Low-latency live streaming (LLS) has emerged as a popular web application, with many platforms adopting real-time protocols such as WebRTC to minimize end-to-end latency. However, we observe a counter-intuitive phenomenon: even when the actual encoded bitrate does not fully utilize the available bandwidth, stalling events remain frequent. This insufficient bandwidth utilization arises from the intrinsic temporal variations of real-time video encoding, which cause conventional packet-level congestion control algorithms to misestimate available bandwidth. When a high-bitrate frame is suddenly produced, sending at the wrong rate can either trigger packet loss or increase queueing delay, resulting in playback stalls. To address these issues, we present Camel, a novel frame-level congestion control algorithm (CCA) tailored for LLS. Our insight is to use frame-level network feedback to capture the true network capacity, immune to the irregular sending pattern caused by encoding. Camel comprises three key modules: the Bandwidth and Delay Estimator and the Congestion Detector, which jointly determine the average sending rate, and the Bursting Length Controller, which governs the emission pattern to prevent packet loss. We evaluate Camel on both large-scale real-world deployments and controlled simulations. In the real-world platform with 250M users and 2B sessions across 150+ countries, Camel achieves up to a 70.8% increase in 1080P resolution ratio, a 14.4% increase in media bitrate, and up to a 14.1% reduction in stalling ratio. In simulations under undershooting, shallow buffers, and network jitter, Camel outperforms existing congestion control algorithms, with up to 19.8% higher bitrate, 93.0% lower stalling ratio, and 23.9% improvement in bandwidth estimation accuracy.

Person re-identification (Re-ID) can recognize users based on their clothing, body shape, and other information without the need for clear facial images, and is widely applied in the field of intelligent security. Traditional Re-ID systems mainly rely on high-definition RGB cameras, but the deployment of large-scale high-definition RGB cameras indoors has caused serious privacy and ethical concerns. Recently, wireless-based Re-ID systems (Wi-Fi, RFID, millimeter-wave radar, etc.) have shown promising prospects, but the limited sensing resolution hinders their practical deployment. In this paper, we propose WarmGait, a Re-ID system based on thermal array sensors, which can achieve high-precision Re-ID at low cost and minimize the invasion of user privacy. However, using thermal arrays for Re-ID still faces two major challenges. The first is the low and unclear texture resolution of images caused by low-cost infrared devices. The second is that existing gait recognition methods require maintaining the sequential constraint of gait images, which reduces the flexibility of gait recognition or Re-ID. To address these two challenges, we first designed an edge module inspired by Taylor Finite Difference (TFD) to aggregate image edge information to help improve the resolution of infrared devices. Then, we considered gait as a collection of gait profiles and extracted features from the frame level and collection level for recognition, breaking through the limitations of the number and order of input images. After extensive experimental evaluation, our model can achieve an average recognition accuracy of 87.3% in various scenarios, demonstrating the potential of WarmGait in Re-ID.

Live streaming that supports real-time interaction has become increasingly popular. To support the ensuing requirements on low end-to-end latency, RTM, the state-of-the-art live streaming system at Douyin, replaces the HTTP-FLV streaming protocol with WebRTC. To tailor the WebRTC stack to the live streaming scenario, we focus on optimizing first-frame delay, startup video rebuffering, audio-to-video drift, and per-session CPU usage. Those are the top-priority metrics identified from an importance analysis with respect to two user engagement metrics, i.e., viewer penetration and viewing time. To date, WebRTC-based streaming in RTM has been in operation for 4 years, and serves billions of viewer sessions every day. It dramatically optimizes QoE metrics (e.g., end-to-end latency reduced by 54.5%), and delivers statistically significant user engagement gains (e.g., number of paid orders increased by 0.8%). In this paper, we report our deployment experiences comprehensively.

