Abstract To date, machine learning models have been widely applied to intrusion detection system (IDS) for improving detection accuracy, where most IDS suffer from adversarial evasion attacks that may lead to data loss and user privacy leakage. Although there have been numerous solutions proposed against adversarial evasion attacks, they often neglect the relationships between different traffic and heavily relied on data labels. Therefore, this paper proposes AEDGNN, a new approach for detecting adversarial evasion attacks using graph neural network (GNN) model. On one hand, AEDGNN employs E-GraphSAGE to capture network topology in IDS for building the relationship between different inputs. On the other hand, AEDGNN utilizes deep graph infomax (DGI) to train the GNN in a self-supervised manner for maximizing mutual information between local and global representations. In addition, to clarify the practical performance of defending against traditional adversarial attacks, we implement AEDGNN and classic machine learning models based on CIC-IDS2018 benchmark dataset. The experimental results show that AEDGNN achieves significant improvements on both normal and adversarial samples compared to classic solutions. The accuracy of AEDGNN is 0.02%–1.53% higher than that of classic solutions for normal samples, and 26.04%–59.04% higher for adversarial samples.

Existing secret sharing-based secure aggregation protocols suffer from high overhead and inflexibility in handling dynamic clients. To address these issues, this paper introduces AnniMask, an efficient and dynamic secure aggregation protocol. By replacing conventional secret sharing with a double-point annihilation function for mask generation, AnniMask reduces the state-of-the-art aggregation overhead fromO(nlog2n) in computation andO(nlogn) in communication to linear. Moreover, the protocol achieves linear complexity for handling dynamic clients, representing a progressive improvement over previous approaches. Crucially, AnniMask remains robust under arbitrary client dropout rates, whereas the tolerance of existing masking schemes is fundamentally limited by their secret sharing threshold. Formal security analysis proves that AnniMask provides stronger resilience against collusion attacks while ensuring privacy and integrity. Comprehensive experimental results demonstrate that AnniMask achieves superior efficiency while maintaining high model accuracy, showcasing its robustness even under a client dropout rate as high as 90%.

The large-scale deployment of Internet of Things (IoT) devices continuously generates spatio-temporal sensing data associated with time and location, which promotes the demand for privacy-preserving range-aggregate queries over such data. However, existing range-aggregate queries for IoT data only support aggregate computations over a single dimension, and fail to perform verification over range query result and aggregate computation. In this paper, we present VeriMIRA, a privacy-preserving range-aggregate query system over spatio-temporal IoT data with multidimensional numerical attributes. Technically, for range queries over outsourced spatio-temporal IoT data, we introduce new primitives of spatio-temporal prefix encoding (STPE) and verifiable and searchable spatio-temporal EF-Tree (VSEF-Tree), and combine improved symmetric homomorphic encryption (iSHE).For aggregate computation over multidimensional attributes, we introduce a new primitive of multi-client functional encryption with verifiable aggregation for inner product (VA-MCFE). By employing VSEF-Tree and VA-MCFE, the results of both range query and aggregation computation can be efficiently verified. In addition, we present security analysis on the introduced new primitives and VeriMIRA. Finally, we conduct extensive experiments, and evaluate the performance of existing solutions and VeriMIRA over a real-world dataset, which demonstrates practical computation and communication overhead for spatio-temporal range-aggregate queries. With sacrificing only 20% overhead in the data outsourcing stage, VeriMIRA achieves 70% time savings over state-of-the-art range-aggregate query approaches at 20,000 aggregations, while providing range-aggregate verification property.

Proof of Aliveness (PoA) has emerged as a useful cryptographic concept for periodically ascertaining the operational status (aliveness) of devices, especially for those in cyber-physical systems. However, existing PoA schemes exhibit shortcomings stemming from intermittent aliveness proofs and a lack of resilience against the threats caused by malicious verifiers. Motivated by this, we introduce a new security notion called Proof of Persistent Aliveness (PoPA), which encompasses two new properties: persistent aliveness (PAlive) and audit (Audit). Our PAlive strengthens prior work by addressing the security concerns associated with generating persistent aliveness proofs in a continuous time manner, while Audit covers the threats posed by malicious verifiers. To efficiently realize PoPA, we developed two new building blocks: a deterministic hash-based Proof of Work (HPoW) scheme and private tweakable hash (PTH) functions. Using these primitives, we propose a scalable and lightweight PoPA construction, named SPAC, which is provably secure in our PoPA model without relying on random oracles. SPAC leverages HPoW and a customized authenticated credential structure that employs a variant of the Winternitz one-time signature scheme derived from PTH, enabling unlimited aliveness proofs with very small proof size. Over 93% of aliveness proofs are 84 bytes in size, with the worst-case proof size being only 372 bytes.

Federated learning (FL) is a paradigm that ensures the confidentiality and accessibility of data without requiring the collection of private data from multiple sources. It acquires an aggregation model by integrating various local models from clients. However, clients are vulnerable to numerous security and privacy threats. Existing solutions were unable to implement training models that are both dropout-resilient and lightweight while also providing verification capabilities when large-scale clients are involved in federated training. To improve the usability of FL, we propose a verifiable and lightweight multi-round secure FL framework by designing and incorporating a double-masking mechanism to ensure secure transmission. Moreover, we optimize the secure aggregation strategy by designing a dropout-resilience method via the secret-sharing mechanism. Specifically, we establish a lightweight model-secure training scheme and provide a parameter reuse strategy by constructing a full connection graph, which reduces computational cost and communication overhead. Furthermore, we propose a secure authentication protocol that enables the client to verify the accuracy of the computing results from the server. Extensive experimental evaluations indicate that our solution demonstrates relatively modest performance but superior functionality compared to current state-of-the-art methods. In particular, we can achieve the verification function with an acceptable increase in computational cost of approximately 200ms per epoch.

With the rapid advancement of cloud technology, ciphertext-policy attribute-based encryption (CP-ABE) schemes are highly suited to cloud storage environments. In order to protect sensitive information, policy-hidden CP-ABE has garnered significant attention. However, these schemes are vulnerable to fake policy attacks, where an attacker may introduce false policy and leak system information. To address this issue, we propose a traceable and revocable CP-ABE scheme with policy authentication (TR-PA-ABE). This scheme incorporates a policy checker, which is able to verify whether a ciphertext is encrypted under the correct access policy without revealing any confidential information. Additionally, it features a traceability mechanism that leverages white-box tracing to identify users who leak their keys by embedding user identities within their attribute keys. Our direct revocation method efficiently updates ciphertexts associated with revoked users without impacting the keys of other users, thus minimizing computing overhead. We formally prove that TR-PA-ABE is indistinguishable secure under chosen plaintext attacks (IND-CPA) based on the decision parallel$q$-bilinear Diffie-Hellman exponent assumption. Furthermore, our performance evaluation illustrates the practicality and efficiency of TR-PA-ABE.

Voiceprint verification has been widely adopted in daily applications due to its convenience and efficiency. However, the latent representations extracted during speech verification often encode sensitive personal information, such as emotion and gender, which raises significant privacy concerns. Existing methods mainly focus on protecting predefined sensitive attributes, but in many cases, the attributes that attackers are interested in are unknown to defenders. To address this limitation, we propose the Speech Information Bottleneck Network (SIBNet), a framework for representation level privacy enhancement based on information theoretic approaches. SIBNet differs from existing speech attribute privacy mechanisms in three key respects: (1) We formulate biometric privacy protection as an Information Bottleneck (IB) optimization problem that balances identity utility and sensitive attribute suppression. (2) SIBNet leverages a variational distribution parameterized by neural networks to approximate mutual information, enabling the derivation of lower bounds for effective model optimization. (3) An additive angular margin penalty is introduced into the speaker classification loss to promote discriminative embeddings and preserve identity utility. Experiments on public speech datasets demonstrate that SIBNet significantly outperforms state of the art methods in both biometric recognition accuracy and suppression of sensitive soft biometric attributes.

Digital and physical identity authentications are often implemented concurrently to meet strict access control for online services. Although privacy-preserving digital credentials provide strong guarantees such as anonymity and minimal disclosure, these benefits are compromised if holders must simultaneously present physical identification (e.g., government issued IDs) to establish ownership. To securely bind digital credentials to their physical holders while preserving privacy, a new protocol called card-based anonymous credentials (cbAC) was proposed by Hesse et al. (USENIX Security'23). However, this approach faces two significant drawbacks: the size of the communication during credential presentation scales linearly with the number of disclosed attributes, and it lacks revocability, which is essential for internal governance, including identity management and accountability. In this paper, we bridge the above gap by first introducing a constant-size two-party proof of knowledge protocol in asymmetry settings, where there exists a disparity in storage and computational resources between the two parties. Furthermore, building upon this two-party proof of knowledge protocol and utilizing signatures with randomizable keys, we meticulously design a cbAC scheme that is both efficient and capable of supporting revocation. We formalize all notions and conduct a rigorous security proof of the proposed construction. Finally, we present benchmarks from our implementation to illustrate the better than-state-of-the-art performance and features of our solutions.

Privacy-preserving social graph search allows the retrieval of relationships within social networks while not com promising individuals' private information. Although numerous solutions enable conjunctive queries for relationships on encrypted social networks, the multi-client model is neglected despite its crucial role in collaborative data sharing, and personalized recommendations. In this paper, we present AuthGraph, a privacy-preserving and conjunctive social graph search system with trusted hardware in the multi-client (i.e., multi-writer/multi reader) model. In AuthGraph, a data owner delegates update rights to writers for maintaining dynamic social relationships, while readers are allowed to perform edge-weighted conjunctive queries via writer-enforced access policy. Technically, AuthGraph builds a multi-writer/multi-reader model with access control delegation for writers via a set-constrained pseudo-random function, and uses attribute-based encryption to configure authorizations for readers. To give a provably secure conjunctive search system over a dynamic social graph database, AuthGraph revisits oblivious dynamic cross tag protocol via providing comprehensive forward privacy and Type-O backward privacy. Different from previous solutions, in AuthGraph, the semi-black-box deployment of trusted hardware effectively ensures system security while maintaining performance. Finally, we demonstrate the performance of AuthGraph through extensive experiments on real social network datasets on AliCloud, revealing that the writer enforced access policy has minimal impact on search time cost.

The security of distributed systems, especially blockchain-based applications, relies heavily on threshold signature protocols to maintain decentralization. Identifiable aborts are critical in these protocols, enabling detection and attribution of malicious behavior. However, existing threshold EdDSA schemes with identifiable aborts often rely on zeroknowledge proofs, which significantly increase computational overhead. Additionally, these schemes suffer from inefficient abort handling and difficulty defending against DDoS attacks targeting abort mechanisms. Furthermore, weighted threshold signature schemes frequently encounter weight centralization, where high-weight participants dominate decision-making. In this paper, we propose a threshold EdDSA protocol, named EdFROST, which is unforgeable and supports identifiable aborts under a chosen-message attack (IA-CMA), based on FROST3 proposed by Ruffing et al. (ACM CCS '22). Leveraging EdFROST, we present the first weighted threshold EdDSA scheme that considers both the number of participants and arbitrary weight distribution to mitigate the risk of weight centralization. We also design a game-theoretic incentive model, implemented via tamper-proof chaincode, achieving rational identifiable aborts with a unique sequential equilibrium. This model incentivizes honest behavior to maximize individual benefits while ensuring efficient abort handling and resisting DDoS attacks targeting IA. Experimental results demonstrate that the EdFROST and chaincode are efficient and lightweight, making them well-suited for large-scale distributed systems.

Dynamic searchable symmetric encryption (DSSE) allows a client to update and retrieve its encrypted database stored on a server. To enable the database contributed by multi-writers to be searched by multi-readers, the multi-writer/multi-reader model is explored for DSSE (M/M-DSSE). Recently, FP-HSE (USENIX Security'22) and FP-MSE (TDSC'24) employed key aggregation methodology to introduce writer-selection property for M/M-DSSE, where a reader uses a single aggregate key to search the database containing selective writers. However, they neglected the reader-selection property where a writer selects which readers can search its data, and only supported single-keyword search. In this paper, we present BiMM, a conjunctive M/M-DSSE scheme with bilateral selection that simultaneously supports writer-selection and reader-selection properties. Additionally, BiMM achieves forward privacy (FP) for both server and client, and Type-O backward privacy (BP). Technically, we introduce a new primitive called bilateral key-aggregate encryption (Bi-KAE) that refines KAE via distributed key generation, by which both writers and readers can specify their selections. Based on ODXT (NDSS'21) that provides conjunctive queries while achieving FP with server and BP, we introduce double-blinded values to match all update records for the search keywords and additionally use the 0/1-Encoding technique to consider FP with client. Besides presenting formal security analysis for BiMM, we also conduct extensive experiments over public datasets on a real cloud server environment. The experiment results demonstrate that BiMM achieves practical performance for desired properties. With #keyword = 50 and #s-term = 10 for conjunctive queries, BiMM runs 6.34× faster than Nomos (AsiaCCS'24) which does not consider either writer-selection or reader-selection.

Anonymous credentials are ideal for decentralized systems like blockchains, as they enhance privacy, security, and regulatory compliance while maintaining flexibility and adaptability. These decentralized systems often require features such as weighted threshold issuance and tracing for elasticity of decision-making, fine-grained blindness for user privacy control, and issuer-hiding to reduce potential external threats. However, the latest advancements in anonymous credential schemes cannot meet all of these essential properties for blockchain systems. To address these challenges, we propose weighted threshold anonymous credentials with redactable fine-grained blind signature (WTAC). Firstly, by leveraging unlinkable redactable signatures (URS) and functional encryption techniques, our redactable fine-grained blind signature supports selective disclosure and permits credential issuers to learn a particular function value related to the attributes during issuance without revealing the actual attribute content. Secondly, we utilize weighted ramp secret-sharing (WRSS) and randomizable signatures to achieve weighted threshold anonymous credentials, which are issuer-hiding to both users and verifiers. Moreover, we provide a concrete construction instantiated by the Fiat-Shamir paradigm and demonstrate its application, a privacy-preserving auditable lending system in blockchain scenarios, achieving the integration of user privacy and regulatory compliance. Finally, we give a formal security proof of anonymity, fine-grained blindness, traceability, non-frameability, and issuer-hiding. Performance evaluation shows the practicability and efficiency of our proposed WTAC.

Anonymous authentication mechanisms play an increasingly critical role in digital ecosystems by enabling users to prove eligibility without revealing identity information. Anonymous tokens serve as fundamental cryptographic primitives for privacy-preserving access control. However, existing solutions often rely on trusted hardware or suffer from centralization issues, such as single points of failure (SPoF) and strong trust assumptions, to enforce non-transferability. In this work, we construct a threshold BBS+ signing protocol using verifiable multiplication-to-addition (MtA) techniques derived from vector oblivious linear evaluation (VOLE). The security of the proposed threshold signature scheme is rigorously established within the Universal Composability (UC) framework. Building upon this foundation, we introduce the first threshold-authorized and threshold-redeemable, and non-transferable anonymous tokens named T3AT. T3AT enables collaborative issuance and verification in the malicious adversary and dishonest majority settings while achieving non-transferability, unlinkability, and unforgeability without relying on trusted hardware or centralized authorities. Our performance evaluation demonstrates the practicality, efficiency, and scalability of T3AT, effectively bridging the gap between anonymous tokens and threshold-based authorization and authentication for privacy-enhanced access control.

Anonymous tokens (AT) have emerged as a critical tool for privacy-preserving authentication. However, state-of-the-art systems face two principal technical limitations: the risk of token transferability, which compromises accountability, and reliance on centralized issuers, which introduces a single point of failure. To address these limitations, we present the first construction of a non-transferable anonymous token system with decentralized issuance (D-NTAT). In particular, our construction supports a dynamic set of issuers, empowering users to obtain tokens by interacting with any subset of the current issuers. The token is publicly verifiable, unlinkable to the issuance process, and, most importantly, non-transferable, even though it is redeemed anonymously. To accomplish this objective, we formalize the notions of D-NTAT, provide a specific construction of a set of protocols from which variants offering enhanced functionalities can be derived, and rigorously prove their security properties. Finally, a proof-of-concept implementation is presented to evaluate their efficiency, which is crucial for blockchain applications such as electronic voting.

