Integrity auditing with deduplication enables integrity verification of cloud-stored IoT data while alleviating storage overhead caused by data redundancy. In most existing deduplication auditing schemes, authenticators are generated using the initial client’s key. However, clients are often vulnerable to key exposure. Compromise of the private key undermines the auditing security of all identical files. Although client-key-based schemes provide stronger security, they still suffer from the risk of gradual key-exposure in long-term deployments. Therefore, achieving integrity auditing, data deduplication, and resistance to long-term key-exposure simultaneously remains a challenging problem. While some existing schemes achieve these objectives, they rely on a third-party auditor. Compromise of the auditor would endanger all clients, and its continuous involvement could incur additional communication overhead. To address these limitations in cloud-based IoT data storage, this work presents an integrity auditing scheme that simultaneously supports deduplication and long-term key-exposure resilience without requiring a third party for key updates. By aggregating authenticators and public keys of clients, authenticator storage, proof generation and proof verification costs remain independent of the number of participating clients. Additionally, the integrity of previously uploaded data remains protected even when all clients’ secret keys at the current time are compromised. Our scheme is provably secure in the random oracle model under the ℓ-wBDHI∗3assumption. Performance evaluations further demonstrate that the authenticator size and auditing cost are unaffected by the number of identical files, making the scheme practical for cloud-based IoT systems.

Federated learning, as a distributed machine learning framework, enables participants to collaboratively train models by uploading only local gradients instead of exchanging local data. However, the malicious server might infer the participants' private data from the uploaded gradients or return incorrect aggregated results to participants. To tackle the above issues, numerous privacy-preserving and verifiable federated learning schemes have been developed. However, only a few of these schemes address collusion-resistant verification, and none considers the potential disputes between participants and server. In this paper, we put forward a privacy-preserving federated learning scheme with collusion-resistant verification and fair arbitration (PFLVA). In PFLVA, a novel verification method is designed, in which non-colluding participants can verify the correctness of aggregated gradient, even if up to$N-1$participants collude with the server, where$N$denotes the total number of online participants. We propose an efficient gradient encryption method to ensure participants' privacy while substantially reducing the computational overhead. We introduce a smart contract to locate the compromised entity when disputes arise and to achieve fair arbitration. Additionally, PFLVA allows participants to go offline without incurring additional computational or communication overheads for the online participants. We provide a comprehensive security analysis to demonstrate the correctness, verifiability, privacy protection, and collusion resistance of PFLVA. Experimental results demonstrate that PFLVA maintains high model accuracy while significantly reducing the computational and communication overhead for participants compared to related schemes.

Secure data forwarding involves converting decrypted ciphertext, initially readable by one user, into a format that can be deciphered by another user. Proxy re-encryption is a commonly employed technique for secure data forwarding. However, this technique faces two inherent limitations. Firstly, only the data owner possesses the ability to control which data users can decrypt the ciphertext, resulting in receivers receiving irrelevant or uninterested information. Secondly, when data is forwarded through multiple nodes, it becomes vulnerable to various attacks such as impersonation and forgery. A solution called bilateral access control addresses these issues by letting the sender and receiver specify access control policies that the other party should comply with and ensure message confidentiality and authenticity. Nevertheless, to the best of our knowledge, there is currently no existing bilateral access control scheme capable of achieving secure data forwarding. In response to this issue, we propose a privacy-preserving proxy bilateral access control scheme, which simultaneously achieves all the above functionalities. Subsequently, we prove the message confidentiality and authenticity under the standard assumptions in the random oracle model. Finally, extensive theoretical analysis and performance evaluation demonstrate that the scheme provides unique features and comparable performance.

The ubiquitous sensing capabilities of the Internet of Things (IoT) enable large-scale user tracking by identifying users who appear in at least t distributed location datasets. However, the distribution of these datasets across multiple tracking entities significantly increases the risk of sensitive data exposure. To address this problem, threshold multi-party private set intersection (T-MPSI) provides a promising privacy-preserving solution. Although the known works about T-MPSI have made valuable contributions, especially in terms of security, the efficiency deficiency in current T-MPSI protocols becomes apparent in large-scale deployment for user tracking. The core challenge is to develop an efficient T-MPSI protocol under the relaxed security constraint that is acceptable for user tracking. We first design a lightweight batch replicated secret sharing private membership test protocol with high performance. Moreover, we develop a one-round secure aggregation algorithm that bridges the gap between the secure query and the secure comparison built upon replicated secret sharing. Building on these techniques, we present an efficient T-MPSI protocol tailored to the designated k-collusion model. Our protocol significantly enhances secure query efficiency and ensures that the communication complexity of secure comparison remains independent of the number of parties. We formally prove its security, and extensive experiments in a LAN setting demonstrate at least a 6× speedup for secure query and a 3× speedup for secure comparison over the state-of-the-art protocol. These results confirm the practicality and efficiency of the proposed protocol for privacy-preserving user tracking.