Tile-based streaming and super resolution (SR) are two representative technologies adopted to improve bandwidth efficiency of 360° video streaming. The former allows selective downloading of contents in the user viewport by splitting the video into multiple independently decodable tiles. The latter leverages client-side computation to enhance the received video to higher quality using advanced neural network models. In this work, we propose a Collaborated Streaming and Enhancement (CSE) adaptation framework for mobile 360° videos, which integrates super resolution with tile-based streaming to optimize the user experience with dynamic bandwidth and limited computing capability. To effectively enhance the tile-based video streaming through SR, we propose to adaptively group the tiles for quality enhancement adapting to the content similarity. We also identify and address several key design issues to integrate SR into tile-based video streaming including unified video quality assessment, computational complexity model for super resolution, and buffer analysis considering the interplay between transmission and enhancement. We further formulate the quality-of-experience (QoE) maximization problem for mobile 360° video streaming and propose a rate adaptation algorithm to make the best decisions for download and for enhancement based on the Lyapunov optimization theory. Extensive evaluation results validate the superiority of our proposed approach, which demonstrates stable performance with considerable QoE improvement, while enabling a trade-off between playback smoothness and video quality.

With the development of Wi-Fi sensing, wireless-based gait recognition has become increasingly important as it supports a wide range of applications (person identification, disease diagnosis, etc.). However, two serious challenges limit the universal deployment of such Wi-Fi vision schemes: i) the limited bandwidth of Wi-Fi severely restricts the granularity of gait recognition, and ii) users non-gait behaviors (e.g., stopping and turning) interfere with the extraction of gait-related features. In this paper, we propose CSID, which can achieve robust gait recognition under the limited bandwidth conditions of commercial Wi-Fi devices. Specifically, we use a neural network to generate super-resolution spectrograms of channel state information (CSI), overcoming the limitation of insufficient Wi-Fi bandwidth. To overcome the challenge of non-gait behavior interference, considering the human-incomprehensible nature of Wi-Fi spectrograms, we adopt cross-domain adversarial training and further extract gait features that are independent of the interference behaviors by learning domain-independent representations. We conducted a large number of experiments in different indoor environments, and the average person identification rate of the CSID system reached 91.6%. These results demonstrate that the CSID system is promising and could be used as a complement to visual person identification systems in the future.

The alignment of Image Quality Assessment (IQA) models with diverse human preferences remains a challenge, owing to the variability in preferences for different types of visual content, including user-generated content and AI-Generated Content (AIGC), etc. Despite the significant success of existing IQA methods in assessing specific visual content by leveraging knowledge from pre-trained models, the intricate factors impacting final ratings and the specially designed network architecture of these methods result in gaps in their ability to accurately capture human preferences for novel visual content. To address this issue, we propose Align-IQA, a novel framework that aims to generate visual quality scores aligned with diverse human preferences for various types of visual content. Align-IQA contains two key designs: (1) A customizable quality-aware guidance injection module. By injecting specializable quality-aware prior knowledge into general-purpose pre-trained models, the proposed module guides the acquisition of quality-aware features and allows for various adjustments of features to be consistent with diverse human preferences for different types of visual content. (2) A multi-scale feature aggregation module. By simulating the multi-scale mechanism in the human visual system, the proposed module enables the extraction of a more comprehensive representation of quality-aware features from the human perception perspective. Extensive experimental results demonstrate that Align-IQA achieves better or comparable performance to State-Of-The-Art (SOTA) methods. Notably, Align-IQA outperforms the previous best results on AIGC datasets, achieving Pearson's Linear Correlation Coefficients (PLCCs) of 0.890 (+3.73%) on AGIQA-1K and 0.924 (+1.99%) on AGIQA-3K. Additionally, Align-IQA reduces training parameters by 72.26% and inference overhead by 78.12%, while maintaining SOTA performance.