The ubiquitous sensing capabilities of the Internet of Things (IoT) enable large-scale user tracking by identifying users who appear in at least t distributed location datasets. However, the distribution of these datasets across multiple tracking entities significantly increases the risk of sensitive data exposure. To address this problem, threshold multi-party private set intersection (T-MPSI) provides a promising privacy-preserving solution. Although the known works about T-MPSI have made valuable contributions, especially in terms of security, the efficiency deficiency in current T-MPSI protocols becomes apparent in large-scale deployment for user tracking. The core challenge is to develop an efficient T-MPSI protocol under the relaxed security constraint that is acceptable for user tracking. We first design a lightweight batch replicated secret sharing private membership test protocol with high performance. Moreover, we develop a one-round secure aggregation algorithm that bridges the gap between the secure query and the secure comparison built upon replicated secret sharing. Building on these techniques, we present an efficient T-MPSI protocol tailored to the designated k-collusion model. Our protocol significantly enhances secure query efficiency and ensures that the communication complexity of secure comparison remains independent of the number of parties. We formally prove its security, and extensive experiments in a LAN setting demonstrate at least a 6× speedup for secure query and a 3× speedup for secure comparison over the state-of-the-art protocol. These results confirm the practicality and efficiency of the proposed protocol for privacy-preserving user tracking.

In recent years, cloud computing has seen widespread application in 6G-enabled smart healthcare, which facilitates the sharing of medical data. Before uploading medical data to cloud server (CS), numerous data sharing schemes employ attribute-based encryption (ABE) to encrypt the sensitive medical data of data owner (DO), and only provide access to data user (DU) who meet certain conditions, which leads to privacy leakage and single points of failure, etc. This paper proposes a blockchain-enhanced anonymous data sharing scheme for 6G-enabled smart healthcare with distributed key generation and policy hiding, termed BADS-ABE, which achieves secure and efficient sharing of sensitive medical data. BADS-ABE designs an anonymous authentication scheme based on Groth signature, which ensures the integrity of medical data and protects the identity privacy of DO. Meanwhile, BADS-ABE employs smart contract and Newton interpolation to achieve distributed key generation, which eliminates single point of failure due to the reliance on trusted authority (TA). Moreover, BADS-ABE achieves policy hiding and matching, which avoids the waste of decryption resources and protects the attribute privacy of DO. Finally, security analysis demonstrates that BADS-ABE meets the security requirements of a data sharing scheme for smart healthcare. Performance analysis indicates that BADS-ABE is more efficient compared with similar data sharing schemes.

In NDSS 2024, Yu et al. proposed AAKA, an Anonymous Authentication and Key Agreement scheme designed to protect users' privacy from mobile tracking by Mobile Network Operators (MNOs). AAKA aims to provide both anti-tracking privacy and traceability (lawful de-anonymization), allowing subscribers to access the network via anonymous proofs while enabling a Law Enforcement Agency (LEA) to trace the real identity if misbehaviors are detected. However, we identify that the AAKA scheme in NDSS 2024 is insecure since the subscriber's identity is exposed within the protocol, thereby failing to achieve the claimed privacy and traceability. Building on the repair of AAKA, we propose AAKA +, Anonymous Authentication and Key Agreement with Verifier-Local Revocation, a new mobile authentication scheme, to ensure privacy against mobile tracking. In addition to the privacy and traceability introduced in NDSS 2024, AAKA + additionally allows the MNO to immediately assert whether the associated subscriber has been traced and revoked upon receiving an anonymous proof We formally define the syntax and the security model of AAKA + and propose two concrete schemes, AAKA+BB andAAKA+PS, based on the Boneh-Boyen signature and the Pointcheval-Sanders signature schemes, respectively. Both AAKA+BB and AAKA+PS are pairing-free on the user equipment side and compatible with existing cellular infrastructure. Experimental results show that our schemes are practical, with anonymous proof generation taking approximately 18 milliseconds for a constrained device.

With the growth of large-scale multimodal data and advancements in neural networks (NNs), cross-modal retrieval (CMR) relies on outsourced computation for efficiency and scalability. Existing privacy-preserving CMR approaches under the fully outsourced setup typically employ traditional machine learning models or simple NNs due to the limitations of privacypreserving techniques. It results in significant performance gaps in efficiency and accuracy compared to plaintext CMR. In this paper, we present PP-DACMR, a privacy-preserving deep adversarial hashing approach for cross-modal retrieval. With the paradigm of secure two-party computation, PP-DACMR employs a lightweight technique, additive secret sharing (ASS), to safeguard multimodal data and NNs. A series of ASS-based protocols are designed specifically for CMR based on GAN architecture, supporting in-the-cloud training and querying. Moreover, we optimize two generic secure arithmetic protocols for truncation and matrix multiplication, which are fundamental to PP-DACMR, contributing to improved performance. We conduct experimental evaluations over real-world multimodal datasets and compare PP-DACMR to the state-of-the-art approach PPCMR. The results demonstrate PP-DACMR outperforms PPCMR, achieving an improvement on the average mAP of 11.73% and being 5.3× faster.

Easily Deployable and Efficiently Searchable Encryption (EDESE) is a cryptographic primitive designed for practical searchable applications, offering efficient search and easy deployment. However, it remains vulnerable to Leakage-Abuse attacks, allowing adversaries to exploit keyword-matching processes to extract sensitive information. To address these vulnerabilities, we introduce Leakage-Resilient EDESE (LR-EDESE) with k-indistinguishability and controlled leakage functions. We then propose Volume Leakage-Resilient EDESE (VLR-EDESE), a new scheme to protect against both query and document volume leakage. Our experimental results demonstrate that at k = 5000 (maximum security setting), VLR-EDESE incurs an overhead of 63× compared to the baseline EDESE without leakage protection, outperforming state-of-the-art methods with 320× and 97× overhead, respectively. For smaller k values (10, 20, 50, 100), storage and communication overhead remain within 2× and 2.5× of the baseline EDESE, highlighting VLR-EDESE's flexibility. Finally, we present CloudSec, an implementation of VLR-EDESE that seamlessly integrates with cloud storage platforms, using OneDrive as an example.

The sharing of electronic medical records (EMRs) significantly enhances disease research and healthcare system efficiency. However, outsourcing EMRs to cloud servers introduces risks such as tampering and malicious propagation by recipients. Existing solutions combining blockchain and universal designated verifier signature proofs (UDVSPs) mitigate these risks but rely on secure channels for key sharing, adding communication and computation costs that hinder deployment. In this article, we introduce the first secure channel-free universal designated verifier signature proofs (SCF-UDVSPs) scheme, leveraging simplified cryptographic techniques like the$\Sigma $-protocol and public key encryption. Integrating SCF-UDVSP with blockchain, we develop an optimized EMR sharing system that effectively prevents these attacks, including tampering and malicious propagation. Security proofs and performance analysis validate the feasibility and effectiveness of our proposed system. Compared to existing UDVSP solutions, our approach reduces computational costs by approximately 59.3% without increasing communication overhead, while also eliminating the need for establishing a secure channel.

Many businesses are putting their sensitive data in the cloud with the fast growth of cloud computing and storage. To ensure user privacy, it is necessary to keep encrypted data only in the cloud. Attribute-based encryption (ABE) is a popular mean in cloud storage scenarios. ABE is not only faced with key escrow problem but also suffers from user revocation issue when he or she is no longer authorized to access to encrypted data. In order to address these two issues, we propose a revocable registered attribute-based encryption scheme, which not only avoids key escrow problem but also supports precise revocation of a user’s access to a file as well as permanent deregistration of a user from the system. Furthermore, we prove the semantic security of the scheme and conduct a performance experiment to show the efficiency.

Industrial Internet of Things (IIoT) processes industrial information anytime and anywhere by deploying smart devices, which inevitably confronts with potential challenges for access control and secure authentication issues. Attribute-based signature (ABS) utilizes a collection of attributes instead of the user’s identity to achieve identity authentication, which supports anonymous access control, data integrity and nonrepudiation. However, ABS schemes exist inherent key escrow problem because all users’ private keys are generated via key authority. In addition, most ABS schemes use time consuming pairing operations, which is unsuitable for resource-constrained IIoT devices. To solve above problems, we present a key escrow-free ABS scheme and utilize server-aided technology to run most of pairing operations in the verification phase, which reduces computation overhead in recursive algorithm based on tree. Furthermore, we utilize tree-based access policy to implement flexible access control. We design a key distribution protocol. By executing this protocol, the key authority cannot derive a whole private key independently without no user’s secret value, which solves key escrow problem. We demonstrate that the presented scheme is existentially unforgeable under adaptive chosen-policy attack in the standard model. Performance analysis shows that the designed scheme is more efficient compared with the existing ABS schemes.

Mobile cloud storage enables IoT devices to use on-demand resources and share data with different mobile devices, where these outsourced data on the cloud are encrypted due to data confidentiality concern. Although dynamic searchable symmetric encryption (DSSE) allows data owners to directly search and update its encrypted data, it rarely considers implementing authorized search toward different mobile devices. Existing authorized keyword search systems for mobile cloud storage suffer from the following limitations: 1) only achieves Type-III backward privacy; 2) no support for verification of search result; and 3) incurs high time overhead for data update and search. Therefore, we propose$\textsf {VE}{-}\textsf {FLY}{++}$, an efficient, verifiable, and authorized DSSE system with forward and enhanced backward privacy for mobile cloud storage. Technically,$\textsf {VE}{-}\textsf {FLY}{++}$presents a verifiable inverted bitmap index (VIBI) to achieve forward privacy and enhanced Type-I (a.k.a.,$\textrm {Type-I}^{-}$) backward privacy, with supporting verification of search results. In addition, we combine symmetric encryption with homomorphic addition with the introduced VIBI for a fast authorized search function. To further enable efficiently handling hundreds of millions of files, we adopt chunking technology to present a highly scalable$\textsf {VE}{-}\textsf {FLY}{++}$. Finally, we use Raspberry Pi, Rock Pi, and Huawei Cloud on real datasets to conduct extensive experiments to clarify the practical efficiency of$\textsf {VE}{-}\textsf {FLY}{++}$.

In the cloud-assisted Industrial Internet of Things (IIoT), flexible and secure data sharing promotes industry processes optimization and new products making. To enable selective data retrieval over categorized data collected by IoT devices in the encryption domain, key-aggregate searchable encryption (KASE) is adopted for group data sharing in IIoT due to efficient management of encryption keys. Nonetheless, existing solutions rarely consider user revocation property and suffered from the following limitations: 1) the user revocation needs interaction process between data owner and cloud and 2) the nonrevoked users may be accidentally revoked. Therefore, we propose a blockchain-based revocable KASE system (BC-RKASE) that achieves noninteractive user revocation and trusted revoked user management. Technically, the result is nontrivially obtained from revisiting the generation of aggregate keys and key updates via secret sharing, along with redesigning trapdoor adjustment and providing public verifiable proof for key updates by public blockchain. Besides formal security analysis, we conduct extensive experiments in a real cloud environment and thin IoT devices (Raspberry Pi) using a public IIoT dataset to confirm the practical performance of BC-RKASE. In particular, BC-RKASE outperforms state-of-the-art schemes with$13.4{\times {\sim }}15\times $time efficiency accelerating for data retrieval and runs more than$16\times $faster for user revocation.

In the realm of secure data outsourcing, verifiable dynamic searchable symmetric encryption (VDSSE) enables a client to verify search results obtained from an untrusted server while protecting the data privacy. Nevertheless, the storage cost of verification structure in some schemes escalates linearly with the number of keywords, and the generation of proofs demands a substantial number of exponentiation operations. Moreover, some schemes overlook forward and backward security in the dynamic database. In this article, we introduce FB-VDSSE, an advanced VDSSE scheme that ensures both forward and backward security. Specifically, we introduce an efficient accumulation commitment verification structure (AC-VS) that attains a commitment verification value with a constant-size storage cost. Based on the AC-VS, we further propose a forward and backward secure VDSSE scheme. Within this scheme, the server exclusively generates a membership proof at the corresponding index of the vector, reducing the computation cost associated with the search operation. Finally, we provide the security proof and functional comparison, demonstrating that our scheme effectively ensures forward security, backward security, and verifiability. Additionally, the experimental evaluations underscore the efficiency of our scheme, showcasing its superior performance compared to relevant schemes in practical scenarios.

Verifiable searchable encryption (VSE) not only allows the client to search encrypted data, but also allows the client to verify whether the server honestly executes search operations. Currently, VSE scheme has been widely studied in cloud storage. However, most existing VSE schemes did not hide the access pattern and volume pattern, which respectively refer to the document identifiers and the number of documents matching the queried keywords. Recent studies have exploited these two patterns to launch attacks on searchable encryption schemes, resulting in compromising the confidentiality of encrypted data and queried keywords. In order to solve above issues, we utilize additively symmetric homomorphic encryption scheme and private set intersection protocol to construct a VSE scheme that supports conjunctive keyword search and hides the access pattern and volume pattern (i.e., response-hiding and volume-hiding). Our security model assumes that the server is malicious in the sense that it might deliberately carry out incorrect search operations. Formal security analysis demonstrates that our scheme achieves the desired security properties under our leakage function. Compared to previous schemes, our scheme has advantages in terms of performance and functionality. In an experimental setup with a security parameter of 128 bits and$2^{23}$keyword/document pairs, the search time is approximately only 7.18 seconds.

Soft-biometric privacy-enhancement methods are widely used in face recognition systems to prevent attackers from inferring soft-biometric attributes (e.g., gender, age, and race). However, existing methods typically focus on either representation-level or image-level privacy protection. In this paper, we propose a novel Face Conditional Privacy Funnel Network (Face-CPFNet), a dual-level privacy-enhancement framework with three key innovations. First, it introduces a dual-level privacy protection system where attackers receive reconstructed face images by combining the random guess of the sensitive attribute's potential label with the face representation provided by the user. Second, we propose the Face-CPF optimization problem, based on the Conditional Privacy Funnel (CPF) and an additional information leakage constraint. A deep variational approximation approach with parameterized deep neural networks is used to solve this problem and develop the Face-CPFNet model. Third, it enables supervised disentangled representation learning for reconstructing face images with variations in generative factors, and further enhances privacy protection by introducing an information leakage constraint when the sensitive attribute is a discrete binary random variable. Experimental results on benchmark datasets indicate that Face-CPFNet strikes a more effective balance between face verification accuracy and soft-biometric privacy compared with existing SBPE and CPF models.

Fueled by its successful commercialization, the recommender system (RS) has gained widespread attention. However, as the training data fed into the RS models are often highly sensitive, it ultimately leads to severe privacy concerns, especially when data are shared among different platforms. In this paper, we follow the tune of existing works to investigate the problem of secure sparse matrix multiplication for cross-platform RSs. Two fundamental and critical issues are addressed: preserving the training data privacy and breaking the data silo problem. Specifically, we propose two concrete constructions with significantly boosted efficiency. They are designed for the sparse location insensitive case and location sensitive case, respectively. State-of-the-art cryptography building blocks including homomorphic encryption (HE) and private information retrieval (PIR) are fused into our protocols with non-trivial optimizations. As a result, our schemes can enjoy the HE acceleration technique without privacy trade-offs. We give formal security proofs for the proposed schemes and conduct extensive experiments on both real and large-scale simulated datasets. Compared with state-of-the-art works, our two schemes compress the running time roughly by$10\times$and$2.8\times$. They also attain up to$15\times$and$2.3\times$communication reduction without accuracy loss.

