This article has been accepted for publication in a future issue of this journal, but has not been

fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TNSE.2018.2846736, IEEE
Transactions on Network Science and Engineering
1

Privacy-Preserving Auction for Big Data Trading

Using Homomorphic Encryption
Weichao Gao∗ , Wei Yu∗ , Fan Liang∗ , William G. Hatcher∗ , and Chao Lu∗
∗ Department of Computer and Information Sciences

Towson University, MD, USA 21252

Emails: {wgao3,fliang1,whatch2}@students.towson.edu, {wyu,clu}@towson.edu

Abstract—Cyber-Physical Systems (smart grid, smart transportation, smart cities, etc.), driven by advances in Internet of Things (IoT)
technologies, will provide the infrastructure and integration of smart applications to accelerate the generation and collection of big data
to an unprecedented scale. As now a fundamental commodity in our current information age, such big data is a crucial key to
competitiveness in modern commerce. In this paper, we address the issue of privacy preservation for data auction in CPS by
leveraging the concept of homomorphic cryptography and secured network protocol design. Specifically, we propose a generic
Privacy-Preserving Auction Scheme (PPAS), in which the two independent entities of Auctioneer and Intermediate Platform comprise
an untrusted third-party trading platform. Via the implementation of homomorphic encryption and one-time pad, a winner in the auction
process can be determined and all bidding information is disguised. Yet, to further improve the security of the privacy-preserving
auction, we additionally propose an Enhanced Privacy-Preserving Auction Scheme (EPPAS) that leverages an additional signature
verification mechanism. The feasibilities of both schemes are validated through detailed theoretical analyses and extensive
performance evaluations, including assessment of the resilience to attacks. In addition, we discuss some open issues and extensions
relevant to our scheme.

Index Terms—High-Confidence CPS, Internet of Things, Big Data, Auction, Privacy-Preserving, Homomorphic Cryptography, Security
and Resilience, Network Protocol Design

1 I NTRODUCTION erated in CPS/IoT systems, critical challenges must be over-

come, such as properly evaluating the price of datasets,
With the advancement of Internet of Things (IoT) tech-
enabling fair and secure data trading with the support of
nologies, immense quantities of sensors and actuators will
network protocols, and ensuring data copyright protection.
be developed and deployed to support the monitoring and
Although data, in the form of digital information/commod-
control of a number of smart-world Cyber-Physical Sys-
ity, can be duplicated and assigned with an infinite number
tems (CPS), including the smart grid, smart transportation,
of copies, competition among data users would prefer to
smart cities, smart manufacturing, and others [1], [2], [3],
compete for it. Thus, an economically-driven approach, such
[4], [5]. In such smart-world systems, massive amounts of
as auctioning, becomes a viable way for the data trading in
data will be generated, giving rise to truly unprecedented
the networking environment so that the value of collected
CPS/IoT-based big data [6], [7], [8]. Ubiquitous distributed
data can be maximized via a trading-based data sharing
network-connected devices will engender diverse applica-
paradigm. Notice that there have already been auctions de-
tions for the generation, maximization, and optimization
signed for similarly intangible items, such as electricity and
of a variety of resources that span a multitude of domains.
spectrum resources, and a number of research efforts have
Furthermore, it is readily evident that emerging network-
been conducted [9], [10], [11], [12], [13], [14]. Nonetheless, a
ing and computing technologies shall enable easier, faster,
majority of these auctions take place on an auction platform
and cheaper data collection from such CPS systems.
run by sellers, meaning that the sellers play the role of the
Research on the accumulation, analysis, and applica-
auctioneer, and information from the bidders is open to the
tion of big data has proceeded rapidly. With the help
sellers during the auction. In addition, with the increasing
of data mining, deep learning, and other techniques to
number of data owners, it is inefficient and inconvenient
facilitate data processing, massive amounts of data are
for each data seller to maintain their own auction platform.
already being collected and processed, generating valu-
Thus, a third-party data trading platform in the network
able information to users and affecting our daily lives.
environment would be a more realistic approach.
As a result, greater attention is being paid to the market
value of big data, which has come to be considered as When a third-party auction platform is used, privacy
a new type of natural resource. Naturally, this resource protection becomes a critical issue and this calls for de-
itself can be considered as a domain of CPS, similar to signing effective network protocols to achieve privacy-
electrical energy or spectrum allocation, as it implicates preserving auction. For both sellers and bidders in an active
distributed infrastructures and networked technologies auction, the reserve or bidding price should not be revealed
for the management and effective optimization of welfare until the end of the bidding window. In addition, the auction
for data users and owners. data (i.e., the data to sell) should be accessed only by
To realize the potential value of data commodities gen- the winner of the bid. Thus, a fully trusted platform is

2327-4697 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TNSE.2018.2846736, IEEE
Transactions on Network Science and Engineering
desired. Nonetheless, the fully trustworthy third-party plat-
form is difficult to realize for a variety of reasons, including
emergent cyber-threats, insider adversaries, and platform
insecurity. In order to protect the privacy of both sellers and
buyers, additional protection and detection schemes should
be provisioned on the platform.
To address the issue of privacy protection in the third-
party auction platform, we consider the introduction of
homomorphic cryptography [15] to enable the auctions
to be processed using only encrypted bids and design a
corresponding network protocol. In this paper, we first pro-
pose a baseline Privacy-Preserving Auction Scheme (PPAS)
to meet the basic requirements of the privacy-preserving
auction. To be specific, the scheme is designed with two
independent entities that comprise the third-party auction
platform: (i) the Auctioneer and (ii) the Intermediate Plat-
form. We leverage the Paillier cryptosystem [16] to im-
plement homomorphic encryption and with the assistance
of a one-time pad. Under our designed architecture, the
Intermediate Platform will only see the Paillier encrypted
bids, while the Auctioneer only sees the bids disguised
with a one-time pad. This design ensures that the auction
data will only be accessible by the winner of the auction.
A prototype of PPAS is implemented and evaluated, with
the goal of conducting auctions on encrypted bids being
achieved.
We then further investigate the security limitation of
PPAS and attempt to improve the scheme with additional
security features. Thus, the Enhanced Privacy-Preserving
Auction Scheme (EPPAS) is proposed, based on PPAS. To
be specific, we use the digital signature feature of the
Paillier cryptosystem to ensure that the data has not been
manipulated in transmission or by a compromised entity
(the Auctioneer or the Intermediate Platform) in the net-
work. In addition, the function of comparing encrypted data
is revised to eliminate possible loopholes. We conduct a
theoretical analysis to validate the efficiency and security
features of EPPAS. This is carried by evaluating time and
space complexities to measure efficiency, while various at-
tack scenarios are applied to validate the security resiliency.
Finally, we implement the system and conduct extensive
experiments on assorted scenarios. Our experimental results
demonstrate that our designed system is capable of meeting
the needs of privacy preservation during the third-party
platform-basd data auction, and is secure against attacks
from compromised messages, and compromised compo-
nents of the third-party platform.
Our contributions in this paper are as follows:
2
and comparison. The evaluation results demon-
strate the effectiveness, efficiency, and security of
our proposed EPPAS.
• Extension: As the proposed scheme is generic, and
a variety of auction rules can be provisioned and
more efficient cryptosystems can be applied, we
address potential avenues of future research to
meet the requirements of different data auctions.
The remainder of this paper is organized as follows: In
Section 2, we provide preliminary background to briefly
review homomorphic cryptography. In Section 3, we intro-
duce the design rationale to achieve the privacy-preserving
data auctions. In Section 4, we propose our baseline scheme,
the Privacy-Preserving Auction Scheme (PPAS) for big data
auctions, along with an analysis, performance evaluation,
and considerations about its limitations. In Section 5, we
improve upon the baseline scheme with the addition of
further security features, proposing the Enhanced Privacy-
Preserving Auction Scheme (EPPAS). We also analyze the
properties of our scheme with respect to both efficiency
and security. In Section 6, we discuss some open issues
and extensions relevant to our schemes. In Section 7, we
conduct a literature review. Finally, we conclude the paper
in Section 8.
2 P RELIMINARY
In this section, we briefly introduce the concept of Homo-
morphic cryptography. Traditionally, data is encrypted by
one party, sent, and must be decrypted for processing of the
plaintext result. Nonetheless, it is clear that this is not ideal,
as not all destinations can be trusted. Instead, the ability
for processing to be performed on the encrypted cypher-
text data should ensure that the destination never sees the
content of the original plaintext. This is the concept of ho-
momorphic cryptography. Here, all the data is encrypted by
some encryption scheme before being transmitted to some
untrusted parties for computation. All the computation on
the untrusted side is performed on the encrypted data, and
the computed result is received and decrypted by the user to
obtain the final result. Ideally, privacy is protected because
the plaintext data is never observed in any untrusted area.
To realize this process, the operations that are performed on
the ciphertext, once decrypted, must match the correspond-
ing operations performed on the original plaintext.
The concept of homomorphic encryption can be pre-
sented as
∀m1 , m2 ∈ M, EK (m1 ) C EK (m2 ) → EK (m1 M m2 ),
• Basic Scheme: We propose a basic scheme denoted (1)
as the Privacy-Preserving Auction Scheme (PPAS) where M is the set of plaintext, m is any plaintext in M,
to enable auctions with encrypted bids. We provide E is the encryption function, K is the encryption key, and
a detailed description of the designed architecture
and algorithms, an analysis of the auction scheme,
and evaluate its performance via emulation.
• Enhanced Scheme: Based on insights from our anal-
ysis of the PPAS scheme, we propose an Enhanced
Privacy Preserved Auction Scheme (EPPAS), to im-
prove the security and privacy of the auction. We
provide the detailed architecture and algorithms
of the improved EPPAS, analysis of the improved
auction, and an additional performance evaluation
2327-4697 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
M and C stand for some operators in M and the corre-
sponding set of ciphertext C . Under the ideal homomorphic
encryption scheme, the untrusted servers only see, operate,
and return encrypted data, enabling protection of the user’s
privacy.
Regarding the development of homomorphic encryp-
tion, the first homomorphic encryption schemes achieved
only Partial Homomorphic Encryption (PHE), meaning that
the possible homomorphic operations were limited to a
finite set (e.g., only addition and multiplication). Typical
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TNSE.2018.2846736, IEEE
Transactions on Network Science and Engineering
3