The convergence of machine learning and searchable encryption enhances the ability to protect the privacy and security of data and enhances the processing power of confidential data. To enable users to efficiently perform machine learning tasks on encrypted data domains, we delve into oblivious keyword search with authorization (OKSA). The OKSA scheme effectively maintains the privacy of the user’s query keywords and prevents the cloud server from inferring ciphertext information through the searching process. However, limitations arise because the traditional OKSA approach does not support multi‐keyword searches. If a data file is associated with multiple keywords, each keyword and corresponding data must be encrypted one by one, resulting in inefficiency. We introduce an innovative approach aimed at enhancing the efficiency of search processes while addressing the limitation of current encryption and search systems that handle only a single keyword. This method, known as the oblivious multiple keyword search with authorization (OMKSA), is designed for more effective keyword retrieval. One of our important innovations is that it uses the arithmetic techniques of bilinear pairs to generate new tokens and new search methods to optimize communication efficiency. Moreover, we present a detailed and rigorous demonstration of the security for our proposed protocol, aligned with the predefined security model. We conducted a comparative experiment to determine which of the two schemes, OKSA and OMKSA, is more efficient when querying multiple keywords. Based on our experimental results, our OMKSA is very efficient for data searchers. As the number of query keywords increases, the computational overhead of connected keyword searches remains stable. Finally, as we move into the 5G era, the potential applications of OMKSA are huge, with clear implications for areas such as machine learning and artificial intelligence. Our findings pave the way for further exploration and deployment of these frontier areas.

With the rapid advancement of Internet of Things (IoT) technology, large volumes of data are exchanged among users via cloud servers. However, in an untrusted cloud server environment, the risk of data tampering is significant. For instance, a cloud server may fail to update its records promptly after receiving updated data from a data sender. Consequently, when the data receiver retrieves the relevant information, the cloud server may return outdated data, leading to security issues in data utilization. To address this problem, we propose a scheme that facilitates efficient verification in untrustworthy cloud environments. Our research approach is to utilize cryptographic accumulators within the oblivious searchable encryption model to achieve efficient verification. The data sender first uses a cryptographic accumulator to calculate the cumulative value of all messages to be uploaded, which are publicly accessible. In addition, the accumulator generates witness values for messages authorized to the data recipient. Before retrieving data, the data receiver can leverage the cryptographic accumulator to verify the timeliness of incoming messages, ensuring that the data is current and free from tampering. Furthermore, the data sender retains the flexibility to dynamically update the data stored in the cloud and efficiently refresh both the encrypted accumulator and its corresponding witness value. This article presents a rigorous security proof and a comparative experiment was carried out, supported by both analytical evaluations and experimental results, which collectively confirm the practical applicability of the proposed scheme in the context of the IoT.

Verifiable data streaming (VDS) is proposed to authenticate a sequence of ordered data, such that the misbehavior on the data returned by cloud server can be effectively detected. VDS also allows to efficiently replace the outsourced data by another value. However, the old authentication information can make the expired data pass the verification. To prevent this attack, VDS schemes must provide a revocation approach to revoke the old authentication information. The current approach employs the tree-like authentication structure or cryptographic accumulator, which will influence the efficiency of the VDS scheme. In this work, we find an approach to construct the low-storage VDS scheme supporting efficient revocation. Towards this end, we fully exploit the property of chameleon hash function with ephemeral trapdoor to propose a signature, which is the crucial step to construct the VDS scheme. In our VDS scheme, the size of the authentication information can be reduced to be less than the scale of the data streaming (i.e., low storage). Furthermore, the client is able to revoke the old authentication information in an efficient manner, where she only needs to release a message (i.e., efficient revocation). The performance evaluation shows that the proposed VDS scheme is efficient and practical.

