If the equation does hold, it means the signatures are valid. After checking the validity, CC decrypts the aggregated ciphertext C j and retrieves the aggregated data by performing the following steps.

Step-1: CC decrypts the aggregated ciphertext C j . From (8), by taking

M = k 1 i=1 D ij + x ij mod n, and R = k 1 i=1 r ij .
The report g M • R n mod n 2 is still a ciphertext of the Paillier Cryptosystem. Thus, CC uses the tuple (λ, μ) to recover M as

M = L C λ j mod n 2 μ mod n. ( 15
)
Step-2: After decrypting, CC uses x 0j to obtain k 1 i=1 D ij as

k 1 i=1 D ij = M -x 0j mod n. ( 16
)
Step-3: CC uses the decoding function to retrieve each aggregated data k 1 i=1 d ik . CC divides the binary representation of k 1 i=1 D ij into l blocks of bits, the length of each block is ( log 2 (k 1 ) + z). Thus, the first ( log 2 (k 1 ) + z) least significant bits correspond to the aggregation result k 1 i=1 m i1 and so on. The CC then retrieves the aggregation result of each type of data as

⎛ ⎝ k 1 i=1 D ij ⎞ ⎠ 2 = k 1 i=1 m il • • • • • • k 1 i=1 m i2 k 1 i=1 m i1 . ( 17
)
Due to overflow during aggregation, the required extra bits cannot be more than log 2 (k 1 ) when k 1 numbers are added. This explains why we choose to pad ( log 2 (k 1 ) + z)*(k -1) zeros after m ik in every d ik . Fig. 3. shows the aggregated data retrieved by the CC when k 1 = 4 and l = 3, where D ij was generated by SM ij . 2) Fault-Tolerant Data Reading: Upon receiving the faulttolerant report from FN j , CC first verifies the signature according to the following equation: e P, σ j = e pk j , H C j ID j TS .

(

) 18
If the equation does hold, it means the signatures are valid. CC decrypts the aggregated ciphertext C j and retrieves the aggregated data by performing the following steps.

Step-1: CC decrypts the aggregated ciphertext C j as

M = L C λ j mod n 2 μ mod n. ( 19
)
Step-2: After decrypting, CC computes x 0j as

x 0j = i∈U ij /U ij x ij mod n. ( 20
)
Step-3: CC uses x 0j to obtain the fault-tolerant aggregated multidimensional data

i∈U ij /U ij D ij = M -x 0j mod n. ( 21
)
Step-4: CC uses the decoding function, as described earlier, to retrieve the fault-tolerant aggregation result of each type of data as

⎛ ⎜ ⎝ i∈U ij /U ij D ij ⎞ ⎟ ⎠ 2 = i∈U ij /U ij m il • • • • • • i∈U ij /U ij m i2 i∈U ij /U ij m i1 . ( 22
)

VI. ANSWERING OTHER QUERIES

In this section, we discuss how to adapt ESMA to answer other queries, namely, variance report query and set-aggregation report query.

A. Variance Report Query

The CC may need other statistical functions than summation such as variance to further analyze power consumption. This could allow the detection of abnormal situations and load imbalance. In the following, we present how ESMA can be adapted to achieve dual-functional MDA for FCSG, which can support, for each type of data, aggregation of mean and variance at the same time. Observe that

VAR(m i1 ) = k 1 i=1 m 2 i1 k 1 - k 1 i=1 m i1 k 1 2 = 1 k 1 k 1 i=1 m 2 i1 - 1 k 2 1 ⎛ ⎝ k 1 i=1 m i1 ⎞ ⎠ 2 . ( 23
)
If the CC needs to perform a variance analysis on multidimensional data, each SM ij add the data (m 2 i1 , m 2 i2 , . . . , m 2 il ) in addition to (m i1 , m i2 , . . . , m il ) and encode them as follows:

d ik = m 2 ik 2 (m ik ) 2 0 θ , k = 1, . . . , l (24)
where θ = (2 log 2 (k 1 ) + 3z) * (k -1) and (m ik ) 2 is padded by zeros in the left to be represented in ( log 2 (k 1 ) + z) bits. Due to square calculation, the required bits for m 2 ik cannot be more than 2z where z is the maximum number of bits that could represent a DT. This explains why we choose to pad (2 log 2 (k 1 ) + 3z) * (k -1) zeros in every d ik . The SM ij then follows the same steps as previously described to produce its report. At the end of the decryption phase, CC retrieves the queried data as follows:

⎛ ⎝ k 1 i=1 D ij ⎞ ⎠ 2 = k 1 i=1 m 2 il k 1 i=1 m il • • • • • • k 1 i=1 m 2 i1 k 1 i=1 m i1 . ( 25
)

B. Set Aggregation Query

We suppose that there exist f subsets corresponding to f electricity consumption ranges, such that [R 1 , R 2 ), [R 2 , R 3 ), . . . ,[R f , +∞). The CC may need to calculate the total consumption and also the number of users of each subset in a period [START_REF] Li | PPMA: Privacy-preserving multisubset data aggregation in smart grid[END_REF]. In the following, we show how ESMA can be adapted to achieve the data aggregation of multisubset for FCSG. We assume that if the electricity consumption data, generated by SM ij ,

m i ∈ [R s , R s+1 ), SM ij will lie in the subset U s ⊂ U, where U = U 1 ∪U 2 ∪• • •∪U f , and U s ∩U t = ∅, for s, t = 1, 2, . . . , f , s = t. We also have E = E 1 +E 2 +• • •+E f , E 1
is the total electricity consumption of the subset U 1 and so on. We can then consider for each subset a block of bits in our encoding function. Each SM ij encodes its data m i ∈ [R s , R s+1 ) into D ij as follows:

D ij = 1 (m i ) 2 0 θ , s = 1, . . . , f (26)
where θ = (2 * log 2 (k 1 ) + z) * (s -1) and (m i ) 2 is padded by zeros in the left to be represented in ( log 2 (k 1 ) + z) bits.

The SM ij then follows the same steps as previously described to produce its report. Afterward, FN j aggregates the number of users and total usage of each subset. At the end of the decryption phase, CC retrieves the queried data as follows:

⎛ ⎝ k 1 i=1 D ij ⎞ ⎠ 2 = U f E f • • • |U 2 | E 2 |U 1 | E 1 . ( 27
)

VII. SECURITY ANALYSIS

In this section, we analyze the security of ESMA. In particular, we show how ESMA can protect the user's individual data, and ensure data integrity and source authentication.

A. Privacy Protection

In the SM report generation phase, the sensitive multidimensional data d ij is blinded by adding the secret key x ij modulo n to get the ciphertext: C ij = g d ij +x ij mod n • r n mod n 2 . SM ij sends C ij to the corresponding FN j instead of d ij directly. The FN j is then unable to decrypt the received ciphertext and to read the sensitive data d ij without knowing the Paillier private key and x ij . The Paillier cryptosystem is semantically secure, so the encryption is secure against any form of ciphertext analysis. User's multidimensional data (m i1 , m i2 , . . . , m il ) in d ij are also semantic secure and privacy preserving. Furthermore, due to the randomization of r, the Paillier encryption can resist dictionary attacks, since the encryption of the same data will result into different ciphertexts with very high probability. This ensures that even if the adversary A eavesdrops the communication or even intrudes into the FN j database and gets C ij , he will not have access to the user's private data D ij .

In the data aggregation phase, FN j performs aggregation operation directly on ciphertexts. For the CC, after decryption, it only has the data sum for every dimension. Even if A intrudes into the CC database, he cannot retrieve the individual multidimensional data, i.e., (m i1 , m i2 , . . . , m il ). Therefore, the privacy of individual data is ensured in ESMA.

Furthermore, ESMA ensures that a colluding set of users cannot compromise the privacy of other users. In fact, if A compromises the users' privacy, he can access the private data and retrieves the secret share x ij . In ESMA, there is no correlation between the randomly generated shares by TA, namely, the secret shares x ij ∈ Z * n . So, compromising the secret shares of a few users will not reveal the secret shares of remaining users. Suppose the case where A succeeds in compromising k 1 -1 users that belong to a certain FN j , and gets their secret shares x 1j , x 2j , . . . , x k-1j . For k 1 -1 users, (1) can be rewritten as follows:

x 0j = k 1 -1 i=1 x ij + x k 1 j mod n. ( 28
)
Data privacy of the remaining user is still maintained because A does not have the sum of the secret shares x 0j of CC nor the Paillier private key, thereby, A will not be able to compromise x k 1 j . Consequently, in ESMA, regardless of the number of compromised users, A cannot access the private data of the other users.