PHE schemes include ElGamal [17] and Paillier [16], among
others. In contrast, a Fully Homomorphic Encryption (FHE)
scheme is one that allows arbitrary computations on cypher-
text. The first viable fully homomorphic scheme was pro-
posed by Gentry [15] in 2009, using lattice-based cryptogra-
phy and the mechanism of bootstrapping. Expansions upon
that work include LTV [18] and GSW [19], among others.
Despite these advances, in most cases, current implementa-
tions of FHE are not suited to meet efficiency requirements
with respect to speed and space. As a compromise, the
recent trend is to use Somewhat Homomorphic Encryption
(SWHE), which have a limited number of operations and
the ciphertext from being decrypted by any seller or bidder,
the public key should not belong to any one of them. In
the meantime, however, using the auctioneer’s public key
would enable it to know the actual value before the end of
the bidding window.
To address this issue, our solution is to introduce an
independent party, denoted the Intermediate Platform, lo-
cated between the auction participants and the Auctioneer.
Specifically, all bids from the participants are sent to the
Intermediate Platform, in which they are padded with a
randomly generated pad, using the following:
depth of FHE, but can still achieve good performance.
In our privacy-preserving auction scheme, we imple-
ment one representative homomorphic encryption scheme,
called Paillier cryptosystem [16] as an example to demon-
PKa (Padded Bid) = PKa (Bid) (c,padding) PKa (Pad). (2)
In addition, the feature of homomorphic encryption enables
the padded bids to satisfy the following condition:
strate our idea. This is an asymmetric encryption system
based on the problem of computing nth residue, and is
believed to be computationally difficult. Paillier belongs to
a partial homomorphic scheme that supports addition on
the ciphertext. That is, E(m1 ) + (m2 )) = E(m1 ) · E(m2 ),
Padded Bid = SKa (PKa (Padded Bid)) = Bid(m, padding) Pad.
(3)
In Equations (2) and (3), P Ka (x) stands for the encryp-
tion function using the Auctioneer’s public key, SKa (x)
stands for the decryption function using the Auctioneer’s
where E is the encryption function, and m1 and m2 are the secret key, (c, padding) is the operation of padding using
plaintext. We note that Paillier can achieve semantic security,
where it is not possible to determine, in polynomial time,
the original plaintext, whose ciphertext encrypts with a
probability significantly larger than 0.5.
3 D ESIGN R ATIONALE
In the following, we introduce our design rationale to
achieve a privacy-preserving data auction. To fulfill the
requirements, we consider cryptosystems and design algo-
rithms to realize the individual key functions needed in the
trading process.
3.1 Leveraging Homomorphic Encryption
Recall that in our proposed scenario described in Section 1,
the data auctions are controlled by a third-party auctioneer.
In this scenario, privacy protection is required by both sell-
ers and bidders. Specifically, sensitive bidding information
(bidding price, reserve price, quantity, etc.) must remain
undisclosed until at least the end of the bidding window
of each auction.
To meet this requirement, one simple solution is to
encrypt the sensitive data before the bids are sent out.
Meanwhile, the auctioneer needs the data to determine the
bidding result. This means that either it must reveal the
disguised data right after the bidding window, or it can
generate the bidding result using the disguised data without
knowing the actual value. In the former, all bids can only
be processed after the bidding window, which is inefficient
when the number of bids is high. Thus, the second option,
where the bids can be processed as received without reveal-
ing the contents, becomes the viable approach, implicating
homomorphic encryption.
3.2 Independent Intermediate Platform
To enable operation upon multiple encrypted bids in
an asymmetric homomorphic encryption scheme, all bids
ciphertext, and (m, padding) is the operation of padding using
plaintext. In this design, the Intermediate Platform sees only
the encrypted bids and the Auctioneer sees only the padded
bids. Furthermore, neither of them would be able to uncover
the original bids before the end of the bidding window.
In the meantime, when using same pad for every bid, it
is possible for the Auctioneer to use the padded bids to
compare and sort when a proper homomorphic encryption
system is selected.
3.3 Auction Data Delivery
Another important requirement from the seller is that the
auction data needs to be disguised and would only be able
to be revealed to the winner of the auction. In designing
the platform for big data trading, the size of the auction
data must be taken into consideration. Notice that symmet-
ric encryption schemes are much faster than asymmetric
schemes. We thus leverage this property, using a symmetric
scheme, such as AES, to encrypt the large volume of auction
data, and applying the asymmetric homomorphic scheme to
encrypt the AES encryption key for the system to deliver.
We have also developed the algorithms for key delivery
using a homomorphic scheme and one-time pad (OTP). To
be specific, the seller randomly generates the key K for
AES encryption to encrypt the auction data D and obtain
the AES encrypted data AESK (D). K is then encrypted
by the Auctioneer’s public key P Ka to obtain P Ka (K).
Upon receipt of AESK (D) and P Ka (K), the Intermedi-
ate Platform generates the OTP, applies the homomorphic
padding using Equation (4), and sends P Ka (KOT P )) to
the Auctioneer. From Equations (5) and (6), the Auctioneer
decrypts P Ka (KOT P )) using its own secret key SKa , and
re-encrypts the result using the auction winner’s public key
P Kw , sending it back to the Intermediate Platform. Finally,
the platform applies homomorphic depadding, defined in
Equation (7), leaving the PKw encrypted AES key P Ka (K),
which allows the winner to decrypt and reveal AESK (D).
These equations are listed as follows:
should be encrypted using the same public key. To prevent PKa (KOT P ) = PKa (K) (c,padding) PKa (OTP), (4)

2327-4697 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TNSE.2018.2846736, IEEE
Transactions on Network Science and Engineering
4

KOT P = SKa (PKa (KOT P )), (5)

PKw (KOT P ) = PKw (KOT P ), (6)
PKw (K) = PKw (KOT P ) (c,depadding) PKw (OTP).
Via this mechanism, we can prevent both Auctioneer and
Intermediate Platform from seeing the original value of the
AES key. Thus, by using a proper homomorphic encryption
mechanism, the auction data can be delivered to the target
without being revealed.
3.4 Selection of Cryptosystem
In order to realize the auction procedure efficiently, one
of the most important functions is sorting, because it
determines the winning prices of the auction. Note that
the algorithm for sorting on disguised data depends sig-
nificantly on the cryptosystem selected. Considering the
analysis outlined above, we choose the Paillier cryptosystem
to realize our design. Recall that in Section 2, Paillier enables
the addition operation by decrypting the product of the
ciphertext, according to,
Pi + P ad = SK(PK(Pi ) · PK(P ad)).
th
Here, Pi is the i price, and Pad is the pad to disguise Pi .
Thus, the sorting result on P ricei (where i ∈ n) is equiva-
lent to the sorting result on P ricei + P ad, where i ∈ n, when
using the same pad. Meanwhile, in the detailed algorithm,
the revealing of the pad after the bidding window will help
the Auctioneer find the actual value of the winning price.
The operation of homomorphic addition also satisfies
our design for auction data delivery, applying the key
exchanging algorithm that we mentioned in Equations (4)
through (7). The homomorphic de-padding can be realized
using
PKw (K) = PKw (KOT P ) · (PKw (OTP))−1 ,
where PKw is the winner’s public key, KOT P is the padded
key, and OTP is the one-time pad.
4 P RIVACY -P RESERVING AUCTION S CHEME
Based on the design rationale in Section 3, we consider the
selected cryptosystem with the outlined algorithms, and
propose our Privacy-Preserving Auction Scheme (PPAS).
We first present our architecture and workflow, and then
analyze the system with respect to time and space efficiency.
Finally, we implement and evaluate a prototype of our
system, and consider several unresolved issues.
4.1 System Architecture
Figure 1 illustrates the system architecture of the Privacy-
Preserving Auction Scheme, which consists of four entities:
Auctioneer, Intermediate Platform, Seller, and Bidder. Each
entity is detailed below.
Auctioneer. The Auctioneer is the party who organizes
the data auctions. It initializes new auctions upon the re-
quest from a registered seller and generates asymmetric
key pairs using a Homomorphic cryptosystem (we use the
Paillier cryptosystem in this prototype) and publishes its
public key (PK). The secret key (SK) is kept only by itself so
2327-4697 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
(7)
Fig. 1. System Architecture
that neither the Intermediate Platform, nor the auction par-
ticipants would be able to decrypt the ciphertext. By design,
the Auctioneer keeps receiving pairs of the ciphertext of the
one-time-padded bidding prices from the Intermediate Plat-
form during the bidding window, comparing the padded
value, and replying with the results. This function enables
(8)
the Intermediate Platform to carry out the sorting operation
on the encrypted bidding prices. After the bidding window,
the auctioneer receives and reveals the encrypted winning
price, and re-encrypts the key to the auction data with the
winner’s public key.
Intermediate Platform. The Intermediate Platform is
independent from the Auctioneer. During the auction, it
receives and stores the encrypted bids from Sellers and
Bidders. The Intermediate Platform is implemented with the
Paillier cryptosystem as well, and performs the function of
padding on the incoming bids. By the communication with
the auctioneer, the intermediate platform is able to sort all
incoming encrypted bids without revealing them. After the
(9) winner is determined, the auction data will be posted with
the key encrypted by the winner’s public key.
Seller and Bidders. A seller is the provider of the auction
data and determines the reserve price. Bidders are the par-
ties who submit bids to the auction platform for seeking the
auction data. In our proposed auction scheme, we assume
that all participants (sellers and bidders) in the auctions
are registered users. To be specific, the Auctioneer and the
Intermediate Platform are able to access the public key of
the auction participants from the database, and the payment
to the seller is guaranteed as long as the winning price
(higher than the reserve price) is determined. It is worth
noting that the prototype of the auction scheme supports
auctions with one seller, multiple bidders, and one winner.
Our designed system is generic and a variety of auction
rules can be provisioned in our system.
In addition, we list the notations used in the algorithms
discussed in the following sections in Table 1.
4.2 Detailed Workflow
The detailed workflow of the Privacy-Preserving Auction
Scheme is illustrated in Figure 1. We have divided the
process into five primary phases, which correspond to the
numbers in the figure. In addition, Algorithms 1 through
4 are presented, describing each algorithm implemented
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TNSE.2018.2846736, IEEE
Transactions on Network Science and Engineering
5

TABLE 1. Notations Algorithm 2: PPAS: Bidder’s Algorithm

AuID Identifier of an auction 1 Fetch the public key of the Auctioneer (PKa ) and Auction ID
UIDs , UIDb i Unique Identifier of the Seller and Bidders (AuID);
SKa , PKa Secret-Public Key Pair generated by the Auctioneer 2 if Key pair not exists then
SKs , PKs Secret-Public Key Pair generated by the Seller 3 Generate key pair ({PKbi ,SKbi });
SKbi , PKbi Secret-Public Key Pair generated by the i-th Bidder 4 Update PKbi to Auctioneer’s database;
PK() Encryption using Public Key 5 Determine bidding price Pbi ;
SK() Decryption using Secret Key 6 Fetch User ID: UIDbi ;
Ss (), Sbi (), Signed by Seller/Bidder using secret key 7 Encrypt using PKa : get PKa (Pbi );
Vs (), Vbi (), Verify Signature using Seller/Bidder’s public key 8 Send {AuID, UIDbi , PKa (Pbi )} to Intermediate Platform as
K AES key to encrypt the Auction Data Bidding Information ;
D The Auction Data for sale
AESK (D) AES encrypted auction data
PADp () One-Time-Pad for price pad
PADK () One-Time-Pad for AES key pad Algorithm 3: PPAS: Intermediate Platform Algo-
Pr Reserve Price
Pbi Bidding Price rithm
Pw Winning Price 1 Receive public key of the Auctioneer (PKa ), Auction ID
SN Series Number generated by Intermediate Plat- (AuID) and bidding window;
form, assigned to received bids 2 while during bidding window do
3 Receive bids;
4 if from seller then
5 Store PKa (Pr ) and PKa (K );
for each of the four entities (Seller, Bidder, Intermediate 6 else
Platform, and Auctioneer) in detail. 7 Store PKa (Pbi ) in last position of heap;
Phase 1: Open New Auction. The Seller sends the 8 do
request to the Auctioneer to open a new auction. 9 Randomly generate pad PADp for price padding;
10 PKa (Pbi + PADp )=PKa (Pbi ) · PKa (PADp );
Phase 2: Initialize the Auction. Following Algorithm 4 11 Fetch Price Ps in current position of the heap to
in Line 1 through 6, the Auctioneer initializes the auction swap;
upon the receipt of the new auction request. It generates 12 PKa (Ps + PADp )=PKa (Ps ) · PKa (PADp );
13 Send PKa (Pbi + PADp ) and PKa (Ps + PADp ) to the
Paillier key pairs {PKa , SKa } and the Auction ID (AuID) for Auctioneer to compare;
this newly initialized auction. PKa and AuID are published 14 Flag = Receive boolean value from Auctioneer,
and the Intermediate Platform is informed by the Auction- larger for true ;
eer to start waiting for bids. 15 while Flag;
Phase 3: Place Bids During the bidding window, the 16 heap.pull(), get winner: PKa (Pw );
Seller follows Algorithm 1. It randomly generates a 256-bit 17 Randomly generate pad PADp for price padding;
key (K ) for AES encryption on the data to sell (Line 5). As 18 Send PKa (Pw + PADp ) and PKa (Pr + PADp ) to the Auctioneer
to compare;
we use Paillier cryptosystem-based module n, the K should 19 Receive boolean value from Auctioneer, larger for true ;
be positive. K and the reserve price (Pr ) are encrypted 20 if true then
using the Auctioneer’s public key (P Ka ) (Line 8). The Seller 21 Randomly generate pad PADK for key padding;
then sends the auction ID (AuID), the user ID (UIDs ), the 22 Send UIDw , PKa (K +PADK ) to Auctioneer;
23 Receive PKw (K +PADK ) ;
encrypted reserve price (PKa (Pr )), and the encrypted key 24 Depadding: PKw (K ) = PKw (K +PADK ) * [
for the AES encrypted auction data (PKa (K )) as the auction PKw (PADK )]−1 ;
information to the Intermediate Platform (Line 9). After that, 25 Publish AESK (D) and PKw (K );
26 else
the Auction Data D is Encrypted using AES with key K , the 27 Terminate current auction;
result AESK (D) is sent to the Intermediate Platform as well
(Line 10 and 11).
The Bidder follows Algorithm 2. It determines the bid-
ding price (Pbi ) and encrypts it using the Auctioneer’s
Phase 4: Price Sorting. While the bidding window re-
public key (PKa ) (Line 5 through 7). The Seller then sends
mains open, the Intermediate Platform follows Algorithm 3
{AuID, UIDbi , PKa (Pbi )to the Intermediate Platform as Bid-
to receive and store the seller’s auction information (Line
ding Information (Line 8).
5), and continues receiving bids from the bidders (Line 7
through 14). The accepted bids are inserted and stored to
Algorithm 1: PPAS: Seller’s Algorithm a heap (with the maximum price on top). To determine the
1 Fetch the public key of the Auctioneer (PKa ) and Auction ID position of the incoming bids in the heap, the encrypted
(AuID); new price is compared with the price stored in the parent.
2 if Key pair not exists then
3 Generate key pair ({PKs ,SKs }); Both encrypted prices are padded with a new randomly
4 Update PKs to Auctioneer’s database; generated pad before the pair is sent to the Auctioneer.
5 Randomly generate AES key K ; After decryption with its secret key (SKa ), the Auctioneer
6 Determine reserve price Pr ; (follows Algorithm 4, Line 7 through 15) has the one-time-
7 Fetch User ID: UIDs ; padded prices, replying true if the newer price is larger for
8 Encrypt using PKa : get PKa (K ), PKa (Pr );
9 Send {AuID, UIDs , PKa (Pr ), PKa (K )} to Intermediate the Intermediate Platform to finish the sorting.
Platform as Auction Information ; Phase 5: Conclude the Auction. When the bidding
10 Encrypt Auction Data D using K , get AESK (D) ; window closes, the Intermediate Platform checks whether
11 Send AESK (D) to Intermediate Platform as Auction Data ;
the reserve price is exceeded by the top price in the heap
using the same mechanism for comparison as in Phase 3

