The data generated in the Internet of Things (IoT) holds significant transactional and utilitarian value. However, traditional data trading models face numerous challenges, including privacy leaks of raw data and limitations in arbitration. This paper proposes a secure and verifiable privacy-preserving data trading scheme for IoT (SVDT), in which perturbed data is substituted for raw data to fundamentally mitigate the risk of privacy leakage. Secondly, we construct a dual-verification mechanism based on homomorphic encryption and merkle trees to simultaneously achieve verifiability and confidentiality during the trading process. Additionally, smart contract facilitate escrow and automated execution to ensure trading fairness. Finally, a collusion-resistant anonymous arbitration mechanism is designed utilizing ring signatures to sever the association between the arbitrator’s identity and the adjudication result, thereby safe-guarding the anonymity and independence of the arbitration while effectively resolving disputes. Theoretical analysis demonstrates that the scheme effectively achieves data security and trading fairness, with security analysis validating its privacy-preserving properties. Experimental results show a favorable balance between performance overhead and privacy utility. The findings indicate that SVDT scheme provides a practical solution for fair trading involving IoT data.

Federated learning is a distributed machine learning paradigm through centralized model aggregation. However, standard federated learning relies on a centralized server, making it vulnerable to server failures. While existing solutions utilize blockchain technology to implement Decentralized Federated Learning (DFL), the statistical heterogeneity of data distributions among clients severely degrades the performance of DFL. Driven by this issue, this paper proposes a decentralized federated prototype learning framework, named DFPL, which significantly improves the performance of DFL under heterogeneous data distributions. Specifically, DFPL introduces prototype learning into DFL to mitigate the impact of statistical heterogeneity and reduces the amount of parameters exchanged between clients. Additionally, blockchain is embedded into our framework, enabling the training and mining processes to be executed locally on each client. From a theoretical perspective, we analyze the convergence of DFPL by modeling the required computational resources during both training and mining. The experiment results highlight the superiority of DFPL in both model performance and communication efficiency across four benchmark datasets with heterogeneous data distributions.

Wireless medical sensor networks (WMSNs) have been widely adopted in healthcare for collecting users' physiological data, providing crucial references for medical diagnosis and prevention. However, transmitting sensitive data over public networks faces security risks, potentially leading to privacy breaches and financial losses. Moreover, large-scale data transmission increases energy consumption, hindering continuous monitoring. Therefore, achieving energy efficiency alongside data security is critical for WMSNs. This paper proposes a lightweight slope-based piecewise linear approximation algorithm for online data compression, utilizing slope intervals under a user defined error bound, to reduce energy consumption. Concurrently, we introduce a pairing-free certificateless aggregate signature scheme, proven secure under the random oracle model against different type adversaries, to enhance data privacy and integrity. Experimental results demonstrate that the compression algorithm achieves efficient compression while preserving trends, and the aggregate signature scheme reduces computational overhead by 20% without increasing communication costs.

Deep learning models heavily depend on training data quality. While online datasets offer cost-effective solutions for diversity and scale, they introduce security risks. Malicious actors can inject hidden triggers, enabling backdoor attacks that compromise model integrity. Existing defenses remain limited—often demanding large clean datasets, showing inconsistent robustness across attacks, and struggling against adaptive adversaries. Therefore, in this paper, we endeavor to address the challenges of backdoor attack countermeasures in real-world scenarios, thereby fortifying the security of the training paradigm under the data-collection manner. Concretely, we first explore the inherent relationship between the robustness of the poisoned samples, demonstrating the poisoned samples are more robust to perturbation than the clean ones through the theoretical analysis and experiments. Then, we propose a robust and clean-data-free backdoor defense framework, namely Mellivora Capensis (MeCa), which enables training a clean model on the poisoned dataset.MeCadetects poisoned samples and trains clean models without needing clean data or prior knowledge of the poisoning (e.g., poison ratio). We conduct extensive experiments in defending against 8 SOTA attacks (including 3 adaptive attacks) on 4 datasets. The experimental results reveal thatMeCacan achieve an average attack success rate with almost 0.00% to defend against SOTA backdoor attacks while maintaining model availability, which outperforms 7 SOTA backdoor defense methods. Furthermore, the excellent performance on 3 different model architectures and poison ratios also highlights the remarkable generalization capability ofMeCa.

Federated learning (FL), a distributed computing paradigm, is vulnerable to poisoning attacks that impair model performance and privacy attacks that leak participant information. Existing FL defense schemes struggle to counter poisoning attacks under data heterogeneity and high privacy computation overhead, limiting the practicality of federated learning. To address these issues, this paper proposes a model-contrastive federated learning framework with lightweight privacy preservation and poisoning attack detection, named MCFL. Specifically, we design a novel model-contrastive term by aligning intermediate-layer representations of models in the local optimization function to promote consistency of model updates among benign participants. Additionally, we design a secure aggregation protocol that adopts two-server aggregation instead of the single server to resist poisoning attacks with lightweight privacy protection. The proposed MCFL is theoretically proven in terms of convergence, robustness, and privacy. Extensive experiments demonstrate the superiority of MCFL compared to existing FL defense schemes.

The rapid proliferation of the Internet of Things (IoT) has made resource exchange and collaboration across diverse IoT domains commonplace, necessitating secure and privacy-preserving cross-domain authentication. However, existing schemes suffer from critical limitations: they lack time-bound access control, leading to persistent unauthorized access and heightened security risks, and most are incomplete, requiring resource-intensive redeployment of cryptographic mechanisms and increasing management overhead. To address these challenges, we propose a dynamic time-bound anonymous complete cross-domain authentication scheme that leverages consortium blockchain for decentralized trust, embeds dual temporal constraints, expiration time and permissible authentication periods, into credentials for fine-grained access control and automatic natural revocation, and employs accumulators and non-interactive zero-knowledge proofs (NIZKs) to enable anonymous authentication while ensuring strong privacy protection. Crucially, the proposed scheme achieves complete cross-domain authentication without modifying existing cryptographic mechanisms, significantly reducing overhead in computational, communication, and storage. Security and performance analyses confirm that the proposed scheme not only guarantees robust security and privacy but also outperforms existing schemes in efficiency.

The widespread adoption of data-driven services, including networked data collection and analysis systems, has greatly enhanced convenience and decision-making, but it has also raised growing concerns about the trade-off between fine-grained utility and personalized privacy guarantees. Personalized Differential Privacy (PDP) offers a flexible framework by allowing users to specify individualized privacy budgets. However, existing sampling-based PDP mechanisms often rely on coarse risk modeling assumptions that treat individual data characteristics uniformly, leading to suboptimal utility and inefficient privacy expenditure. In this paper, we propose the Utility-Aware Sampling Mechanism (UASM), a principled PDP implementation that enables fine-grained, user-centric privacy control while explicitly optimizing utility. First, UASM formalizes policy-assisted secret specifications, allowing confidentiality to be determined through a combination of baseline protection rules and personalized privacy preferences, and combines them with individualized privacy budgets. Second, UASM employs a two-stage utility-aware sampling strategy to calibrate noise: (i) an optimal global threshold selected to reduce unnecessary privacy-budget wastage while respecting users’ declared budgets, and (ii) a sensitivity-aware refinement stage that allocates privacy loss according to each record’s influence on query accuracy. Formal privacy analysis demonstrates that UASM provides rigorous privacy guarantees and promotes fairer privacy expenditure under heterogeneous privacy requirements. Extensive experiments on synthetic and real-world datasets, including network-oriented downstream tasks, show that UASM achieves a superior privacy-utility trade-off over state-of-the-art PDP baselines, underscoring its practical effectiveness.