Bandwidth Estimation(BWE) is the most important and challenging problem for Real Time Communication(RTC) systems. The rule-based BWE is designed with hand-crafted rules, which mainly depend on human knowledge, and therefore is difficult to generalize to unknown scenarios. Learning-based BWE algorithms, especially online reinforcement learning-based algorithms, are proposed to explore new decisions in complex network environments adaptively. However, these algorithms require frequent interactions with the environment, which would cause catastrophic experience for RTC users.

Distributed data storage (DDS) can assist compressive crowdsensing (CCS) to solve the challenge of temporary data storage in the network. Block compressive sensing effectively addresses DDS of large spatiotemporal data from crowdsensing, allowing efficient reconstruction at low storage and computational costs. However, when the data is unevenly distributed over the sensing area, existing algorithms ignore the variability of information between blocks and still require the central server to uniformly collect samples from each block stored on the mobile device, leading to a reduction in overall reconstruction accuracy. To address this, we propose an adaptive sampling allocation strategy that deeply analyzes the statistical information of each block which can help the central server to collect the number of measurements for each block adaptively to improve the sampling quality. Additionally, we consider the correlation between blocks and use a global denoising strategy to further improve the reconstruction accuracy. Experimental results demonstrate that, compared to the state-of-the-art DDS-CCS algorithm, our proposed adaptive sampling allocation with a joint-denoising mechanism significantly improves the accuracy of the information-rich blocks that most affect the global accuracy, and hence the global reconstruction accuracy. which also remains robust to different block sizes and exhibits improved stability.

Distributed data storage (DDS) in mobile crowdsensing (MCS) systems has recently gained popularity. Data should be briefly saved on participants’ mobile devices before being gathered once the centralized cloud servers resume normal operations. For MCS systems, the existing DDS strategies briefly considered reconstructing the scene as precisely as possible without thinking about the costs of each step. However, our goal is to obtain a sufficiently accurate approximation of the sensing data from mobile participants with as few costs as possible. We note a crucial observation: when a specified number of participants have been transmitted to a central server, the sensing data has already been well reconstructed, and the accuracy advancement with additional transmitted participants is minimal. In our scheme, two stopping criteria are proposed for DDS in compressive MCS, which aims to enhance recovery performance while reducing the costs of the whole process. In the first stopping criterion, we established a rule to stop the continued recruitment of participants. The algorithm adaptively increases the number of participants until the reconstruction accuracy meets the requirement. Another stopping criterion of the reconstruction algorithm is designed to find a more accurate number of iterations than the original. The experiment results demonstrate that the first stopping criterion can reduce participants’ collection while obtaining an approximate value. The second stopping criterion assists the reconstruction algorithm in terminating at a more appropriate number of iterations, saving computing costs while ensuring accuracy.

The searchable encryption (SE) is a particular case of structured encryption, which has been intensively researched in the secure cloud storage system. By constructing a structured secure index, such as encrypted multimaps (EMMs), encrypted inverted index (EII), etc., SE can achieve efficient keyword search over the encrypted data set. However, existing SE constructions do not take search permissions into consideration, resulting in the lack of a mechanism of the data access control, which may not be suitable for Industrial Internet of Things (IIoT) applications, since an integrated industrial system contains all kinds of data with rigorous access permissions. In this article, we construct an attribute-based SE (ABSE) construction for a cloud-assisted IIoT application scenario. By designing the novel access policy-based structured secure index and the attribute-based search token, our construction achieves fine-grained keyword search privilege control over encrypted IIoT data as well as the same search complexity as the traditional SE. To the best of our knowledge, this is the first ABSE construction. We provide the correctness and security proofs for our construction. Experimental evaluation results in a real-world data set show the correctness and the practical search efficiency of the proposed ABSE.