2327-4697 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TNSE.2018.2846736, IEEE
Transactions on Network Science and Engineering
6
TABLE 2. Time Efficiency in PPAS
Algorithm 4: PPAS: Auctioneer Algorithm (n is the number of total bids)
Operation O() Seller Bidder Auctioneer IP
1 Receive auction request from seller; Key Generation O(1) 1 1 1 0
2 Generate key pair ({PKa ,SKa }); Encryption O(1) 2 1 1 n lg n + 2
3 Generate Auction ID (AuID); Decryption O(1) 0 0 n lg n + 2 0
4 Determine bidding window ;
Padding O(1) 0 0 0 n lg n + 2
5 Publish PKa , AuID;
6 Send bidding window to Intermediate Platform; TABLE 3. Per Item Space Cost over Key Length in PPAS
7 while during bidding window do
8 Receive pairs of padded prices ; 512 bits 1024 bits 2048 bits
9 Padded P1 = SKa (PKa (P1 +PADp ) ; Key Size 192 bytes 384 bytes 768 bytes
10 Padded P2 = SKa (PKa (P2 +PADp ) ; Ciphertext 128 bytes 256 bytes 512 bytes
11 Compare Padded P1 to Padded P2
12 if larger then Bidding message 136 bytes 264 bytes 520 bytes
13 Send true to Intermediate Platform Payload 8 bytes 8 bytes 8 bytes
14 else
15 Send f alse to Intermediate Platform
the auctioneer will perform decryption for nlogn+2 times.
16 Bidding window close;
17 Receive pairs of padded prices ; As we can observe in Table 2, the overall upper bound of the
18 Padded P1 = SKa (PKa (P1 +PADp ) ; time complexity in an entire auction process is O(n log n),
19 Padded P2 = SKa (PKa (P2 +PADp ) ; which is determined by the heap sorting of the received
20 Compare Padded P1 to Padded P2 ; bids in the Intermediate Platform, again n being the number
21 if larger then
22 Send true to Intermediate Platform; of bids during the auction. Under this time complexity, we
23 Receive UIDw , PKa (K +PADK ); consider our proposed Privacy-Preserving Auction Scheme
24 Fetch PKw using UIDw ; to be efficient.
25 Decrypt PKa (K +PADK ) ;
26 PKw (K +PADK ) = PKw (SKa (PKa (K +PADK )));
Space Efficiency: In Table 3, we generalize the per-item
27 Send PKw (K +PADK ) to Intermediate Platform; space cost in the Privacy-Preserving Auction Scheme when
28 else choosing different key lengths. Theoretically, a large length
29 Send f alse to Intermediate Platform; asymmetric key can provide a higher degree of security,
30 Auction close; at the cost of storage overhead. For example, when using
a 2048-bit key, which is considered sufficient security for
the near future, the resulting key size is 768 bytes and each
(Algorithm 3, Line 16 through 19; Algorithm 4, Line 16 ciphertext would require 512 bytes. In addition, while each
through 20). The winner’s UID and the one-time-padded payload, such as bidding price, remains 8-bytes, the bidding
and encrypted AES key is sent to the Auctioneer (Algo- message in this case would be 520 bytes.
rithm 3, Line 21 and 22). The Auctioneer returns with the
OTP-padded AES key encrypted by the winner’s public key 4.4 Performance Evaluation of PPAS
(Algorithm 4, Line 22 through 27). The Platform removes
A prototype of the proposed Privacy-Preserving Auction
the OTP, and publishes AESK (D) and P Kw (K ), which
has been implemented. We now present the results of our
can only be decrypted by the winner of the auction (Al-
performance evaluation to demonstrate its effectiveness.
gorithm 3, Line 23 and 24).
The prototype, including Paillier cryptosystem [16], and the
workflow and algorithms described in Section 4.2, have
4.3 Analysis of PPAS been implemented in Java. More specifically, each of the
Time Efficiency: By decomposing the key operations in- four entities (Auctioneer, Intermediate Platform, Seller, and
volved in the auction process, we generalize the time effi- Bidder) have been individually implemented for execution
ciency in Table 2. The individual operations are listed in in the Common Open Research Emulator (CORE) [20],
the first column, while the second column represents the which is a python framework with a GUI for users to
upper bound of the time complexity in big-O notation emulate network topology. All communication and data
for each individual operation. In the third through sixth transmissions in our evaluation have been carried out using
columns, we list the total number of times each operation the Constrained Application Protocol (CoAP) protocol.
occurs for each entity (Seller, Bidder, Auctioneer, and In- In our deployed prototype, the bandwidth has been set
termediate Platform) during one full auction process with to a high value so that we consider only the processing
n bidders. In the table, IP stands for the “Intermediate time at this evaluation. The emulation environment was
Platform". The processing time to perform a single key setup on an OSX system on a MacMini computer with
generation is fixed when the length of the target key is an Intel Core i5 CPU at 2.6 GHZ, and 8 GB memory. The
determined, resulting in O(1). In the same way, perform- experiments were carried out in the following two stages.
ing a single encryption, decryption, or padding will take In the first stage, we evaluated the performance of the
a fixed time as well, once the key is determined. During individual operations, including Encryption, Decryption,
the auction, the Intermediate Platform will perform heap Padding, and Key Generation. We tested each Operation
sorting (complexity O(nlogn)) on the received bids each using key lengths of 512 bits, 1024 bits, and 2048 bits, each
time it performs encryption on a one-time-pad, as well executed 10,000 times and taking the average processing
as when it performs padding. Additionally, it does the time as the performance metric of the individual Operations.
same operation for the reserve price and AES key from In the second stage, we evaluated the performance of the
the seller, which is 2. The resulting complexity is a total system (i.e., the Auctioneer and the Intermediate Platform).
nlogn + 2 for each operation. Applying the same analysis, We used the worst-case scenario that assumes all bids come

