APT (Advanced Persistent Threat) attacks last for a long time and have strong penetration, which allows attackers to obtain a large amount of sensitive data and resources. Traditional access control algorithms cannot completely prevent highly concealed APT attack intrusions and cannot meet the access control requirements in a multi-domain environment. Therefore, this paper proposes a multi-domain interoperability dynamic access control algorithm for APT attacks. The APT attack is mapped to the Petri net, and its attack mode is deeply analyzed. The trust experience, trust knowledge and trust recommendation of each domain in the network under the APT attack are calculated to obtain the trust value of each domain; the domain trust level is obtained based on the domain trust value, and the access rights of the corresponding role in the domain are assigned according to the level to complete the multi-domain interoperability dynamic access control. The experimental results show that the algorithm has high control efficiency and good control performance. The success rate of malicious node requests does not exceed 10%, and the access request takes only 2.3ms. It can be seen that the dynamic access control mechanism proposed in this study can not only effectively deal with APT attack scenarios, but also maintain the high performance of the network while ensuring system security.

As SDN (Software Defined Network) becomes more and more widely used, the risk of SDN network facing DDoS (Distributed Denial of Service, Distributed Denial of Service) attacks is also increasing. The attack traffic generated by DDoS attacks will cause serious damage to SDN. The network brings huge load pressure, which affects the normal network business. In severe cases, it may cause the entire SDN network to be paralyzed and cause property losses. Therefore, the detection of attack methods is very necessary and of great significance. This paper proposes an attack detection method based on Fuzzy C-means clustering algorithm (FCM), and designs a DDoS attack detection and defense system that includes three major functions: data collection, attack detection, and attack defense. Finally, the effectiveness of the proposed DDoS attack detection algorithm and defense strategy was verified through experiments. Experimental results show that the missed detection rate and bit error rate of the FCM fuzzy clustering algorithm are only 4.15% and 3.75%, which have obvious advantages over other commonly used detection methods.

With the booming development of blockchain, it has gradually gained wide attention in the Internet of Things (IoT), finance, and other fields. However, due to the shared nature of blockchain ledgers among multiple users, sensitive user information, such as transaction amounts and private agreements, can be easily exposed. This poses significant privacy concerns for blockchain users. To address this issue, we propose TrustChain, a high-performance smart contract model based on the Trusted Execution Environment (TEE). TrustChain aims to safeguard the privacy of smart contract codes and user data by leveraging the secure execution environment provided by the TEE. Specifically, we introduce the TEE to run the smart contract with security and privacy without introducing a heavyweight cryptographic algorithm, thus improving the performance of the system. When running smart contracts, the operate nodes equipped with TEE ensure that the Operating System (OS) of the node itself cannot access the data within the TEE. This isolation effectively separates the sensitive information of the smart contract from the external environment. Furthermore, we introduce Verifiable Random Functions (VRFs) to randomly choose the operate nodes to prevent collusion attacks, further improving the security of the model. The graph ledger, based on the Directed Acyclic Graph (DAG), is used to adapt to the high-performance characteristics of a smart contract system based on the TEE. Finally, we simulate the scheme in TrustZone and demonstrate the feasibility of TrustChain through a series of experiments and analyses. The analysis and experimental results demonstrate that our solution exhibits excellent privacy protection performance and achieves higher throughput compared to traditional smart contracts. • We have introduced TrustChain, a smart contract model based on TEE, to ensure the privacy and security of smart contracts. • VRFs are proposed to randomly select operate nodes, preventing collusion and enhancing defense against malicious attacks. • The redesigned consensus mechanism limits blockchain storage to smart contract outputs, preventing leakage of sensitive information. • We enhanced smart contract performance by integrating a DAG-based ledger with TEE's low-latency execution.

