Smart grid is an electrical grid that uses digital information and communication technology to gather information. Like other digital systems, security and privacy are crucial for smart grid. However, security and privacy protection will inevitably introduce computational complexity and overhead. As smart grid systems are usually operated in a large scale, computational efficiency is a challenging issue. In this paper, we propose an efficient and secure billing system for smart grid, featuring privacy-preserving and data aggregation. We show that our system offers better privacy protection and computational efficiency, in comparison with an existing protocol. Our security analysis indicates that our protocol achieves privacy-preserving on electricity reading aggregation and billing, perfect forward secrecy of system session keys, identity authentication, data integrity, and confidentiality. It also shows that even if we allow the collusion of server and gateways, user privacy can still be achieved. Copyright (C) 2016 John Wiley & Sons, Ltd.