The cloud-assisted industrial Internet of Things (IIoT) architecture can sustain highly available computation and massive storage services for modern industrial systems. When data owners store IIoT data to remote cloud platforms, the data security will face tough challenges. Cryptographic technologies endow an ability to guarantee data confidentiality. However, traditional encryption techniques make data access control and data searching malfunctioning. Recently emerging attribute-based keyword search (ABKS) primitive achieves fine-grained access control and effective data searching over ciphertexts. However, existing ABKS schemes only consider single data owner scenarios and may be an inappropriate choice for IIoT applications, where there exists multiple data owners for an integrated industrial system. Directly extending state-of-the-art single owner schemes to ones for multiowner environment will impose a complicated key management issue. We present an ABKS scheme for multiowners in the cloud-assisted IIoT architecture. By designing a novel master key generation and private key aggregation mechanism with desired communication overheads, our scheme eliminates the complex key management issue in the multiowner model. Formal security proof demonstrates that our scheme is secure against the cloud server. Experimental evaluations also demonstrate its correctness and practicality.

The attribute-based keyword search (ABKS), which simultaneously achieves searching and fine-grained access control over encrypted data, is frequently applied in cloud computing environments characterized by data storage and sharing. Recently, inspired by attribute-based encryption (ABE) and searchable encryption (SE) primitives, several ABKS schemes have been presented. However, almost all existing ABKS schemes actually only provide an attribute-based keyword equality match function and do not have a structural index to support practical search efficiency and dynamic data updates in real-world applications. To the best of our knowledge, this study is the first to realize an attribute-based keyword search construction supporting numerical comparison expressions with the practical search efficient and dynamic data update capacity (ABKS-NICEST), based on our proposed attribute-based keyword secure search scheme supporting numerical comparison expressions (ABKS-NICE) and anexclusive OR-chain-based inverted index structure. To the best of our knowledge, ABKS-NICEST is the first attributed-based keyword search scheme with practical search efficiency and dynamic data update capacity. In addition, numerical values are an important and common attribute, so providing comparison expressions among numerical values can greatly enhance the expressivity of access policy. Therefore, we use the prefix membership verification technique to design a method to support any numeric comparison expression in a flexible and uniform manner. Through theoretical and experimental evaluations, we determine that ABKS-NICEST is the most efficient ABKS scheme.

Existing WiFi recognition schemes are capable of discovering patterns of indoor semantics, such as human activity, identity, indoor environment, and so on. We note that channel state information (CSI) presents an opportunity for hackers to learn indoor privacy, however, currently there is a lack of security research on CSI. In this article, we are the first to discuss and define the security problem of CSI signals, which is further extended to the problems of nontargeted protection and targeted protection. To solve them, we present two types of adversarial autoencoder networks (AAENs). Through replacing the original signals with the generated adversarial ones, the protected semantic features are modified, and the significant features of the other semantics required to be recognized are reserved. Intensive evaluations demonstrate that with the proposed AAENs, the recognition accuracy of the protected semantic can be significantly decreased, while still maintaining the other semantics to be identified correctly.

The e-healthcare cloud system has shown its potential to improve the quality of healthcare and individuals' quality of life. Unfortunately, security and privacy impede its widespread deployment and application. There are several research works focusing on preserving the privacy of the electronic healthcare record (EHR) data. However, these works have two main limitations. First, they only support the `black or white' access control policy. Second, they suffer from the inference attack. In this paper, for the first time, we design an inference attack-resistant e-healthcare cloud system with fine-grained access control. We first propose a two-layer encryption scheme. To ensure an efficient and fine-grained access control over the EHR data, we design the first-layer encryption, where we devise a specialized access policy for each data attribute in the EHR, and encrypt them individually with high efficiency. To preserve the privacy of role attributes and access policies used in the first-layer encryption, we systematically construct the second-layer encryption. To take full advantage of the cloud server, we propose to let the cloud execute computationally intensive works on behalf of the data user without knowing any sensitive information. To preserve the access pattern of data attributes in the EHR, we further construct a blind data retrieving protocol. We also demonstrate that our scheme can be easily extended to support search functionality. Finally, we conduct extensive security analyses and performance evaluations, which confirm the efficacy and efficiency of our schemes.