Public-key Encryption with Keyword Search (PEKS) is a promising cryptographic mechanism that enables a semi-trusted cloud server to perform (on-demand) keyword searches over encrypted data for data users. Existing PEKS schemes are limited to precise or fuzzy keyword searches, creating a gap given the widespread use of wildcards for rapid searches in real-world applications. To address this issue, several wildcard keyword search schemes have been proposed to support wildcard searches in the public-key setting. However, these schemes suffer from inefficiency and/or inflexibility. Worse yet, they are all vulnerable to (insider) keyword guessing attacks (KGA), which is highly effective when the keyword space is polynomial in size. To address these vulnerabilities, this paper first proposes a new wildcard keyword search scheme called Public-key Encryption with Wildcard Search (PEWS), which is built based on the standard Decisional Diffie-Hellman (DDH) assumption. The complexity of all algorithms in PEWS increases linearly with the keyword length, while remaining almost constant or even decreasing linearly with the number of wildcards. To resist against (insider) KGA, we further extend PEWS into the first Public-key Authenticated Encryption with Wildcard Search (PAEWS) scheme. Our PEWS and PAEWS schemes are highly flexible, supporting searches for any number of wildcards positioned anywhere within the keyword. We conduct a comprehensive performance evaluation of our PEWS and PAEWS, while also comparing PEWS with the state-of-the-art scheme in the public-key setting. The experimental results demonstrate that both PEWS and PAEWS are efficient and practical, and the experimental comparisons illustrate that PEWS achieves approximately$2 \times $faster computation and reduces communication by at least 50%.

Verifiable data streaming (VDS) enables the client to incrementally store a sequence of ordered data on an untrusted cloud server, and verify the validity of the retrieved data. Moreover, the client can replace a data with another value. The common security problem caused by updating operation is the cloud server may use old authentication information to make expired data pass the verification. To solve this problem, the known approaches use the cryptographic accumulator that actually influences the performance of VDS scheme. The main concerns can be generalized as how to design a VDS scheme without cryptographic accumulator, in such a way that further optimizes the performance of VDS scheme. We put forward the idea to convert the standard digital signature relevant to the updated data into chameleon digital signature whose non-transferability is the key to solve the problem. This is the first attempt to securely authenticate the dynamic data without cryptographic accumulator. In the proposed VDS scheme, the client's local storage overhead, computation overheads of the cloud server in responding to a query and updating the data are constant. As the experimental results shown, the proposed VDS scheme outperforms the scheme in terms of the efficiency.

Data streaming is an ordered sequence of data continuously generated over time, whose dynamic scale is hard to be predicated in advance. Since the traditional integrity verification primitives are not qualified to check the integrity of the retrieved data and the outsourced database in streaming setting, some specific schemes were proposed by adopting the tree- like authentication structure or the combination of signature and accumulator. However, these schemes are not optimal for the owner. The main concerns can be generalized as how to reduce the size of the authentication information to be less than the scale of the data streaming, and enable the resource-constrained owner to check the data integrity without using challenge. To address the problems, we intend to find a new approach to design the scheme by exploiting the novel technique called decentralized vector commitment (DVC). Towards this goal, we first propose a key exposure-freeness chameleon vector commitment scheme, and then present the efficient DVC technique based on our key exposure-freeness chameleon vector commitment scheme. The scheme is finally constructed by leveraging the efficient DVC technique. Besides the integrity verification, our scheme is also sufficient to efficiently distribute the data to a user who is protected from receiving the stale data. To optimize the performance in concurrently retrieving multiple data, we introduce the batch query that reduces large amounts of communication and computation overheads. The security analysis and performance evaluation show that our solutions are secure and efficient.

In this study, an efficient deep-learning-driven sparse-target imaging (DLSTI) method was developed for array borehole radar to improve the accuracy of target localization in a subsurface nonuniform media. First, by making use of the linear superposition and separable characteristics of the target and background echo, the background echo was generated with an electromagnetic (EM) simulation using prior medium information. The background echo was then removed from the radar receiver echo using a convex-optimization-based front-end target echo extractor (TEE) to obtain the raw sparse target echo. Subsequently, the raw target echoes and true target locations in the simulation dataset were utilized for the training of a back-end stacked autoencoder (SAE) in a data-driven manner, which is capable of illustrating accurate target locations in field tests in nonuniform environments after training. The comparison results in multiple simulations and field scenes show that the proposed DLSTI outperforms other effective imaging methods in terms of target localization accuracy and image sidelobes (SLs), including reverse time migration and back-projection (BP), whose localization error was improved to 0.02 m and the image SL was reduced by 16.09 dB.

Verifiable database with update (VDB) enables the client to store a large dataset in the outsourced database, and then efficiently query and update the data with a new value. It is attractive for the merits of checking the validity of the queried data and detecting the malicious actions of tampering with the outsourced database concurrently. However, the database in the context of VDB is merely suitable to store a fixed-size dataset. Hence, VDB is inapplicable to the unbounded-size database that provides the capability to store and manage the arbitrary-size datasets in the incremental manners. To circumvent the weaknesses, we research on the verifiable unbounded-size database with update (VUSDB). The VUSDB is sufficient for multiple clients to store their own arbitrary-size datasets in the database that has already contained some datasets. In order to design a VUSDB scheme, we first put forward a primitive called authenticated matrix commitment and give a scheme. This primitive is qualified to commit to a collection of ordered data represented in the form of matrix, and assure the ownership of the opened data. Then we utilize the authenticated matrix commitment scheme to construct a VUSDB scheme. The performance evaluation shows that the proposed schemes are efficient and practical.