The exponential growth of wearable medical devices (WMDs) and the increasing demand for real-time health data sharing necessitate secure and fine-grained access control mechanisms. However, existing ciphertext-policy attribute-based encryption (CP-ABE) schemes suffer from computational and storage overheads that grow linearly with policy complexity. To address this challenge, we propose fog-assisted composite attribute-based encryption (FA-CABE), a novel scheme that integrates composite attributes with fog computing to enhance efficiency. FA-CABE leverages the subset sum problem (SSP) to map conjunctive policy clauses to composite attributes, substantially reducing both encryption and decryption overhead. A dualfog-node architecture offloads cryptographic computations from WMDs, enabling lightweight local processing. Rigorous security analysis under the Decisional Bilinear Diffie-Hellman (DBDH) assumption demonstrates that FA-CABE achieves replayable chosen ciphertext attack (RCCA) security. Experimental results show that FA-CABE achieves encryption speeds that are 22.13×–145.02× faster and decryption speeds that are 6.71×–161.83× faster than existing schemes, while requiring only a constant number of operations for decryption. Additionally, experimental validation on the Raspberry Pi 4B shows that the energy consumption is as low as 0.72 W per core, with data processing speed reaching 23.38 MB/s.

In the era of pervasive online social networks (OSNs), the erosion of information privacy is occurring at an unprecedented rate. Empowering individuals with user-centric control over their private information is crucial to fostering public confidence in OSN services. Hence, the investigation into the personalized privacy configurations within the framework of differential privacy for OSNs, particularly for social relationships, is captivating. In this paper, we introduce a Collaborative Personalized Edge Differential Privacy model (CPEDP), ensuring personalized protection for sensitive social relationships while retaining the high utility of network features. Specifically, CPEDP allows each user to define a policy specification consisting of two complementary components: secret specifications at the edge level to identify sensitive relationships, and privacy specifications at the user level to determine personalized privacy parameters. These user-defined preferences are integrated through a collaborative privacy decision-making process that ensures consistent and interpretable privacy guarantees. Furthermore, we formalize the privacy primitive of CPEDP and develop a sampling-based mechanism to effectively implement the proposed model. Finally, comparative experiments on real-world datasets confirm that CPEDP achieves superior privacy-utility trade-offs, yielding more accurate estimates of key graph statistics through policy-driven personalization.

Large language models (LLMs), with their powerful natural language processing capabilities, can provide more advanced intelligent services for edge devices. However, deploying LLMs at the edge is vulnerable to jailbreak attacks, which can cause the model to generate unsafe content. Meanwhile, current jailbreak attack schemes are inefficient in generating highly stealthy jailbreak prompts. To address this, we propose a Fast and Controllable Bias-Guided Jailbreak Attack (FCB) scheme. First, to improve attack efficiency, we optimize the bias of the model’s output layer to guide the model in generating low-energy jailbreak prompts by directly adjusting the output layer’s logits, thereby accelerating the decoding process. Second, to enhance the stealthiness of the generated jailbreak prompts, we design token stop selection and bias normalization methods to constrain the perturbations during the iterative process, preventing the generation of jailbreak prompts without meaningful semantics. Finally, extensive experimental results demonstrate that FCB can generate highly stealthy jailbreak prompts within a short time. Specifically, compared to the current state-of-the-art controllable attack generation scheme, COLD Attack, FCB achieves up to a 8% improvement in attack success rate, reduces perplexity by up to 181.171, and shortens generation time by as much as 28 seconds.

As the Industrial Internet of Things (IIoT) expands, the number of stakeholders increases. Many entities require significant amounts of data from industrial devices. These data streams improve information sharing and optimize the industrial chain. However, IIoT’s enormous data volumes pose challenges to traditional encryption methods, which are unable to meet efficiency and energy consumption requirements. Thus, a new, efficient encryption algorithm is essential for managing data flows among IIoT subscribers. In this paper, we propose a fast, low-energy, high-security encryption scheme to manage multi-entity data streams. First, we introduce a novel encryption scheme based on the Subset Sum Problem (SSP), which improves energy efficiency and speed. Second, to meet subscription requirements, we employ attribute-based encryption (ABE) for key forwarding. Finally, we handle subscription revocations with device key updates. The device owner utilizes their secret value to generate an identity proof with a key update request.

Binary Code Similarity Detection (BCSD), a technique for assessing the similarity between two given binary code snippets, holds significant value in searching for vulnerable functions within embedded device firmware, which is typically closed-source. However, existing BCSD approaches face two major challenges: the irreversible loss of semantic and structural information during the process of binary code compilation, which affects detection performance; and the inability to directly perform similarity detection between binary code and source code. In this paper, we present Bin2SrcSim, a novel BCSD approach that employs a Large Language Model (LLM) to convert binary code into source code representations. Bin2SrcSim fine-tunes an LLM at the function-level to transform assembly code and pseudocode into source code. Consequently, the similarity between any two binary code functions can be assessed by calculating the cosine similarity and Jaccard similarity of the transformed source code. The experimental results demonstrate that Bin2SrcSim outperforms all baselines, achieving Recall@1 scores of 0.82, 0.83, 0.93, and 0.81 across various scenarios involving cross-architecture, cross-compiler, and cross-optimization levels. Bin2SrcSim also demonstrates satisfactory performance in vulnerable function search within real-world IoT device firmware. Moreover, Bin2SrcSim supports similarity detection between binary code and source code, expanding the scope of detection applications.

Federated Large Language Model (FedLLM) shows excellent potential in collaboratively training large language models (LLM) under the federated learning (FL) framework, which is benefiting from its privacy protection advantage. However, FedLLM faces the significant challenge of the non-IID problem. In the real world, there are often cross-source or even cross-domain language set data between IoT devices. To address the issue, we propose a new FedLLM framework FedALoRA via personalized and efficient parameter fine-tuning (PEFT). Specifically, the proposed scheme combines the personalized aggregation method and the LoRA method, which can adaptively aggregate the downloaded global model and local model to the local target on each client while ensuring low training costs. This adaptation initializes the local model before each iterative training, enabling clients to learn general knowledge while enhancing their understanding of their own domain knowledge. Extensive experiments and analysis on cross-domain non-IID settings and the financial datasets on Dirichlet non-IID settings demonstrate the effectiveness and superiority of FedALoRA.

With the continuous development of Internet of Things (IoT), significant value has been generated, but numerous challenges remain. Recommender systems, as an effective tool to optimize IoT services, can significantly enhance user experience. However, the IoT’s demands for low latency and high-computational load make it difficult for traditional recommender systems to adapt. Moreover, traditional approaches often overlook the dynamic nature of user preferences, which are crucial for determining user satisfaction with IoT services. To address these issues, we propose a novel method called MoreGCN, which quantifies the temporal evolution of user preferences and integrates user interest modeling to accurately match similar users. This approach guides the learning of convolutional networks during the recommendation process. Deployed within a distributed computing framework and combined with meta computing, MoreGCN significantly improves computational efficiency and recommendation accuracy. Experimental results demonstrate that, across three benchmark datasets, MoreGCN consistently outperforms several existing state-of-the-art methods in terms of performance.

Cloud-fog automation architecture has propelled the advancement of the Industrial Internet of Things (IIoT), significantly enhancing production efficiency and intelligence through extensive data collection and connectivity. Simultaneously, industrial cyber-physical system leverages this data to achieve intelligent control and optimization of production processes. As industrial production becomes increasingly specialized and complex, independent operations within a single domain are no longer sufficient to meet demands, making cross-domain collaborative production inevitable. Consequently, ensuring the security of cross-domain communication and data sharing has become a critical issue for IIoT under the cloud-fog automation architecture. Existing solutions encounter substantial management and computational burdens in cross-domain communication and data sharing, and they are vulnerable to privacy leakage risks. To address these challenges and enhance industrial production efficiency, this paper uses consortium blockchain to co-design a cross-domain authentication and data sharing scheme. The scheme ensures secure and private cross-domain communications with minimal computational, communication, and storage overhead. And, the proposed time-specific plaintext checkable encryption protocol can secure data during cross-domain sharing. Security and performance analyses show that the proposed scheme effectively reduces computational and communication resource demands while maintaining communication and data security.