Due to the integration of cloud computing in Internet of Things (IoT) systems, an increasing volume of IoT data is encrypted and uploaded to cloud servers. Attribute-Based Keyword Search (ABKS) schemes enable authorized users to access the encrypted IoT data, however, existing schemes suffer from sensitive information exposure (caused by publicly visible access policies) and low efficiency in dynamic multi-party sharing. To alleviate these issues, this paper develops an efficient attribute-based searchable proxy re-encryption scheme with policy hiding for IoT data sharing. Specifically, the scheme employs a layered encryption architecture where symmetric encryption (e.g., AES) protects massive IoT data, and Attribute-Based Encryption (ABE) secures the symmetric key. Such design ensures that policy updates for dynamic multi-party sharing are implemented by updating the ABE ciphertext using proxy re-encryption keys, eliminating the need to re-encrypt bulk IoT data. Meanwhile, an AND-gate structure for multi-valued attributes is introduced to enforce access policies while ensuring policy hiding and protecting data owners’ sensitive information. Additionally, the proposed scheme achieves constant overhead (key/ciphertext sizes are independent of attributes), supports fast keyword search, and enables low-latency data retrieval in IoT systems. Rigorous security analysis and comparative evaluations with closely relevant schemes validate the security and practicality of our scheme.

In cloud Electronic Medical Records (EMRs), health-related private information such as genetics and diseases is contained. Thus, the secure ownership transfer protocol should protect users’ privacy. In certain scenarios, some users, including patients, doctors, medical and research institutions, may be offline. As a result, existing protocols cannot be directly employed. Motivated by these observations, in this paper we propose a secure and efficient ownership transfer for cloud EMRs auditing protocol. Specifically, our protocol allows the existence of offline users while ensuring users anonymity, it is achieved using different signature constructions. Additionally, a tracing mechanism is introduced to safeguard against malicious users. We rigorously prove the security of our protocol, comprehensively evaluate the performance of it, and compare our protocol with a few closely relevant protocols. According to the evaluations, our protocol significantly improves ownership transfer efficiency while achieving additional functionalities, including public verifiability, multi-ownership transferability, anonymity, and traceability.

Abstract Federated learning (FL) is a focus of research in the area of privacy protection since it does not have the privacy issues that arise from data concentration. Although its emergence has attracted widespread attention from academia and industry, existing works on FL still face security challenges. FL can be considered as a cooperative-based task to achieve global model sharing. However, the model raises issues of cooperative security, such as free-riding and poisoning attacks. Therefore, we focus on the behavior of participants with strong cooperative relationships and build a Cooperative Security-aware Federated Learning model using blockchain. In addition, we propose a credit-based economic model including profit and punishment mechanisms to ensure fairness and security among participants. Furthermore, for data privacy, we develop a participation permission strategy to protect the privacy of participants through proxy re-encryption and homomorphic encryption. Finally, the simulation results of the real datasets show that the proposed scheme achieves a good performance in security and accuracy.

Abstract In certain cloud Electronic Medical Records (EMRs) applications, the data ownership may need to be transferred. In practice, not only the data but also the auditing ability should be transferred securely and efficiently. However, we investigate and find that most of the existing data ownership transfer protocols only work well between two individuals, and they become inefficient when dealing between two communities. The proposals for transferring tags between communities are problematic as well since, they require all members get involved or a fully trusted aggregator facilitates ownership transfer, which are unrealistic in certain scenarios. To alleviate these problems, in this paper we develop a secure auditing protocol with decentralized (t, n)-threshold ownership transfer for cloud EMRs. This protocol is designed to operate efficiently without requiring the mandatory participation of every user or the involvement of any trusted third-party. It is achieved by employing the threshold signature. Rigorous security analyses and comprehensive performance evaluations illustrate the security and practicality of our protocol. Specifically, according to the evaluations and comparisons, the communication and computational consumption is independent of the file size, i.e., it is constant in our protocol for both communities.

Abstract Studies show that machine learning models trained from biased data can discriminate against groups with certain sensitive attributes. This problem can be mitigated by cleaning the original data or learning fair representations. However, collecting real data in real-life is extremely time and resource-consuming, whereas generative models (e.g., GANs) can create new data that enable more application scenarios. Therefore, utilizing fair data generated by generative models can benefit various downstream tasks. In this paper, we propose a information-minimizing generative adversarial network to improve the fairness of machine learning by generating fair data. An ANOVA-based latent factor is constructed in the input for reducing the accuracy loss, and the joint adversarial training between the generator and classifier can better solve the indirect discrimination and achieve fair classification. Extensive experiments on various environments show the effectiveness of the proposed method.

