In this paper, we consider the privacy preserving problem of consensus protocol. First, we introduce a privacy preserving scheme, where each node produces and transmits a sequence of random values with their mean equaling to the node's initial state. We show that the network can reach average consensus with privacy preserving scheme, and provide a sufficient condition under which the initial state of one node can be inferred completely. Further, we study the privacy preserving performance when there exists an attacker who can intercept the data transmitted on the edges. In a ring network, aiming at the attacker with limited power, we find the optimal attacking strategy to maximize the probability of the privacy disclosure. Finally, the simulations verify the derived theoretical results.