B. Data Integrity and Authentication

In ESMA, the BLS short signature [START_REF] Boneh | Aggregate and verifiably encrypted signatures from bilinear maps[END_REF] is adopted to sign the user's private data and the aggregated data. For the message {C ij , ID ij , TS, σ ij } sent by SM ij , the corresponding FN j first checks ID ij and TS and then verifies the message's integrity by checking if [START_REF] Kumari | Fog computing for smart grid systems in the 5G environment: Challenges and solutions[END_REF] holds. We can see that each element of the message is involved in verification, and any manipulation of the message will cause inequality. Therefore, the message's integrity sent by SM ij can be verified by FN j . Similarly, when receiving the message {C j , ID j , TS, σ j } sent by FN j , CC first checks ID j and TS and then verifies the message's integrity by checking if ( 14) holds. From the equation, each element of the message is involved in verification, and any manipulation of the message will cause inequality. Therefore, the message's integrity sent by FN j can be verified by CC.

The signature σ ij of SM ij is generated with the corresponding private key sk ij , and the signature σ j of FN j is generated with the corresponding private key sk j . Since the adversary does not know the private keys sk ij and sk j , it cannot produce the correct messages. Therefore, ESMA can guarantee that all users and their private data are legitimate.

Data integrity and authentication are then provided since the BLS signature is provably secure [START_REF] Boneh | Aggregate and verifiably encrypted signatures from bilinear maps[END_REF]. Consequently, A cannot launch active attacks without being detected. The TS included in the packet can prevent replay attacks. Any data modification or false data injection can be detected when the recipient fails to check the signature validity.

VIII. PERFORMANCE EVALUATION

Tonyali et al. [START_REF] Tonyali | A realistic performance evaluation of privacy-preserving protocols for smart grid AMI networks[END_REF] analyzed the cost generated when using HE in SG in terms of bandwidth and end-to-end delay. The authors state that computation and communication costs and scalability impact severely the network reliability and must be considered. Consequently, in this section, we first compare, in terms of computation and communication cost, ESMA with previous works, and then we analyze its scalability.

A. Computation Cost

Using well-known cryptographic libraries, MIRACL [START_REF] Certivox | Multiprecision Integer and Rational Arithmetic C/C++ Library (MIRACL)[END_REF], and PBC [START_REF] Lynn | PBC Library[END_REF], we compute the cost of the cryptographic operations used in ESMA and previous schemes. We consider for Paillier encryption a 1024-b n and for pairing a base field size of 160 b. For ECC, we use the standard curve secp160-r1. Table III shows the results obtained on a computer with Intel Core i5-2430 2.4-GHz CPU and 2-GB RAM. Note that multiplication in Z n 2 , modular addition, and hash operations are negligible compared to exponentiation in Z n 2 and pairing operations. We compare ESMA with the schemes that achieve MDA, namely, EPPA [START_REF] Lu | EPPA: An efficient and privacy-preserving aggregation scheme for secure smart grid communications[END_REF], Boudia et al. [START_REF] Boudia | Elliptic curve-based secure multidimensional aggregation for smart grid communications[END_REF], Ming et al. [START_REF] Ming | Efficient privacy-preserving multidimensional data aggregation scheme in smart grid[END_REF], and Zuo et al. [START_REF] Zuo | Privacy-preserving multidimensional data aggregation scheme without trusted authority in smart grid[END_REF] (see Table I). In ESMA, when SM ij produces its report, it requires 2 C e to generate C ij and C m to generate σ ij . In EPPA [START_REF] Lu | EPPA: An efficient and privacy-preserving aggregation scheme for secure smart grid communications[END_REF], SM ij performs (l + 1)C e and C m to generate the ciphertext and the signature. In [START_REF] Boudia | Elliptic curve-based secure multidimensional aggregation for smart grid communications[END_REF], SM ij performs 2(l + 1)C pm . In [START_REF] Ming | Efficient privacy-preserving multidimensional data aggregation scheme in smart grid[END_REF], SM ij performs 4 C pm . In [START_REF] Zuo | Privacy-preserving multidimensional data aggregation scheme without trusted authority in smart grid[END_REF], SM ij performs C E-ElGamal and 2C exp . We present a comparison in Fig. 4. The results show that ESMA significantly reduces the computation cost at the user side in comparison with EPPA scheme which also utilizes Paillier to achieve MDA. In [START_REF] Boudia | Elliptic curve-based secure multidimensional aggregation for smart grid communications[END_REF], the cost increases linearly with the number of DTs. In [START_REF] Ming | Efficient privacy-preserving multidimensional data aggregation scheme in smart grid[END_REF] and [START_REF] Zuo | Privacy-preserving multidimensional data aggregation scheme without trusted authority in smart grid[END_REF], the cost is efficient; however, as we will see later, this advantage is lost at CC where the decryption operation requires solving DLP which is a heavy computation in the case of large plaintexts.

