With the emergence of IoT devices, data aggregation in the area of smart grids can be implemented based on IoT networks. However, the communication and computation resources of IoT devices are limited so it is not possible to apply conventional Internet protocols directly. On the other hand, gathering data from smart meters in the advanced metering infrastructure faces challenges such as privacy-preserving and heavy-loaded authentication and aggregation schemes. In this paper, we propose an improved lightweight, secure, and privacy-preserving scheme for aggregating data of smart meters in large-scale IoT-based smart grids. The proposed scheme adopts light-weight operations of cryptography such as exclusive-OR, hash, and concatenation functions. In comparison with the schemes in the literature, the analysis and simulation results show that the proposed scheme satisfies the same security levels, while at the same time burdens lower computation and communication overheads. This observation makes the proposed scheme more suitable to be employed in large-scale and IoT-based smart grids for data aggregation.