Many network middleboxes have been deployed to performdeep packet inspection(DPI) over packet payloads. However, such middleboxes cannot accomplish their tasks when the traffic is encrypted.BlindBox(SIGCOMM 2015) provided the first solution for performing DPI over encrypted traffic. To improve its efficiency, a later proposalPrivDPI(CCS 2019) introduced a practical technique to generate encrypted rules. However, a recent proposalP2DPI(ASIACCS 2021) showed that the rule generator in PrivDPI can comprise the user's privacy. In this paper, we present a new attack on P2DPI and show that the privacy of its endpoints can still be compromised by the rule generator. We comprehensively analyze the vulnerability of prior studies and presentPrivBox, a new DPI system that achieves the same privacy guarantee as BlindBox while maintaining practical efficiency. This is based on a new technique calleddual double-masking obfuscated rule generation. For a ruleset of 3,000, PrivBox achieves connection establishment time on the endpoint side comparable to PrivDPI and supports up to 4,672 token encryptions per second, which is sufficient for a number of real-world applications. Overall, our experiment demonstrates that PrivBox is practical and well-suited for short, frequently established sessions, especially when token repeating is common.

Sparse inner product (SIP) has the attractive property of overhead being dominated by the intersection of inputs between parties, independent of the actual input size. It has intriguing prospects, especially for boosting machine learning on large-scale data, which are tangled with sparse data. In this paper, we investigate privacy-preserving SIP problems that have rarely been explored before. Specifically, we propose two concrete constructions, one requiring offline linear communication, which can be amortized across queries, while the other has sublinear overhead but relies on the more computationally expensive tool. Our approach exploits state-of-the-art cryptography tools including garbled Bloom filters (GBF) and Private Information Retrieval (PIR) as the cornerstone but carefully fuses them to obtain nontrivial overhead reductions. We provide formal security analysis of the proposed constructions and implement them into representative machine learning algorithms including k-nearest neighbors, naive Bayes classification, and logistic regression. Compared to existing efforts, our method achieves 2-$50\times$speedup in runtime and up to$10\times$reduction in communication.

Reputation-based authentication is a mechanism used to establish trust and ensure the reliability of vehicle communication in vehicular ad hoc networks (VANETs). However, existing schemes ignore the importance of privacy protection and face issues such as malicious vehicles spreading false or duplicate messages. To address these issues, this paper proposes a secure and anonymous reputation-based authentication scheme based on the ElGamal cryptosystem for the vehicular communication system, which promotes cooperative behavior and encourages vehicles' positive contribution to the network. In particular, we design an efficient duplicate detection mechanism based on the technique of Bloom filter to aid in identifying and isolating malicious vehicles. Security analysis is conducted to demonstrate the robust security of the proposed scheme. The results of performance evaluation highlight the superiority of the proposed scheme in addressing the identified shortcomings while maintaining reasonable computation and communication costs.

Cloud-assisted Internet of Things (IoT) is a new paradigm to compensate for the disadvantage of limited resources in IoT and extend the functional boundary of IoT. How to preserve the data privacy while identifying the data source in cloud-assisted IoT is a huge challenge and many cryptographic primitives such as matchmaking encryption (ME) are hence introduced to reach this goal. However, we observe that these tools fail to deal with some rigorous cases in which the data owner does not want anyone to disclose the entire data and even authorized users can only obtain a specified part. In this paper, to address such issue, we design a privacy-preserving data computing system with bilateral access control (PDCS-BAC) for cloud-assisted IoT based on a new primitive called identity-based matchmaking functional encryption (IB-MFE). We give the formal definition and security model of IB-MFE, then present two concrete IB-MFE schemes for inner-product function. Thus, PDCS-BAC manages to simultaneously provide flexible privacy computation with enhanced data privacy, bilateral access control, and data authenticity. Finally, we conduct comprehensive performance evaluations to demonstrate the practicability of our schemes for cloud-assisted IoT.

Due to the introduction of cloud computing in healthcare services, personal health records (PHRs) have being uploaded to cloud servers in increasing numbers. Since data confidentiality requirements exist, data owners should encrypt their PHRs in advance of transmitting them to a cloud server. Attribute-based encryption with keyword search (ABKS) technique ensures that the encrypted PHRs are able to retrieved by other data users whose attributes match access polices granted by data owners. However, access polices are public in most existing ABKS schemes, which can reveal sensitive information contained in PHRs. In this article, we provide an efficient ABKS scheme with policy hiding for PHRs that implements the following features. (1) The fine-grained access control is achieved where data owners can authorize which data users can retrieve encrypted PHRs. (2) The access policy is hidden to safeguard sensitive information from being leaked. (3) The costs of storage and computation do not grow linearly as the number of attributes increases. The security of the presented ABKS scheme is reduced to the truncated$q$-DABDHE assumption and the DDH assumption. Its performance is also demonstrated by our extensive simulation experiments.

Ample profits of GPU cryptojacking attract hackers to recklessly invade victims’ devices, for completing specific cryptocurrency mining tasks. Such malicious invasion undoubtedly obstructs normal device usage and wastes computation resources. To resist the threat of GPU cryptojacking, existing works aim to timely detect and clear away it, by distinguishing the dissimilitude between it and legitimate applications. However, these detection mechanisms inappropriately rely on two conflict cornerstones, manifested in leveragingmutable samples of illegitimate cryptojackingto designsupervision-based detection models requiring samples with stable patterns. This limitation compromises the practicability of existing detection mechanisms in the face of mutable cryptojacking samples. To fill the gap, we explore the superiority of unsupervised learning in handling this issue and further propose an unsupervised manner-enabled detection mechanism named MagInspector, only using legitimate applications’ magnetic signatures from GPU side channels for model construction. MagInspector innovates in training an unsupervised autoencoder network by an adversarial mode that well learns the stable signature patterns of legitimate applications, while incompatible with mutable cryptojacking ones. In the process of model training, we elaborately extract mutual energy cumulation distribution features to represent legitimate applications to overcome the impact of their inter-type differences. Meanwhile, a locality sensitive hashing-driven outlier removal algorithm is designed to enhance MagInspector’s robustness to the noise samples. Finally, extensive experiments are conducted on GPUs covering four generations of common NVIDIA architectures and two generations of AMD architectures; the results show that applying MagInspector to mutable cryptojacking signature detection achieves a significant average accuracy improvement of 25.5% and 17.8%, respectively.

Using side-effect sensing information to monitor the behavior of smartphone usage raises privacy leakage concerns. However, existing research typically utilizes only a single sensing channel or performs a simple aggregation of multi-channel data to infer user behavior, without sufficiently leveraging rich spatiotemporal information embedded in the diverse sensing channels. Such a narrow focus of existing works fails to exhibit the real risk of user privacy leakage. To bridge this research gap, we propose HiddenSpy, a comprehensive study assessing the smartphone usage snooping associated with multiple sensing channels, such as accelerometers and magnetometers. We start by examining the relationship between the data gathered from each channel and daily usage behaviors, highlighting information volume differences across channels. Building on this analysis, we propose a multi-layer attention mechanism that dynamically adjusts the importance of spatiotemporal information from different channels and time frames, facilitating the efficient use of multi-channel data for behavior inference. Importantly, our work marks a pivotal shift from addressing information leakage in single channels to managing information exposure throughout the smartphone sensing system, laying the foundation for more comprehensive protective measures. To validate our approach, we collect data from forty widely-used applications and evaluate the corresponding usage behavior snooping performance. The results show that HiddenSpy improves accuracy in three common snooping tasks, while its defense mechanism reduces accuracy to a low level, effectively preventing information leakage.

Secure cloud-edge data sharing has been researched recently to provide high quality on-demand data service. Attribute-based encryption (ABE) is a promising solution that achieves data confidentiality and flexible access control simultaneously. But three major issues remain when adapting ABE in cloud-edge, namely reliable user revocation, high performance on devices, and trust issues of public cloud. First, existing direct user revocation mechanisms focus on preventing a revoked user from decrypting header ciphertexts even when key exposure occurs, but ignore the payload security. Second, how to conveniently apply deployment on diverse platforms and run programs on resource-constrained devices with high efficiency is a challenge. Finally, no universal guarantee of cloud computation and management tasks, thus lazy or malicious cloud may not follow the protocol and perform improper actions on purpose. In this work, we propose a Hardware-Assisted Hybrid Fully Outsourced Revocable Attribute-Based Proxy Re-Encryption (H²O-RABPRE) scheme that supports reliable user revocation for full data traffic and hardware-assisted fully outsourced computation. Moreover, we design a hardware-assisted data-sharing framework with rapid deployment for cloud-edge, which integrates the developed SGX-MCL to protect outsourced tasks executed by cloud/edge devices against malicious behaviors and utilizes the enhanced WebAssembly runtime, WasmCrypto, a unified deployment approach for IoT devices with near-native performance. We implement the scheme on an SGX cloud server, a laptop, a Raspberry Pi, and an ESP32 board, and the results indicate that the proposed scheme is practical.

Remote data integrity auditing enables a client to efficiently ensure the integrity of entire data stored in untrusted servers via auditing. Yet, existing solutions generally emphasize on various metrics (such as minimal storage, fast update, metadata privacy), but not audit performance (e.g., low audit time, small proof size). To this end, a label-aggregating remote data integrity auditing scheme (LARDA) was proposed in ESORICS ’22, which is the state-of-the-art work in terms of proof size and storage cost. However, LARDA needs a trusted third party (TTP) for performing data auditing for all data owners, which introduces a single point of failure since the audit process routinely needs to interact with the TTP. To address this issue, we introduce a new concept called threshold label-aggregating data auditing and propose two novel schemes. Our first solution is based on Pedersen secret sharing technique, which can significantly alleviate the key escrow problem of LARDA. Our second solution is an efficient batch verifying scheme for multiple TTP’s secret key shares, utilizing the KZG (Kate, Zaverucha and Goldberg) secret sharing technique. This scheme can maintain the size of commitment for TTP’s secret key constant rather than a linear factor with the number of TTPs. We conduct comprehensive experiments to demonstrate the scalability of our schemes. In particular, our second scheme improves the verification time for TTP’s secret key shares in constant, only requiring two pairings and one exponentiation in group with an average of 7.39 ms, regardless of the number of TTPs increasing. For our first scheme, the verification procedure requires$2t$exponentiations in group (where t is the threshold value), ranging from 2.37 ms ($t = 2$) to 26.85 ms ($t = 35$).

Secure cloud storage is a prevalent way to provide data retrieval services, where users’ data are encrypted before uploading to the cloud. To effectively perform keyword searches over the encrypted data, the approach of searchable encryption (SE) was introduced. However, the leakage of the keyword-pair result pattern to the cloud could be exploited to reconstruct the queried keywords. To mitigate such information leakages, numerous result pattern-hiding SE systems were proposed but rarely supported data sharing with expressive queries and even owner-enforced authorization. Therefore, we present a result pattern hiding and authorized SE system (AXT) supporting conjunctive queries for cloud-based data sharing. Technically, we construct an authorized label private set intersection protocol from a refined authorized public key encryption with an equality test and then combine it with an introduced asymmetric variant of oblivious cross-tag protocol. Moreover, we introduce the system and security model of AXT along with rigorous security proof. Furthermore, we conduct comparative experiments between state-of-the-art solutions with AXT on HUAWEI Cloud platform under the widely recognized Enron dataset, which reveal that AXT achieves practical performance with retaining authorized data sharing and result pattern hiding, specifically, the time overhead for conjunctive queries with 10 keywords is reduced by 20$\%$.

The continuous development of mobile terminal applications, online maps, and other navigation services have become widely used, simultaneously giving rise to significant security risks. To address the issues of privacy leakage and low efficiency in traditional graph shortest path retrieval schemes, an efficient privacy-preserving graph shortest path retrieval scheme is proposed, called EP-GSPR. Specifically, this scheme addresses the privacy security problems in the existing graph shortest path retrieval solutions by ensuring the bilateral privacy protection of the user's query location and the database privacy of the cloud server. Throughout the retrieval process, the cloud server cannot obtain the user's location information, and the user cannot access any database information other than the retrieval results. To overcome the performance bottlenecks in existing schemes, a progressive iterative retrieval framework is designed as the fundamental modular, called Pirf, achieving sub-linear retrieval costs and low storage overhead on the cloud server side. Finally, the security analyses demonstrate the EP-GSPR scheme achieves the bilateral privacy-preserving in terms of user and server sides. The comprehensive experiment evaluations also state the efficiency and practicality of the proposed scheme

As a promising technology, key-aggregation searchable encryption with constant computation overhead is especially suitable for sensor nodes with limited computation resources in wireless sensor networks. However, in most of the existing key-aggregation searchable encryption schemes, the authorized aggregation key is generated in a deterministic way. As a result, these schemes suffer from “Key Forge Attack” and “Trapdoor Forge Attack” that we proposed and hence fail to support the security property as they claimed (which is an important goal to be achieved in key-aggregation searchable encryption schemes). To fix these flaws, in this paper, we identify the security challenges related to key-aggregation searchable encryption and propose a lightweight key-aggregation authorized searchable encryption scheme based on attribute-based encryption, called KA$^{2}$SE. It enables a data owner to share encrypted data with an authorized query user by issuing only a single authorized aggregation key, and the authorized query user only needs to submit a single trapdoor to the cloud server to perform keyword search. We formulate the security definitions for KA$^{2}$SE and prove its security. Finally, empirical evaluations demonstrate that KA$^{2}$SE is computationally efficient in comparison with existing schemes.

Abstract Searchable asymmetric encryption (SAE) enables a client to search over a data owner’s encrypted data. Nevertheless, state-of-the-art SAE schemes allow a data owner to specify access control policy for a client, while they have not considered the threat case of a malicious data owner. To address the problem, this work presents a non-interactive SAE scheme with bilateral access control: (i) allowing data owner and client to both specify policies toward the other party; (ii) allowing client to perform arbitrary boolean queries with sub-linear search complexity. Technically, we extend Cash et al.’s highly scalable SSE into an asymmetric setting and introduce the property of data owner authenticity. By refining identity-based matchmaking encryption, we formalize the syntax and security definition of our SAE with identity-based bilateral access control. Moreover, the security of the proposed SAE can be reduced to discrete logistic assumption and decisional bilinear Diffie–Hellman assumption. As an enhanced extension, we present a non-interactive multi-client SAE scheme with fuzzy identity-based bilateral access control. In addition, we implement the proposed schemes in real cloud platform and evaluate their performance on a real-world dataset. The result confirms that our SAE schemes achieve bilateral access control for both data owner and client with highly acceptable efficiency.

The Internet of Things (IoT) boom has enabled massive data collection in cloud servers. Therefore, access efficiency and data privacy in cloud storage services have become a significant concern. Data and users are hierarchical in IoT applications, which require fine-grained multilevel access control. Additionally, achieving public verification to resist the malicious server and clients is indispensable. Aiming at the challenge above, we propose a new forward private multilevel dynamic searchable symmetric encryption (MLDSSE) scheme called Peony, employing multilevel linked lists and constrained pseudorandom function, which is more efficient and secure. Then, we introduce a cryptographic primitive named multilevel symmetric revocable encryption (MSRE), and we give a general method for constructing a novel forward and Type-II backward-private MLDSSE scheme Peony++ based on MSRE. Further, we design the multilevel digests and utilize the smart contract as a trusted platform to support public verification for Peony++. Theoretical analysis and experimental evaluations show that Peony achieves higher security and reduces search time by an average of 35.81% compared to the state-of-the-art MLDSSE scheme. To the best of our knowledge, Peony++ is the only multilevel searchable encryption currently available that can achieve forward and Type-II backward privacy, all while balancing efficiency and functionality.

Due to the advent of healthcare wireless medical sensor networks (HWMSNs) technology, the traditional model of medical treatment has been transformed. In HWMSNs environments, sensor nodes (e.g., wearable devices) collect medical data from patients and transmit them to doctors for diagnosis. Several certificateless aggregate signature (CLAS) schemes have been put forward to guarantee secure transmission of medical data and privacy of patients in HWMSNs. However, the utilization of a centralized key generation center (KGC) implies elevated risk of insecurity and privacy disclosure. Practical and destructive coalition attacks resulting from the collusion of an insider signer with a malicious KGC are difficult to resist. Therefore, a security-enhanced certificateless designated verifier anonymous aggregate signature (CL-DVAAS) scheme is devised to solve these problems. As introduced in the you only speak once (YOSO) model, an ever-changing, unpredictable committee replaces the role of the KGC for system initialization and key distribution. The serverless computing paradigm empowers the proposed scheme with excellent attack prevention and privacy protection capabilities. The proposed scheme is provably secure against various types of attacks in the random oracle model. Moreover, the performance evaluation and comparison illustrate that our scheme outperforms the state-of-the-art solutions.