Abstract Reconfigurable intelligent surface (RIS) has great potential in securing wireless transmission, and it can flexibly change the wireless communication environment. However, the employment of RIS increases the difficulty in beamforming of base station (BS), and existing schemes cannot be directly utilized to enhance the security of system. Therefore, a reinforcement learning framework to jointly control BS and RIS for the purpose of enhancing the secure performance is proposed. Specifically, the beamforming ia transformed with artificial noise and reflection control as a Markov decision problem (MDP) in complex domain. Then, we develop the deep deterministic policy gradient based on complex‐valued neural networks (CV‐DDPG) to imitate the rules of complex computation. Additionally, the CV‐DDPG is performed as the agent of reinforcement learning to control the BS and RIS, which enables better utilization of the implied phase information of complex values in the system. The simulation results show that the proposed model promotes the performance of the control and greatly improves the secrecy rate of the legitimate user.

To secure communications, this article presents a key extraction scheme for smart devices using ambient sounds. Specifically, it is designed for the scenario when smart devices do not have any pre-loaded secrets. Moreover, it can be implemented when smart devices have no access to the online trusted third party or the Network Time Protocol server. In our scheme, smart devices achieve synchronization by making use of ambient sounds. Then, they calculate and obtain the pairing distance and secure distance by applying a band-pass filter. Completing these operations, two smart devices can directly extract a communication key. We analyze the security of our scheme and evaluate the performance of it by implementing the scheme using a few off-the-shelf devices. The experimental results indicate that compared with related schemes, the bit generation rate of our scheme has significant improvement (increases at least 80%), and it can reach 312 bit/s.

The rapid development of genomic high-throughput sequencing has identified a large number of DNA regulatory elements with abundant epigenetics markers, which promotes the rapid accumulation of functional genomic region data. The comprehensively understanding and research of human functional genomic regions is still a relatively urgent work at present. However, the existing analysis tools lack extensive annotation and enrichment analytical abilities for these regions. Here, we designed a novel software, Genomic Region sets Enrichment Analysis Platform (GREAP), which provides comprehensive region annotation and enrichment analysis capabilities. Currently, GREAP supports 85 370 genomic region reference sets, which cover 634 681 107 regions across 11 different data types, including super enhancers, transcription factors, accessible chromatins, etc. GREAP provides widespread annotation and enrichment analysis of genomic regions. To reflect the significance of enrichment analysis, we used the hypergeometric test and also provided a Locus Overlap Analysis. In summary, GREAP is a powerful platform that provides many types of genomic region sets for users and supports genomic region annotations and enrichment analyses. In addition, we developed a customizable genome browser containing >400 000 000 customizable tracks for visualization. The platform is freely available at http://www.liclab.net/Greap/view/index.

Due to the characteristics of wireless network transmission, smart home devices are vulnerable to malicious attacks. Malicious attackers can not only intercept the transmission data of smart home devices to grasp the user’s personal privacy information but also can eavesdrop the transmission between devices to forge the user’s legal information. These attacks have brought great security risks to people’s daily lives. In order to ensure the security of transmitted data, establishing keys for smart home devices is necessary. In this article, an adaptive physical-layer key generation scheme based on received signal strength (RSS) is proposed in Smart Homes. The scheme performs group quantization and adaptive quantization on the collected RSS measurements. The design of group quantization improves the randomness of the generated keys and makes 0 and 1 in generated keys more evenly distributed. The advantage of adaptive quantization is to design adaptive quantization intervals. The smart home devices can select the appropriate quantized reference levels according to the RSS measurements in different scenarios. In order to verify the practicability of the key generation scheme, we analyze the performance of the proposed scheme in static and dynamic scenarios. In addition, this scheme is compared with other key generation schemes from various performance indicators. The comparison results show that our scheme is better than other schemes in terms of randomness.

Long noncoding RNAs (lncRNAs) have been proven to play important roles in transcriptional processes and biological functions. With the increasing study of human diseases and biological processes, information in human H3K27ac ChIP-seq, ATAC-seq and DNase-seq datasets is accumulating rapidly, resulting in an urgent need to collect and process data to identify transcriptional regulatory regions of lncRNAs. We therefore developed a comprehensive database for human regulatory information of lncRNAs (TRlnc, http://bio.licpathway.net/TRlnc), which aimed to collect available resources of transcriptional regulatory regions of lncRNAs and to annotate and illustrate their potential roles in the regulation of lncRNAs in a cell type-specific manner. The current version of TRlnc contains 8 683 028 typical enhancers/super-enhancers and 32 348 244 chromatin accessibility regions associated with 91 906 human lncRNAs. These regions are identified from over 900 human H3K27ac ChIP-seq, ATAC-seq and DNase-seq samples. Furthermore, TRlnc provides the detailed genetic and epigenetic annotation information within transcriptional regulatory regions (promoter, enhancer/super-enhancer and chromatin accessibility regions) of lncRNAs, including common SNPs, risk SNPs, eQTLs, linkage disequilibrium SNPs, transcription factors, methylation sites, histone modifications and 3D chromatin interactions. It is anticipated that the use of TRlnc will help users to gain in-depth and useful insights into the transcriptional regulatory mechanisms of lncRNAs.