The pursuit of refined data analysis and the preservation of privacy in Big Data pose significant concerns. Among the paramount paradigms for addressing these challenges, differential privacy stands out as a vital area of research. However, traditional differential privacy tends to be excessively restrictive when it comes to individuals’ control over their own data. It often treats all data as inherently sensitive, whereas in reality, not all information related to individuals is sensitive and requires an identical level of protection. In this paper, we define secret specification-based differential privacy (SSDP), where the term “secret specification” implies enabling users to decide what aspects of their information are sensitive and what are not, prior to data generation or processing. By allowing individuals to independently define their secret specifications, the SSDP achieves personalized privacy protection and facilitates effective data analysis. To enable the targeted application of SSDP, we further present task-specific mechanisms designed for database and graph data scenarios. Finally, we assess the trade-offs between privacy and utility inherent in the proposed mechanisms through comparative experiments conducted on real datasets, demonstrating the utility enhancements offered by SSDP mechanisms in practical applications.

The proliferation of Internet of Things (IoT) devices has led to a surge in data generation within smart home environments. This data explosion has raised significant privacy concerns and highlighted a lack of user-friendly controls. Consequently, there is a pressing need for a robust privacy-enhancing mechanism tailored for smart homes, safeguarding sensitive data from a user-centric perspective. In this paper, we introduce the Fog-enhanced Personalized Differential Privacy (FEPDP) model, which utilizes the distributed nature of fog computing to improve data processing efficiency and security in smart homes. Specifically, the personalization, as a key feature of FEPDP, is manifested through an array of user-driven policy specifications, enabling home users to specify secret and privacy specifications for their personal data. These specifications not only enhance control over personal data but also align with the heterogeneous nature of smart home environments. Subsequently, aligned with fog-based smart home architecture, we propose two policy-driven partitioning mechanisms that utilize threshold partitioning based on dynamic programming to effectively implement FEPDP. Finally, comprehensive theoretical analysis and experimental validation across various statistical analysis tasks and datasets confirm that FEPDP achieves a superior privacy-utility trade-off for smart home data by leveraging non-sensitive data and fog-based partitioning.

With the prevalence of online social networks (OSNs), much personal information is collected and maintained by trusted service providers for third-party queries and analyses. Existing works regarding differentially private social network data publication overlook the fact that different users exhibit distinct privacy preferences or sensitivity inclinations. Neglecting these individual nuances may lead to privacy mechanisms that are overly conservative or inadequately protective. Furthermore, the injection of excessive noise into OSN data perceived by users as non-personal or less sensitive can incur additional privacy costs, resulting in lower service quality. This paper introduces a fine-grained, sensitivity-aware personalized edge differential privacy model (SPEDP) for OSNs. Specifically, SPEDP enables each OSN user to individually define the sensitivity level of their social connections, facilitating user-friendly personalized privacy settings. We design a privacy-aware mechanism that operates within a trusted service provider, capable of establishing privacy protection levels based on user-perceived sensitivity settings. Additionally, we propose a sensitivity-aware sampling mechanism to implement SPEDP. To further optimize the privacy mechanism, we explore a privacy threshold optimization strategy aimed at minimizing privacy budget waste. Finally, the personalized privacy protections and utility improvements achieved by the SPEDP mechanism are rigorously validated through theoretical analysis and comprehensive comparative experiments on benchmark datasets.

Online social networks have emerged as a significant data source, but the extensive collection and utilization of personal information have given rise to profound concerns regarding privacy. From a legislative and policy perspective, and in alignment with the concept of privacy as control, users have the right to control their personal privacy information. However, users often encounter challenges in terms of understanding and effectively managing their privacy settings to align with their specific privacy requirements. To address this issue, in this paper, we incorporate the concept of trust and propose a trust-based personalized differential privacy model for online social networks, denoted as TPDP, which relies on a trusted central server to facilitate its operation. Specifically, when a user requests access to another user’s personal information, the TPDP mechanism provides a privacy response, where the privacy level is determined based on the direct and indirect trust values among users, calculated automatically by the trusted central server. Furthermore, the proposed TPDP model offers user-to-user personalized differential privacy protection from the perspectives of network structures, trust-related factors, and trust propagation patterns. Finally, we validate the model’s feasibility and assess the privacy-utility trade-off, as well as its robustness against attacks, through theoretical analysis and performance evaluation.

Data privacy breaches have prompted growing concerns regarding privacy issues on social networks. Preserving the privacy of links in the directed social graph, where edges signify the information flow or data contributions, poses a formidable challenge. However, existing methods for uncertain graphs primarily target undirected graphs and lack rigorous privacy guarantees. In this paper, we present a personal evidence protection algorithm called PEPA, which provides formally dual privacy guarantees for directed social links. Specifically, we implement out-link privacy to protect the out-links of nodes. Despite this protection, the exposure of in-links can still compromise privacy, potentially affecting service quality. To address this, we further introduce an uncertain directed graph algorithm as a post-processing approach for out-link privacy. This algorithm injects uncertainty into nodes’ in-links, effectively transforming the original directed graph into a probability-driven uncertain structure. Additionally, we propose an effective noise optimization method. Finally, we evaluate the trade-off between privacy and utility achieved by PEPA through comparative experiments. The results demonstrate privacy enhancements of PEPA compared to the$(k, \varepsilon )$-obfuscation algorithm and utility improvements over the RandWalk algorithm and UG-NDP. Particularly, PEPA demonstrates approximately a 2-fold improvement in utility compared to PEPA without noise optimization.

Differential privacy has received considerable attention as a privacy concept for releasing statistical information from datasets. While differential privacy provides strict statistical guarantees, it is equally crucial to investigate how these guarantees interact with individual privacy preferences and privacy policies. Existing solutions, such as one-sided differential privacy, treat all sensitive records equally in terms of privacy protection, although datasets can be classified based on predetermined privacy policies that differentiate between sensitive and insensitive records. In this paper, we present a novel concept of privacy termed One-sided Personalized Differential Privacy (OSPDP), offering verifiable privacy assurances at the user level for sensitive records derived from privacy policies. Specifically, OSPDP enables data owners to articulate their privacy needs more flexibly, avoiding a one-size-fits-all approach to privacy protection and potentially establishing a dichotomous privacy policy regarding the sensitivity of records. Furthermore, the truthful release or legitimate disclosure of non-sensitive records reduces unnecessary privacy consumption and can be utilized to significantly enhance data utility. Additionally, we present several well-performing mechanisms for achieving OSPDP. Finally, we evaluate and analyze the trade-off between privacy and utility of the proposed mechanisms through extensive experiments.

With the advent of various mobile IoT devices, a large amount of e-health record (EHR) data has been generated. This data has great potential to improve medical research. However, there are many challenges regarding the sharing of medical data. Firstly, users are more inclined to interact anonymously. Secondly, verifying the validity of certificates in the case of anonymous interactions is challenging. In addition, it is necessary to uncover the identities of the actual interacting parties in the event of malicious behavior. Therefore, we address the above challenges and propose group signatures with time constraints to support anonymous and traceable EHR data sharing. First, we propose a group signature scheme that supports traceability. Second, to address the issue of validating anonymous certificates, we propose group signatures with time constraints that enable dynamic updates to validity. Through this, we can dynamically revoke group members. Lastly, security proofs and efficiency analyses demonstrate that our scheme is both secure and efficient.