In ESMA, EPPA, and [START_REF] Zuo | Privacy-preserving multidimensional data aggregation scheme without trusted authority in smart grid[END_REF], when FN j (gateway in the case of EPPA and [START_REF] Zuo | Privacy-preserving multidimensional data aggregation scheme without trusted authority in smart grid[END_REF]) receives all of the reports from the covered SM ij , it first performs a batch verification to verify the data that needs (k 1 + 1)C p . Then, it aggregates the ciphertexts and produces a signature, which consists of several negligible multiplications in Z n 2 and C m (multiplications in Z n and C exp in [START_REF] Zuo | Privacy-preserving multidimensional data aggregation scheme without trusted authority in smart grid[END_REF]). Consequently, at FN j , the costs are almost the same, except for [START_REF] Boudia | Elliptic curve-based secure multidimensional aggregation for smart grid communications[END_REF] and [START_REF] Ming | Efficient privacy-preserving multidimensional data aggregation scheme in smart grid[END_REF], which employ an Elliptic curvebased batch verification that is more efficient than pairing one. However, in the fog computing paradigm, FNs are considered to have more computational abilities than traditional gateways. Thus, the aggregation operation can be efficiently computed.

In ESMA and EPPA [START_REF] Lu | EPPA: An efficient and privacy-preserving aggregation scheme for secure smart grid communications[END_REF], when CC (OA in the case of EPPA) receives a packet from FN j , it first performs 2C p to verify the data and then retrieves the aggregation result by performing C e . In [START_REF] Boudia | Elliptic curve-based secure multidimensional aggregation for smart grid communications[END_REF], the CC performs 3C pm and l times a reverse mapping function which requires solving the ECDLP to recover M. To verify and retrieve the data in [START_REF] Ming | Efficient privacy-preserving multidimensional data aggregation scheme in smart grid[END_REF], the CC performs 4C pm and a computation of the ECDLP to recover M, while in [START_REF] Zuo | Privacy-preserving multidimensional data aggregation scheme without trusted authority in smart grid[END_REF], the CC performs 2 (k 1 + 1) C p , C D-ElGamal and a computation of the DLP to recover M. By considering Pollard's lambda method to compute DLP and ECDLP, we conduct experiments to compute the execution time at CC using MIRACL. The method requires a time complexity of

O(l • √ k 1 • 2 z ), O( √ l•k 1 •2 z ), O( √ (l + 1)•k 1 •2 z ) in [11]-[ 13
], respectively. The results presented in Fig. 5 show that regardless of the size of the aggregation result M, EPPA and ESMA have the same computation overhead at CC. However, in the other works, the higher is the size of the aggregation result, the higher is the computation time. In fact, an aggregate size higher than 40 b cannot be efficiently recovered at CC at all. Ugus et al. [START_REF] Ugus | Optimized implementation of elliptic curve-based additive homomorphic encryption for wireless sensor networks[END_REF] stated that in the El Gamal additive encryption scheme, the final aggregation must be small enough for realistic applications (e.g., 3 bytes) allowing a successful recovery at the decryption device. Consequently, the schemes of Boudia et al. [START_REF] Boudia | Elliptic curve-based secure multidimensional aggregation for smart grid communications[END_REF], Ming et al. [START_REF] Ming | Efficient privacy-preserving multidimensional data aggregation scheme in smart grid[END_REF], and Zuo et al. [START_REF] Zuo | Privacy-preserving multidimensional data aggregation scheme without trusted authority in smart grid[END_REF] cannot be practical for large aggregation results for SG. The super increasing sequence has been utilized in [START_REF] Ming | Efficient privacy-preserving multidimensional data aggregation scheme in smart grid[END_REF] and [START_REF] Zuo | Privacy-preserving multidimensional data aggregation scheme without trusted authority in smart grid[END_REF] with El Gamal HE to achieve MDA. In these two schemes, the CC has to solve the DLP to retrieve the aggregated data. Boudia et al. [START_REF] Boudia | Elliptic curve-based secure multidimensional aggregation for smart grid communications[END_REF] used El Gamal HE with multiple public keys. However, in this case, also, the CC has to compute the ECDLP to retrieve the aggregated data. In the aforementioned schemes, the authors use heavy computation either to encrypt [START_REF] Lu | EPPA: An efficient and privacy-preserving aggregation scheme for secure smart grid communications[END_REF], [START_REF] Boudia | Elliptic curve-based secure multidimensional aggregation for smart grid communications[END_REF] or to decrypt [START_REF] Boudia | Elliptic curve-based secure multidimensional aggregation for smart grid communications[END_REF]- [START_REF] Zuo | Privacy-preserving multidimensional data aggregation scheme without trusted authority in smart grid[END_REF] the multidimensional data. Consequently, ESMA is the most efficient.