Abstract The functional encryption scheme designed using the lattice can realize fine-grained encryption and it can resist quantum attacks. Unfortunately, the sizes of the keys and ciphertexts in cryptographic applications based on learning with errors are large, which makes the algorithm inefficient. Therefore, we construct a functional encryption for inner product predicates scheme by improving the learning with errors scheme of Agrawal et al. [Asiacrypt 2011], and its security relies on the difficulty assumption of ring learning with errors. Our construction can reduce the sizes of the keys and ciphertexts compared with the learning with errors scheme.

Cryptographic keys should be established for the smart home devices in order to secure home area networks. In certain smart home applications, however, the devices might be produced by different factories. As a result, it becomes impractical to assume devices are preloaded with secrets before leaving factories. Moreover, in some scenarios, smart home devices have no access to an online trusted third party. These problems make conventional key agreement schemes inapplicable for these devices. It is investigated that devices can extract secrets from received signal strength (RSS) measurements at the physical layer. However, the bit extraction rate is low. The Merkle puzzle is introduced to design the key agreement scheme by expanding the low entropy seed to high entropy secret key. However, it introduces considerable time and computation costs. To alleviate these problems, in this article, we design a hybrid key agreement scheme for smart homes. Namely, smart home devices first extract short random keys at the physical layer. Then, they establish secret communication keys at higher layers by making use of the Merkle puzzle. In this way, secret keys can be established without using any preloaded secrets or online trusted third party. We prove the security of the new scheme and present a prototype implementation using Ralink WiFi cards. Moreover, we evaluate the performance of our scheme and compare it with other related schemes. The analysis shows that comparing with the related schemes, in our scheme, the time cost is at least one order of magnitude lower, the computation cost is at least five orders of magnitude lower, and the extra communication cost is moderate.

The characteristics of wireless transmission make the smart homes become vulnerable to kinds of malicious attacks, such as eavesdropping. To ensure the security of home area networks, cryptographic keys need to be established for smart home devices. Specifically, the lightweight physical layer key extraction schemes can be implemented. In practice, however, the key generation rate of the state-of-the-art schemes is low. To improve the rate, in this paper we propose an adaptive secret key establishment scheme for smart homes using the Received Signal Strength (RSS) measurements. Two smart home devices can adaptively quantize the collected RSS measurements and obtain the secret key. To illustrate the practicality of our scheme, we experimentally implement it using the Ralink WiFi cards based on the RT2870 chipset. In addition, we evaluate the randomness of the generated key by conducting the NIST randomness test experiment.

In this paper, we present a method for comparing and evaluating different collections of machine learning algorithms on the basis of a given performance measure (e.g., accuracy, area under the curve (AUC), F-score). Such a method can be used to compare standard machine learning platforms such as SAS, IBM SPSS, and Microsoft Azure ML. A recent trend in automation of machine learning is to exercise a collection of machine learning algorithms on a particular problem and then use the best performing algorithm. Thus, the proposed method can also be used to compare and evaluate different collections of algorithms for automation on a certain problem type and find the best collection. In the study reported here, we applied the method to compare six machine learning platforms – R, Python, SAS, IBM SPSS Modeler, Microsoft Azure ML, and Apache Spark ML. We compared the platforms on the basis of predictive performance on classification problems because a significant majority of the problems in machine learning are of that type. The general question that we addressed is the following: Are there platforms that are superior to others on some particular performance measure? For each platform, we used a collection of six classification algorithms from the following six families of algorithms – support vector machines, multilayer perceptrons, random forest (or variant), decision trees/gradient boosted trees, Naive Bayes/Bayesian networks, and logistic regression. We compared their performance on the basis of classification accuracy, F-score, and AUC. We used F-score and AUC measures to compare platforms on two-class problems only. For testing the platforms, we used a mix of data sets from (1) the University of California, Irvine (UCI) library, (2) the Kaggle competition library, and (3) high-dimensional gene expression problems. We performed some hyperparameter tuning on algorithms wherever possible. The online supplement is available at https://doi.org/10.1287/ijoc.2018.0825 .