With the advent of cloud computing, more and more people tend to outsource their data to the cloud. As a fundamental data utilization, secure keyword search over encrypted cloud data has attracted the interest of many researchers recently. However, most of existing researches are based on an ideal assumption that the cloud server is “curious but honest”, where the search results are not verified. In this paper, we consider a more challenging model, where the cloud server would probably behave dishonestly. Based on this model, we explore the problem of result verification for the secure ranked keyword search. Different from previous data verification schemes, we propose a novel deterrent-based scheme. With our carefully devised verification data, the cloud server cannot know which data owners, or how many data owners exchange anchor data which will be used for verifying the cloud server's misbehavior. With our systematically designed verification construction, the cloud server cannot know which data owners' data are embedded in the verification data buffer, or how many data owners' verification data are actually used for verification. All the cloud server knows is that, once he behaves dishonestly, he would be discovered with a high probability, and punished seriously once discovered. Furthermore, we propose to optimize the value of parameters used in the construction of the secret verification data buffer. Finally, with thorough analysis and extensive experiments, we confirm the efficacy and efficiency of our proposed schemes.

With the advent of cloud computing, it has become increasingly popular for data owners to outsource their data to public cloud servers while allowing data users to retrieve this data. For privacy concerns, secure searches over encrypted cloud data has motivated several research works under the single owner model. However, most cloud servers in practice do not just serve one owner; instead, they support multiple owners to share the benefits brought by cloud computing. In this paper, we propose schemes to deal with privacy preserving ranked multi-keyword search in a multi-owner model (PRMSM). To enable cloud servers to perform secure search without knowing the actual data of both keywords and trapdoors, we systematically construct a novel secure search protocol. To rank the search results and preserve the privacy of relevance scores between keywords and files, we propose a novel additive order and privacy preserving function family. To prevent the attackers from eavesdropping secret keys and pretending to be legal data users submitting searches, we propose a novel dynamic secret key generation protocol and a new data user authentication protocol. Furthermore, PRMSM supports efficient data user revocation. Extensive experiments on real-world datasets confirm the efficacy and efficiency of PRMSM.

With the advent of cloud computing, it becomes increasingly popular for data owners to outsource their data to public cloud servers while allowing data users to retrieve these data. For privacy concerns, secure searches over encrypted cloud data motivated several researches under the single owner model. However, most cloud servers in practice do not just serve one owner, instead, they support multiple owners to share the benefits brought by cloud servers. In this paper, we propose schemes to deal with secure ranked multi-keyword search in a multi-owner model. To enable cloud servers to perform secure search without knowing the actual data of both keywords and trapdoors, we systematically construct a novel secure search protocol. To rank the search results and preserve the privacy of relevance scores between keywords and files, we propose a novel Additive Order and Privacy Preserving Function family. Extensive experiments on real-world datasets confirm the efficacy and efficiency of our proposed schemes.

Cloud computing provides abundant benefits including easy access, decreased costs and flexible resource management. For privacy concerns, sensitive data have to be encrypted before outsourcing, which obsoletes traditional data utilization based on plaintext keyword search. Therefore, developing a secure search service over encrypted cloud data is of paramount importance. There are several researches concerned about this problem. However, all these schemes are based on a single cloud model which has the threat of single point of failure, loss and corruption of data, loss of availability and loss of privacy. In this paper, we explore the problem of secure distributed keyword search in a multi-cloud paradigm. We first define a distributed search model. Based on this model, we propose two schemes. In scheme_I, we propose to cross-store all encrypted file slices, keywords and keys. In scheme_II, we systematically construct a keyword distributing strategy and a file distributing strategy. Further, we extend both schemes with Shamir's secret schemes to achieve better availability and robustness. Extensive experiments on real-world datasets confirm the efficacy and efficiency of our schemes.