We consider an outsourced computation model in the selective data sharing setting. Specifically, one of the data owners outsources the encrypted data to an untrusted cloud server, and wants to share the specific function of these data with a group of data users. A data user can perform the specific computation on the data that it is authorized to access. We propose a construction under this model for the inner product computation by using the Inner Product Functional Encryption (IPFE) as a building block. A standard IPFE used on this model has two privacy weaknesses regarding the master secret key and the encrypted vector. We propose a strengthened IPFE that revises these weaknesses. We construct a new IPFE scheme and use it to construct an efficient outsourced inner product computation scheme. In our outsourced computation scheme, the storage overhead and the computation cost for a data user are independent of the vector size. The result privacy and the outsourced data privacy are well preserved against the untrusted cloud server. The experimental results show that our schemes are efficient and practical.

In this article, an efficient radar fusion-before-imaging (RFBI) method for heterogeneous borehole radar systems is proposed. Different from conventional fusion-after-imaging processes, the sample sets collected from heterogeneous borehole radar systems (monostatic, bistatic, or multiple-input multiple-output) are first merged into one data set before the imaging process in RFBI, and a single imaging operation is demanded to obtain the target space image with high precision. Specifically, the diversity in heterogeneous borehole radar sample sets is taken into consideration, and the radar sample sets are inserted and fused into a high-dimensional sample set before imaging. The target space spectrum is generated according to the echo space–frequency constraint relationship, and the target space is extracted from one imaging process. The influence of clutters in RFBI results is reduced, and the imaging accuracy is satisfactory. Meanwhile, due to the fusion process ahead, the computational time of RFBI hardly increases with the number of radar sample sets. The synthetic and field experiment results show that RFBI demonstrates comparable accuracy as Kirchhoff migration and higher efficiency in processing large amounts of data sets at the cost of large memory requirement, which is suitable for the joint imaging of heterogeneous radar systems.

Wildcard searchable encryption is an advanced variant of searchable encryption that can simultaneously maintain the searchability and confidentiality of the encrypted data. The wildcard searchable encryption outperforms the standard one for the fact that the users can use it to search the desired data even with the inexact keywords. Considering the millisecond level response time in the era of 5G, there are higher demands on the efficiency and accuracy that may be a pair of contradictions in wildcard searchable encryption. To improve the efficiency without sacrificing the accuracy, we put forward a novel scheme, tree-based index scheme (TBIS), through filtering the search results step by step instead of enumeration in the prior works and in the instantiation of TBIS, the search time drops sharply to the millisecond level. By using more kinds of characters, the accuracy of search result is improved visibly. TBIS achieves nonadaptive security that is indistinguishable against chosen character set attacks proposed in this paper. The security criteria can capture the relationship among characters, keywords and documents. At last, we put forward a frame structure in machine learning as an application of the proposed scheme.

Summary With the wide deployment of cloud computing, outsourcing complicated computational tasks to cloud service providers has attracted much attention. An increasing number of clients with computationally constrained devices choose to outsource their heavy tasks to cloud servers to reduce the computational overhead in local. However, how to preserve the integrity of computational results becomes a challenge since commercial cloud servers are not trusted. Public verifiability is an effective mechanism to allow clients to verify the integrity of the results returned by the servers. Because the results are sensitive in many applications, it raises the problem of privacy leakage in the public verification process. In this paper, we propose an efficient verifiable computation scheme while keeping output privacy. The proposed scheme achieves blind verifiability such that the verifiers who have not the additional information (retrieve key) can verify the integrity of the result without learning the result. Furthermore, by combining with (k,n)‐threshold sharing, our scheme allows the clients jointly learn the results.

This paper presents an efficient multiple-input multiple-output (MIMO) borehole radar imaging method based on a high degree of freedom for subsurface sensing. The variable separations between the different transmitter and receiver pairs in MIMO borehole radar are considered and introduced as imaging coefficients into the expanded unified MIMO sample set, which gives the MIMO sample set desired characteristics of a high degree of freedom. By exploiting the high degree of freedom in the unified MIMO expanded sample set, the sample interpolation and energy migration of target reflections can be done in once efficient imaging processing for all transmitters of the MIMO radar system, and finally, accurate target image with low sidelobe level (SL) can be delivered. The computational cost of the proposed method will barely increase with the number of transmitters in the MIMO radar survey, which enables the proposed method to handle MIMO borehole radar imaging in an accurate and efficient manner. The imaging properties of the proposed method are proven to be superior to the conventional imaging methods in SL and computational cost, which is suitable for large MIMO borehole imaging surveys in subsurface sensing applications.