2327-4697 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TNSE.2018.2846736, IEEE
TABLE 4. Time for Individual Operations in PPAS
512 bits 1024 bits
KeyGen 8.4013 ms 46.5453 ms
Encryption 1.3833 ms 9.1497 ms
Decryption 1.2893 ms 8.8755 ms
Padding 0.0047 ms 0.0148 ms
TABLE 5. System Performance (2048-bit key)
100 1000
Processing time 59951 ms 913797 ms
Avg. time per bid 599.51 ms 913.80 ms
Success Rate 100 % 100 %
at the end of the bidding window. The key length used was
2048 bits, which is capable of providing adequate security
against brute force attacks. The numbers of bids were set
to 100, 1,000, and 10,000. We recorded the processing time
from the first incoming bid until the winner-access-only key
was published. We also recorded the accuracy of the system
successfully finding a winner.
Table 4 shows the performance of individual operations
under different key lengths. As can be observed, the average
processing time for each individual operation increases with
the length of key. This result can be used as a baseline to
predict the performance when applied to other uses.
Table 5 shows the system performance of the Auction-
eer with the Intermediate Platform. We can observe from
the result that the system achieves a 100 % success rate
in finding the correct winner, proving the effectiveness of
our system. Nonetheless, the average processing time for
each bid in a 10,000-bid auction is on the order of 1200 ms
when using a 2048-bit key, which is a significantly long
time. Furthermore, the total processing time to complete an
auction with 10,000 bids is approximately 3.5 hours. We can
attribute this to the fact that every comparison of price must
apply a new one-time-pad to the encrypted bid. Nonethe-
less, our scheme shows great promise, as the performance
can be dramatically increased in several ways. Considering
that we use the worst-case scenario where all bids come
at the last minute, the bids in real-world auctions would
come in throughout the entire bidding window. Thus, the
processing after the bidding window would be significantly
reduced. Meanwhile, the experiment has been conducted
on a standard commodity computer. To meet the needs
of large scale service, the system could be deployed to
more powerful servers or cloud hardware. Recall that in
Table 2, the upper bound of the overall time complexity is
O(n log n), indicating that the system is well designed and
performance can be increased by the application of better
hardware.
4.5 Remaining Security Issues
As observed in Section 4.4, our proposed Privacy-Preserving
Auction Scheme is proven to be able to complete the basic
auction procedure. Recall the design of the PPAS in Sec-
tion 4.2, all bids received and seen by the Intermediate
Platform are encrypted with the Secret Key generated by the
Auctioneer, while all bids received and seen by the Auction-
eer are encrypted with the one-time pad by the Intermediate
Platform. As the Auctioneer and the Intermediate Platform
are independent of each other, privacy during normal auc-
tion procedures is preserved. Nonetheless, security issues
2327-4697 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
Transactions on Network Science and Engineering
7
remain that need consideration, especially those that exceed
2048 bits the normal auction procedure. We outline several in the
377.8954 ms
following scenarios.
68.3971 ms
68.0633 ms Issue 1. Manipulated Message: In the PPAS, all bids
0.0441 ms communicated between involved entities are encrypted to
prevent the leakage of privacy. With the public key of the
Auctioneer being accessible to everyone, however, any party
10000 is able to generate a valid message, including bids. It is
12615756 ms possible, then, that an adversary may try to either replace
1261.58 ms messages during the communication, or even pretend to be
100 % a legal bidder to intervene in the auction process. Lacking
a verification mechanism, potential issues of authentication
need to be addressed.
Issue 2. Loopholes in Comparing Encrypted Data:
Recall Algorithms 3 and 4 in Section 4.2, to compare two
encrypted bids in the Intermediate Platform, the encrypted
prices are padded and sent to the Auctioneer, which returns
the result after comparing the padded prices. This mech-
anism keeps the prices disguised in both the Auctioneer
and the Intermediate Platform under normal operation.
Nonetheless, the function of comparison implemented in
the Auctioneer could be potentially abused. In this case, to
disclose a target encrypted data (either a price or the AES
key of the auction data), the only thing that an adversary
must do is applying the mechanism of binary search and
keep generating closer values. This, then, requires the In-
dependent Platform to be trustable and not compromised,
which is inconsistent with the requirements of the third-
party auction platform.
Issue 3. Compromised Entities: In this scenario, we
consider one or more of the auction entities to be compro-
mised, and assume that the adversary has full access to the
compromised entities. When either bidders or the seller are
compromised, illegal bids could be received and accepted
by the Intermediate Platform and the Auctioneer, and the
auction result would be affected. When the Intermediate
Platform is compromised, the adversary could claim itself
the winner to the Auctioneer, and obtain the key of the auc-
tion data. When the Auctioneer is compromised, although
the key of the auction data with one-time pad is secured, the
comparing function could be abused to circumvent proper
operation of the auction. As a result, the mechanism of
detecting compromised entities is needed to reject malicious
bids or at least alert the system.
5 E NHANCED P RIVACY -P RESERVING AUCTION
S CHEME
To address the remaining security issues in our Privacy-
Preserving Auction Scheme (PPAS) proposed in Section 4,
we now propose an Enhanced Privacy-Preserving Auction
Scheme (EPPAS). In the following, we first introduce the
enhanced security features of EPPAS. We then present the
system architecture and detailed workflow. Finally, we con-
duct an analysis of EPPAS with respect to both efficiency
and security.
5.1 Enhanced Security Features
In our enhanced scheme, we seek to improve upon the
design of the system to address the three security issues
(Issues 1, 2, and 3) discussed in Section 4.5.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TNSE.2018.2846736, IEEE
Transactions on Network Science and Engineering
5.1.1 Manipulated Message Prevention
Since the third-party auction platform cannot be fully
trusted, there should be mechanisms to detect and prevent
potential security issues. In the Privacy-Preserving Auction
Scheme (PPAS) presented in Section 4, we have separated
the Auctioneer and the Intermediate Platform, making them
independent of each other. This means that the privacy
of the auction participants is ensured by the encryption
scheme, unless both the Auctioneer and the Intermediate
Platform are compromised at the same time. The encrypted
data, however, is easily manipulated, since everyone can
apply the public key. For example, as outlined in Issue 1
in Section 4.5, above, if the bidding price is manipulated,
the bidder could lose the bid or pay more.
Thus, to ensure the correct auction results, there should
be mechanisms to protect the integrity of the data. We
leverage the digital signature to enable the detection of ma-
nipulation. In some asymmetric encryption schemes, users
are able to use their own secret key to sign the data. The
signature can only be created by using the secret key, and
could be verified by using the public key. By examining the
data with its signature, the recipient is able to detect any
anomaly or attempted falsification. Notice that, for digital
signature, Paillier supports signing on the data using the
secret key and verifying the signature using the public key.
Using signature verification, manipulated bids will be fil-
tered and rejected by the normally functioning Intermediate
Platform.
5.1.2 Loophole Improvement
To determine the winner of an auction with privacy dis-
guised, the function of comparison between the asymmet-
ric encrypted prices are needed. Recall in our proposed
Privacy-Preserving Auction Scheme (PPAS), we implement
the comparison function on the Auctioneer side, in which
the secret key can be accessed. By sending the pair of
padded encrypted prices to the Auctioneer, the Intermediate
Platform receives the result. This mechanism has a critical
loophole, however, as denoted in Issue 2 in Section 4.5,
and can be abused by the adversary.
To address this issue, we have re-designed the compari-
son mechanism. In our enhanced scheme, the sorting heap
is implemented on the Auctioneer’s side. The Intermediate
Platform no longer maintains the heap, but only sends the
padded prices along with a serial number to the auctioneer.
After the bidding window, the winning price is determined
by the Auctioneer, and the corresponding serial number
is used to fetch the remaining information of the winning
bid from the Intermediate Platform. With the new signature
verification mechanism, the Auctioneer further verifies the
bid, and replies with the re-encrypted key for the auction
data to the Intermediate Platform. Since the Auctioneer
no longer simply responds to the request of comparing
encrypted data, the enhanced scheme can eliminate the
aforementioned loophole.
5.1.3 Compromised Entity Detection and Prevention
Recall from Section 4.5 that we discussed the issue of
compromised entities. With the implementation of the dig-
ital signature and verification, the Intermediate Platform of
2327-4697 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
8
the enhanced scheme is able to filter and reject manipu-
lated bids from compromised bidders. In the meantime, it
also prevents the compromised Intermediate Platform from
manipulating the received bids. In our enhanced scheme,
the Auctioneer would sample the incoming prices at a
given rate, and verify them after the bidding window to
see whether the Intermediate Platform used a different pad
to manipulate the sorting results. While the Intermediate
Platform still uses one-time pad to secure the key of the
auction data, a compromised Auctioneer cannot cheat the
key as well. We will describe the entire algorithm in detail
in the rest of this section.
5.2 System Architecture
The overall architecture of EPPAS remains the same as that
of PPAS, as in Figure 1, consisting of the four entities:
Auctioneer, Intermediate Platform, Seller, and Bidder. The
changes to each are detailed in the descriptions below.
Notice that, while the architecture of the system does not
change, we have replaced several implementations follow-
ing Section 5.1.
Auctioneer. The function remains largely the same as in
PPAS. The Auctioneer in EPPAS is the party who organizes
the data auctions. It still initializes new auctions upon a
request from a registered seller, generates asymmetric key
pairs using a homomorphic cryptosystem (we keep the use
of Paillier cryptosystem as an example to demonstrate our
idea), and publishes its public key (PK). The secret key (SK)
is kept only by itself so that neither the Intermediate Plat-
form, nor the auction participants would be able to decrypt
the ciphertext. Maintaining the same design, the Auctioneer
receives the ciphertext of padded bidding prices from the
Intermediate Platform during the bidding window. Unlike
PPAS, in EPPAS, the sorting takes place in the Auctioneer.
Comparing the padded prices enables the Auctioneer to find
the highest price without knowing the actual value. In our
enhanced scheme, the Auctioneer also samples the incoming
bids at a consistent sample rate for further detection of
malfunctions. After the bidding window closes, it receives
the pad of the price and the OTP padded key for the auction
data from the Intermediate Platform to reveal the winning
price, and verifies the sampled prices to detect anomalies
from the Intermediate Platform, which is not fully trusted.
Intermediate Platform. The Intermediate Platform re-
mains independent from the Auctioneer in our enhanced
scheme. During the auction, it receives and stores the en-
crypted bids from Sellers and Bidders. The Intermediate
Platform is implemented with the Paillier cryptosystem, and
performs the function of padding on the incoming bids. In
the enhanced scheme, the Intermediate Platform examines
each bid by verifying the signatures to avoid suspicious
bids. Meanwhile, the communication from the Auctioneer
is examined as well. After the winner is determined, the
auction data will be posted with the key encrypted by
winner’s public key.
Seller and Bidders. The roles of the seller and the
bidders do not change. The Seller remains the provider of
the auction data and determines the reserve price. Bidders
submit bids to the auction platform for acquiring the auction
data. In the enhanced scheme, the bidding information is
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TNSE.2018.2846736, IEEE
Transactions on Network Science and Engineering
9

additionally signed with a digital signature to avoid data
being manipulated by adversaries.
We would like to clarify that the authentication and
payment are required in both our proposed auction
schemes, PPAS and EPPAS, and only legal participants
(registered users) are allowed to participate in the auction.
In Algorithms 1 and 2 for PPAS and Algorithms 5 and 6
for EPPAS, sellers and bidders will include their unique
identifiers (UID) in the bids. The issue/risk of fake infor-
mation does exist in the PPAS scheme (as we mentioned
in Section 4.5). This issue is addressed in our proposed
enhanced scheme, EPPAS, by implementing signatures in
the biddings (as mentioned in Section 5.4.3).
To be specific, the Auctioneer and the Intermediate
Platform are able to access the public key of the auction
participants from the database, and the payment to the
seller is guaranteed as long as the winning price (higher
than the reserve price) is determined. It is worth noting that
the prototype of the auction scheme supports auctions with
one seller, multiple bidders, and one winner. Our designed
system remains generic and a variety of auction rules can
be provisioned in our system. In terms of security, we
consider attacks that would manipulate the bidding infor-
mation or procedures after compromising the Auctioneer
or the Intermediate Platform. Notice that attacks against
availability, such as denial-of-service, which aim at disabling
the operation of the auction system, are outside the scope of
this paper. In the meantime, the scenarios where individual
participants (Sellers, Bidders, or both) are compromised by
the adversary, or where bidding information is manipulated
by the adversary, are outside the scope as well.
5.3 Detailed Workflow
Figure 1 illustrates the workflow for each auction process in
the EPPAS, which includes the following key phases.
Phase 1: Open New Auction. The Seller sends the
request to the Auctioneer to open a new auction.
Phase 2: Initialize Auction. According to Algorithm 8
(Line 1 through 6), upon the receipt of the new auction
request, the Auctioneer initializes the auction. It generates
Paillier key pairs {PKa , SKa } and the Auction ID (AuID) for
this newly initialized auction. PKa and AuID are published
and the Intermediate Platform is informed by the Auction-
eer to start waiting for bids.
Phase 3: Place Bids. The Seller follows Algorithm 5. It
randomly generates a 256-bit key (K ) for AES encryption on
the data to sell (Line 5). As we use the Paillier cryptosystem-
based module n, the K should be positive. K and the
reserve price (Pr ) are encrypted using the Auctioneer’s
public key (PKa ) (Line 8). The Seller then uses its own secret
key SKs to sign the reserve price (Pr ) to obtain Ss (Pr ), and
sign the sum of AuID+UIDs + PKa (Pr )+Ss (Pr )+PKa (K ),
obtaining Ss (ALL) (Line 9 and 10). Then, {AuID, UIDbi ,
PKa (Pbi ), Sbi (Pbi ), Sbi (ALL)} is sent as the auction informa-
tion to the Intermediate Platform (Line 11). After that, the
Auction Data D is Encrypted using AES with key K , and
the result AESK (D) is sent to the Intermediate Platform as
well (Line 12 and 13).
The Bidder follows Algorithm 6. It determines the bid-
ding price (Pbi ), which is encrypted using the Auctioneer’s
public key (PKa ) (Line 5 through 7). The Seller then uses
its own secret key SKbi to sign the bidding price (Pbi )
to obtain Sbi (Pbi ), and sign the sum of AuID+UIDbi +
PKa (Pbi )+Sbi (Pbi ), and obtain Sbi (ALL) (Line 8 and 9).
Then, {AuID, UIDbi , PKa (Pbi ), Sbi (Pbi ), Sbi (ALL)} is sent to
the Intermediate Platform as the Bidding Information (Line
10).
Algorithm 5: EPPAS: Seller’s Algorithm
1 Fetch the public key of the Auctioneer (PKa ) and Auction ID
(AuID);
2 if Key pair not exists then
3 Generate key pair ({PKs ,SKs });
4 Update PKs to Auctioneer’s database;
5 Randomly generate AES key K ;
6 Determine reserve price Pr ;
7 Fetch User ID: UIDs ;
8 Encrypt using PKa : get PKa (K ), PKa (Pr );
9 Sign using SKs , get Ss (Pr );
10 Sign using SKs , get Ss (ALL) = Ss [AuID + UIDs + PKa (Pr ) +
Ss (Pr ) + PKa (K )];
11 Send {AuID, UIDs , PKa (Pr ), Ss (Pr ), PKa (K ), Ss (ALL)} to
Intermediate Platform as Auction Information ;
12 Encrypt Auction Data D using K , get AESK (D) ;
13 Send AESK (D) to Intermediate Platform as Auction Data ;
Algorithm 6: EPPAS: Bidder’s Algorithm
1 Fetch the public key of the Auctioneer (PKa ) and Auction ID
(AuID);
2 if Key pair not exists then
3 Generate key pair ({PKbi ,SKbi });
4 Update PKbi to Auctioneer’s database;
5 Determine bidding price Pbi ;
6 Fetch User ID: UIDbi ;
7 Encrypt using PKa : get PKa (Pbi );
8 Sign using SKbi , get Sbi (Pr );
9 Sign using SKbi , get Sbi (ALL) =
Sbi [AuID+UIDbi +PKa (Pbi )+Sbi (Pbi )];
10 Send {AuID, UIDbi , PKa (Pbi ), Sbi (Pbi ), Sbi (ALL)} to
Intermediate Platform as Bidding Information ;
Phase 4: Price Sorting: In this step, the Intermediate Plat-
form receives the seller’s auction information and continues
receiving bids from the bidders following Algorithm 7 (Line
6 through 24). It examines each bid by verifying the signa-
ture Sbi (ALL), and rejects unmatched bids (Line 9 through
11 and 18 through 20). Accepted bids are assigned with
a serial number (SN ), and stored (Line 13 and 22). Each
encrypted price is then padded and sent with its SN to
the Auctioneer (Line 13 through 16 and 22 through 24).
Following Algorithm 8 (Line 7 through 15), after decryption,
the Auctioneer has the padded price, and inserts it into a
max heap so all incoming prices are sorted. The auctioneer
also samples the prices at a given rate for future detection
of anomalies from the Intermediate Platform, which may be
compromised or abused by the insider adversary.
Phase 5: Conclude Auction: When the bidding window
closes, the Auctioneer checks whether the reserve price is
exceeded, and sends the SN of the winner and the bids in
the sample list to the Intermediate Platform (Algorithm 8,
Line 17 through 18). The Platform returns with the en-
crypted pads for the price, the encrypted OTP padded AES
key, and the signatures of the reserve price, winning price,
and sampled price (Algorithm 7, Line 25 through 27). When
all signatures are verified, the Auctioneer re-encrypts the