The rapid evolution of the smart grid has made the security and reliability of communication within the power system an urgent and critically important issue. To address this challenge, authentication and key agreement (AKA) protocols have gained significant attention and are regarded as indispensable tools for ensuring the secure operation of the smart grid. However, traditional AKA protocols are plagued by a series of issues, including cumbersome certificate management, delayed certificate revocation, and vulnerability to man-in-the-middle attacks. With the emergence of certificate-less public key cryptography (CL-PKC), the integration of conventional AKA protocols with CL-PKC has emerged as a prominent trend. This paper presents an enhanced certificate-less AKA protocol for smart grids, named ECL-AKA. Firstly, the paper outlines the architecture and security model of this protocol. Subsequently, it presents the complete workflow of the ECL-AKA protocol. Notably, the ECL-AKA protocol introduces a private key verification step before key agreement, allowing for rapid screening of malicious requests at a lower computational cost, thereby enhancing the protocol’s resistance to various types of attacks. In addition, the ECL-AKA’s security is formally established through rigorous theoretical proofs based on the random oracle model in the paper. Finally, comparative experimental analysis demonstrates that the ECL-AKA exhibits lower computational and communication overhead while satisfying essential security attributes.

Currently, power data trading typically relies on Web pages as the conventional mode of mediation. Nevertheless, dishonest trading Web may secretly resell the data sets of grid companies or have no way of knowing what the buyer has done with the power data, thereby compromising the privacy of power user. This article proposes a privacy-preserving supply-demand consistency matching service scheme (PPMSE) to address the problem of whether the power data provided by the seller aligns with the requirements of the buyer in power data trading. The scheme utilizes enhanced public-key searchable encryption (PKSE) to establish a matching environment that fulfills privacy protection needs, thereby facilitating consistency matching between supply and demand, all while preserving user privacy. Then, the PPMSE ensures that matching service can only occur within the designated platform by equipping the power data trading cloud platform with public and private keys. Additionally, by applying ciphertext policy attribute-based encryption (CP-ABE) to the data processing tasks of the buyer, the scheme enables the seller to decrypt and obtain what the buyer has done with the data after successful matching and meeting specific attributes. Ultimately, a comprehensive analysis and performance evaluation are provided, validating the feasibility and superiority of the proposed scheme.

The massive amount of data on the Internet of Things (IoT) drives recommendation systems (RSs) based on graph neural network (GNN) to fully play a role in improving user experience. However, data sharing and centralized storage can pose serious security threats. Even though federated learning (FL) can render data “available but not visible,” the heterogeneity of graph data within IoT institutions can result in limitations in recommendation performance. To address the issues, we propose a privacy-preserving decentralized cross-institutional federated graph learning framework called DCI-PFGL for IoT service recommendation, which alleviates the negative impact of data heterogeneity while protecting data security. Our approach extracts graph feature embeddings using the shortest path graph kernel. These embeddings are then anonymized and compared on a blockchain through smart contracts, which helps match partner IoT institutions with lower data heterogeneity. Subsequently, IoT institutions within the same partition collaborate in federated graph learning. We also ensure the protection of transmitted information through differential privacy measures. Finally, we conduct comprehensive experiments on two benchmark data sets. Results demonstrate that DCI-PFGL outperforms other approaches in terms of system accuracy and collaboration costs.

With the development of big data technology, the power industry has also entered the data-driven intelligence era. Cloud computing-based smart grids give the power industry stronger capabilities in data analytics. Electricity load forecasting in the cloud helps smart grids allocate resources appropriately. However, the users' privacy is easily compromised in the load forecasting process with cloud computing. The electricity usage data collected by the system may contain sensitive information about the users, which could lead to serious privacy leakage. In order to solve the issues, we propose a novel privacy-preserving cloud-aided load forecasting scheme for the cloud computing-based smart grid. It contains a secure online training algorithm and an efficient real-time forecasting algorithm. Meanwhile, the two-party interaction security scheme is more suitable for real-world applications. Before being sent to the cloud server, the control center of the smart grids encrypts the data using homomorphic encryption. During the process of model training and forecasting, the data remains securely encrypted at all times to avoid the risk of data privacy breaches. Finally, security and experimental analyses show that our scheme effectively avoids privacy leakage while reducing resource consumption.

Social recommendation improved the quality and efficiency of recommendation but increased the risk of privacy leakage, especially with the introduction of social networks. Consequently, the social recommendation considering user privacy has drawn tremendous attention from academia to industry. Nevertheless, most of the existing work regards the recommender systems as static, ignoring the diffusion of social influence over time. In this article, we propose a secure and efficient framework, temporal privacy-preserving social recommendation model (PrivTSR), to capture the changes of user preference for items and item types with time. PrivTSR first utilizes differential privacy to encrypt the data owned by the data owner. Then, inspired by the long short-term memory (LSTM), at each time step the initial user embedding and the initial item embedding are generated via DeepWalk as new ratings of users for items emerges in the user–item-type graph. The initial user-preference embedding is generated randomly at the first time step, and it is equivalent to the updated embedding of the previous time step for the later time steps. Most importantly, on the social graph, PrivTSR updates the user embedding and the user-preference embedding with graph attention convolutional network and graph attention diffused network, which aggregates (diffuses) social influence from (to) neighbors in depth and breadth. On the user–item-type graph, the user embedding and the item embedding are updated by aggregating the embedding of users and items in the six paths. Final, taking into account the users’ preference for items and item types, PrivTSR predicts the ratings of users to the items for the next time step. The extensive experiments are conducted on two real-world datasets, which demonstrated the superiority of our model over several competitive baselines.

Data aggregation plays a crucial role in smart grid communication as it enables the collection of data in an energy-efficient manner. However, the widespread deployment of smart meters has raised significant concerns regarding the privacy of users' personal data. Therefore, in this paper, we present an efficient and privacy-preserving data aggregation and trust management scheme (PATM) for an IoT-enabled smart grid based on smart contract. Firstly, we propose a five-layer architecture for smart grid communication to support secure and efficient data aggregation and management. Under the architecture, the Boneh-Goh-Nissim cryptosystem with blind factor is improved to facilitate privacy protection. In addition, the tamper-evident nature of blockchain is utilized for effective data management. Our designs also enhance the resistance to differential attack and prevent privacy breaches during the aggregation process. Detailed security proof and theoretical analysis confirm that our PATM can satisfies the necessary security and privacy requirements while maintaining the required efficiency for smart grid operations. Furthermore, comparative experiments demonstrate that PATM outperforms other proposed work in terms of storage cost, computational complexity, and utility of differential privacy.

With the rise of social media, the rapid spread of rumors online has resulted in numerous negative effects on society and the economy. The methods for rumor detection have attracted great interest from both academia and industry. Given the widespread effectiveness of contrastive learning, many graph contrastive learning models for rumor detection have been proposed by using the event propagation structure as graph data. However, the existing contrastive models usually treat the propagation structure of other events similar to the anchor events as negative samples. While this design choice allows for discriminative learning, on the other hand, it also inevitably pushes apart semantically similar samples and, thus, degrades model performance. In this article, we propose a novel propagation fusion model called propagation structure fusion model based on node-level contrastive learning (PFNC) for rumor detection based on node-level contrastive learning. PFNC first obtains three augmented propagation structures by masking the text of each node in the propagation structure randomly and perturbing some edges in the propagation structure based on the importance of edges. Then, PFNC applies the node-level contrastive learning method between every two augmented propagation structures to prevent the samples with similar propagation structure from far away. Finally, a convolutional neural network (CNN)-based model is proposed to capture the relevant information that is consistent and supplementary among three augmented propagation structures by regarding the propagation structure of the event as a color picture, three augmented propagation structures as color channels, and each node as a pixel. The experimental results on real datasets show that the PFNC significantly outperforms the state-of-the-art models for rumor detection.