In 2019, Saleem et al. [START_REF] Saleem | FESDA: Fog-enabled secure data aggregation in smart grid IoT network[END_REF] have proposed a fault-tolerant mechanism to achieve resilience to node failures in their ODA scheme for FCSG. However, in their proposal, the faulttolerant decryption cost increases at CC with the increasing number of faulty SMs. In fact, the more are the number of faulty SMs more cryptographic operations are executed at CC. Furthermore, the decryption at CC requires solving DLP to recover the aggregation result. In ESMA, regardless of the number of faulty SMs, the cost of the fault-tolerant decryption at CC is always the same. Fig. 6 shows the efficiency of our fault-tolerant decryption compared to that of Saleem et al. [START_REF] Saleem | FESDA: Fog-enabled secure data aggregation in smart grid IoT network[END_REF].

B. Communication Cost

In MDA schemes, l types of data are encrypted and sent by each SM to the corresponding aggregator. The communication overhead can be divided into two parts: 1) SM-to-FN communication and 2) FN-to-CC communication. In ESMA, C ij , ID ij , TS, and σ ij are sent from SM to FN j , where C ij ∈ Z IV.

We depict in Fig. 7 the comparison in terms of communication cost SM-to-FN for 20 types of data. It can be seen that ESMA incurs lower communication overhead than [START_REF] Boudia | Elliptic curve-based secure multidimensional aggregation for smart grid communications[END_REF]. The cost of communication is approximately equal to that of [START_REF] Lu | EPPA: An efficient and privacy-preserving aggregation scheme for secure smart grid communications[END_REF] and [START_REF] Zuo | Privacy-preserving multidimensional data aggregation scheme without trusted authority in smart grid[END_REF]. However, in comparison with [START_REF] Lyu | PPFA: Privacy preserving fog-enabled aggregation in smart grid[END_REF], the communication overhead is higher in ESMA. The reason is that Ming et al. [START_REF] Ming | Efficient privacy-preserving multidimensional data aggregation scheme in smart grid[END_REF] employed in their scheme elliptic curve groups for encryption and signature, which leads to cost-efficient communications. Nevertheless, first, as previously mentioned, the main drawback of their proposal is that the CC has to compute the ECDLP, which severely limits the upper bound. Second, they consider a finite field with a 160-b q, the plaintext space is then severely limited for the considered super-increasing sequence, which has an impact on the number of DTs as well. The same observation can be made for [START_REF] Boudia | Elliptic curve-based secure multidimensional aggregation for smart grid communications[END_REF] and [START_REF] Zuo | Privacy-preserving multidimensional data aggregation scheme without trusted authority in smart grid[END_REF]. In ESMA, there is no extra computation at SM and CC. The plaintext is up to 1024 b and an important number of DTs can be supported in a single ciphertext.

C. Scalability Analysis

In ESMA, we use an encoding function to structure the multidimensional data in Z n . In our implementation, we consider a 1024-b n in Paillier encryption. However, Paillier can support larger key sizes, such as 2048 and 4096 b for improved In Table V, we show, according to n, z, and k 1 , the number of DTs l that can be supported in a single ciphertext. The table shows that using our encoding function, an important number of DTs l can be supported in a single Paillier ciphertext. For instance, with z = 16 b and 500 reporting SMs, 40 DTs can be supported in a single ciphertext. Note that the number z can be significantly reduced with a reference technique, such as presented in [START_REF] Sanli | SRDA: Secure reference-based data aggregation protocol for wireless sensor networks[END_REF] for efficient communications in sensor networks [START_REF] Fouchal | A distributed power management optimisation in wireless sensors networks[END_REF]. The plaintext space in previous works cannot support a large number of DT as mentioned earlier.