2327-4697 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TNSE.2018.2846736, IEEE
Transactions on Network Science and Engineering
10

Algorithm 7: EPPAS: Intermediate Platform Algo- Algorithm 8: EPPAS: Auctioneer Algorithm

rithm 1 Receive auction request from seller;
1 Receive public key of the Auctioneer (PKa ), Auction ID 2 Generate key pair ({PKa ,SKa });
(AuID) and bidding window; 3 Generate Auction ID (AuID);
2 if Key pair not exists then 4 Determine bidding window ;
3 Generate key pair ({PKp ,SKp }); 5 Publish PKa , AuID;
4 Update PKp to Auctioneer’s database; 6 Send bidding window to Intermediate Platform;
5 Randomly generate pad PADp for price padding and pad 7 while during bidding window do
PADK for AES key padding; 8 Receive padded price and SN from Intermediate Platform;
6 while during bidding window do 9 if Reserve price then
7 Receive bids; 10 Padded Pr = SKa (PKa (Pr +PADp ) ;
8 if from seller then 11 if bidding price then
9 Verify using Vs {Ss (ALL)}; 12 Padded Pbi = SKa (PKa (Pbi +PADp ) ;
10 if not match then 13 Insert Padded Pbi to HeapMAX
11 Reject; 14 if random by sample rate then
12 else 15 Add SN to Sample List (LSN )
13 Assign series number SN and store;
14 Padding: PKa (Pr + PADp ) = PKa (Pr )*PKa (PADp ) ; 16 Bidding window close;
15 Padding: PKa (K +PADK ) = PKa (K )*PKa (PADK ) ; 17 if HeapMAX .pull >= Padded Pr then
16 Send PKa (Pr +PADp ) and SN to the Auctioneer ; 18 Send List of SN LSN include all sampled SN and
17 else winner’SNw , to Intermediate Platform;
18 Verify using Vbi {Sbi (ALL)}; 19 Receive PKa (PADp ), Sw (Pw ), Sbi (Pbi ) where SNbi ∈ LSN ,
19 if not match then PKa (K +PADK ) ;
20 Reject; 20 Decrypt PKa (PADp ), PKa (K +PADK ) ; Pi = Padded Pi -
21 else PADp , for reserve price, winning price, and sampled
22 Assign series number SN and store; price ;
23 Padding: PKa (Pbi + PADp ) = 21 if reserve, winning and sample prices verified then
PKa (Pbi )*PKa (PADp ) ; 22 PKw (K +PADK ) = PKw (SKa (PKa (K +PADK ))) send
24 Send PKa (Pbi )*PKa (PADp ) and SN to the PKw (K +PADK ) to Intermediate Platform;
Auctioneer ; 23 Auction close;
24 else
25 Receive list of SN LSN and SNw from Auctioneer; 25 Prices are manipulated, auction terminate ;
26 Use SNw find PK(w ); 26 else
27 Send PKa (PADp ), Sbi (Pbi ) where SNbi ∈ LSN , 27 Reserve price not hit;
PKa (K +PADK ) to Auctioneer; 28 Send terminate to Intermediate Platform;
28 if receive PKw (K +PADK ) then
29 Depadding: PKw (K ) = PKw (K +PADK ) * [
PKw (PADK )]−1 ; TABLE 6. Composition of operations in each Entity
30 Publish AESK (D) and PKw (K ); (n is the number of total bids)
31 else O() Seller Bidder Auctioneer IP
32 Terminate current auction ; Key Gen. O(1) 1 1 1 1
Encryption O(1) 2 1 1 2
Decryption O(1) 0 0 n+2 0
Padding O(1) 0 0 0 n+2
Sorting O(log n) 0 0 n 1
OTP padded AES with the winner’s public key, and sends Signature O(1) 2 2 2 n
it to the Platform (Algorithm 8, Line 21 through 23). The Verification O(1) 0 0 n + 2+ n+2
Platform removes the OTP, and publishes AESK (D) and rsample · n
P Kw (K ), which can only be decrypted by the winner of the
auction (Algorithm 7, Line 28 through 30). time complexities will not exceed O(n log n), we consider
our proposed scheme to be efficient.

5.4 Analysis of EPPAS 5.4.2 Space Efficiency

We now analyze the effectiveness of the improved EPPAS In Table 7, we generalize the per item space cost when
scheme with respect to time and space efficiency, and addi- choosing different key lengths. Theoretically, a large length
tionally analyze the enhanced security features. asymmetric key can provide a higher degree of security, at
the cost of storage overhead. Using a 2048-bit key, which
5.4.1 Time Efficiency is considered sufficient for the near future, each ciphertext
In Table 6, we list the fundamental operations used in our and signature requires 512 bytes. Recall Algorithm 6, in
proposed prototype in the first column. The time complexity our prototype, which uses 2048-bit keys, each bid needs
of each individual operation is provided in the second 2 signatures and 1 ciphertext to secure the 8-byte bidding
column. In the Paillier cryptosystem, the length of the key price, resulting in 1536 bytes of overhead.
determines its strength. Once the length is determined, the
time of a single operation remains constant. This can be TABLE 7. Per Item Space Cost over Key Length
seen in the table, in which the time complexity for every
512 bits 1024 bits 2048 bits
cryptography-related operation is O(1). In addition, sorting Key Size 192 bytes 384 bytes 768 bytes
can achieve O(log n) for each insertion, where n is the Ciphertext 128 bytes 256 bytes 512 bytes
number of items that are already in the sorted list. For each Signature 128 bytes 256 bytes 512 bytes
auction, we count the number of individual operations used Bidding message 392 bytes 776 bytes 1542 bytes
by each entity in the remaining columns of Table 6. As the Payload 8 byte 8 bytes 8 bytes