Cryptojacking is a new type of Internet of Things (IoT) attack, where an attacker hijacks the computing power of IoT devices, such as wireless routers, smart TVs, set-top boxes, or cameras, to mine cryptocurrencies, e.g., PyRoMineIoT. The attackers launch selfish mining-like (SM-like) attacks to obtain lucrative mining rewards with the stolen computing power, once the power exceeds a threshold. Generally, a single deep learning (DL) model with a single feature (e.g., fork height) is trained to detect SM-like attacks. However, the existing model fails to detect every SM-like attack since the model training ignores other distinctive features (e.g., mining rewards and blocking rate) of SM-like attacks. In this article, SM-NEEDLE, an ensemble DL (NEEDLE) method is proposed to detect SM-like attacks. More specifically, the distinctive features are extracted from the blockchain system, where SM-like simulators emulate the strategies of SM-like attacks. Further, to circumvent the local optima problem caused by the single DL model (e.g., Back-Propagation Neural Network, BPNN), the SM-NEEDLE trains multiple BPNNs with these distinctive features. Evaluation results indicate the accuracy and false negative rate (FNR) of SM-NEEDLE for detecting SM-like attacks (including SM1 and its variants) are 98.9% and 1.48%, respectively. That is, 98.9% of SM-like attacks are correctly identified and only 1.48% of attacks are undetectable.

In the digital era, one of the most significant changes in the IoT world is the popularity of digital subscriptions, where service providers upload encrypted service information to the cloud for sharing. In practice, the untrustworthy service providers may intentionally leak their private keys used to encrypt service information (for profits), allowing unauthorized subscribers to enjoy valuable service. The malicious behavior described above has become a severe obstacle to the widespread application of IoT-based digital subscriptions. To address this issue, we propose a fine-grained and sanitizable access control system (FSAC), in which service information could only be accessed by authorized subscribers. To thwart potential threats from malicious service providers, we design a sanitizable mechanism to transform the original ciphertext, ensuring that a subscriber is unable to decrypt the sanitized ciphertext solely using the leaked key of the service provider. For resource-constrained IoT devices, we further extend FSAC with outsourced decryption (FSACO) that relieves subscribers from the burden of decryption. In particular, FSACO allows subscribers to perform two exponentiation operations rather than time-consuming paring operations (as that in FSAC) to decrypt sanitized ciphertext. We conduct rigorous security analysis of our systems and demonstrate their efficient performance through extensive experiments. Specifically, the enhanced system FSACO has a minimum decryption time of approximately 0.08 ms.

Blockchain-based Industrial Internet of Things (IIoT) integrates the blockchain technology into the traditional IIoT infrastructure to provide secure and collaborative services. In IIoT, the traffic is usually encrypted using a cipher suite (SSL/TLS) for secure communication, which makes it hard for middleboxes (MBs) to detect malicious activity in the traffic. To address this problem, secure MBs that directly perform encrypted traffic inspection have been presented. Recently, a new privacypreserving deep packet inspection (DPI) system on MB for IoT scenarios was proposed, but it suffered from the following two limitations: 1) no support for fast token detection and 2) no support for tracing abnormal sources. To address the two limitations, we propose BTDPI, a privacy-preserving traceable DPI system that efficiently performs inspection over encrypted traffic in blockchain-based IIoT. Technically, we adopt a two-layer filter architecture to improve the efficiency of detection and moreover introduce a new online–offline certificateless aggregate signature with smart contract to design an identity traceability mechanism. The experiment result shows that BTDPI runs$26.7\times $faster for token detection with 3000 tokens and 3000 rules than the state-of-the-art work.

The transition from paper-based information to Electronic-Health-Records (EHRs) has driven various advancements in the modern healthcare industry. In many cases, patients need to share their EHR with healthcare professionals. Given the sensitive and security-critical nature of EHRs, it is essential to consider the security and privacy issues of storing and sharing EHR. However, existing security solutions excessively encrypt the whole database, thus requiring the entire database to be decrypted for each access request, which is time-consuming. On the other hand, the use of EHR for medical research (e.g., development of precision medicine and diagnostics techniques) and optimisation of practices in healthcare organisations require the EHR to be analysed. To achieve that, they should be easily accessible without compromising the patient’s privacy. In this paper, we propose an efficient technique called E-Tenon that not only securely keeps all EHR publicly accessible but also provides the desired security features. To the best of our knowledge, this is the first work in which an Open Database is used for protecting EHR. The proposed E-Tenon empowers patients to securely share their EHR under their own multi-level, fine-grained access policies. Analyses show that our system outperforms existing solutions in terms of computational complexity.

The cloud-assisted mobile electronic health (e-health) system facilitates e-health data sharing between healthcare providers and patients, but also raises the security and privacy concerns of e-health data. Although Ciphertext-Policy Attribute-Based Encryption (CP-ABE) has been a promising technique to achieve fine-grained access control over encrypted e-health data, it still incurs high encryption and decryption burdens on mobile users such as smartphones and sensors. In addition, malicious cloud servers may conduct incorrect operations due to various interest incentives (e.g., leaking sensitive information to illegal users, saving computation and storage costs). To solve the above issues, in this paper we first propose an Outsourced CP-ABE (OABE) with verifiable encryption scheme by splitting secret keys corresponding to an attribute set and using the short signature, which not only reduces the encryption and decryption complexities of mobile users but also guarantees that cloud servers correctly perform encryption operations. Then, we extend OABE to construct outsourced CP-ABE with verifiable decryption (OABE+) by utilizing the verifiable tag mechanism, which guarantees that cloud servers correctly conduct the ciphertext transformation. Formal security analysis proves that our schemes are selectively secure against unauthorized accesses and malicious operations. Extensive experiments using various real-world datasets demonstrate that our schemes are efficient and feasible in real applications.

In this paper, we presentVerifyML, the first secure inference framework to check the fairness degree of a given Machine learning (ML) model.VerifyMLis generic and is immune to any obstruction by the malicious model holder during the verification process. We rely on secure two-party computation (2 PC) technology to implementVerifyML, and carefully customize a series of optimization methods to boost its performance for both linear and nonlinear layer execution. Specifically, (1)VerifyMLallows the vast majority of overhead to be performed offline, thus meeting the low latency requirements for online inference. (2) To speed up offline preparation, we first design novel homomorphic parallel computing techniques to accelerate the authenticated Beaver's triple (including matrix- vector and convolution triples) generation procedure. It achieves up to$1.7\times$computation speedup and gains at least$10.7\times$less communication overhead compared to state-of-the-art work. (3) We also present a new cryptographic protocol to evaluate the activation functions of non-linear layers, which is$4\times$–$42\times$faster and has$\gt 48\times$less communication than the existing 2 PC protocol against malicious parties. In fact,VerifyMLeven beats the state-of-the-art semi-honest ML secure inference system! We provide a formal theoretical analysis forVerifyMLsecurity and demonstrate its performance superiority on mainstream ML models including ResNet-18 and LeNet.

In this paper, we study the problem of secure ML inference against a malicious client and a semi-trusted server such that the client only learns the inference output while the server learns nothing. This problem is first formulated by Lehmkuhlet al.with a solution (MUSE, Usenix Security'21), whose performance is then substantially improved by Chandranet al.'s work (SIMC, USENIX Security'22). However, there still exists a nontrivial gap in these efforts towards practicality, giving the challenges of overhead reduction and secure inference acceleration in an all-round way. Based on this, we propose SIMC 2.0, which complies with the underlying structure of SIMC, but significantly optimizes both the linear and non-linear layers of the model. Specifically, (1) we design a new coding method for parallel homomorphic computation between matrices and vectors. (2) We reduce the size of the garbled circuit (GC) (used to calculate non-linear activation functions,e.g., ReLU) in SIMC by about two thirds. Compared with SIMC, our experiments show that SIMC 2.0 achieves a significant speedup by up to$17.4\times$for linear layer computation, and at least$1.3\times$reduction of both the computation and communication overhead in the implementation of non-linear layers under different data dimensions. Meanwhile, SIMC 2.0 demonstrates an encouraging runtime boost by$2.3\sim 4.3\times$over SIMC on different state-of-the-art ML models.

Well-trained neural network models are deployed on edge servers to provide valuable inference services for clients. To protect data privacy, a promising way is to exploit various types of secret sharing to implement privacy-preserving neural network inference. However, existing schemes suffer high communication rounds and overhead, making them hardly practical. In this paper, we propose Cenia, a new communication-efficient privacy-preserving neural network inference model. Specifically, we exploit arithmetic secret sharing to develop low-interaction secure comparison protocols, that can be used to realize secure activation layers (e.g., ReLU) and secure pooling layers (e.g., max pooling) without expensive garbled circuit and oblivious transfer primitives. Besides, we also design secure exponent and division protocols to realize secure normalization layers (e.g., Sigmoid). Theoretical analysis demonstrates the security and low complexity of Cenia. Extensive experiments have also been conducted on benchmark datasets and classical models, and experimental results show that Cenia achieves privacy-preserving, accurate, and efficient neural network inference. Particularly, Cenia can achieve 37.5% and 60.76% of Sonic’s communication rounds and overhead, respectively, compared to Sonic (i.e., the state-of-the-art scheme).

Group time-based one-time passwords (GTOTP) is a novel lightweight cryptographic primitive for achieving anonymous client authentication, which enables the efficient generation of time-based one-time passwords on behalf of a group without revealing any information about the actual client’s identity beyond their group membership. The security properties of GTOTP regarding anonymity and traceability have been formulated in a static group management setting (where all group members should be determined during the group initialization phase), yet, a formal treatment for real-world dynamic groups (i.e., group members may join and leave at any time) is still an open question. It is non-trivial to construct an efficient GTOTP scheme that can provide a lightweight password generation procedure run by group members and support dynamic group management, allowing group members to join and leave without affecting other members’ states (non-disruptively). To address the above challenge, we first define the notion and the security model of dynamic group time-based one-time passwords (DGTOTP) in this work. We then present an efficient DGTOTP construction that can generically transform an asymmetric time-based one-time passwords scheme into a DGTOTP scheme utilizing a chameleon hash function family and a Merkle tree scheme. Within our construction, we particularly tailor an outsourcing solution realizing an issue-first-and-join-later (IFJL) strategy, enabling smooth joining and revocation without disrupting other group members. Moreover, our scheme minimizes symmetric cryptographic operations and maintains constant storage for group members, compared to the linear storage cost that grows rapidly with respect to the lifetime of the GTOTP instance in the previous static GTOTP scheme. Our DGTOTP scheme satisfies stronger security guarantees in a dynamic group management setting without random oracles. Our experimental results confirm the efficiency of our DGTOTP scheme.

Deep Neural Networks (DNNs) have been extensively employed for automatic face recognition, enabling the extraction of compact and discriminative representations from facial images. However, these representations typically encode a multitude of information ranging from individual identities to sensitive soft-biometric attributes such as gender, race, or age. This raises concerns regarding the privacy disclosure of soft-biometric as these attributes should be protected. To address this issue, we propose a novel Face Information Bottleneck Network (FIBNet), which is a representation-level privacy-enhancing framework based on the Information Bottleneck (IB) principle. The proposed FIBNet differs significantly from previous representation-level privacy-enhancing techniques in three key aspects. First, it generates a privacy-enhanced face representation, providing novel insights through an information-theoretic privacy framework. Second, we formulate the privacy protection of soft-biometric attributes as an IB optimization problem by striking a tradeoff between preserving a controlled amount of identity information within face representations and suppressing soft-biometric attribute information. Last, the proposed approach protects soft-biometric privacy from adversaries interested in specific sensitive attributes that are unknown to the biometric system designers or users. Detailed experimental results obtained on widely recognized facial recognition datasets demonstrate that the proposed FIBNet significantly outperforms the state-of-the-art methods in terms of both biometric performance for face verification and its soft-biometric attribute suppression efficiency. These notable results verify FIBNet as a novel and effective approach for ensuring representation-level soft-biometric privacy.

Threshold anonymous credentials enable users to acquire credentials in a decentralized manner while upholding their privacy. However, distributed network environments, such as electronic voting systems and federated identity management systems, have pressing needs for enhancing security, reducing reliance on fixed-group issuers, and achieving scalability. These requirements expose the significant constraints of existing threshold anonymous credential systems, which struggle to support dynamic threshold settings. This struggle leads to the necessity of system rewinding whenever an issuer is included or excluded. Moreover, the communication and computation complexities involved in showing credentials exhibit a linear relationship with the number of credentials possessed by each user. In this paper, we present a novel dynamic threshold anonymous credential system, named DTACB, to tackle the aforementioned challenges. DTACB enables the dynamic adjustment of thresholds, allowing issuer adjustments without rewinding the system. DTACB additionally supports batch-showing of credentials and proof of credential quantity values while preserving the user’s credentials collection remains undisclosed. We conduct rigorous security analysis and validate our efficiency claims via implementing and benchmarking. In particular, DTACB effectively reduces the cost of batch-proof verification to 3.78 ms, independent of the user’s proof size.

Data-driven landscape across finance, government, and healthcare, the continuous generation of information demands robust solutions for secure storage, efficient dissemination, and fine-grained access control. Blockchain technology emerges as a significant tool, offering decentralized storage while upholding the tenets of data security and accessibility. However, on-chain and off-chain strategies are still confronted with issues such as untrusted off-chain data storage, absence of data ownership, limited access control policy for clients, and a deficiency in data privacy and auditability. To solve these challenges, we propose a permissioned blockchain-based privacy-preserving fine-grained access control on-chain and off-chain system, namely FACOS. We applied three fine-grained access control solutions and comprehensively analyzed them in different aspects, which provides an intuitive perspective for system designers and clients to choose the appropriate access control method for their systems. Compared to similar work that only stores encrypted data in centralized or non-fault-tolerant IPFS systems, we enhanced off-chain data storage security and robustness by utilizing a highly efficient and secure asynchronous Byzantine fault tolerance (BFT) protocol in the off-chain environment. As each of the clients needs to be verified and authorized before accessing the data, we involved the Trusted Execution Environment (TEE)-based solution to verify the credentials of clients. Additionally, our evaluation results demonstrated that our system (https://github.com/cliu717/AsynchronousStorage) offers better scalability and practicality than other state-of-the-art designs. We deployed our system on Alibaba Cloud and Tencent Cloud and conducted multiple evaluations. The results indicate that it takes about 2.79 seconds for a client to execute the protocol for uploading and about 0.96 seconds for downloading. Compared to other decentralized systems, our system exhibits efficient latency for both download and upload operations.

Secure cloud storage offers encrypted databases outsourcing service for resource-constrained clients, containing numerous tables with certain relations. Searchable symmetric encryption enables a client to search over its encrypted database on the cloud, while rarely considering queries over joins of tables. Join Cross-Tags (JXT) protocol (ASIACRYPT 2022) is thence presented that enables conjunctive queries over joins of tables, while neglecting arbitrary Boolean queries with disjunctive and conjunctive normal forms (DNF/CNF) in TWINSSE (PETS 2023). However, trivially combining JXT and TWINSSE for arbitrary DNF/CNF boolean queries over joins of tables seems infeasible due to: (i) no support for dis/conjunctive query with the same meta-keyword; (ii) returning inaccurate search results; (iii) incurring costly storage overhead. Therefore, we introduce TNT-QJ, a practical TwiN cross-Tag protocol for arbitrary boolean Query-Join over multi-tables. The result is technically obtained from revisiting TWINSSE’s framework via using s-term (the least frequent keyword) for the relation between a keyword and its meta-keyword, and non-trivially combined with JXT’s query-join approach for introducing a connective attributed in encryption tuples. In addition, we present a semi-full multi-fork searchable tree to store keyword information and reveal keyword containment relations, where the storage consumption is reduced from$\mathcal {O}(n^{3})$to$\mathcal {O}(n^{2})$. Finally, to clarify practical performance, we conduct extensive experiments on JXT and TNT-QJ using an open database in the HUAWEI cloud. Besides enabling disjunctive queries over joins of tables, TNT-QJ also runs$1.2\times $faster for conjunctive queries than JXT (with #keywords=2), which confirms rich features and practical efficiency.