D. Storage Analysis

In ESMA, each SM stores in its memory its ID, the public key of CC, a private key, and a secret share. Each FN stores its ID, the public key of each covered SM, and a private key. In EPPA [START_REF] Lu | EPPA: An efficient and privacy-preserving aggregation scheme for secure smart grid communications[END_REF], each SM stores its ID, l generators, n, and a private key. Each FN stores the public key of each covered SM and a private key. In [START_REF] Boudia | Elliptic curve-based secure multidimensional aggregation for smart grid communications[END_REF], each SM stores its ID, l public keys, a generator G, and a private key. Each FN stores the public key of each covered SM and a private key. In [START_REF] Ming | Efficient privacy-preserving multidimensional data aggregation scheme in smart grid[END_REF], each SM stores its ID, l big primes a i , the CC's public keys, a generator P, a secret share, and a private key. Each FN stores the public key of each covered SM, P, and a private key. In [START_REF] Zuo | Privacy-preserving multidimensional data aggregation scheme without trusted authority in smart grid[END_REF], each SM stores its ID, the CC's public key, l big primes a i , g, and a private key. Each FN stores the public key of each covered SM and a private key. A comparison with previous works is presented in Table VI. Note that the points on the curve are considered in their uncompressed form. The main observation we can make is that the storage overhead in previous schemes depends on the number of DTs l. In our work, the overhead is 3264 b whatever the number l.

IX. CONCLUSION

In this article, we proposed ESMA, an efficient and secure MDA for FCSG. ESMA can structure and encrypt the multidimensional data into a single Paillier ciphertext. Thanks to the encoding function employed, which also gives the ability to the CC to recover the aggregated data for every dimension efficiently and securely. The security analysis shows that the privacy, confidentiality, integrity, and authentication of the data are provided. The performance analysis shows the scalability advantage of ESMA, the efficiency of our fault-tolerant mechanism, and also, the cost-efficiency of ESMA in terms of computation and communication. ESMA can also be adapted to respond to other queries than summation. Therefore, it satisfies the application needs of SG for smart cities.

Fig. 1 .

 1 Fig. 1. System model. data modification, false data injection, replay, or stealing the user's private data by intruding the database of CC and FN.In addition to the aforementioned attacks and due to the SM wastage, we also assume that certain SMs could be in failure status and thereby will fail to send their data to FN.

Fig. 2 .

 2 Fig. 2. Example of D ij with l = 3.

Fig. 3 .

 3 Fig. 3. Example with k 1 = 4 and l = 3.

Fig. 4 .

 4 Fig. 4. Computation cost at SM.

Fig. 5 .

 5 Fig. 5. Computation cost at CC vs. The aggregate size.

  n 2 and σ ij ∈ G 1 . Let the size of ID ij and TS be all 8 B. Therefore, the communication cost SM-to-FN is 2048 + 64 + 160 = 2272 b. Next, we analyze FN-to-CC communication. In ESMA, {C j , ID j , TS, and σ j } are sent from FN j to CC, where C ij ∈ Z 2 n and σ ij ∈ G 1 . Therefore, the communication cost FN-to-CC is 2048 + 64 + 160 = 2272 b. The comparison of communication cost with previous MDA schemes is shown in Table

Fig. 6 .

 6 Fig. 6. FT decryption cost at CC.

Fig. 7 .

 7 Fig. 7. SM-to-FN communication cost.

  d ik = (m ik ) 2 0 θ , k = 1, . . . , l where θ = log 2 (k 1 ) + z * (k -1).

TABLE II NOTATIONS

 II

TABLE III COST

 III OF CRYPTOGRAPHIC OPERATIONS

  Recall that each SM ij encodes its l types of data (m i1 , m i2 , . . . , m il ) into (d i1 , d i2 , . . . , d il ) as

	TABLE V
	SCALABILITY ANALYSIS
	TABLE VI
	STORAGE OVERHEAD COMPARISON
	security.