2327-4697 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TNSE.2018.2846736, IEEE
1
10%
20%
0.8 30%
40%
Success Rate
50%
0.6
0.4
0.2
0
0 10 20 30 40 50
Number of Bids
(a) Manipulation Not Missing Higher
Bidder
Fig. 2. Success Rate of Manipulation by Compromised Platform
5.4.3 Enhanced Security Features
We now analyze the security features of EPPAS with respect
to three primary cases: (i) Messages are manipulated, (ii)
the Intermediate Platform is compromised, and (iii) the
Auctioneer is compromised.
Manipulated Message: In this case, none of the entities
are compromised. Instead, an adversary tries to send ma-
nipulated messages (e.g., bids) to intervene in the auction
process. Nonetheless, as we implement signatures in each
message sent between entities, the manipulated message is
not able to pass the verification due to not being signed, and
the manipulated messages will be rejected without affecting
the auctions.
Intermediate Platform Compromised: In this case, the
Intermediate Platform is compromised and we assume that
the adversary has full and complete access. First, the Inter-
mediate Platform is independent from the Auctioneer. This
means that it is still not able to obtain the Auctioneer’s secret
key SKa , and thus the encrypted prices and key for the
auction data will not be revealed. Next, we consider that the
adversary may want to reveal the key K for the auction data
by cheating the Auctioneer. By design, however, it can only
obtain the re-encrypted key P Kw (K ) from the Auctioneer.
Thus, the only mechanism available is to make itself the
winner of the auction. To win the auction, the adversary
would need to create a price with a legal signature, which
means using a registered account. In addition, it needs to
manipulate all other higher bids. Since the Paillier encrypted
prices are semantic secure, the adversary can only randomly
select the target at a certain rate, hoping to have found all
higher bids.
Figure 2a illustrates the success rate of the adversary not
missing any higher bids over the number of incoming bids,
assuming a 10 % chance for the bid to be higher. Nonethe-
less, the manipulation would be detected by the Auctioneer
as well. Figure 2b represents the successful rate of not being
detected over the number of incoming bids, assuming a 10 %
sampling rate in the Auctioneer. Combined, the successful
cheating rate is shown in Figure 2c, which is less than
0.1 % after the total number of bids exceeds 50. Notice that,
even if the manipulation is successful and not detected, the
adversary still needs to pay at least the reserve price, since
manipulation to the reserve price would be detected under
our guarantee.
Auctioneer Compromised: In this case, the Auctioneer
2327-4697 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
Transactions on Network Science and Engineering
11
1 1
10% 10%
20% 20%
0.8 30% 0.8 30%
40%
40%
Success Rate
Success Rate
50% 50%
0.6 0.6
0.4 0.4
0.2 0.2
60
0 0
0 10 20 30 40 50 60 0 10 20 30 40 50 60
Number of Bids Number of Bids
(b) Manipulation Not Being Detected (c) Cheat Successful
is compromised and we assume the adversary has full and
complete access. The adversary has the Auctioneer’s secret
key SKa . Nonetheless, by our deigned procedure, it is not
possible for the adversary to obtain the unpadded prices
before the end of the bidding window. The adversary could
send a bid to the Intermediate Platform and obtain the
padded price to find the value of the pad. Nonetheless, with
only the padded price and serial number returns, it is hard
to match the original price.
If the adversary wants to cheat for the key of the auction
data, it could try to claim itself as the winner of the auction.
Nonetheless, according to our design, the Winner’s serial
number is sent to the Intermediate Platform before getting
the pad to reveal actual prices. The adversary would not
be able to find the serial number for its own bidding price.
Therefore, this type of cheating cannot be achieved.
To summarize, our proposed EPPAS is proven to be
secure against the above attacks.
5.5 Performance Evaluation of EPPAS
Just as in the PPAS evaluation, we have implemented our
proposed Enhanced Privacy-Preserving Auction Scheme
and conducted a performance evaluation to demonstrate its
effectiveness. In the following, we first present the evalua-
tion methodology and then describe the evaluation results.
Methodology. We have implemented our EPPAS proto-
type, including Paillier cryptosystem [16], and the workflow
and algorithms described in Section 5.3, in Java. The four
entities (Auctioneer, Intermediate Platform, Seller, and Bid-
der) have been individually implemented for emulation in
CORE, and we used the Constrained Application Protocol
(CoAP) protocol to realize the communication and data
transmissions.
The bandwidth has again been fixed at a high value such
that we consider only the processing time of the scheme. The
emulation environment was setup on the same system from
Section 4.4 (an OSX system on a MacMini computer with
Intel Core i5 CPU at 2.6 GHZ, and 8 GB memory).
The experiments were conducted in the following three
stages: In the first stage, we evaluated the performance of
the individual operations, including Encryption, Decryp-
tion, Padding, Signing, Verification, and Key Generation,
testing each using key lengths of 512 bits, 1024 bits, and
2048 bits. Each Operation was executed 10,000 times, and the
average processing time was recorded as the performance of
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TNSE.2018.2846736, IEEE
1
NOT missing Higher Bidder
Manipulation Not Detected
0.8 Cheat Success
Event Rate
0.6
0.4
0.2
0
0 200 400 600
Number of Bids
Fig. 3. Security against Compromised Platform
TABLE 8. Time for Individual Operations
512 bits 1024 bits
KeyGen 8.4013 ms 46.5453 ms
Encryption 1.3833 ms 9.1497 ms
Decryption 1.2893 ms 8.8755 ms
Padding 0.0047 ms 0.0148 ms
Signature 3.1532 ms 20.8929 ms
Verification 2.5946 ms 17.6915 ms
the individual operations. In the second stage, we evaluate
the performance of the system (i.e., the Auctioneer and
the Intermediate Platform). We considered the worst-case
scenario that assumes all bids come at the end of the bidding
window. The key length that we used is 2048 bits, which is
able to provide adequate security. The numbers of bids were
set to 100, 1,000, and 10,000,. We recorded the processing
time from the first incoming bid until the winner-access-
only key is published. We also record the accuracy of the
system successfully finding a winner.
In the third stage, we evaluate the security aspects of EP-
PAS. Particularly, we generated manipulated messages, and
simulated the attacks mentioned in Section 5.4 to validate
the security of EPPAS. For instance, to test security against
manipulated messages, we ran 100 experiments, where the
total number of bids was set to 10,000. We manipulated
10 % of the messages and recorded the rejection rate, as well
as the times that the auction was terminated. To test the
security against the Platform being compromised, we set
10 % target bids and set the manipulation rate at 10 %, and
the sample rate in the Auctioneer is set to 10 %. The number
of bids is set to 200, and we recorded the rate of successful
cheating of 10,000 runs.
Results. Table 8 shows the performance of individual
operations under different key lengths. As can be observed,
the average processing time for each individual operation
increases with the length of the key. This result can be used
as a baseline to predict the performance when applied to
other uses. Compared to the results for PPAS (Table 5), ad-
ditional processing times are included for digital signature
and verification. As observed, it would take about twice of
the processing time for these two operations compared to
encryption and decryption.
Table 9 shows the system performance of the Auctioneer
with the Platform. It can be observed from the result that the
system achieves a 100 % success rate in finding the correct
winner, again proving the effectiveness of our system. The
2327-4697 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
Transactions on Network Science and Engineering
12
TABLE 9. System Performance (2048-bit key)
100 1000 10000
Processing time 51687 ms 505880 ms 5047507 ms
Avg. time 516.87 ms 505.88 ms 504.75 ms
Success Rate 100 % 100 % 100 %
TABLE 10. Resilience to Manipulated Messages (MSG)
Total Number Accepted Rejected
Normal MSG 900,000 900,000 0
Manipulated MSG 100,000 0 100,000
Total Number Completed Terminated
Auctions 100 100 0
800 1000
average processing time for each bid is on the order of
500 ms when using a 2048-bit key, taking almost 1.5 hours
to complete an auction with 10,000 bids. Compared to the
result to in PPAS (Table 5), however, the processing time
2048 bits in EPPAS is significantly reduced. This is due to the new
377.8954 ms comparison mechanism, where all padded prices are com-
68.3971 ms pared and sorted in the Auctioneer’s side. Thus, encryption
68.0633 ms
0.0441 ms
is no longer needed for every swap, saving processing time.
152.4763 ms It is notable our enhanced scheme has both improved the
135.0198 ms security of the system and reduced the processing time.
Nonetheless, this performance can be further increased
in multiple ways. First, considering that we use the worst-
case scenario where all bids come at the last minute, the
bids in real-world auctions would come in throughout the
entire bidding window, and the processing after the bid-
ding window would be significantly reduced. Second, by
analyzing the individual operations, we know that Sign-
ing and Verifying take much longer than Encryption and
Decryption. While these operations ensure the security of
the auction, nonetheless, the Verification/Signing may not
need to use the same key pairs as Encryption and Decryp-
tion. Considering the security needs of different levels, we
could use a separate shorter bit-length key pair for digital
signature and verification. Finally, the experiment has been
conducted on a standard commodity computer. To meet the
needs of large scale service, the system could be deployed
to more powerful servers or clouds. As demonstrated in
Table 6, the highest time complexity of the operations is
O(n log n), meaning that the system is well designed and
performance can be increased by implementation in more
powerful hardware.
Table 10 illustrates the results of security against ma-
nipulated messages. As can be observed, all manipulated
messages were rejected, and normal messages are accepted.
Likewise, all 100 auctions are correctly completed without
termination. The results demonstrate that the system is
resilient to this type of attack, and normal operation is
unaffected.
Figure 3 shows the result of security against a compro-
mised Intermediate Platform. As can be observed, the com-
promised Platform is either detected or fails to manipulate
all targets at the very beginning of the bidding procedure.
Notice that, as shown in Section 5.4, the compromised
Auctioneer will not affect the system.
6 E XTENSION
Through our extensive experiments in Section 4.4, we
have validated the effectiveness of our proposed Privacy-
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TNSE.2018.2846736, IEEE
Transactions on Network Science and Engineering
Preserving Auction Scheme (PPAS). Furthermore, with the
improvement in design, Section 5.5 presents better per-
formance in processing time for our Enhanced Privacy-
Preserving Auction Scheme (EPPAS). As we have clarified
in the performance evaluation, we used the worst-case
scenario, where all bids arrive at the end of the bidding
window. In real-world practice, bids could arrive randomly
during the bidding window, and would result in a shorter
processing time for the platform to return the bidding
results. Meanwhile, our proposed EPPAS is highly security
resilient and can successfully deal with different privacy
threats. In the following, we discuss some extensions.
Extended Algorithms and Rules. Despite the effective-
ness of our designed auction, there remain several avenues
for us to improve upon this auction scheme. In this paper,
the auction schemes we have proposed (both PPAS and
EPPAS) can be considered as one generic framework. This
means that it is modularized and can be further integrated
with additional algorithms and auction rules. As we have
mentioned, for example, EPPAS is able to support one
seller, multiple bidders, and one winner in each auction
process. It would be very interesting and useful to extend
the capabilities of our auction platform to support more
auction rules, including multiple winners, multiple sellers
on data equivalents, and others. Moreover, since the plat-
form is designed as a modular system, we can enable the
replacement of the current cryptosystem, or the introduction
of additional operations and mechanisms without changing
the framework. As in the real-world, the trading data could
be from varying applications (CPS, IoT System, etc.), and
this modularization provides the capability for the auction
platform to access data that varies in type, size, and other
features.
Based on the previous work and proposed auction plat-
form, there are several extensions that we intend to imple-
ment to further to improve the performance and security of
our proposed auction platform. The designed data trading
process is highly relevant to big data, IoT, and copyright
protection. Thus, in order to promote further research,
extension tasks should address system robustness, system
adaptability, data pricing model, data trading scheme, and
data copyright protection.
System Robustness: Homomorphic cryptography-
based schemes cost more in terms of time and space to
ensure privacy during the auction in comparison with tra-
ditional plaintext-based auction schemes. Different mech-
anisms in the realm of Homomorphic cryptosystems may
yield better performance in time and space costs, as well
as support additional operations. In addition, a variety of
differential privacy mechanisms can be considered in the
privacy-preserving design of the auction process [21], [22],
[23].
Other Privacy Preserving Strategies. Differential Pri-
vacy is another strategy for privacy preservation [24]. In
Differential Privacy, randomized noise is added to the
valued data as a response on each query to provide a dif-
ferential privacy guarantee. Generally speaking, the noise
is adjusted based on the sensitivity of the randomization
function, which measures the maximum difference in the
values of the two responses from the adjacent datasets.
As applied to auctions, Differential Privacy can provide
2327-4697 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
13
an alternative mechanism to protect identities and other
sensitive information, such as pricing. Nonetheless, since
the winner of the auction should be determined by the
bidding prices, adding randomized noise will affect the
accuracy of the auction process, reducing the utility of the
auction process as a whole.
System Adaptability. Big data is the key to the next
waves of growth in productivity. Meanwhile, IoT accelerates
the growth in volume and variety for big data. Thus, data as
a kind of digital commodity has many different types and
diverse sources, such as software, multimedia, unstructured
data, etc. In this paper, we only consider the content encryp-
tion method and auction algorithms, however, due to the
diversity of data types, the proposed auction platform needs
to be extended to support different data types. For instance,
trading software in the proposed auction platform may not
require encryption. Furthermore, only using homomorphic
encryption to encrypt the licenses or the keys of the software
may be a viable and efficient alternative.
Data Pricing Model. Similar to traditional commodity
trading, the very first step of data trading is data pricing. In
this paper, we only consider a generic auction mechanism
that is used to determine the price. There are a number of
research efforts related to auction mechanisms, include one-
side auction [25], [26], double auction, [27], [28], seal-bid
auction [29], and combinatorial auction, to name a few. As
ongoing work, we plan to integrate additional auction mod-
els into our data trading platform. In addition to auction
schemes, different data pricing strategies (free-data strategy,
usage-based pricing strategy, package pricing strategy, flat-
pricing strategy, two-tart tariff strategy, etc.) should be con-
sidered [6]. Finally, incorporating game theory mechanisms
into our data pricing model (e.g., non-cooperative game,
Stackelberg game, and bargaining game) has the potential
to improve the adaptability of our model, and provides
another interesting research direction.
Data Copyright Protection. The big data life-cycle con-
sists of data collection, data analysis, data pricing, data
trading, and data protection [6]. When the trading process
is completed, the data copyright protection will be the most
important issue for data owners. There are a number of
research efforts toward protecting different types of data.