IoT and 5G-enabled smart healthcare allows medical practitioners to diagnose patients from any location via electronic health records (EHRs) by wireless body area network (WBAN) devices. Privacy, including the medical practitioner's identity and the patient's EHR, can easily be leaked from hospitals or cloud servers, and secret keys used to access EHRs must be revoked after diagnosis. In response to the challenges associated with user authentication and secret key revocation, this paper proposes an access control scheme with privacy-preserving authentication and flexible revocation for smart healthcare using attribute-based encryption (ABE), named PAFR-ABE, which provides access control to prevent malicious users from decrypting EHRs. Meanwhile, PAFR-ABE ensures privacy-preserving authentication for users during secret key generation, which safeguards users' identities and prevents unauthorized requests for secret keys. In addition, PAFR-ABE achieves flexible revocation and recovery of secret keys, which eliminates the need to update secret keys for unrevoked users. Security analysis indicates that PAFR-ABE meets the security requirements of an access control scheme for smart healthcare, especially in terms of forward security and backward security. Performance analysis shows that PAFR-ABE is efficient in the key generation and revocation algorithms compared with typical access control schemes.

Electronic health (e-health) systems may outsource data such as patient e-health records to mobile cloud servers for efficiency gains (e.g., minimizing local storage and computation costs). However, such a move may result in privacy implications in the presence of semi-honest cloud servers. Searchable Encryption (SE) can potentially facilitate privacy-preserving searches based on keywords for encrypted data stored in the mobile cloud, but most existing SE solutions do not support temporal access control (i.e., a mechanism that grants access permissions to users for specified time ranges). Hence, in this paper we design a time-controllable keyword search scheme by using an attribute-based comparable access control. This allows users to match indexes encrypted at specified time intervals. Then, we improve the basic framework to support efficient user revocation using secret sharing. We then formally prove the security of our proposed frameworks against chosen-keyword attack and key collusion attack, as well as achieving keyword secrecy. We also evaluate the performance of our proposed approach using a real-world dataset to demonstrate their practical utility.

Cloud computing is the widespread acceptance of a promising paradigm offering a substantial amount of storage and data services on demand. To preserve data confidentiality, many cryptosystems have been introduced. However, current solutions are incompatible with the resource-constrained end-devices because of a variety of vulnerabilities in terms of practicality and security. In this paper, we propose a practical and secure data-sharing system by introducing a new design of attribute-based encryption with verifiable outsourced decryption (VO-ABE for short). Our system offers: (1) data sharing at a fine-grained level; (2) a scalable key issuing protocol without any secure channel; (3) a verifiable outsourced decryption mechanism for resource-constrained end-devices against the malicious cloud service provider; and (4) adaptive security against the real-world attacks. To formalize our solution with cryptographic analysis, we present the formal definition of VO-ABE and its concrete construction with provable security. In particular, our design leverages the techniques of the traditional ABE, verifiable outsourced decryption, and randomness extractor to support fine-grained access control, cost-effective data sharing, and security assurance with high entropy. Moreover, our design is provably secure in the adaptive model under the standard assumption, which offers a stronger security guarantee since the state-of-the-art solution is selectively secure under the non-standard assumption and suffers from a variety of real-world attacks. The implementation and evaluation demonstrate that our solution enjoys superior functionality and better performance than the relevant solutions. More importantly, our solution is compatible with the resource-constrained end-devices since the decryption mechanism takes around 1.1ms and is 22.7x faster than the state-of-the-art solution.

Blockchain as an open and immutable ledger is being posited as the next frontier in healthcare that will help solve the industry's interoperability challenges. However, immutability in processing personal data is no longer legal since the General Data Protection Regulation (GDPR) requires the “right to be forgotten” as a critical data subject right. To observe such data regulation, it is desirable to build a healthcare blockchain with data redaction in a controlled way. Moreover, electronic health records (EHRs) usually are sensitive and the conventional blockchain lacks systematic and formal security analysis of data confidentiality, especially in the multi-user setting. Furthermore, EHRs are typically helpful in medical research for predicting epidemic diseases and valuable in insurance agencies making business plans. Hence, in healthcare blockchain systems, data confidentiality and flexible key distribution have become the most challenging issues that should be urgently resolved. In this paper, we propose a privacy-preserving and redactable healthcare blockchain system (PRHBS). Our solution offers fine-grained block-level data reduction and secure data sharing with flexible key distribution mechanisms. We give the formal definition and security models of PRHBS, and propose a generic construction based on trapdoor-based chameleon-hash function, attribute-based encryption, and puncturable encryption. We present formal security analysis and give an instantiation based on our proposed generic construction. The comprehensive comparison and experimental simulation demonstrate that our implementation exhibits comparable performance, while surpassing the most relevant solutions in terms of functionality.

Abstract Public key encryption with keyword search is a promising primitive which enables search over encrypted data in secure data outsourcing services. In traditional construction, the associated keywords may be recovered from a given trapdoor by a malicious server through keyword guessing attacks. Therefore, the notion of public-key authenticated encryption with keyword search (PAEKS) was introduced, where a sender encrypts (and authenticates) the keywords using a receiver’s public key and its secret key. In this paper, we consider the forward security for PAEKS and introduce a new primitive: forward secure public-key authenticated encryption with keyword search (FS-PAEKS), which captures the information leakage risk from previously issued queries due to the updates on the outsourced data. Technically, we embed a non-interactively agreed key into the cipher-keyword generation algorithm, and bind the cipher-keyword and the trapdoor with a set converted from algorithm-generation time. Finally, we present an efficient FS-PAEKS scheme supporting conjunctive query, and prove its forward security against chosen keyword attacks and keyword guessing attacks. To illustrate practical performance, we implement our FS-PAEKS and related PAEKS schemes based on Enron dataset in real cloud environment.

Abstract Dynamic searchable symmetric encryption (DSSE) with forward and backward privacy makes it possible to perform search on the outsourced encrypted database efficiently while still allowing updates under acceptable leakage. Current forward and backward private DSSE (FB-DSSE) scheme proposed by Zuo et al. cannot support conjunctive keyword query and the cloud server needs to be honest-but-curious. Recent FB-DSSE scheme supporting conjunctive keyword query proposed by Patranabis et al. cannot verify search results. On the other hand, searchable symmetric encryption scheme proposed by Wang et al. that supports conjunctive keyword query and the verification of search results cannot achieve forward and backward privacy. The problem of constructing a verifiable conjunctive FB-DSSE scheme is still open. In this paper, we propose a verifiable conjunctive dynamic searchable symmetric encryption scheme (VCDSSE). VCDSSE is a FB-DSSE scheme that additionally supports the verification of search results and conjunctive keyword query. We revisit homomorphic MAC to enable efficient verification of search results, adopt the technique of oblivious cross-tags to achieve conjunctive keyword query and utilize state chain to ensure forward and backward privacy. The formal security analysis and performance evaluation demonstrate that VCDSSE is secure and practical as compared with Mitra scheme in terms of search time.

Vehicular ad hoc network (VANET) enables a more efficient and secure traffic environment by integrating several emerging technologies. The technology of certificateless aggregate signature (CLAS) is widely utilized to guarantee secure communications in VANET. However, the legitimation of vehicles’ public keys cannot be verified effectively in existing CLAS protocols for VANET. Thus, a malicious key generation center (KGC) can masquerade as any vehicle and generate legitimate signatures. In this article, a reliable malicious KGC-resistant CLAS protocol, called RelCLAS, is proposed to eradicate this problem. RelCLAS solves the key escrow problem owning to the combination of registration-based encryption (RBE) and CLAS. Partial public keys selected by vehicles are stored in a key accumulator to prevent malicious KGC from forging valid signatures. Formal security proof demonstrates that RelCLAS satisfies the fundamental security requirements of VANET. Extensive simulations illustrate that RelCLAS is efficient, reliable, and feasible.

For multiuser search scenarios over encrypted cloud data, the multiuser searchable encryption (MUSE) technology is a viable solution for incorporating privacy protection and favorable operability functions together. However, current MUSE technologies suffer from three practical limitations: 1) a secure channel between data owner and users will greatly increase the burden of owner; 2) a trusted third party (TTP) is required in some solutions; and 3) some solutions cannot resist keyword guessing attack (KGA), which means that the information of search trapdoor is easily leaked. In order to solve the above three problems, our first practical solution (DuMSE) without secure channel and without TTP is proposed in this article, which also can resist KGA. With inverted indexes, the search time complexity of DuMSE can be reduced to$r$, where$r$is the number of corresponding data. To support dynamically updating data, our second dynamic solution based on DuMSE is also proposed in this article, named as dynamic DuMSE (dDuMSE). The construction of dDuMSE includes not only the above features of DuMSE but also a new feature. Our analysis and experimental results show that the proposed schemes are secure and practical.

Secure outsourced middleboxes are deployed in network function virtualization services that detect malicious activities on communications, which provides privacy-preserving deep packet inspection (DPI) over encrypted traffic. To boost filtering efficiency of packets, the two-layer middlebox architecture has been adopted in recent DPI systems. Nevertheless, state-of-the-art solutions based on two-layer architecture mainly suffer from two limitations: i) cannot support dynamic rule addition; ii) failed to inspect discontinuous token for rule matching. To address these limitations, this work proposes an efficient, dynamic and continuous DPI (DCDPI) system in secure outsourced middleboxes. To achieve dynamic rule addition with forward privacy, we refine a data structure called virtual binary tree (VBTree) and further introduce a variant of VBTree for DCDPI, termed VBTree+. VBTree+ supports two new desirable features: i) taking the rule action information into consideration; ii) achieving both rule identifier and rule action hiding. By introducing a token continuity check mechanism, DCDPI can effectively identify discontinuous tokens and categorize continuous tokens into one group. The extensive experiment over the real dataset and rule set confirms the practicality and efficiency of DCDPI. Compared to state-of-the-art works with same setting, DCDPI is 18%$\sim$110% more efficient for a connection establishment between gateway/client and server.

Cloud-based publish-subscribe (pub-sub) services provide a decoupling method for publishers and subscribers to effectively exchange targeted information and massive data on the cloud platform. Data publishers implement fine-grained access control to set subscription privileges for outsourced data through an access policy. However, in the context of semi-honest cloud platforms, the publisher's access policy may be collected, and incomplete or incorrect subscription results may be returned (e.g., to save communication costs). Existing solutions pay little attention to protecting the data publisher's access policy and cannot provide efficient verification for local results. In this article, we propose a verifiable multi-keyword data publish-subscribe scheme with a hidden access policy (VMP/S). Specifically, VMP/S combines attribute-based keyword search and data aggregation technology to achieve secure fine-grained access control, thereby protecting the privacy of the access policy. Additionally, the scheme provides an effective method for verifying local results by using equal-length verification information to confirm the correctness of feedback subscription data. Furthermore, we introduce a novel verification method for access control to enhance subscription performance efficiency. We demonstrate that VMP/S achieves IND-CKA security and ensures the privacy of the access policy through a comprehensive security analysis. Through experimental simulations, we confirm its effectiveness.

The rapid development and wide application of blockchain not only highlight the significance of privacy protection (including anonymity and confidentiality) but also the necessity of auditability. While several ingenious schemes such as MiniLedger and traceable Monero supporting both privacy protection and auditability have been proposed, they either provide incomplete privacy protection (only achieving anonymity within a small set or only providing confidentiality but not anonymity), or involve additional auditing conditions such as reaching threshold transaction volume or requiring permissioned nodes to serve as the manager, or restrict to specific blockchain types such as Monero. To mitigate these issues, this article proposes a generic anonymous, confidential, and auditable transaction system (named ACA), which is compatible with both UTXO-based permissionless and permissioned blockchains. Core technologies of ACA include designed traceable anonymous key generation and publicly verifiable authorization mechanisms from existing cryptographic tools (i.e., public key encryption, partially homomorphic encryption, and accumulator) as well as the meticulous designed signatures of knowledge and smart contract. To demonstrate the entity of our proposal, we first prove its security including authenticity, anonymity, confidentiality and soundness, and then provide an instantiation to evaluate its performance. The final implementation and benchmarks show that our proposal can still gain performance advantage even adding more functionalities.

Privacy-preserving pattern matching enables a user to find all occurrences of a pattern in a text without revealing any sensitive information. However, many previous works designed on homomorphic encryption suffer from expensive computational overhead and a simple way to use it can lead to potential input leakage via access pattern during the matching process. In this article, we propose a differentially oblivious pattern matching algorithm, calledDOPM. It is deployed on two servers by taking a series of lightweight secret-sharing-based protocols as building blocks. InDOPM, we utilize a witness array and the single instruction multiple data (SIMD) technique to parallelize the algorithm, which achieves sublinear round complexity in performing two-party computation. Additionally, we formally define a new access pattern privacy in the context of differential privacy, named$(\epsilon,\delta)$-differentially oblivious privacy ($(\epsilon,\delta)$-DOP), and present a pair of differentially oblivious algorithms to read and write elements in an array without using oblivious shuffle. Detailed security analysis demonstrates that the proposedDOPMachieves the goal of protecting confidentiality and access pattern during the matching process. Finally, we benchmark our scheme on a real-world human genome dataset, and experimental results show thatDOPMis$10.9\times$faster than the brute-force matching,$3.4-7.1\times$faster than two state-of-the-art approaches.

To reduce the cost of human and material resources and improve the collaborations among medical systems, research laboratories and insurance companies for healthcare researches and commercial activities, electronic medical records (EMRs) have been proposed to shift from paperwork to friendly shareable electronic records. To take advantage of EMRs efficiently and reduce the cost of local storage, EMRs are usually outsourced to the remote cloud for sharing medical data with authorized users. However, cloud service providers are untrustworthy. In this paper, we propose an efficient, secure, and flexible EMR sharing system by introducing a novel cryptosystem called dual-policy revocable attribute-based encryption and tamper resistance blockchain technology. Our proposed system enables EMRs to be shared at a fine-grained level and allows data users to detect any unauthorized manipulation. Moreover, the key generation center can revoke malicious users without affecting the honest users. We provide the formal security model as well as the concrete scheme with security analysis. The experimental simulation and experimental analysis of our proposed scheme demonstrate that our proposed system has superior performances to the most relevant solutions.

Secure cloud search services provide a cost-effective way for resource-constrained clients to search encrypted files in the cloud, where data owners can customize search authorization. Despite providing fine-grained authorization, traditional attribute-based keyword search (ABKS) solutions generally support single keyword search. Towards expressive queries over encrypted data, multi-client searchable symmetric encryption (MC-SSE) was introduced. However, current search authorizations of existing MC-SSEs: (i) cannot support dynamic updating; (ii) are (semi-)black-box implementations of attribute-based encryption; (iii) incur significant cost during system initialization and file encryption. To address these limitations, we present AasBirch, an MC-SSE system with fast fine-grained authorization that supports adaptable authorization switching from one policy to any other one. AasBirch achieves constant-size storage and lightweight time cost for system initialization, file encryption and file searching. We conduct extensive experiments based on Enron dataset in real cloud environment. Compared to state-of-the-art MC-SSE with fine-grained authorization, AasBirch achieves 30$\sim 200\times$smaller public parameter and secret key size, with the assumed least frequent keyword in a query ($s$-term) as 21. Moreover, it runs 10$\sim 20\times$faster for file encryption and$>20\times$faster for file searching. In addition, AasBirch outperforms 80,000× (resp. 7,850×) faster with$s$-term=1 (resp. =21), as compared to classic dynamic ABKS system.

