To ensure the security of Internet of Things (IoT) communications, one can use deep packet inspection (DPI) on network middleboxes to detect and mitigate anomalies and suspicious activities in network traffic of IoT, although doing so over encrypted traffic is challenging. Therefore, in this article, an efficient and privacy-preserving encrypted traffic detection scheme is proposed. The scheme uses only lightweight cryptographic operations (i.e., symmetric encryption, hash functions, and pseudorandom functions) to achieve both privacy and security within an inspection round. A dispute resolution mechanism is also designed to address potential disputes between client(s) and server(s). We also present the corresponding security proof and experimental evaluation, which demonstrate that our proposed scheme achieves strong security and privacy preservation and good performance.

Access control mechanisms define the level of access to the resources among specified users. It distinguishes the users as authorized or unauthorized based on appropriate policies. Several traditional and hybrid access control models have been proposed in previous researches over the last few decades. In this study, we provide a detailed survey of access control models and compare the traditional and hybrid access control models based on their access control criteria. This survey focuses on the growing literature of access control models and summarizes it through comparative analysis, identifying limitations and illustrating the advantages of both traditional and hybrid models. This study will help the researchers to get a deep understanding of the traditional and hybrid access control models.

The expeditious development in cloud-enabled industrial Internet of Things (IIoT) healthcare has significantly reduced the costs to monitor and protect people at home while notably improving the quality of human healthcare. Despite its considerable convenience and benefits, it confronts some security and privacy challenges in the aspects of bilateral fine-grained access control, the authenticity and tamper resistance of shared health data. To tackle these constraints, a secure privacy-preserving bilateral access control scheme with fine granularity (PBAC-FG) is proposed in this article. Our PBAC-FG exploits fine-grained access control and matchmaking encryption technologies to ensure both participants (e.g., patients and healthcare providers) can specify their respective fine-grained access control over the encrypted health data, such that only authorized counterparts can efficiently access the health data. Besides, the correct rigorous security proofs are indicated to verify that our PBAC-FG is indeed secure. We carry out comprehensive performance evaluations and comparisons to demonstrate the efficiency and practicality of the PBAC-FG for IIoT healthcare applications.

The emerging of healthcare Industrial Internet of Things (HealthIIoT) cannot only facilitate high-quality care services for patients but also enable efficient telemedicine platform for healthcare practitioners. However, it faces several fundamental security and privacy challenges, such as secure fine-grained data delivery, privacy preserving keyword-based ciphertext retrieval, malicious key delegation, and efficiency of the system. To combat these issues, we propose a privacy-aware and traceable fine-grained system (PTFS) for secure data delivery in cloud-assisted HealthIIoT. Compared to the existing solutions that only implement some of the preceding features, the proposed solution enables secure fine-grained data delivery, privacy-preserving data retrieval, efficient encryption and decryption operations, and trace of malicious key delegation simultaneously. For security analysis, rigorous proofs of the proposed scheme are provided to prove its security. In addition, extensive simulations and experiments are conducted for performance evaluation, which demonstrate the feasibility and effectiveness of PTFS.

Recently in the IEEE Transactions on Dependable and Secure Computing (doi: 10.1109/TDSC.2019.28976752019), Miao et al. proposed a novel construction of Privacy-Preserving Attribute-Based Keyword Search in Shared Multi-owner Setting (ABKS-SM), which can delegate keyword search tasks to cloud server provider (CSP) without revealing any useful information. Although the authors claimed that the offline keyword guessing attacks can be resisted in ABKS-SM scheme, we show that this scheme indeed suffers from four types of offline keyword guessing attacks and hence fails to gain the claimed security property, which is an important goal to be achieved in searchable encryption schemes. Specifically, given the concrete attacks, we demonstrate that the underlying keyword information can be extracted from both encrypted keyword indexes and trapdoors by any malicious user and any adversarial CSP. We hope that the similar security vulnerabilities could be avoided in the future design of related searchable encryption schemes.

The Internet of Things (IoT), recognized as one of the major technological revolutions in the century, is deployed and used today sociality. The related security issues are taken into account by the academia and industry. Recently, an online/offline certificateless signature scheme (OO-CLS) proposed by Saeed et al. is used to construct a heterogeneous remote anonymous authentication protocol (HRAAP) in wireless body area networks based on the IoT. However, in this article, we show that the scheme is vulnerable to the forgery attack which is not necessary to know any information except public system parameters. Furthermore, we show that the sensor node can generate the partial private keys and secret values of other sensor nodes after it obtains its partial private key. This causes that the HRAAP is also insecure. Finally, we improve the OO-CLS and analyze the security of our improved scheme.

With the booming of Internet of Things (IoT), smart health (s-health) is becoming an emerging and attractive paradigm. It can provide an accurate prediction of various diseases and improve the quality of healthcare. Nevertheless, data security and user privacy concerns still remain issues to be addressed. As a high potential and prospective solution to secure IoT-oriented s-health applications, ciphertext policy attribute-based encryption (CP-ABE) schemes raise challenges, such as heavy overhead and attribute privacy of the end users. To resolve these drawbacks, an optimized vector transformation approach is first proposed to efficiently transform the access policy and user attribute set into respective vectors of shorter length while other approaches result in redundant and longer vectors. Our transformation approach can greatly relieve the costly overheard of key generation, encryption, and decryption phases. Then, based on the transformation approach and the offline/online computation technology, we propose a lightweight policy-hiding CP-ABE scheme for the IoT-oriented s-health application. With our proposed scheme, data users in the s-health system can perform lightweight encryption and decryption without leaking any sensitive privacy about the attributes of the user. Finally, the formal security analysis, the theoretic performance evaluation and experiment results indicate that the solution is secure and efficient.

Existing server-aided attribute-based signature (SA-ABS) to secure industrial Internet of Things (IIoT)-oriented applications raise challenges such as achieving collusion attack resilience and realizing expressive linear secret-sharing scheme (LSSS) access structures. In this paper, we positively address these challenges by proposing a novel SA-ABS for IIoT. Distinct from the existing works in this field, our SA-ABS protocol not only allows to delegate the heavy calculation in both signature generation and verification to a third-party server, but also resists the collusion attack and realizes expressive LSSS access structures. The formal proof about the unforgeability of the proposed SA-ABS has been given on the basis of the standard model. Theoretical analysis as well as experimental simulation reveal the fact that the proposed SA-ABS is feasible and efficient.