For example, software-based copyright protection typically
uses both on-line and off-line digital rights management
(DRM) [30], [31]. In contrast, multimedia-based copyright
protection usually includes watermarking technologies [32],
[33], [34]. In the proposed auction platform, we use homo-
morphic encryption to encrypt the source data. It is our
intention to investigate embedding a watermark into the
data during the encryption process. This feature has the
potential to merge data trading and protection together, and
improve the performance and adaptability of the platform.
7 R ELATED W ORK
The advance of CPS and IoT technologies have led to a
number of smart-world systems (smart grid, smart cities,
smart manufacturing, etc.) [1], [2], [3], [4], [5] and data
trading has become an active research topic in recent years
[6], [35], [12], [36], [37], [38], [39], [40], [27]. For example,
Liang et al. in [6] reviewed existing research in big data,
identified the lifecycle of big data trading, discussed existing
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TNSE.2018.2846736, IEEE
Transactions on Network Science and Engineering
research focused on data pricing, data trading, and data
protection, and considered future research needs. Pantelis
and Aija in [35] designed a taxonomy to study the value of
big data. An et al. in [38] investigated a one-side data auction
market and proposed a scheme to deal with false data
bidding attacks. Koronios et al. in [41] discussed internal
data markets and the opportunities in data trading. Jiao et
al. in [40] proposed a Bayesian profit maximization auction,
which can be solved to obtain optimal service price and data
size, leading to profit maximization.
In trading digital commodities, determining pricing
and value of the commodities are critical. For example,
Muschalle et al. in [42] presented data pricing strategies,
including the sample data free strategy, the usage-based
data pricing strategy, and others. Meanwhile, Roncoroni
[43] proposed a cost-based data pricing model, which first
calculates the cost and then determines the price. Nonethe-
less, this model does not consider competition and demand,
which is the disadvantage of this kind of pricing model [44].
Niyato et al. in [36] proposed the market model and price
scheme. Shen et al. in [37] addressed the issue of how to
price big personal data and proposed a pricing model for big
personal data based on tuple granularity. In addition, Kang
et al. in [45] proposed a Stackelberg Game-based pricing
model and Mao et al. in [46] proposed a Bargaining Game-
based pricing model.
In addition, trading using auction schemes has been
applied to manage resources in various systems, such as
CPS [12], [11], wireless networks [13], [14], and others. For
example, An et al. in [12] addressed the electricity trading
issue in the smart grid and designed a new online double
auction scheme. Nadendla et al. in [13] designed a sealed-
bid auction scheme to enable dynamic spectrum allocation
in wireless networks. In addition, Chao et al. in [47] focused
on the coordination of data trading and trading efficiency in
the market, and proposed an iterative auction mechanism
to coordinate trading. Their study focused on avoiding
the selfish data owner, who only seeks to maximize their
own data value, which also affects the efficiency of overall
systems.
Regarding data auction mechanisms, Lorenzo and
Gonzalez-Castano in [48] proposed a matching game mech-
anism using game theory to increase the speed of an auction
process. Yu et al. in [49] proposed an economics model that
deals with the trading scenario, in which the single user’s
trading decision is subject to future demand uncertainty. Via
the designed scheme, a single user could make a decision to
meet the best price by using this model. In addition, several
recent studies have begun to investigate the privacy issues
in data markets [50], [51]. Nonetheless, research on privacy
in data auctions is still in its infancy.
A critical issue of auction markets is the potential for
privacy exposure for both bidders and owners in big data
arena. Privacy protection concepts and methods can be
found in [52], [6], [53], [54], [55], [56], [57], [24], [58],
[21], [38]. For example, research efforts have been con-
ducted toward privacy preserving techniques for CPS [58].
Nonetheless, the traditional methods usually only focus on
owner and commodity privacy protections, and ignore the
bidders. One explanation is that the encrypted information
of bidders needs to be decrypted during the auction process.
2327-4697 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
14
Homomorphic cryptography and differential privacy are
representative types of privacy-preserving schemes in auc-
tion markets that have been applied in recent years. There
have been some research efforts related to using homomor-
phic cryptography to protect auction processes, such as [59],
[60], [61], [62], [63], [64]. For example, Huang et al. in [62],
[64] applied homomorphic encryption to protect privacy in
spectrum auction. The authors in [61] also designed auction
schemes based on homomorphic encryption in spectrum
allocation. In addition, relevant techniques have been used
for secure data aggregation in wireless sensor networks
[65]. Nonetheless, there is only few literatures on designing
privacy-preserving schemes in data market auctions [66],
[67].
To summarize, in this paper, we proposed a comprehen-
sive third-party data auction platform using homomorphic
encryption to protect the privacy of both owners/sellers
and bidders. To our knowledge, there is no other research
which involves homomorphic encryption to protect the data
auction process and designs both privacy-preserving and
secure third-party auction platform, which is the focus of
our study. Compared with the existing auction schemes,
we are not only focused on the efficiency and security of
the platform, but also the integration of the third-party
auction platform as a new concept to satisfy the demands
of big data and CPS. Through our experiments, the pro-
posed platform has demonstrated good performance, and
through the application of homomorphic encryption, all the
private information is encrypted during the auction process,
demonstrably protecting both owner and bidder privacy.
8 F INAL R EMARKS
In this paper, we have addressed the issue of protecting
information privacy during the data auction in the third-
party auction platform. We have leveraged the concept of
homomorphic encryption to design a Privacy-Preserving
Auction Scheme (PPAS). In order to carry out a privacy-
preserving auction, we selected a set of crypto-primitives
and designed algorithms in our system to enable the ef-
ficiency of the auction process. To further improve the
security and resistance to attacks of PPAS, we proposed
the Enhanced Privacy-Preserving Auction Scheme (EPPAS).
The prototypical system of the auction scheme has been
implemented to conduct thorough experimental evaluation.
The experimental results demonstrate that our proposed
scheme is capable of ensuring the determination of an
auction winner with a 100 % correct rate under normal
operations and without leakage of private information. In
addition, multiple attack scenarios against the auction were
investigated and applied in our evaluation, and have been
correctly detected and prevented. We also discussed some
extensions of our designed system. Our generic framework
can be further integrated with other cryptosystems and
auction rules to improve the performance and the scope of
the data auction.
R EFERENCES
[1] R. van der Meulen, “8.4 billion connected ’things’ will be in
use in 2017, up 31 percent from 2016,” 2017. [Online]. Available:
https://www.gartner.com/newsroom/id/3598917
[2] J. A. Stankovic, “Research directions for the Internet of Things,”
IEEE Internet of Things Journal, vol. 1, no. 1, pp. 3–9, Feb 2014.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TNSE.2018.2846736, IEEE
Transactions on Network Science and Engineering
[3] Q. Yang, D. An, R. Min, W. Yu, X. Yang, and W. Zhao, “Optimal
PMU placement based defense against data integrity attacks in
smart grid,” IEEE Transactions on Forensics and Information Security
(T-IFS), vol. 12, no. 7, pp. 1735–1750, 2017.
[4] J. Lin, W. Yu, X. Yang, Q. Yang, X. Fu, and W. Zhao, “A real-time
en-route route guidance decision scheme for transportation-based
cyberphysical systems,” IEEE Transactions on Vehicular Technology,
vol. 66, no. 3, pp. 2551–2566, March 2017.
[5] J. Lin, W. Yu, N. Zhang, X. Yang, H. Zhang, and W. Zhao, “A
survey on Internet of Things: Architecture, enabling technologies,
security and privacy, and applications,” IEEE Internet of Things
Journal, vol. 4, no. 5, pp. 1125–1142, Oct 2017.
[6] F. Liang, W. Yu, D. An, Q. Yang, X. Fu, and W. Zhao, “A survey
on big data market: Pricing, trading and protection,” IEEE Access,
vol. 6, pp. 15 132–15 154, 2018.
[7] S. Yu, M. Liu, W. Dou, X. Liu, and S. Zhou, “Networking for big
data: A survey,” IEEE Communications Surveys Tutorials, vol. 19,
no. 1, pp. 531–549, Firstquarter 2017.
[8] M. Mohammadi, A. I. Al-Fuqaha, S. Sorour, and M. Guizani,
“Deep learning for iot big data and streaming analytics: A
survey,” CoRR, vol. abs/1712.04301, 2017. [Online]. Available:
http://arxiv.org/abs/1712.04301
[9] C. Yi and J. Cai, “Two-stage spectrum sharing with combinatorial
auction and stackelberg game in recall-based cognitive radio net-
works,” IEEE Transactions on Communications, vol. 62, no. 11, pp.
3740–3752, 2014.
[10] F. Wu, Q. Huang, Y. Tao, and G. Chen, “Towards privacy preserva-
tion in strategy-proof spectrum auction mechanisms for noncoop-
erative wireless networks,” IEEE/ACM Transactions on Networking
(TON), vol. 23, no. 4, pp. 1271–1285, 2015.
[11] Q. Yang, D. An, W. Yu, X. Yang, and X. Fu, “On stochastic optimal
bidding strategy for microgrids,” in 2015 IEEE 34th International
Performance Computing and Communications Conference (IPCCC),
Dec 2015, pp. 1–8.
[12] D. An, Q. Yang, W. Yu, X. Yang, X. Fu, and W. Zhao, “SODA:
Strategy-proof online double auction scheme for multimicrogrids
bidding,” IEEE Transactions on Systems, Man, and Cybernetics: Sys-
tems, vol. PP, no. 99, pp. 1–14, 2017.
[13] V. S. S. Nadendla, S. K. Brahma, and P. K. Varshney, “Optimal
spectrum auction design with 2-d truthful revelations under un-
certain spectrum availability,” IEEE/ACM Transactions on Network-
ing, vol. 25, no. 1, pp. 420–433, Feb 2017.
[14] Z. Feng, Y. Zhu, Q. Zhang, L. M. Ni, and A. V. Vasilakos, “TRAC:
Truthful auction for location-aware collaborative sensing in mobile
crowdsourcing,” in IEEE Conference on Computer Communications
(INFOCOM), April 2014, pp. 1231–1239.
[15] C. Gentry, “Fully homomorphic encryption using ideal lattices,”
in Proceedings of the Forty-first Annual ACM Symposium on Theory of
Computing, ser. STOC ’09. New York, NY, USA: ACM, 2009, pp.
169–178.
[16] P. Paillier et al., “Public-key cryptosystems based on composite
degree residuosity classes,” in Eurocrypt, vol. 99. Springer, 1999,
pp. 223–238.
[17] T. ElGamal, “A public key cryptosystem and a signature scheme
based on discrete logarithms,” IEEE Transactions on Information
Theory, vol. 31, no. 4, pp. 469–472, 1985.
[18] A. López-Alt, E. Tromer, and V. Vaikuntanathan, “On-the-fly mul-
tiparty computation on the cloud via multikey fully homomorphic
encryption,” in Proceedings of the forty-fourth annual ACM sympo-
sium on Theory of computing. ACM, 2012, pp. 1219–1234.
[19] C. Gentry, A. Sahai, and B. Waters, “Homomorphic encryption
from learning with errors: Conceptually-simpler, asymptotically-
faster, attribute-based,” in Advances in Cryptology–CRYPTO 2013.
Springer, 2013, pp. 75–92.
[20] Common Open Research Emulator, http://www.nrl.navy.mil/
itd/ncs/products/core.
[21] X. Yang, T. Wang, X. Ren, and W. Yu, “Survey on improving data
utility in differentially private sequential data publishing,” IEEE
Transactions on Big Data, vol. PP, no. 99, pp. 1–1, 2017.
[22] Q. Wang, Y. Zhang, X. Lu, Z. Wang, Z. Qin, and K. Ren, “Real-time
and spatio-temporal crowd-sourced social network data publish-
ing with differential privacy,” IEEE Transactions on Dependable and
Secure Computing, vol. PP, no. 99, pp. 1–1, 2016.
[23] F. McSherry and K. Talwar, “Mechanism design via differential
privacy,” in Foundations of Computer Science, 2007. FOCS ’07. 48th
Annual IEEE Symposium on, Oct 2007, pp. 94–103.
2327-4697 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
15
[24] X. Yang, T. Wang, X. Ren, and W. Yu, “Survey on improving data
utility in differentially private sequential data publishing,” IEEE
Transactions on Big Data, 2017.
[25] Q. Wu, M. C. Zhou, Q. Zhu, and Y. Xia, “Vcg auction-based
dynamic pricing for multigranularity service composition,” IEEE
Transactions on Automation Science & Engineering, vol. PP, no. 99,
pp. 1–10, 2017.
[26] L. Li, X. Liu, and Z. Hu, A Bid Evaluation Method for Multi-attribute
Online Reverse Auction. Springer Singapore, 2017.
[27] X. Zhou and H. Li, “Buying on margin and short selling in an
artificial double auction market,” Computational Economics, no. 8,
pp. 1–17, 2017.
[28] T. Zhou, B. Chen, C. Zhu, and X. Zhai, “TPAHS: A truthful and
profit maximizing double auction for heterogeneous spectrums,”
in Trustcom/bigdatase/i?spa, 2017, pp. 27–33.
[29] O. Kirchkamp, E. Poen, and J. P. Rei?, “Outside options: Another
reason to choose the first-price auction,” European Economic Review,
vol. 53, no. 2, pp. 153–169, 2009.
[30] C. Skipper, E. D. Lewis, D. Konetski, C. Burchett, R. W. Schuckle,
J. M. Burke, W. W. Robbins, and C. E. Gates, “Systems and
methods for providing secure data,” Aug. 5 2015, uS Patent App.
14/819,322.
[31] C. D’Orazio and K.-K. R. Choo, “An adversary model to evaluate
DRM protection of video contents on iOS devices,” Computers &
Security, vol. 56, pp. 94–110, 2016.
[32] F. Arab, S. M. Abdullah, S. Z. M. Hashim, A. A. Manaf, and
M. Zamani, “A robust video watermarking technique for the
tamper detection of surveillance systems,” Multimedia Tools and
Applications, vol. 75, no. 18, pp. 10 855–10 885, 2016.
[33] J. Hao, X. Yao, J. Huang, Y. Qian, and J. Jagannathan, “Video
content protection,” Feb. 9 2016, uS Patent 9,258,584.
[34] K. Jain and U. Raju, “A digital video watermarking algorithm
based on LSB and DCT,” Journal of Information Security Research,
vol. 6, no. 3, pp. 92–97, 2015.
[35] K. Pantelis and L. Aija, “Understanding the value of (big) data,”
in Big Data, 2013 IEEE International Conference on, 2013, pp. 38–42.
[36] D. Niyato, M. A. Alsheikh, P. Wang, D. I. Kim, and Z. Han, “Mar-
ket model and optimal pricing scheme of big data and internet
of things (iot),” in Communications (ICC), 2016 IEEE International
Conference on, 2016, pp. 1–6.
[37] Y. Shen, B. Guo, Y. Shen, X. Duan, X. Dong, and H. Zhang,
“A pricing model for big personal data,” Tsinghua Science and
Technology, vol. 21, no. 5, pp. 482–490, 2016.
[38] D. An, Q. Yang, W. Yu, D. Li, Y. Zhang, and W. Zhao, “To-
wards truthful auction for big data trading,” in 2017 IEEE 36th
International Performance Computing and Communications Conference
(IPCCC), Dec 2017.
[39] C. Niu, Z. Zheng, F. Wu, X. Gao, and G. Chen, “Trading data
in good faith: Integrating truthfulness and privacy preservation
in data markets,” in Data Engineering (ICDE), 2017 IEEE 33rd
International Conference on. IEEE, 2017, pp. 223–226.
[40] Y. Jiao, P. Wang, D. Niyato, M. A. Alsheikh, and S. Feng, “Profit
maximization auction and data management in big data markets,”
in Wireless Communications and Networking Conference (WCNC),
2017 IEEE. IEEE, 2017, pp. 1–6.
[41] A. Koronios, T. Redman, and J. Gao, “Internal data markets:
the opportunity and first steps,” in Cooperation and Promotion of
Information Resources in Science and Technology, Fourth International
Conference on, 2009, pp. 127–130.
[42] A. Muschalle, F. Stahl, A. Löser, and G. Vossen, “Pricing ap-
proaches for data markets,” in International Workshop on Business
Intelligence for the Real-Time Enterprise. Springer, 2012, pp. 129–144.
[43] A. Roncoroni, “Commodity price models,” Encyclopedia of Quanti-
tative Finance, 2010.
[44] E. F. Fama and K. R. French, “Commodity futures prices: Some ev-
idence on forecast power, premiums, and the theory of storage,” in
The World Scientific Handbook of Futures Markets. World Scientific,
2016, pp. 79–102.
[45] X. Kang, R. Zhang, and M. Motani, “Price-based resource alloca-
tion for spectrum-sharing femtocell networks: A stackelberg game
approach,” IEEE Journal on Selected areas in Communications, vol. 30,
no. 3, pp. 538–549, 2012.
[46] Y. Mao, T. Cheng, H. Zhao, and N. Shen, “A strategic bargaining
game for a spectrum sharing scheme in cognitive radio-based
heterogeneous wireless sensor networks,” Sensors, vol. 17, no. 12,
p. 2737, 2017.
[47] X. Cao, Y. Chen, and K. R. Liu, “Data trading with multiple
owners, collectors, and users: An iterative auction mechanism,”
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TNSE.2018.2846736, IEEE
Transactions on Network Science and Engineering
16