Cloud computing has been widely accepted as a computing paradigm to offer high-quality data services on demand. However, it suffers from various attacks as the cloud service provider and data owners are not in the same trusted domain. To support data confidentiality, existing cloud-based systems apply cryptographic tools to issue the decryption key to data users to share data in a controlled way. However, fine-grained cloud data sharing still faces many challenges, especially when dealing with dynamic user groups. In this paper, we introduce a secure and efficient cloud-based data-sharing system with fine-grained access control and dynamic user groups. Our system enjoys 1) adaptive security in prime-order groups, 2) forward secrecy against revoked user fetches data generated before being revoked, and 3) decryption key exposure resistance against the compromise of the frequently used decryption key, where the previous solutions only concentrate on one or two above-mentioned properties. More specifically, we introduce two timestamp management mechanisms that manage the timestamp in each ciphertext to support dynamic user groups with forward secrecy. By applying the proposed timestamp management mechanisms, we introduce two novel designs of attribute-based encryption schemes with formal definition and security analyses. The proposed schemes are adaptively secure in prime-order groups under a standard assumption and support decryption key exposure resistance. We conduct theoretical analysis and experimental simulation to demonstrate the outperformance of our solutions.

Secure cloud-assisted data publish/subscribe (Pub/Sub) service provides an asynchronous method for publishers and subscribers to non-interactively exchange encrypted messages. Besides performing conjunctive subscription policy, numerous data Pub/Sub systems have recently been proposed to provide dynamic access control enforced from the publisher side to the subscriber side. However, these solutions fail to consider the following properties: (i) bilateral access control for both publishers and subscribers; (ii) the anonymity of the publisher; (iii) high matching time cost between publication and subscription. Therefore, we present P/S-BiAC, a secure and boolean cloud-assisted data Pub/Sub system with attribute-based bilateral access control that achieves authenticity and anonymity of publishers. In particular, P/S-BiAC enables cloud-based brokers to use the subscriber’s trapdoor to match published data with sub-linear time complexity. Technically, we introduce a “BiAC-and-Hidden” technique to refine publication tuples and trapdoor in classic searchable symmetric encryption solutions. Moreover, we implement P/S-BiAC and evaluate its practical performance based on Enron dataset in real cloud environment. To deal with a conjunctive subscription policy, P/S-BiAC runs 27.8× faster for matching time cost (with s-term=10) compared to state-of-the-art solutions, which demonstrates its feasibility in practical data Pub/Sub services with strong security properties.

Searchable encryption (SE) is a promising strategy for cloud-based file retrieval services, via structuring correspondences between files and keywords. Public key encryption with keyword search (PEKS) has been generally employed in file-sharing services, as compared to searchable symmetric encryption (SSE). However, PEKS is inherently vulnerable to keyword guessing attacks (KGA) launched by a malicious server. To resist such attacks, classic solutions are dual-server PEKS (DS-PEKS) [TIFS’2015] and server-aided PEKS (SA-PEKS) [TIFS’2016]. However, the query model in these two solutions only support single keyword search pattern, which inevitably limits their wide deployments in practice due to efficiency concern. In this work, we present DSB-SE, a new cloud-based file sharing & retrieval system that supports boolean queries while retaining KGA-resistance. Compared to DS-PEKS and SA-PEKS, the cost of documents searching in DSB-SE is 25, 000 times (resp. 6, 600 times) faster when$\#\text {keyword}=10$and$s\text {-term}=1$, where$s$-term is the least frequent keyword in the query pattern. Technically, the performance gain derives from revisiting traditional boolean SSE by: (i) introducing a pairing-free DDH-based transformation key modular that allows a data reader’s query pattern to be treated as a data writer’s; (ii) employing the dual-server methodology to support boolean query with efficient validity checks. In particular, the client-to-cloud communication cost for retrieving index of a single document is bounded to$10^{-2}s$, and the cost of sending a token ranges from$8\times 10^{-2}s\sim 13\times 10^{-2}s$. Nevertheless, DSB-SE is$1.5\times 10^{-2}s$slightly slower than DS-PEKS (but$1.35\times 10^{-2}s$faster than SA-PEKS) for key generation cost. Overall, the experiments show that the DSB-SE is practical and sufficient for real cloud applications, which is conducted over Enron dataset under a real-world cloud platform.

Edge computing is an emerging distributed computing concept that allows edge servers to provide authorized consumers with various on-demand services. Due to highly dynamic and untrustworthy network environments, various potential security concerns (e.g., unauthorized access, data manipulation, and privacy leakage) have been the critical factors restricting the development of edge computing. A recent heterogeneous framework proposed by Dougherty et al. (CCS’21), named APECS, deploys token-based authorization and multiple attribute-based encryption (MABE) to guarantee access control and data confidentiality. While APECS achieves a secure asynchronous access control without the “always-on” cloud, it suffers from privacy leakage (caused by the public identity information) and fake data spreading issues (due to the data confidentiality). In this paper, we propose an Anonymous and Auditable Distributed Access Control Framework for Edge Computing (AADEC) to relieve these issues. AADEC is based on two building blocks that we designed, namely a conditional anonymous authentication and an auditable MABE with optimized performance. We also define the formal security models and present security proofs for our proposal. The final qualitative comparison and performance benchmark demonstrate that AADEC can achieve a trade-off among anonymity, confidentiality, auditability and efficiency.

Despite the myriad benefits offered by blockchain technology, most of them still face several interrelated issues, such as limited transaction throughput, exorbitant transaction fees, and protracted confirmation times. Payment channel networks have emerged as a promising scalability solution, allowing two mutually distrustful users to engage in multiple off-chain transactions. However, existing schemes based on Hash Time Lock Contract or Anonymous Multi-hop Lock generally cannot ensure strong unlinkability of payments, due to the fact that the time-lock information still remains on the blockchain. To enhance on-chain privacy, a versatile tool was recently proposed by Thyagarajan et al. (CCS’20), namedVerifiable Timed Signatures, but it suffers from the dual insufficiencies of linear-increasing performance and time unverifiability (i.e., performance is linear to the number of signature shares, and signatures cannot be ensured recoverable after the specified time). In this paper, we first propose an approach to reduce computational overhead of VTS, which can be applied to enhance other established schemes, such as VTD (S&P’22) and VTLRS (ESORICS’22). To further reduce the computational complexity fromO(n)toO(1), we introduce a new cryptographic primitive calledVerifiable Timed Adaptor Signatures. Moreover, we extend the VTAS to VTAS+which provides the security property of verifiable recovery. We demonstrate the practicality of our proposal via presenting a concrete instantiation and constructing a privacy-enhanced payment channel network. Finally, the comprehensive evaluation reveals that our solutions exhibit superior performance than the state-of-the-art schemes.

Vehicular ad hoc network (VANET) is an emerging technology that can significantly improve the efficiency of transportation systems and mitigate traffic accidents by exchanging traffic-related messages or announcements. Nevertheless, there has not been a consensus on how to generate, distribute, and validate trustworthy announcements in such an untrusted wireless environment. Security and privacy, inspiration mechanism, and resource integration are significant challenges for announcement generation and dissemination. In this paper, a secure and trustworthy announcement dissemination scheme is realized for location-based service (LBS) application in VANET. A blockchain-assisted vehicular cloud (VC) architecture is proposed to harvest underutilized heterogeneous resources of vehicles participating in VANET. Moreover, the technologies of blockchain and smart contract are adopted to classify vehicles into different levels automatically by bidding for bonuses. What’s more, vehicles can generate trustworthy announcements with the help of neighbor vehicles by adopting the technology of threshold signature. Meanwhile, the reputation of announcements is evaluated for trust management. Formal security analysis shows that the proposed scheme satisfies fundamental security and privacy requirements in VANET. Experimental results show that the proposed scheme is robust and efficient.

As cloud computing is widely used in a variety of different applications, how to continuously improve the efficiency of processing data while protecting data privacy and security is still a problem worth investigating. Existing searchable encryption schemes mainly focus on the exact matching patterns, which are insufficient to meet and cope with the increasing demands for fuzzy search. In particular, there has been a lack of attention to the research on practical and privacy-preserving fully wildcard searchable encryption. In this article, we propose a new wildcard searchable encryption system, which is built based on a novel inner product encryption scheme that can address the above challenges simultaneously. A two-dimensional inner product relation is introduced to remove all restrictions on wildcards, allowing our system to support fully wildcard search. To resist active attacks from malicious adversaries and prevent information leakage, we enhance the security to adaptive simulation-based security under the SXDH assumption. The corresponding security proof of our construction is implicitly established on a hash proof system. Our elaborately constructed system removes redundant parameters and extra complex computations, ensuring its practicality and efficiency. Finally, our system shows better performance in more than 86% of cases in the conducted experiments.

Bilateral access control model, emerging as a novel paradigm in access control, has garnered extensive deployment within the domain of fog computing. This model offers on-demand data services, enabling the efficient identification of sensitive data without resorting to resource-intensive decryption procedures. Nonetheless, prevailing solutions exhibit impracticalities. Specifically, they fall short in supporting adaptive security, while presuming unwavering trustworthiness of the central authority. In this paper, we introduce a pioneering fine-grained and adaptively secure bilateral access control system through enhancements to the matchmaking attribute-based encryption (MABE) framework. We give a formalized definition of MABE, incorporating desirable security features such as blindness and unlinkability, aimed at capturing potential misconduct by the central authority. We propose a generic construction of MABE, drawing upon attribute-based encryption (ABE) and anonymous credential schemes (ACS), with provable security via formal security reduction in the adaptive model. We present an efficient instantiation of the MABE framework by introducing a practical ACS solution, wherein a cryptographic accumulator is employed to enhance performance. Experimental simulations substantiate that our solution not only has superior functionalities but also demonstrates performance on par with state-of-the-art solutions.

With an increasing number of IoT devices being deployed in healthcare, massive amounts of electronic health records (EHRs) are generated and shared in the cloud. To preserve data privacy, one promising data-sharing tool named attribute-based encryption (ABE) has been widely employed. However, it is a challenge to achieve flexible data sharing without loss of confidentiality when authorized users are dynamic. Another challenge is how to guarantee fleet data access time when resource-limited devices are used. In this article, a dynamic access policy ABE (DAP-ABE) system for EHRs in the cloud is proposed. The cloud server can update the access policy without sensitive information, while decryption keys of authorized users do not need to be updated. Authorized users enjoy approximately 0.07 ms data access by outsourcing the majority of the decryption overhead to the cloud server. Furthermore, a verification procedure is embedded in DAP-ABE to check the identities of patients in the data sharing stage, which ensures that no malicious user can upload invalid EHRs. Extensive experiments demonstrate the feasibility and efficiency of the DAP-ABE system.

Nowadays, data privacy is one of the most critical concerns in cloud computing, and many privacy-preserving distributed computing systems based on the trusted execution environment (e.g., Intel SGX) have been proposed to protect the user's privacy during cloud-outsourced computation. However, these SGX-based solutions are vulnerable to some traffic analyses, and loading all tasks into the enclave introduces much overhead for frequent EPC-paging. In this paper, we propose a T-SGX framework, which keeps the confidentiality of a distributed job and guarantees the system efficiency by allowing dynamically loading an enclave shared object for the task under processing. In T-SGX, all these objects are secretly shared and stored in a verifiably distributed share management system (SMS) outside the TCB. To mitigate the exposure of sensitive information, we present an efficient oblivious transfer (OT) protocol under the Decisional Diffie-Hellman (DDH) assumption for obliviously transmitting desired shares. Detailed security analysis demonstrates that the proposed T-SGX achieves the goal of secure distributed computing without privacy leakage to unauthorized parties. Finally, we benchmark the framework in six real-world applications, and the experimental results show that T-SGX significantly outperforms a state-of-the-art solution, with 11.9%-29.7% less overhead performing an SGX-based application.

Cloud-assisted Industrial Internet of Things (IIoT) systems are increasingly deployed in various applications such as location-based services. Outsourcing data to cloud servers can help minimize local data storage and computation overheads, but it may introduce security and privacy concerns. Therefore, privacy-preserving spatial keyword search has been extensively explored in the literature. However, existing solutions still reveal the order of the spatio-textual similarity values between the query point and all data objects, and do not support searching for arbitrary geometric regions. To solve these issues, in this article we propose a privacy-preserving threshold spatial keyword search (TSKS) scheme. Specifically, we use the polynomial fitting technology, vector space model, and randomizable matrix multiplication technology to allow the cloud server to find relevant objects that are within some arbitrary geometric range and contain all query keywords. Finally, formal security analysis proves that our scheme can protect the privacy of data sets and queries, and extensive experiments demonstrate that our scheme is efficient and practical.

The pervasive, ubiquitous, and heterogeneous properties of IoT make securing IoT systems a very challenging task. More so when access and storage are performed through a cloud-based IoT system. IoT data stored on cloud should be encrypted to ensure data privacy. It is also crucial to allow only authorized entities to access and decrypt the encrypted data. In this article, we propose a ciphertext-policy attribute-based encryption (CP-ABE) scheme that enables fine-grained access control of encrypted IoT data on cloud. CP-ABE is regarded as a highly promising approach to provide flexible and fine-grained access control, which is quite suited to secure cloud based IoT systems. We first present an access control system model of CloudIoT platform based on ABE. Based on the presented system model, we construct a ciphertext-policy hiding CP-ABE scheme, which guarantees the privacy of the users. We further construct a white-box traceable CP-ABE scheme with accountability in order to address the user key abuse and authorization center key abuse. Experiment illustrates the proposed systems are efficient.

With the increasing cloud storage service, users can enjoy non-interactive data sharing. Nonetheless, the data owner cannot timely update the shared data all the while. To ensure the timeliness and the authoritative source of the data, some users should be allowed to update the data on behalf of an authoritative data owner without changing data source. However, this allows harmful information to be injected into the data unnoticeably. How to efficiently realize editable cloud-based data sharing supporting malicious user tracing has not been fully explored. To address the problem, we propose a fine-grained and controllably editable cloud-based data sharing scheme with malicious user accountability. The data owner only needs to sign the shared data before uploading it and can specify a fine-grained access control policy about who can update the data and which portions of the data can be updated. The authorized users non-interactively convert signatures of original data into new ones for the updated data, which are indistinguishable from the original signatures. The proposed scheme also supports malicious user accountability in the sense that malicious users who post harmful information can be traced. We demonstrate the security and practicality of our scheme via formal security analysis and extensive experiments.

Cloud-based data storage service has drawn increasing interests from both academic and industry in the recent years due to its efficient and low cost management. Since it provides services in an open network, it is urgent for service providers to make use of secure data storage and sharing mechanism to ensure data confidentiality and service user privacy. To protect sensitive data from being compromised, the most widely used method is encryption. However, simply encrypting data (e.g., via AES) cannot fully address the practical need of data management. Besides, an effective access control over download request also needs to be considered so that Economic Denial of Sustainability (EDoS) attacks cannot be launched to hinder users from enjoying service. In this article, we consider thedual access control, in the context of cloud-based storage, in the sense that we design a control mechanism over both data access and download request without loss of security and efficiency. Two dual access control systems are designed in this article, where each of them is for a distinct designed setting. The security and experimental analysis for the systems are also presented.

Recently, reconstruction attacks on static encrypted database supporting range queries have been proposed. However, attacks on encrypted database within two updates in the similar setting have not been studied extensively. As far as we know, the only work is theupdate recovery attackpresented by Grubbset al.(CCS 2018). Following their seminal work, we present new update recovery attacks fordensedataset (i.e., at least one record corresponding to each value in the range), which enable a deeper understanding of the impact caused by leakages due to updates on dynamic encrypted database. Our first attack aims at recovering the value of a newly added record in the case of one database update. We further demonstrate that the attack can fully reconstruct thedatabase countsif the updated value is either the minimum or maximum in the range. We then consider a setting where two distinct records are added separately, which leads to our second attack. We next extend our attacks to the setting where the update operation is deletion. To the best of our knowledge, update recovery attack on database supporting deletion has not been considered before. We demonstrate practicality of our attack via extensive simulations using real dataset.