Topology design is vital to the high performance data center networks. Due to the limited scalability, many traditional server-centric data center networks are confronting the updating and upgrading hurdles. To address the issue, this paper proposes a highly scalable DCell-based server-centric data center network topology, called HS-DCell, which can use inexpensive and typical switches and servers with only three network ports to achieve excellent network performance HS-DCell can accommodate a large number of servers, and its diameter increases linearly with the growth of network levels, which is better than that of most existing server-centric networks. Furthermore, a fault-free routing algorithm and a fault-tolerant routing algorithm are developed based on HS-DCell. Compared with other mainstream server-centric network topologies, the experimental results show that HS-DCell has obvious advantages in many key performance indicators including scalability, fault tolerance, and server port utilization.

The growing prevalence of graphs representations in our society has led to a corresponding rise in the publishing of graphs by researchers and organizations. To protect the privacy, it is important to ensure that graphs including sensitive data are not disclosed. Since the weight of edges could be utilized to infer confidential information, the graph should be privately published to avoid ethical and legal issues. In this paper, we propose a novel method for privately publishing shortest paths while preserving the privacy of sensitive edge weights in graph. Specifically, we divide the edge weights into internal and external edges based on their edge betweenness centrality. Then, we give two different differentially private algorithms to perturb edge weights based on the distinction between internal and external edges, respectively. To reduce the error ratios between differentially private shortest paths and real shortest paths, we employ edge betweenness centrality to search for the shortest path, which is closest to the true one. Our experimental results show that our mechanisms can effectively reduce the error in the average shortest path distance by 1.1% for large graphs, while for the shortest path change rate, our mechanisms can reduce it by 8.3%.

With the rapid development of the smart grid (SG), the security and reliability of communication for SG has become an urgent and critical issue. The authentication and key agreement (AKA) protocol has emerged as important means to address the security challenges in smart grid. This paper proposes a novel certificateless authentication and key agreement protocol (NCL-AKA) for the smart grid, which overcomes the limitations of existing AKA protocol such as complex certificate management, untimely certificate revocation, and man-in-the-middle attacks. Firstly, the system architecture and threat model of the proposed protocol is presented. Then, the correctness and security of the proposed protocol are analyzed. Finally, comparative experiments and analysis reveal that the NCL-AKA has lower computational cost and communication overhead.

Internet of Medical Things (IoMT) technologies significantly improve the quality of health care, especially at the time when COVID-19 is becoming a worldwide pandemic. Due to the complexity of devices and user nodes in the IoMT system, there should be some ways to ensure the security and quality of the service or information. Decentralized trust management techniques are efficient means of promoting application security and reliability in these cases. However, the majority of currently utilized access control schemes cannot be applied in decentralized trust management systems or perform poorly owing to the numerous restrictions of decentralized systems. In this article, we present a policy-hiding and multiauthority key generation CP-ABE scheme (PM-CPABE) for decentralized trust management systems, which could provide fine-grained access control capabilities. Meanwhile, the proposed scheme does not require any fully trusted entity, thus it can be well adapted to decentralized trust management systems. The scheme also implements policy hiding to protect user privacy. In addition, it supports large universe and outsourced decryption. The security analyses and performance comparisons give evidence of our scheme is secure and efficient.

With the widespread application of real-time embedded systems (ESs), the contradiction between the energy consumption requirements of modern processors and the limited battery capacity becomes more obvious. Dynamic voltage scaling (DVS) has been proven to be one of the most effective technologies for energy management. However, recent studies have shown that the use of DVS leads to a significant increase in the transient fault rate of processors as the characteristic size of logic gates (or transistors) gets smaller and smaller. In this article, we consider the problem of assigning processing frequencies to a group of periodic real-time tasks so as to minimize the overall energy consumption under the constraints of time and reliability. First, under the DVS, we take the reliability of the ESs into consideration through the regularization terms and present the energy consumption optimization model based on the metaheuristic algorithms. Second, a novel algorithm for adaptive differential whale swarm optimization (ADWOA) is proposed according to the optimization requirements. Finally, the optimized data are saved on the chain through the storable feature of the blockchain for the necessary queries. It is worth noting that the on-chain data contains the intrinsic characteristics of the ES, which may give rise to the disclosure of processor privacy. Therefore, we come up with the differential privacy on-chain creating algorithm (DPCA) to protect the privacy of data on the chain. Experimental results show that ADWOA can minimize the energy consumption in real-time ES on the premise of ensuring system reliability and privacy.

As one of the key technologies to enable the internet of things (IoT), cloud computing plays a significant role in providing huge computing and storage facilities for large-scale data. Though cloud computing brings great advantages, new issues emerge, such as data security breach and privacy disclosure. In this paper, we introduce a novel secure and privacy-preserving outsourcing computing scheme (hereafter referred to as SPOCS) to tackle this issue. In SPOCS, the effective use of Intel SGX, one of the trusted execution environment (TEE), ensures the confidence and integrity of sensitive data in cloud computing and prevents data loss from causing privacy disclosure. In order to keep malicious cloud service providers (CSPs) from illegally tampering with the outsourcing results, blockchain is employed to ensure the data immutability. Significantly, our proposed scheme achieves anonymity and traceability. In the outsourcing process, smart contracts are applied to make the whole process fully automated without any human involvement. Finally, the security of the proposed scheme is analyzed in terms of its resistance to different attacks. The experiments indicate that our scheme is effective and efficient.

Recent progress has witnessed the excellent success of neural networks in many emerging applications, such as image recognition, text classification, and speech analysis. In order to achieve secure communication, the utilization of neural networks has been realized yet has not raised sufficient research attention. In addition, the existing neural network-based communication system falls short due to its critical security flaws. In this article, we investigate the security vulnerabilities of the existing neural communication system. Based on our analysis, we design two kinds of attack models, includingtarget man-in-the-middle attackandtarget fraud attack. After that, to improve the security performance of neural communication systems, we develop a new defense mechanism to facilitate two-way secure communication by separating secret key from plaintext and incorporating defensive loss into the training process. Moreover, we show the effectiveness of our proposed neural communication system via theoretical proof. Finally, we implement comprehensive real data experiments to evaluate the performance of our attack and defense methods from the aspects of classification accuracy, communication efficiency and communication qualify, which confirms the advantages of our proposed neural communication system compared with the state-of-the-art.

GCN-based clustering schemes cannot interactively fuse feature information of nodes and topological structure information of graphs, leading to insufficient accuracy of clustering results. Moreover, the deep clustering model based on graph structure is vulnerable to the attack of adversarial samples leading to the reduced robustness of the model. To solve the above two problems, this paper proposes a robust clustering model based on attention mechanism and graph convolutional network (GCN), named AG-cluster. This model firstly uses graph attention network and GCN to learn the feature information of nodes and the topological structure information of graphs, respectively. Then the representation results of the above two learning modules are interactively fused by the interlayer transfer operator. Finally, the model is trained end-to-end using a self-supervised training module to optimize the clustering results of the model. In particular, an efficient graph purification defense mechanism (GPDM) is designed to resist adversarial attacks on graph data to improve the robustness of the model. Experimental results show that AG-cluster outperforms the other four benchmark methods, specifically, AG-cluster improves 7.6% in Accuracy and 11.5% in NMI compared to the best benchmark method. Besides, the new model still shows higher robustness and stronger transferability under multiple attacks.

Spectrum auction is one of the most effective ways to achieve dynamic spectrum allocation in cognitive radio networks , and it provides one effective way to manage the spectrum demands of IoT devices with limited resources. Most spectrum auctions focus on protecting bidder privacy and achieving excellent social efficiency, but few tackles the verification of auction results that are controlled by the auctioneer. In this paper, we propose a cloud-based framework for verifiable privacy-preserving spectrum auctions. Our framework adopts a modified AFGH re-encryption algorithm that achieves both bid privacy protection and auction results verification at the same time. The cloud server helps to compute auction results based on homomorphic encryption , and an auctioneer decrypts the encrypted data from the server to obtain auction results. Meanwhile, the property of re-encryption makes it possible for any bidder to verify the auction results without compromising other bidders’ privacy.