IEEE Transactions on Signal and Information Processing over Networks, Weichao Gao received the B.S. degree from
vol. 3, no. 2, pp. 268–281, 2017. Fudan University (Shanghai, China) in 2005, the
[48] B. Lorenzo and F. J. Gonzalez-Castano, “A matching game for MBA from University of Michigan (MI, USA) in
data trading in operator-supervised user-provided networks,” in 2011, and the M.S. degree in Computer Science
Communications (ICC), 2016 IEEE International Conference on, 2016, and technology from Towson University (MD,
pp. 1–7. USA) in 2017. He is currently a doctoral stu-
[49] J. Yu, M. H. Cheung, J. Huang, and H. V. Poor, “Mobile data dent at Towson University. His research interests
trading: A behavioral economics perspective,” in Modeling and include Internet-of-Things, cyberspace security,
Optimization in Mobile, Ad Hoc, and Wireless Networks (WiOpt), 2015 and computer networks.
13th International Symposium on, 2015, pp. 363–370.
[50] C. Niu, Z. Zheng, F. Wu, X. Gao, and G. Chen, “Trading data
in good faith: Integrating truthfulness and privacy preservation
in data markets,” in Data Engineering (ICDE), 2017 IEEE 33rd
International Conference on, 2017, pp. 223–226.
[51] C. Perera, R. Ranjan, and L. Wang, “End-to-end privacy for open Wei Yu Dr. Wei Yu is an Associate Professor
big data markets,” IEEE Cloud Computing, vol. 2, no. 4, pp. 44–53, with the Department of Computer and Informa-
2015. tion Sciences, Towson University. Before joining
[52] P. Samarati and L. Sweeney, “Protecting privacy when disclosing Towson, he was with Cisco Systems Inc. for nine
information: k-anonymity and its enforcement through generaliza- years. He received the B.S. degree in electrical
tion and suppression,” Technical report, SRI International, Tech. engineering from Nanjing University of Technol-
Rep., 1998. ogy, Nanjing, China, in 1992, the M.S. degree
[53] S. Yu, “Big privacy: Challenges and opportunities of privacy study in electrical engineering from Tongji University,
in the age of big data,” IEEE Access, vol. 4, pp. 2751–2763, 2016. Shanghai, China in 1995, and the Ph.D. de-
[54] L. Xu, C. Jiang, J. Wang, J. Yuan, and Y. Ren, “Information security gree in computer engineering from Texas A&M
in big data: Privacy and data mining,” IEEE Access, vol. 2, pp. University in 2008. His research interests in-
1149–1176, 2014. clude cyberspace security and privacy, computer networks, and cyber-
[55] M. Naor, B. Pinkas, and R. Sumner, “Privacy preserving auctions physical systems. He is a recipient of a 2014 NSF CAREER Award,
and mechanism design,” in Proceedings of the 1st ACM conference 2015 University System of Maryland (USM) Regents’ Faculty Award for
on Electronic commerce. ACM, 1999, pp. 129–139. Excellence in Scholarship, Research, or Creative Activity, and the USM
[56] K. Peng, C. Boyd, E. Dawson, and K. Viswanathan, “Robust, Wilson H. Elkins Professorship Award, and Best Paper Awards from
privacy protecting and publicly verifiable sealed-bid auction,” in WASA 2017, IEEE IPCCC 2016, IEEE ICC 2013 and 2008.
International Conference on Information and Communications Security.
Springer, 2002, pp. 147–159.
[57] Y. Lindell and B. Pinkas, “Privacy preserving data mining.” Journal
of cryptology, vol. 15, no. 3, 2002.
[58] W. Han and Y. Xiao, “Privacy preservation for v2g networks in Fan Liang received a Bachelor degree in Com-
smart grid,” Comput. Commun., vol. 91, no. C, pp. 17–28, Oct. 2016. puter Science from Northwestern Polytechnical
[Online]. Available: http://dx.doi.org/10.1016/j.comcom.2016.06. University China in 2005, and a Master’s de-
006 gree in Computer Engineering from University
[59] K. Suzuki and M. Yokoo, “Secure combinatorial auctions by dy- of Massachusetts Dartmouth in 2015. Currently,
namic programming with polynomial secret sharing,” in Interna- he is pursuing his doctoral degree in Computer
tional Conference on Financial Cryptography. Springer, 2002, pp. Science at Towson University since 2017. His
44–56. research interests include wireless networks, big
[60] M. Yokoo and K. Suzuki, “Secure multi-agent dynamic program- data, smart grid and network security.
ming based on homomorphic encryption and its application to
combinatorial auctions,” in Proceedings of the first international joint
conference on Autonomous agents and multiagent systems: part 1.
ACM, 2002, pp. 112–119.
[61] M. Pan, X. Zhu, and Y. Fang, “Using homomorphic encryption to
secure the combinatorial spectrum auction without the trustwor- William Grant Hatcher received a Bachelor of
thy auctioneer,” Wireless Networks, vol. 18, no. 2, pp. 113–128, 2012. Science degree from the University of Maryland
[62] Q. Huang, Y. Tao, and F. Wu, “Spring: A strategy-proof and in Materials Science and Engineering. He is cur-
privacy preserving spectrum auction mechanism,” in INFOCOM, rently pursuing a Master of Computer Science
2013 Proceedings IEEE. IEEE, 2013, pp. 827–835. degree at Towson University. His research inter-
[63] T. Jung and X.-Y. Li, “Enabling privacy-preserving auctions in ests include mobile computing and security, big
big data,” in Computer Communications Workshops (INFOCOM WK- data, and machine learning.
SHPS), 2015 IEEE Conference on. IEEE, 2015, pp. 173–178.
[64] Q. Huang, Y. Gui, F. Wu, G. Chen, and Q. Zhang, “A general
privacy-preserving auction mechanism for secondary spectrum
markets,” IEEE/ACM Transactions on Networking, vol. 24, no. 3, pp.
1881–1893, 2016.
[65] S. Ozdemir and Y. Xiao, “Secure data aggregation in wireless
sensor networks: A comprehensive overview,” Comput. Netw.,
vol. 53, no. 12, pp. 2022–2037, Aug. 2009. [Online]. Available: Chao Lu has been with Towson University as
http://dx.doi.org/10.1016/j.comnet.2009.02.023 a professor of Computer Science since 1990.
[66] Z. Chen, L. Chen, L. Huang, and H. Zhong, “On privacy- He received his BS in Engineering from Shan-
preserving cloud auction,” in 2016 IEEE 35th Symposium on Reliable dong University China in 1982, and MS in 1985
Distributed Systems (SRDS), Sept 2016, pp. 279–288. and Ph.D. in Engineering (E.E.) in 1988 from
[67] T. Jung and X. Y. Li, “Enabling privacy-preserving auctions in City University of New York. His research inter-
big data,” in 2015 IEEE Conference on Computer Communications ests include error-free computing, human mo-
Workshops (INFOCOM WKSHPS), April 2015, pp. 173–178. tion classification, computer vision, parallel/dis-
tributed computing, and cyber security. He re-
ceived the U.S. Federal “Excellence in Technol-
ogy Transfer" award and the “Alan Berman Re-
search Publications" award in 2001, and has published more than 80
research papers.

2327-4697 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.