A privacy-preserving data analytics system enables a cloud user to perform the distributed job in a secure manner such that the data privacy can be guaranteed during the cloud-outsourced computation. However, many SGX-based solutions are vulnerable to some side-channel attacks, including the access pattern leakage from both network and memory. Several data-oblivious algorithms with full obliviousness have been proposed in the literature, but they are impractical to be used in the cloud due to the expensive computational overhead. In this article, we propose a DPSpark system with the security defined in a notion of$(\epsilon,\delta)$-differentially private obliviousness ($(\epsilon,\delta)$-DPO), which relaxes full obliviousness to enable an efficiency improvement. Based on this definition, we present a perturbation-shuffle-analysis (PSA) computing architecture and design several typical differentially oblivious operators. In further, we optimize the system efficiency by reducing the number of oblivious shuffles and choosing an appropriate privacy budget. Finally, we benchmark the system in different parameters. The experimental results show that DPSpark significantly outperforms two state-of-the-art solutions, only with 10.1-85.4 percent additional overhead performing an SGX-based data analysis application.

Federated deep learning has been widely used in various fields. To protect data privacy, many privacy-preservingapproaches have been designed and implemented in various scenarios. However, existing works rarely consider a fundamental issue that the data shared by certain users (calledirregular users) may be of low quality. Obviously, in a federated training process, data shared by manyirregular usersmay impair the training accuracy, or worse, lead to the uselessness of the final model. In this article, we propose PPFDL, a Privacy-Preserving Federated Deep Learning framework withirregular users. In specific, we design a novel solution to reduce the negative impact ofirregular userson the training accuracy, which guarantees that the training results are mainly calculated from the contribution of high-quality data. Meanwhile, we exploit Yao's garbled circuits and additively homomorphic cryptosystems to ensure the confidentiality of all user-related information. Moreover, PPFDL is also robust to users dropping out during the whole implementation. This means that each user can be offline at any subprocess of training, as long as the remaining online users can still complete the training task. Extensive experiments demonstrate the superior performance of PPFDL in terms of training accuracy, computation, and communication overheads.

Healthcare Internet-of-Things (IoT) enables lightweight devices to observe patients’ vital signals and outsource them to a remote cloud to enjoy flexible data sharing. However, it faces many security threats as the outsourced data is no longer physically controlled by data owners, and the cloud that hosts the outsourced data is not fully trusted. Many privacy protection technologies have been adopted to solve this problem, among which cryptographic mechanisms have become one of the most promising tools. Unfortunately, current cryptographic mechanisms in healthcare IoT mainly suffer from the following challenges: 1) dynamic user groups for managing users’ accessibility; 2) efficient revocation mechanism to mitigate the burden during user revocation; 3) forward and backward secrecy to ensure session independence in the presence of session key leakage; 4) revocable storage to prevent data users from learning any unauthorized data even the data is authorized before; and 5) information manipulation during data transmission. In this article, we introduce a practical and secure system to address the above problems. Our system provides fine-grained access control with dynamic user groups for optimizing scalability and functionality. We prove that our system is secure against numerous real-world threats. Extensive comparison and experimental analysis demonstrate that our system enjoys superior performance than the state-of-the-art solutions.

Cloud-fog computing is a novel paradigm to extend the functionality of cloud computing to provide a variety of on-demand data services via the edge network. Many cryptographic tools have been introduced to preserve data confidentiality against the untrustworthy network and cloud servers. However, how to efficiently identify and retrieve useful data from a large number of ciphertexts without a costly decryption mechanism remains a challenging problem. In this article, we introduce a cloud-fog-device data sharing system (CFDS) with data confidentiality and data source identification simultaneously based on a new cryptographic primitive named matchmaking attribute-based encryption (MABE) by extending matchmaking encryption in CRYPTO’19. Our solution offers a secure fine-grained bilateral access control that includes (1) fine-grained sender access control, (2) fine-grained receiver access control, (3) sender privacy, and (4) performance optimization via outsourcing data source identification to fog nodes. We give the formal definition and security models of MABE, and present a concrete construction with formal security proofs. We also offer a detailed security analysis of our proposed CFDS against real-world security threats. The extensive comparison and experimental simulation demonstrate that, by immigrating heavy workload to fog nodes, our scheme has better functionalities and performances than the most related solutions.

Image licensing regulates the scope, type, and limitations of using an image through an agreement. However, it is challenging to verify whether an agreement has been fulfilled honestly. Existing techniques, such as watermarking and perceptual hashing, help check image originality and editing operations specified in the agreement, but fail to achieve editor designation. In this paper, we propose a verifiable image licensing system (VILS) which provides an effective solution to verify if a received image is used legally according to its licensing agreement. The core building block of our design is a new kind of cryptographic primitive, called accumulator with a designated entity. The new accumulator helps achieve not only editing restriction, but also editor designation in image authentication. Our VILS has the following two appealing features: (1) Authorization: Only an authorized licensee who edits an image with operations declared in a licensing agreement can produce valid images; (2) Efficiency: The verification of VILS is efficient and independent of the number of operations or image size. Compared with the most relevant schemes from the state-of-the-art, the new design enriches the functionality of image authentication but reduces the verification time by 40%.

Immutability has been widely accepted as a fundamental property protecting the security of blockchain technology. However, this property impedes the development of blockchain because of the abuse of blockchain storage and legal obligations. To mitigate this issue, a novel construction of blockchain, calledredactable blockchain, was introduced. It enables a central authority to issue the rewriting privilege to a particular party who can rewrite a registered object, e.g., a block or a transaction, in a controlled way. Unfortunately, the central authority must be fully trusted and is an obvious target suffering from various attacks. In this paper, we introduce a redactable blockchain controlled at a fine-grained level in a decentralized setting. In our solution, the rewriting privilege is issued by multiple authorities for reducing the vulnerability of the centralized setting. To formalize our solution, we introduce a novel cryptographic notion, calleddecentralized policy-based chameleon hash(DPCH), with the formal definition and security model. By applying several simple cryptographic tools, such as chameleon hash, digital signature, and multi-authority attribute-based encryption, we present the generic construction of DPCH along with rigorous security proofs. By applying RSA-based chameleon hash and BLS short signature, we give a practical instantiation of DPCH with performance evaluation. The comprehensive evaluation shows that our solution has superior performance than the state-of-the-art solution.

Secure cloud search service allows resource-constrained clients to effectively search over encrypted cloud storage. Towards enabling owner-enforced search authorization, the notion of attribute-based keyword search (ABKS) has been introduced and widely deployed in practice. To enhance traditional security of ABKS, two state-of-the-art solutions are presented to address keyword guessing attacks or setup inconsistency for secret key. Nevertheless, they have not simultaneously considered the following threats to a data user: (i) inconsistent secret key/cipher-index caused by outside dishonest authority and/or data owner; (ii) algorithm substitution attacks (ASA) launched by inside adversarial eavesdropping. These attacks may unfortunately lead to cloud data breach and user information exposure. To tackle such outside and inside threats, we introduce subversion-resistance and consistency for secure and fine-grained cloud document search services. In particular, we propose a consistent ABKS system with cryptographic reverse firewalls (CRF). Technically, we refer to verifiable functional encryption and employ non-interactive zero-knowledge proofs of discrete logarithm equality to ensure strong input consistency for ABKS. In addition, we build a trusted CRF zone for sanitizing algorithm outputs against ASA attacks. Moreover, we formalize the security model and formally prove security of our system. To clarify practical performance, we implement state-of-the-art solutions and our system in real cloud environment based on Enron dataset. The results show that our system achieves more enhanced security properties without obviously sacrificing performance. In particular, our system achieves comparable time and storage cost for document-index encryption and document search, as compared to state-of-the-art solutions.

Cloud-based VANETs are designed to enable communication between high-speed vehicles. In such a highly dynamic environment, how to provide secure and anonymous communication service is a challenge. In this article, we affirmatively address the challenge by proposing a traitor-resistant and dynamic anonymous communication framework (TD-ACF) for cloud-based VANETs, which supports several advantageous features. In TD-ACF, each vehicle is represented by a set of attributes instead of its real identity, and the driving data is transmitted in encrypted form. Therefore, the anonymous authentication and the confidentiality of driving data are achieved in this way. Meanwhile, TD-ACF supports two practical requirements in cloud-based VANETs: the revocation and the traceability of traitor. For the former, TD-ACF can force a vehicle to exit the communication network at any moment. We employ an efficient binary tree algorithm to reduce the size of key updates for revocation from the traditional linear to the logarithmic level. For the latter, we overcome the barrier of the one-to-many relationship between a vehicle and the shared set of attributes to support traitor tracing. In TD-ACF, unlike most existing schemes, the Semi-Trusted Cloud (STC) can directly capture and punish a traitor instead of querying all the records in the list of unrevoked vehicles. In addition, we solve the key escrow problem that plagues most existing attribute-based schemes. The theoretical analysis and experimental simulation show that the proposed scheme is feasible and effective.

Outsourcing encrypted data to cloud servers that has become a prevalent trend among Internet users to date. There is a long list of advantages on data outsourcing, such as the reduction cost of local data management. How to securely operate encrypted data (remotely), however, is the top-rank concern over data owner. Lianget al.proposed a novel encrypted cloud-based data share and search system without loss of privacy. The system allows users to flexibly search and share encrypted data as well as updating keyword field. However, the search complexity of the system is of extreme inefficiency,$O(n d)$, where$d$is the total number of system files and$n$is the size of query formula. This article, for the first time, leverages the “oblivious cross search” technology in public key searchable encryption context to reduce the search complexity toonly$O(nf(w))$, where$f(w)$is the number of files embedded with the “least frequent keyword”$w$. The new scheme maintains efficient encrypted data share and keyword field update as well. This article further revisits the security models for payload security, keyword privacy and search token privacy (i.e., search pattern privacy) and meanwhile, presents security and efficiency analysis for the new scheme.

Time-based One-Time Password (TOTP) provides a strong second factor for user authentication. In TOTP, a prover authenticates to a verifier by using the current time and a secret key to generate an authentication token (or password) which is valid for a short time period. Our goal is to extend TOTP to the group setting, and to provide both authentication and privacy. To this end, we introduce a new authentication scheme, called Group TOTP (GTOTP), that allows the prover to prove that it is a member of an authenticated group without revealing its identity. We propose a novel construction that transforms any asymmetric TOTP scheme into a GTOTP scheme. Our approach combines Merkle tree and Bloom filter to reduce the verifier’s states to constant sizes.

Searchable Encryption (SE) enables private queries on encrypted documents. Most existing SE schemes focus on constructing industrial-ready, practical solutions at the expense of information leakages that are considered acceptable. In particular, ShadowCrypt utilizes a cryptographic approach named ''efficiently deployable, efficiently searchable encryption'' (EDESE) that reveals the encrypted dataset and the query tokens among other information. However, recent attacks showed that such leakages can be exploited to (partially) recover the underlying keywords of query tokens under certain assumptions on the attacker's background knowledge.

Proof of replication technique has been widely used to verify whether the cloud service providers (CSPs) store multiple replications of a file with dedicated and unique storage space, which effectively prevents CSPs from colluding and storing only one copy of the file. In this field, many representative schemes have been proposed and applied to various scenarios. However, most of the existing schemes are based on the timing assumption (i.e., the verifier rejects the proof of replication if the prover's response is timeout) and do not explicitly consider the problem of batch verification and fault localization. This will bring unnecessary computational overhead to the verifier and reduce the efficiency of batch auditing. To address the above problems, we propose a verifiable proof of replication scheme with fast fault localization and high efficiency. By integrating incompressible encoding and homomorphic linear authenticator, our scheme can effectively audit the integrity of file replications without timing assumptions. To support batch verification and fault localization, we propose a reversed signature aggregation tree (Rev-tree) by integrating the quick binary search and exponent testing. Compared with the traditional binary tree, Rev-tree can further reduce the overhead of batch verification and effectively locate a single fault replication. Moreover, benefit from the property of Rev-tree taking the existing error probability as an estimate of the rest of the tree, our scheme can adjust the verification strategy dynamically to meet with different situations. Finally, security analysis and experimental results show that our scheme is secure and efficient in proof of replication and fast fault localization.

As a versatile system architecture, cloud-fog Internet-of-Things~(IoT) enables multiple resource-constrained devices to communicate and collaborate with each other. By outsourcing local data and immigrating expensive workloads to cloud service providers and fog nodes (FNs), resource-constrained devices can enjoy data services with low latency and minimal cost. To protect data security and privacy in the untrusted cloud-fog environment, many cryptographic mechanisms have been invented. Unfortunately, most of them are impractical when directly applied to cloud-fog IoT computing, mainly due to the large number of resource-constrained end-devices (EDs). In this paper, we present a secure cloud-fog IoT data sharing system with bilateral access control based on a new cryptographic tool called lightweight matchmaking encryption. Our system enforces both sender access control and receiver access control simultaneously and adapts to resource-constrained EDs by outsourcing costly workloads to FNs. We conduct extensive experiments to demonstrate the superior performance of our system to the most relevant solutions in the literature.

Mobile crowdsensing enables people to collect and process a massive amount of information by using social resources without any cost on sensor deployment or model training. Many schemes focusing on the problems of task assignment and privacy preservation have been proposed so far. However, the privacy-preserving of requesters and task access control, which are vital to mobile crowdsensing, is barely considered in the literature. To address the aforementioned issues, a fine-grained task access control system for mobile crowdsensing is proposed. In particular, the requester can decide the group of task performers who can access the task by utilizing attribute-based encryption technology. T he untrusted crowdsensing platform cannot obtain any sensitive information concerning the requester or the task, while the qualified task performers are capable of retrieving tasks within 0.85 ms. Security analysis and experimental results are presented to show the feasibility and efficiency of the proposed system.

Contact tracing is a critical tool in containing epidemics such as COVID-19. Researchers have carried out a lot of work on contact tracing. However, almost all of the existing works assume that their clients and authorities have large storage space and powerful computation capability and clients can implement contact tracing on their own mobile devices such as mobile phones, tablet computers, and wearable computers. With the widespread outbreaks of the epidemics, these approaches are of less robustness to a larger scale of datasets when it comes to resource-constrained clients. To address this limitation, we propose a publicly verifiable contact tracing algorithm in cloud computing (PvCT), which utilizes cloud services to provide storage and computation capability in contact tracing. To guarantee the integrity and accuracy of contact tracing results, PvCT applies a novel set accumulator-based authentication data structure whose computation is outsourced, and the client can check whether returned results are valid. Furthermore, we provide rigorous security proof of our algorithm based on the q -Strong Bilinear Diffie–Hellman assumption. Detailed experimental evaluation is also conducted on three real-world datasets. The results show that our algorithm is feasible within milliseconds of client CPU time and can significantly reduce the storage overhead from the size of datasets to a constant 128 bytes.

Proxy re-encryption (PRE) allows a proxy to transform one ciphertext to another under different encryption keys while keeping the underlying plaintext secret. Because of the ciphertext transformability of PRE, there are many potential private communicating applications of this feature. However, existing PRE schemes are not as full-fledged as expected. The lack of necessary features makes them hard to apply in real-world scenarios. So far, there does not exist a unidirectional multihop PRE scheme with constant decryption efficiency and constant ciphertext size without extensions. Impractical performance and weak scalability also hinder PRE from most real-world applications. In this work, we present a new PRE scheme with secure hardware enclave namedhPRESS(hardware-enhanced PRE scheme using secure enclave). To the best of our knowledge,hPRESSis the first unidirectional multihop PRE scheme which achieves both constant decryption efficiency and constant ciphertext size without extensions. A detailed security analysis demonstrates that our proposal is CCA secure based on the security of the underlying encryption schemes and the secure enclave. We also implement a prototype based on Intel SGX, one of the most popular secure enclave techniques in recent years, and evaluate its performance. The experimental results show that, compared with previous PRE schemes, ourhPRESSis almost one order of magnitude faster in terms of the decryption and transformation.