The reduction in the number of queries to the object model is a hot topic in the current research of black-box adversarial attack methods. To solve this problem, in this article, we propose generating adversarial examples with shadow model (GASM) that shifts the number of queries to the object model to the shadow model. The method first determines the shadow model based on the robustness and transferability of classifiers and fine-tunes the decision boundary of the shadow model by constructing adversarial datasets. Second, accesses the shadow model and constructs adversarial examples by maximizing the output probability of the targeted class (any class other than the current one) to modify the image gradient information. Finally, the results show that GASM has the strongest transferability and outperforms white-box attacks when AlexNet (MNIST), VGG-19 (CIFAR10), and MobileNet v2 (Tiny ImageNet) are selected as shadow models.

Currently, the conventional mode of power data transaction is mediated by Web pages. Nevertheless, there are challenging issues such as privacy protection, transaction security and data reliability in power data trading. In this paper, we present a novel secure power data trading scheme (SPDTS). Firstly, the zero-knowledge proof is employed to achieve data availability and consistency without revealing the data. Then, SPDTS takes full advantage of the dispersibility and immutability of blockchain to ensure the reliability of data transactions. To keep the transaction process efficient, the processing tasks for power data are performed under smart contract. Meanwhile, a trusted execution environment (TEE) is adopted to guarantee the security of power data. Finally, we present a differential privacy scheme to safeguard the privacy information in the power data. Our study indicates that the proposed scheme can achieve privacy protection, transaction security and data reliability. Also, we conduct security analysis and verify the privacy protection property of the scheme in real cases.

In recent years, there have been increasing demands for using deep neural networks (DNNs) to provide image processing services for mobile devices. Considering the privacy of users' images, we utilize a two-tiers DNN which deploys the shallow and deep model on mobile devices and the cloud respectively. Then we propose a novel privacy protection mechanism which is deployed on the mobile device to satisfy the differential privacy. Meanwhile, based on the convolution kernel analysis, we also propose a novel method to improve the computation efficiency of mobile devices. The highlight of our mechanism is that it not only provides customized privacy protection which can resist the attack of Generative Adversarial Network (GAN), but also improves the accuracy of the neural network model. The experimental results on the ImageNet dataset show that we have improved the top-5 accuracy of image classification by 2%-3%. Under the premise of ensuring that the accuracy of the network is not degraded, our method reduces the CPU consumption on the VGG16 and ResNet50 networks to 74.6% and 48.9%, respectively, and can reduce 90% of the memory overhead. This improvement makes it possible to enable mobile deep neural network applications.

This paper focuses on studying the differentially private consensus problem in multiagent networks under a quantized communication environment, where the exact real-value state is not available for transmission due to the range limitation of digital channels. We first extend the differentially private consensus model to the case of a quantized communication environment integrated with a dynamic encoding/decoding scheme and propose a differentially private communication algorithm utilizing the quantized state with a bounded quantizer instead of the exact real-value state to reach an agreement while protecting the initial or current states of the participants from information disclosure. Then, the convergence analysis of mean square consensus in the case of an unbounded quantizer is given to explain the sufficiency of the extended model and convergence conditions. To overcome the uncertainty of saturation in the case of a bounded quantizer, we also give a statistical analysis on the boundedness of quantization that the bounded quantizer with a finite number of bits can remain unsaturated with a desired high probability under certain conditions. Furthermore, we provide the statistical analysis on the convergent accuracy, which shows that the agreement value just converges to a random variable that falls in the neighboring range of the initial state average and the expectation of the agreement value is equal to the initial state average exactly. In addition, we provide the differential privacy analysis for individual agents and the whole network, and then establish the potential relationship between the dynamic encoding/decoding scheme and the differential privacy mechanism. Finally, the simulation results visually show that the proposed algorithm and the main theoretical results are effective and correct.

Many applications such as smart metering and location based services pose strong privacy requirements but achieving privacy protection at the client side is a non-trial problem as payment for the services must be computed by the server at the end of each billing period. In this paper, we propose a privacy preservation and billing scheme termed PPDIR based on delayed information release. PPDIR relies on a novel group signature mechanism and the asymmetric Rabin cryptosystem to protect the privacy of the clients and their requests, to achieve accountability and non-repudiation, and to shift the computational complexity to the server side. It adopts a secret token for anonymity and the token is updated for each client at the beginning of each billing period and securely released only to the server at the end of the billing period. Such a strategy can prevent the server from linking a client's requests made at different billing periods. It also prevents any adversary from linking any request to any client. Note that the server is able to figure out all requests made by a client within a billing period after receiving the delayed token, which is unavoidable for billing purpose. We prove the security properties of the group signature scheme, and analyze the security strength of PPDIR. Our study indicates that PPDIR can achieve privacy-preservation, confidentiality, non-repudiation, accountability, and other security objectives. We also evaluate the performance of our scheme in terms of communication and computational overheads.

Cloud‐assisted Internet of Things (IoT) significantly facilitate IoT devices to outsource their data for high efficient management. Unfortunately, some unsettled security issues dramatically impact the popularity of IoT, such as illegal access and key escrow problem. Traditional public‐key encryption can be used to guarantees data confidentiality, while it cannot achieve efficient data sharing. The attribute‐based encryption (ABE) is the most promising way to ensure data security and to realize one‐to‐many fine‐grained data sharing simultaneously. However, it cannot be well applied in the cloud‐assisted IoT due to the complexity of its decryption and the decryption key leakage problem. To prevent the abuse of decryption rights, we propose a multiauthority ABE scheme with white‐box traceability in this paper. Moreover, our scheme greatly lightens the overhead on devices by outsourcing the most decryption work to the cloud server. Besides, fully hidden policy is implemented to protect the privacy of the access policy. Our scheme is proved to be selectively secure against replayable chosen ciphertext attack (RCCA) under the random oracle model. Some theory analysis and simulation are described in the end.

Due to the abundant marine resources, smart ocean has attracted much attention of the government, industry, and academy. The Internet-of-Things (IoT) architectures for smart ocean have been proposed to collect various of data from the ocean, thereby assisting environmental protection, military reconnaissance, and so on. However, few researchers have paid attention to the security and privacy issues of data collection and transmission. In this article, for the unreliable underwater environment, we present a secure, efficient, and complete data collection, and transmission and storage scheme for IoT in smart ocean. Especially, to prolong the lifetime of the underwater node, two novel data compression algorithms [lossy data compression algorithm (LCA) and lossless data compression algorithm (NLCA)] are also proposed. Moreover, due to the vulnerability of underwater nodes, we also propose a corresponding IoT framework and data collection pattern to resist the single point failure attack. Besides, to guarantee the confidentiality, reliability, and integrity of transmitting data, Elliptic Curve-ElGamal (EC-ElGamal) and elliptic curve digital signature algorithm (ECDSA) are employed. The consensus algorithm and blacklisting mechanism are also employed to detect and address failure or malicious nodes. Finally, the security analysis demonstrates that our scheme is able to resist many typical attacks for underwater nodes, such as manipulation attacks, Distributed Denial-of-Service (DDoS) attacks, malicious node injection attacks, and so on. Additionally, relevant experimental results show that the scheme is feasibility and efficiency.

Edge servers (ESs) are utilized to achieve the storage and sharing of IoT data. However, even if ES brings us much benefit, it also leads to many serious privacy leakage issues because users' data in ESs are out of control. Moreover, ES providers may also disclose user's private-sensitive data. Hence, in this article, we present a privacy-preserving, recoverable, and revocable edge data sharing scheme. In this scheme, we propose a novel attribute revocation chain based on the blockchain technology to achieve attribute revocation in ciphertext-policy attribute-based encryption (CP-ABE). Meanwhile, a secret sharing scheme (SSS) is introduced to assist the data recovery. Especially, for the situation that a single ES is hijacked, we also propose a corresponding efficient detection mechanism and key updating policy to promise the subsequent security of the whole system. Moreover, this scheme also resists Economic Denial-of-Sustainability (EDoS) attacks which are launched by some malicious users. The analysis shows that the proposed scheme can protect user's privacy and resist many attacks. Additionally, relevant experimental results demonstrate that our scheme has low computational overhead on the user side.