In this paper, the formulation of reverse time migration (RTM) is improved for impulse borehole radar imaging in the subsurface scenarios with layered media. By fully adopting the prior information of surrounding media, the time gating function is designed and applied to the incident wave field and scattering wave field for each imaging point, which strengthens the correlation between the wave fields in the time domain. The clutters partly caused by the multiple reflections between different media layers are suppressed due to the gating function. A normalized zero-offset cross correlation with gated samples is conducted and used to weight the result of RTM. The improved approach is compared with the conventional RTM, the back-projection method, and the Stolt migration algorithm with synthetic data and is then validated by a single-borehole radar experiment in a layered media scenario. The results demonstrate that the developed approach is superior to the conventional methods in locating targets and robust in complex subsurface environments.

In this paper, the formulation of Stolt migration is modified for impulse borehole radar imaging in large nonuniform subsurface scenarios. By applying the nonuniform fast Fourier transform (FFT) to the acquisition of the frequency-wavenumber spectrum (FWS), the efficiency of Stolt migration for nonuniform surveys is improved. First, each nonuniform exponent basis in Fourier transform is approximated with a weighted summation of several uniform exponent bases. Then, the nonuniform samples with the same uniform exponent basis are accumulated to generate a larger virtual uniform sample set. The FWS of nonuniform samples is approximated with the virtual sample set by FFT. Finally, angular frequency interpolation and inverse FFT are performed over a sample FWS to reconstruct the reflectivity map of the imaging area. The selection of approximation parameters is discussed to make a tradeoff between approximation error and computational cost. The improved Stolt migration technique is compared with the conventional backprojection method and the Kirchhoff migration method on synthetic data and validated by a single borehole radar experiment in a subsurface scenario. The results show that the developed Stolt migration is superior to the conventional methods in terms of computational cost, cross-range resolution, and the ability to reconstruct the targets.

A novel data acquisition and imaging method based on compressive sensing is utilized for impulse borehole radar (IBR). With the sparse transform that we present for IBR systems, only 50% or even less samples are needed to be collected and transmitted to reconstruct the target space, which reduces the sampling rate and data transmission rate of IBR systems. The simulation and experiment results show that the proposed method is more robust in noise environment and the reconstructed target spaces have less artifacts compared with the solutions of the traditional Stolt migration method.

Radio frequency interference (RFI) usually makes a great impact on through-wall radar (TWR) using ultrawideband signal to achieve high range resolution. In this paper, a phase-coded stepped-frequency (PCSF) waveform is designed to improve the anti-RFI performance of TWR, based on the fact that the different initial phase of the transmitted signals will have no effect on the receiver response to the target echoes, and the RFI is uncorrelated with the transmitted signals. We present the methodology and results of a comparative study on TWR using the PCSF waveform and the conventional stepped-frequency waveform. Comparisons with simulation data and experimental measurements are given to demonstrate the suitability and efficacy of our analysis for the anti-RFI performance of PCSF waveform. The results show that the TWR using PCSF waveform is immune to RFI, and better detection performance is achieved.

In this paper, the formulation of Stolt migration is modified for impulse borehole radar near-field imaging in the subsurface scenarios where the transceiver is widely separated with respect to the detection range. The proposed approach consists of the following aspects. First, the locations of the transmitter and receiver in the survey are regarded as independent sample dimensions, and the original sample set is converted to an enlarged virtual sample set. The frequency-wavenumber spectrum (FWS) of the virtual sample set is available via multidimensional fast Fourier transform (FFT). Then, the relation between the angular frequency and wavenumbers of the transmitter and receiver is derived in the frame of the virtual sample set, which provides the basis for the interpolation in angular frequency and weighting process of FWS. By applying multidimensional inverse FFT (IFFT) to the interpolated and weighted FWS of the virtual sample set, the energy of target responses will focus in some profile of the IFFT result, the position of which is related with the separation between the transmitter and receiver. Finally, the desired target space can be extracted from the IFFT result. The improved Stolt migration technique is compared with the conventional Stolt migration algorithm, back-projection method, and Kirchhoff migration algorithm on synthetic data and validated by single-borehole radar experiment in the subsurface scenario. The results show that the developed Stolt migration is superior to the conventional methods in cross-range resolution, computational cost, and the ability to reconstruct locations and shapes of targets.