Ciphertext-Policy Attribute-Based Keyword Search (CP-ABKS) schemes support both fine-grained access control and keyword-based ciphertext retrieval, which make these schemes attractive for resource-constrained users (i.e., mobile or wearable devices, sensor nodes, etc.) to store, share and search encrypted data in the public cloud. However, ciphertext length and decryption overhead in the existing CP-ABKS schemes grow with the complexity of access policies or the number of data users' attributes. Moreover, such schemes generally do not consider the practical multi-owner setting (e.g., each file needs to be signed by multiple data owners before being uploaded to the cloud server) or prevent malicious cloud servers from returning incorrect search results. To overcome these limitations, in this paper we first design an optimized Verifiable Fine-grained Keyword Search scheme in the static Multi-owner setting (termed as basic VFKSM), which achieves short ciphertext length, fast ciphertext transformation, accelerated search process, and authentic search result verification. Then, we extend the basic VFKSM to support multi-keyword search and multi-owner update (also called as extended VFKSM). Finally, we prove that the basic (or extended) VFKSM resists the Chosen-Keyword Attack (CKA) and external Keyword-Guessing Attack (KGA). We also evaluate the performance of these schemes using various public datasets.

A smart home enables users to access devices such as lighting, HVAC, temperature sensors, and surveillance camera. It provides a more convenient and safe living environment for users. Security and privacy, however, is a key concern since information collected from these devices are normally communicated to the user through an open network (i.e. Internet) or system provided by the service provider. The service provider may store and have access to these information. Emerging smart home hubs such as Samsung SmartThings and Google Home are also capable of collecting and storing these information. Leakage and unauthorized access to the information can have serious consequences. For example, the mere timing of switching on/off of an HVAC unit may reveal the presence or absence of the home owner. Similarly, leakage or tampering of critical medical information collected from wearable body sensors can have serious consequences. Encrypting these information will address the issues, but it also reduces utility since queries is no longer straightforward. Therefore, we propose a privacy-preserving scheme, \sf PrivHomePrivHome. It supports authentication, secure data storage and query for smart home systems. PrivHome provides data confidentiality as well as entity and data authentication to prevent an outsider from learning or modifying the data communicated between the devices, service provider, gateway, and the user. It further provides privacy-preserving queries in such a way that the service provider, and the gateway does not learn content of the data. To the best of our knowledge, privacy-preserving queries for smart home systems has not been considered before. Under our scheme is a new, lightweight entity and key-exchange protocol, and an efficient searchable encryption protocol. Our scheme is practical as both protocols are based solely on symmetric cryptographic techniques. We demonstrate efficiency and effectiveness of our scheme based on experimental and simulation results, as well as comparisons to existing smart home security protocols.

E-Healthcare systems are increasingly popular due to the introduction of wearable healthcare devices and sensors. Personal health records (PHRs) are collected by these devices and stored in a remote cloud. Due to privacy concern, these records should not be accessible by any unauthorized party, and the cloud providers should not be able to learn any information from the stored records. To address the above issues, one promising solution is to employ attribute based encryption (ABE) for fine-grained access control and searchable encryption for keyword search on encrypted data. However, most of existing ABE schemes leak the privacy of access policy which may also contain sensitive information. On the other hand, for users' devices with limited computing power and bandwidth, the mechanism should enable them to be able to search the PHRs efficiently. Unfortunately, most existing works on ABE do not support efficient keyword search on encrypted data. In this work, we propose an efficient hidden policy ABE scheme with keyword search. Our scheme enables efficient keyword search with constant computational overhead and constant storage overhead. Moreover, we enhance the recipient's privacy which hides the access policy. As of independent interest, we present a trapdoor malleability attack and demonstrate that some of previous schemes may suffer from such attack.

As a versatile technique, cloud-fog computing extends the traditional cloud server to offer various on-demand data services. Maintaining data confidentiality is one of the most crucial requirements for data services, many cryptosystems have been proposed to reserve information privacy against such an untrusted environment. However, in cloud-fog computing, how to confidentially and efficiently share data and fetch desirable data without expensive data decryption for resource-constrained end-devices is challenging. In this paper, we propose a cloud-fog system for the Internet-of-Things (IoT) ecosystem by introducing a cryptographic primitive called server-aided revocable bilateral attribute-based encryption (SRB-ABE). Our solution is a secure and lightweight bilateral access control system with dynamic user groups, including (1) fine-grained data user and data owner access control simultaneously; (2) outsourced data source identification; (3) server-aided user revocation with publicly updatable ciphertexts; and (4) lightweight data decryption mechanism with one exponentiation computation. We present the formal definition and concrete construction of SRB-ABE with security proofs to build cloud-fog systems. The extensive comparison and experimental analysis demonstrate that our construction has superior functionality and comparable performance than the most relevant solutions.

As an immutable append-only distributed ledger, blockchain allows a group of participants to reach a consensus in an untrustworthy ecosystem. Immutability is a blockchain feature that persists data forever, but it is no longer legal in reality. Blockchain has unchangeable improper contents that violate laws. Moreover, data regulation toward “the right to be forgotten” requires blockchain must be modifiable. To address this problem, redactable blockchain has been introduced to relax immutability in a controlled way. However, once a participant is authorized, she/he can rewrite any content and no penalty for the malicious behavior that hinders the wide deployment of redactable blockchain in practice. In this paper, we introduce a new notion, dubbed k-time modifiable and epoch-based redactable blockchain (KERB) with a monetary penalty to control rewriting privileges and penalize malicious behaviors. Our solution is built up from simple building blocks: digital signatures and chameleon hashes. We give a formal definition and security models of KERB, and present a generic construction along with formal proofs. The extensive comparison and experimental analysis illustrate that our solution enjoys superior functionalities and performances than the state-of-the-art solutions.

Big data analytics has been regarded as a promising technology to yield better insights into future development by government and industry. Data collection and aggregation are necessary pre-steps to enable data analysis. However, data may be dispersed across multiple places and in different formats. Even worse, data can be encrypted under various encryption mechanisms when data owners try to secure the confidentiality of the data. This makes data aggregation extremely challenging, if not impossible, especially when the encryption keys cannot be shared for various reasons. In this paper, we take the first step in addressing this problem. More specifically, we propose a new notion of cross-domain encryption switching service that securely bridges two well-studied encryption mechanisms, namely traditional public key encryption and identity-based encryption. As of independent interest, our notion supports keyword search over encrypted data, i.e., after encryption switching one may search over the (outsourced) data without loss of data and query secrecy. We provide a provably-secure instantiation satisfying the notion, and further present the efficiency analysis to show the scalability. Our proposed scheme may be applicable in multi-domain cloud storage system.

Secure cloud storage, which is an emerging cloud service, is designed to protect the confidentiality of outsourced data but also to provide flexible data access for cloud users whose data is out of physical control. Ciphertext-Policy Attribute-Based Encryption (CP-ABE) is regarded as one of the most promising techniques that may be leveraged to secure the guarantee of the service. However, the use of CP-ABE may yield an inevitable security breach which is known as the misuse of access credential (i.e., decryption rights), due to the intrinsic “all-or-nothing” decryption feature of CP-ABE. In this paper, we investigate the two main cases of access credential misuse: one is on the semi-trusted authority side, and the other is on the side of cloud user. To mitigate the misuse, we propose the first accountable authority and revocable CP-ABE based cloud storage system with white-box traceability and auditing, referred to as CryptCloud±. We also present the security analysis and further demonstrate the utility of our system via experiments.

Outsourced inference service has enormously promoted the popularity of deep learning, and helped users to customize a range of personalized applications. However, it also entails a variety of security and privacy issues brought by untrusted service providers. Particularly, a malicious adversary may violate user privacy during the inference process, or worse, return incorrect results to the client through compromising the integrity of the outsourced model. To address these problems, we propose SecureDL to protect the model’s integrity and user’s privacy in Deep Neural Networks (DNNs) inference process. In SecureDL, we first transform complicated non-linear activation functions of DNNs to low-degree polynomials. Then, we give a novel method to generate sensitive-samples, which can verify the integrity of a model’s parameters outsourced to the server with high accuracy. Finally, We exploit Leveled Homomorphic Encryption (LHE) to achieve the privacy-preserving inference. We shown that our sensitive-samples are indeed very sensitive to model changes, such that even a small change in parameters can be reflected in the model outputs. Based on the experiments conducted on real data and different types of attacks, we demonstrate the superior performance of SecureDL in terms of detection accuracy, inference accuracy, computation, and communication overheads.

Network middleboxes perform deep packet inspection (DPI) to detect anomalies and suspicious activities in network traffic. However, increasingly these traffic are encrypted and middleboxes can no longer make sense of them. A recent proposal by Sherry et al. (SIGCOMM 2015), named BlindBox, enables the middlebox to perform inspection in a privacy-preserving manner. BlindBox deploys garbled circuit to generate encrypted rules for the purpose of inspecting the encrypted traffic directly. However, the setup latency (which could be 97s on a ruleset of 3,000 as reported) and overhead size incurred by garbled circuit are high. Since communication can only be commenced after the encrypted rules being generated, such delay is intolerable in many real-time applications. In this work, we present PrivDPI, which reduces the setup delay while retaining similar privacy guarantee. Compared to BlindBox, for a ruleset of 3,000, our encrypted rule generation is 288x faster and requires 290,227x smaller overhead for the first session, and is even 1,036x faster and requires 3424,505x smaller overhead over 20 consecutive sessions. The performance gain is based on a new technique for generating encrypted rules as well as the idea of reusing intermediate results generated in previous sessions across subsequent sessions. This is in contrast to Blindbox which performs encrypted rule generation from scratch for every session. Nevertheless, PrivDPI is 6x slower in generating the encrypted traffic tokens, yet in our implementation, the token encryption rate of PrivDPI is more than 17,271 per second which is sufficient for many real-time applications. Moreover, the intermediate values generated in each session can be reused across subsequent sessions for repeated tokens, which could further speedup token encryption. Overall, our experiment shows that PrivDPI is practical and especially suitable for connections with short flows.

Abstract In this paper, we proposed an idea to construct a general multivariate public key cryptographic (MPKC) scheme based on a user’s identity. In our construction, each user is distributed a unique identity by the key distribution center (KDC) and we use this key to generate user’s private keys. Thereafter, we use these private keys to produce the corresponding public key. This method can make key generating process easier so that the public key will reduce from dozens of Kilobyte to several bits. We then use our general scheme to construct practical identity-based signature schemes named ID-UOV and ID-Rainbow based on two well-known and promising MPKC signature schemes, respectively. Finally, we present the security analysis and give experiments for all of our proposed schemes and the baseline schemes. Comparison shows that our schemes are both efficient and practical.

The Internet of Things (IoT)-based health system provides patients and doctors a lot of conveniences, doctors can diagnose patients in time through monitored health data. However, doctors may make a wrong diagnosis of the patient's illness, if the health data stored on the cloud is tampered or lost due to an external attack or power failure. Therefore, it is of great importance to verify the integrity of the patient's health data stored on the cloud. Existing data integrity verification technologies usually need data owner to compute data authenticators for verification, but sensors on a patient in IoT-based health system have limited computation ability, thus existing data integrity verification technologies are not very suitable in IoT-based health system. This paper proposes a lightweight secure IoT-based health storage system to solve this problem. The proposed system employs edge server to compute data authenticators and verify data integrity, greatly reduces the system's computation cost and management burden of third party verifier. Security analysis and performance evaluation show the proposed system is feasible.

Searchable encryption (SE) provides a privacy-preserving mechanism for data users to search over encrypted data stored on a remote server. Researchers have designed a number of SE schemes with high efficiency yet allowing some degree of leakage profile to the remote server. The leakage, however, should be further measured to allow us to understand what types of attacks an SE scheme would encounter. This paper considers passive attacks that make inferences based on prior knowledge and observations on queries issued by users. This is in contrast to previously studied active attacks that adaptively inject files and queries. We consider several assumptions on the types or prior knowledge the attacker possessed and propose a few passive attacks. In particular, under the “full-fledged” assumption, the keyword recovery rate of our attack is optimal in the sense that it is equal to the theoretical upper bound. We further present several enhanced attacks under other weaker assumptions on various levels of the prior knowledge that the attacker can obtain, in which the keyword recovery rates are optimal or nearly optimal (i.e., approaching the theoretical upper bound). In addition, we provide extensive experiments to show the “power” of our passive attacks. This paper highlights the importance of minimizing the prior knowledge of a server and the leakage of search queries. It also shows that simply distorting the frequency of the keyword to hold against our passive attacks may not scale well.

Ciphertext-policy attribute-based encryption (CP-ABE) has been proposed to enable fine-grained access control on encrypted data for cloud storage service. In the context of CP-ABE, since the decryption privilege is shared by multiple users who have the same attributes, it is difficult to identify the original key owner when given an exposed key. This leaves the malicious cloud users a chance to leak their access credentials to outsourced data in clouds for profits without the risk of being caught, which severely damages data security. To address this problem, we add the property of traceability to the conventional CP-ABE. To catch people leaking their access credentials to outsourced data in clouds for profits effectively, in this paper, we first propose two kinds of non-interactive commitments for traitor tracing. Then we present a fully secure traceable CP-ABE system for cloud storage service from the proposed commitment. Our proposed commitments for traitor tracing may be of independent interest, as they are both pairing-friendly and homomorphic. We also provide extensive experimental results to confirm the feasibility and efficiency of the proposed solution.

As a sophisticated mechanism for secure finegrained access control over encrypted data, ciphertext-policy attribute-based encryption (CP-ABE) is one of the highly promising candidates for cloud computing applications. However, there exist two main long-lasting open problems of CP-ABE that may limit its wide deployment in commercial applications. One is that decryption yields expensive pairing cost which often grows with the increase of access policy size. The other is that one is granted access privilege for unlimited times as long as his attribute set satisfies the access policy of a given ciphertext. Such powerful access rights, which are provided by CP-ABE, may be undesirable in real-world applications (e.g., pay-as-youuse). To address the above drawbacks, in this paper, we propose a new notion called auditable σ-time outsourced CF-ABE, which is believed to be applicable to cloud computing. In our notion, expensive pairing operation incurred by decryption is offloaded to cloud and meanwhile, the correctness of the operation can be audited efficiently. Moreover, the notion provides σ-time fine-grained access control. The cloud service provider may limit a particular set of users to enjoy access privilege for at most σ times within a specified period. As of independent interest, the notion also captures key-leakage resistance. The leakage of a user's decryption key does not help a malicious third party in decrypting the ciphertexts belonging to the user. We design a concrete construction (satisfying our notion) in the key encapsulation mechanism setting based on Rouselakis and Waters (prime order) CP-ABE, and further present security and extensive experimental analysis to highlight the scalability and efficiency of our construction.

Ciphertext-policy attribute-based encryption (CP-ABE) enables fine-grained access control to the encrypted data for commercial applications. There has been significant progress in CP-ABE over the recent years because of two properties called traceability and large universe, greatly enriching the commercial applications of CP-ABE. Traceability is the ability of ABE to trace the malicious users or traitors who intentionally leak the partial or modified decryption keys for profits. Nevertheless, due to the nature of CP-ABE, it is difficult to identify the original key owner from an exposed key since the decryption privilege is shared by multiple users who have the same attributes. On the other hand, the property of large universe in ABE enlarges the practical applications by supporting flexible number of attributes. Several systems have been proposed to obtain either of the above properties. However, none of them achieve the two properties simultaneously in practice, which limits the commercial applications of CP-ABE to a certain extent. In this paper, we propose two practical large universe CP-ABE systems supporting white-box traceability. Compared with existing systems, both the two proposed systems have two advantages: 1) the number of attributes is not polynomially bounded and 2) malicious users who leak their decryption keys could be traced. Moreover, another remarkable advantage of the second proposed system is that the storage overhead for traitor tracing is constant, which are suitable for commercial applications.