The concept of social networking is integrated into Internet of things (IoT) to socialize smart objects by mimicking human behaviors, leading to a new paradigm of Social Internet of Things (SIoT). A crucial problem that needs to be solved is how to establish reliable relationships autonomously among objects, i.e., building trust. This paper focuses on exploring an efficient context-aware trustworthiness inference framework to address this issue. Based on the sociological and psychological principles of trust generation between human beings, the proposed framework divides trust into two types: familiarity trust and similarity trust. The familiarity trust can be calculated by direct trust and recommendation trust, while the similarity trust can be calculated based on external similarity trust and internal similarity trust. We subsequently present concrete methods for the calculation of different trust elements. In particular, we design a kernel-based nonlinear multivariate grey prediction model to predict the direct trust of a specific object, which acts as the core module of the entire framework. Besides, considering the fuzziness and uncertainty in the concept of trust, we introduce the fuzzy logic method to synthesize these trust elements. The experimental results verify the validity of the core module and the resistance to attacks of this framework.

With the fast development of smart mobile devices, the mobile crowd-sensing (MCS) has been witnessed as a new data collection paradigm. In this paper, we consider a scenario that an MCS server tries to collect trajectories from participants. In order to protect the participants' location privacy from their own side, we let participants submit noisy data to the server. In addition, we assume that the data collection is delay tolerant which means each participant is allowed to submit his trajectory in a bundle instead of submitting locations one by one. Based on this assumption, we regard each trajectory as a vector in the high dimension space and design a trajectory protection algorithm to perturb the true trajectory before submission. We use the differential privacy (DP) as the privacy model so we can estimate the amount of noise given a privacy level. To evaluate our mechanism, we use real world traffic data collected from Shanghai taxis and compare it with existing work. The results show that our mechanism not only guarantees privacy protection, but also preserves trajectories' utility.

Smart cyber-physical systems (CPSs) include Internet of things (IoT), smart grids, smart cities, smart transportation, and smart "Anything" (e.g., homes and hospitals).ese systems require different levels of security and protection based the sensitivity of their data.Nonetheless, we are living in a world where cyber attacks, privacy violations, phishing scams, and data breaches have become commonplace.Smart CPSs are also subject to security violations and privacy breaches, which stem from the vulnerabilities of existing computers and communications technologies.In addition, as smart CPSs get more complex, more vulnerabilities will emerge.Hackers will be able to launch increasingly sophisticated attacks in the future due to the ever-shi ing cyber physical landscape.Hence, innovative research is needed for security assurance and privacy preservation in smart CPSs for new architectural models, system designs, and cryptographical protocols.In this special issue, we received submissions from both academia and industry in the relevant fields.Following a strict review process, we accepted papers for this special issue.Each of the papers was peer-reviewed by at least three experts in the field.In the following, we provide a brief introduction to each paper.ere are four papers aiming to design and analyze security schemes and privacy preserving strategies for IoT applications.e paper titled "Function-Aware Anomaly Detection Based on Wavelet Neural Network for Industrial Control Communication" proposed a function-aware anomaly detection approach to detect these cyber intrusions and anomalies.Next, the authors of the paper titled "A Compatible OpenFlow Platform for Enabling Security Enhancement in

As the next generation of information and communication infrastructure, Internet of Things (IoT) enables many advanced applications such as smart healthcare, smart grid, smart home, and so on, which provide the most flexibility and convenience in our daily life. However, pervasive security and privacy issues are also increasing in IoT. For instance, an attacker can get health condition of a patient via analyzing real-time records in a smart healthcare application. Therefore, it is very important for users to protect their private data. In this paper, we present two efficient data aggregation schemes to preserve private data of customers. In the first scheme, each IoT device slices its actual data randomly, keeps one piece to itself, and sends the remaining pieces to other devices which are in the same group via symmetric encryption. Then, each IoT device adds the received pieces and the held piece together to get an immediate result, which is sent to the aggregator after the computation. Moreover, homomorphic encryption and AES encryption are employed to guarantee secure communication. In the second scheme, the slicing strategy is also employed. Noise data are introduced to prevent the exchanged actual data of devices from disclosure when the devices blend data each other. AES encryption is also employed to guarantee secure communication between devices and aggregator, compared to homomorphic encryption, which has significantly less computational cost. Analysis shows that integrity and confidentiality of IoT devices’ data can be guaranteed in our schemes. Both schemes can resist external attack, internal attack, colluding attack, and so on.

Due to the complexity and volume, outsourcing ciphertexts to a cloud is deemed to be one of the most effective approaches for big data storage and access. Nevertheless, verifying the access legitimacy of a user and securely updating a ciphertext in the cloud based on a new access policy designated by the data owner are two critical challenges to make cloud-based big data storage practical and effective. Traditional approaches either completely ignore the issue of access policy update or delegate the update to a third party authority; but in practice, access policy update is important for enhancing security and dealing with the dynamism caused by user join and leave activities. In this paper, we propose a secure and verifiable access control scheme based on the NTRU cryptosystem for big data storage in clouds. We first propose a new NTRU decryption algorithm to overcome the decryption failures of the original NTRU, and then detail our scheme and analyze its correctness, security strengths, and computational efficiency. Our scheme allows the cloud server to efficiently update the ciphertext when a new access policy is specified by the data owner, who is also able to validate the update to counter against cheating behaviors of the cloud. It also enables (i) the data owner and eligible users to effectively verify the legitimacy of a user for accessing the data, and (ii) a user to validate the information provided by other users for correct plaintext recovery. Rigorous analysis indicates that our scheme can prevent eligible users from cheating and resist various attacks such as the collusion attack.

The concept of smart grid gained tremendous attention among researchers and utility providers in recent years. How to establish a secure communication among smart meters, utility companies, and the service providers is a challenging issue. In this paper, we present a communication architecture for smart grids and propose a scheme to guarantee the security and privacy of data communications among smart meters, utility companies, and data repositories by employing decentralized attribute based encryption. The architecture is highly scalable, which employs an access control Linear Secret Sharing Scheme (LSSS) matrix to achieve a role‐based access control. The security analysis demonstrated that the scheme ensures security and privacy. The performance analysis shows that the scheme is efficient in terms of computational cost.

Matrix inverse computation is one of the most fundamental mathematical problems in large-scale data analytics and computing. It is often too expensive to be solved in resource-constrained devices such as sensors. Outsourcing the computation task to a cloud server or a fog server is a potential approach as the server is able to perform large-scale scientific computations on behalf of resource-constrained users with special software. However, outsourcing brings in new security concerns and challenges such as data privacy violations and result invalidation. In this paper, we propose a secure and verifiable outsourcing scheme to compute the matrix inverse in a server. In our scheme, the client generates two secret key sets based on two chaotic systems, which are utilized to create two sparse matrices whose permuted versions are used for matrix encryption and decryption to protect input and output privacy. The server computes the inverse over the ciphertext matrix and returns the result to the client who can verify the validity of the inverse. We analyze the proposed scheme in terms of correctness, security, verifiability, and attack resistance, and compare its performance (computation, storage, and communication overheads) with those of the state-of-the-art. Our theoretical results and comparison study demonstrate that the proposed scheme provides a secure and efficient outsourcing mechanism for matrix inverse computation.