To secure the communications of home area networks, cryptographic keys need to be established between smart home devices. Though many key agreement schemes have been proposed, they cannot be directly implemented, due to the reason that in some applications, smart home devices have no access to the online trusted third party. Moreover, in certain scenarios, the smart home devices are manufactured by different factories. As a result, it is a challenge to securely establish the communication keys using the secrets preloaded by different factories. A few key agreement schemes are designed without using the online trusted third party and the preloaded secrets. However, there are some problems in these schemes. In this article, we improve these schemes and design a key agreement scheme for smart homes such that the devices can automatically and securely establish the communication key. Specifically, our scheme is designed by making use of the secret mismatch problem (exists in the physical layer secret extraction schemes). We prove the security of the proposed scheme and present a prototype implementation. Additionally, we analyze the performance of our scheme and compare it with that of other related works. The comparison shows that our key agreement scheme can fix the problems in the related works, however, it introduces some extra communication consumptions.

Data sharing in cloud computing enables multiple participants to freely share the group data, which improves the efficiency of work in cooperative environments and has widespread potential applications. However, how to ensure the security of data sharing within a group and how to efficiently share the outsourced data in a group manner are formidable challenges. Note that key agreement protocols have played a very important role in secure and efficient group data sharing in cloud computing. In this paper, by taking advantage of the symmetric balanced incomplete block design (SBIBD), we present a novel block design-based key agreement protocol that supports multiple participants, which can flexibly extend the number of participants in a cloud environment according to the structure of the block design. Based on the proposed group data sharing model, we present general formulas for generating the common conference key IC for multiple participants. Note that by benefiting from the (v, k + 1, 1)-block design, the computational complexity of the proposed protocol linearly increases with the number of participants and the communication complexity is greatly reduced. In addition, the fault tolerance property of our protocol enables the group data sharing in cloud computing to withstand different key attacks, which is similar to Yi's protocol.

Two-party password-authenticated key exchange (2PAKE) protocols provide a natural mechanism for secret key establishment in distributed applications, and they have been extensively studied in past decades. However, only a few efforts have been made so far to design password-authenticated group key exchange (GPAKE) protocols. In a 2PAKE or GPAKE protocol, it is assumed that short passwords are preshared among users. This assumption, however, would be impractical in certain applications. Motivated by this observation, this article presents a GPAKE protocol without the password sharing assumption. To obtain the passwords, wireless devices, such as smart phones, tablets, and laptops, are used to extract short secrets at the physical layer. Using the extracted secrets, users in our protocol can establish a group key at higher layers with light computation consumptions. Thus, our GPAKE protocol is a cross-layer design. Additionally, our protocol is a compiler, that is, our protocol can transform any provably secure 2PAKE protocol into a GPAKE protocol with only one more round of communications. Besides, the proposed protocol is proved secure in the standard model.

SUMMARY Certificate‐based signature computation is often performed on insecure devices where the signature key is easy to be exposed. To reduce the influence of key exposure, we introduce key‐insulated mechanism into certificate‐based cryptography and formalize the notion and security model of the certificate‐based key‐insulated signature scheme. We then present a certificate‐based key‐insulated signature scheme, which is proven to be existentially unforgeable against adaptive chosen message attacks in the random oracle model. The proposed scheme has potential applications in trusted computing. Copyright © 2013 John Wiley & Sons, Ltd.

Due to the nature of wireless transmission, communication in wireless mesh networks (WMNs) is vulnerable to many adversarial activities including eavesdropping. Pair-wise key establishment is one of the fundamental issues in securing WMNs. This paper presents a new matrix-based pairwise key establishment scheme for mesh clients. Our design is motivated by the fact that in WMNs, mesh routers are more powerful than mesh clients, both in computation and communication. By exploiting this heterogeneity, expensive operations can be delegated to mesh routers, which help alleviate the overhead of mesh clients during key establishment. The new scheme possesses two desirable features: (1) Neighbor mesh clients can directly establish pairwise keys; and (2) Communication and storage costs at mesh clients are significantly reduced.