Many mobile big data applications require the computation of dot‐product of two vectors. For examples, the dot‐product of an individual's genome data collected by a body area network and the gene biomarkers of a health centre can help detect diseases in m‐Health, and that of the interests of two persons can facilitate profile matching in mobile social networks. Nevertheless, mobile big data typically contain sensitive personal information and are more accessible to the general public as they are collected by mobile devices carried by human beings. Therefore exposing the inputs of dot‐product computation discloses sensitive information about the two participants, leading to severe privacy violations. The authors tackle the problem of private dot‐product computation targeting mobile big data applications in which secure channels are hardly established, and the computational efficiency is highly desirable. We first propose two basic schemes and then present the corresponding advanced versions to improve computational efficiency and enhance the privacy‐protection strength. Furthermore, we theoretically prove that our proposed schemes can simultaneously achieve privacy‐preservation, non‐repudiation, and accountability. Our numerical results verify the performance of the proposed schemes in terms of communication and computational overheads.

Proximity detection is one of the most common location-based applications in daily life when users intent to find their friends who get into their proximity. Studies on protecting user privacy information during the detection process have been widely concerned. In this paper, we first analyze a theoretical and experimental analysis of existing solutions for proximity detection, and then demonstrate that these solutions either provide a weak privacy preserving or result in a high communication and computational complexity. Accordingly, a location difference-based proximity detection protocol is proposed based on the Paillier cryptosystem for the purpose of dealing with the above shortcomings. The analysis results through an extensive simulation illustrate that our protocol outperforms traditional protocols in terms of communication and computation cost.

In this paper, we consider the problem of mutual privacy protection in social participatory sensing in which individuals contribute their private information to build a (virtual) community. Particularly, we propose a mutual privacy preserving k-means clustering scheme that neither discloses an individual's private information nor leaks the community's characteristic data (clusters). Our scheme contains two privacy-preserving algorithms called at each iteration of the k-means clustering. The first one is employed by each participant to find the nearest cluster while the cluster centers are kept secret to the participants; and the second one computes the cluster centers without leaking any cluster center information to the participants while preventing each participant from figuring out other members in the same cluster. An extensive performance analysis is carried out to show that our approach is effective for k-means clustering, can resist collusion attacks, and can provide mutual privacy protection even when the data analyst colludes with all except one participant.

This paper aims to improve security performance of data transmission with a mobile eavesdropper in a wireless network. The instantaneous channel state information (CSI) of the mobile eavesdropper is unknown to legitimate users during the communication process. Different from existing work, we intend to reduce power consumption of friendly jamming signals. Motivated by the goal, this work presents a location-based prediction scheme to predict where the eavesdropper will be later and to decide whether a friendly jamming measure should be selected against the eavesdropper. The legitimate users only take the measure when the prediction result shows that there will be a risk during data transmission. According to the proposed method, system power can be saved to a large degree. Particularly, we first derive the expression of the secrecy outage probability and set a secrecy performance target. After providing a Markov mobile model of an eavesdropper, we design a prediction scheme to predict its location, so as to decide whether to employ cooperative jamming or not, and then design a power allocation scheme and a fast suboptimal helper selection method to achieve targeted and efficient cooperative jamming. Finally, numerical simulation results demonstrate the effectiveness of the proposed schemes.

Due to the popularity of auction mechanisms in real-world applications and the increasing awareness of securing private information, auctions are in dire need of bid-privacy protection. In this paper, we design three secure, multi-unit, sealed-bid, first-price auction schemes. The first is a secure auction using homomorphic encryption and is denoted by SAHE; the second is a secure action using masking values and is denoted by SAMV; and the third has an improved masked noise algorithm, denoted by ISAMV. In the first, SAHE, the auction is processed on encrypted bids by a server, and the final output is only known by the auctioneer. Neither the auctioneer nor the server can obtain the full information of the bidders. The second and third auctions, SAMV and ISAMV, decrease computational complexity. Instead of homomorphic encryption, they use random noise to mask the bid values. By using a masking method, the server only knows the noise, and the auctioneer only knows the auction results; neither will see the private information of the bidders. All three schemes enable the auctioneer to verify that the winners have paid the correct amounts. A thorough theoretical analysis is performed to evaluate the security properties, computational complexity, and communication complexity of the auctions. Copyright © 2016 John Wiley & Sons, Ltd.

Attribute based encryption (ABE) has been applied to many applications nowadays [1][2] and it effectively achieves a fine grained access control. Even the encryptor needs only one encryption operation, and all the decryption operations are distributed to the receiver's end, the computational cost of encryption is still impractical when there is a large amount of encryption with different access structures. In this paper, we examine existing techniques that optimize the decentralized attribute based encryption scheme [3], such as a better construction of e Linear Secret-Sharing Scheme (LSSS) matrix, pre-processing of scalar multiplication and pairing, multi-pairing and so on. We proposed the deployment of offline pools to improve the real-time operations. We proposed the method to construct offline pools and designed algorithms to achieve better hitting rate of offline pool topples. We evaluated the optimization techniques, the result shows that there is a 45 times of performance improvement in the encryption (6-8 times for the decryption) after we applied all the real-time optimization techniques mentioned in our paper. With deployment of the offline pools, the optimization can be improved at least 100-200 times than without offline pools.

Cognitive radio networking allows the unlicensed secondary users to opportunistically access the licensed spectrum as long as the performance of the licensed primary users does not degrade. This dynamic spectrum access strategy is enabled by cognitive radio coupled with spectrum sensing technologies. Due to the imperfection of wireless transmissions, collaborative spectrum sensing (CSS) has been proposed to significantly improve the probability of detecting the transmissions of primary users. Nevertheless, current CSS techniques are sensitive to malicious secondary users, leading to a high false alarm rate and low detection accuracy on the presence of the primary users. In this paper, we present several robust collaborative spectrum sensing schemes that can calculate a trust value for each secondary user to reflect its suspicious level and mitigate its harmful effect on cooperative sensing. Our approach explores the spatial and temporal correlations among the reported information of the secondary users to determine the trust values. Extensive simulation study has been performed and our results demonstrate that the proposed schemes can guarantee the accuracy of the cooperative sensing system with a low false alarm rate when a considerable number of secondary users report false information.

Body Area Networks (BANs) are expected to play a major role in patient health monitoring in the near future. Providing an efficient key agreement with the prosperities of plug-n-play and transparency to support secure inter-sensor communications is critical especially during the stages of network initialization and reconfiguration. In this paper, we present a novel key agreement scheme termed Ordered-Physiological-Feature-based Key Agreement (OPFKA), which allows two sensors belonging to the same BAN to agree on a symmetric cryptographic key generated from the overlapping physiological signal features, thus avoiding the pre-distribution of keying materials among the sensors embedded in the same human body. The secret features computed from the same physiological signal at different parts of the body by different sensors exhibit some overlap but they are not completely identical. To overcome this challenge, we detail a computationally efficient protocol to securely transfer the secret features of one sensor to another such that two sensors can easily identify the overlapping ones. This protocol possesses many nice features such as the resistance against brute force attacks. Experimental results indicate that OPFKA is secure, efficient, and feasible. Compared with the state-of-the-art PSKA protocol, OPFKA achieves a higher level of security at a lower computational overhead.

Body Area Networks (BANs) are expected to play a major role in the field of patient-health monitoring in the near future. While it is vital to support secure BAN access to address the obvious safety and privacy concerns, it is equally important to maintain the elasticity of such security measures. For example, elasticity is required to ensure that first-aid personnel have access to critical information stored in a BAN in emergent situations. The inherent tradeoff between security and elasticity calls for the design of novel security mechanisms for BANs. In this paper, we develop the Fuzzy Attribute-Based Signcryption (FABSC), a novel security mechanism that makes a proper tradeoff between security and elasticity. FABSC leverages fuzzy Attribute-based encryption to enable data encryption, access control, and digital signature for a patient's medical information in a BAN. It combines digital signatures and encryption, and provides confidentiality, authenticity, unforgeability, and collusion resistance. We theoretically prove that FABSC is efficient and feasible. We also analyze its security level in practical BANs.

Cloud computing enables resource-constrained clients to economically outsource their huge computation workloads to a cloud server with massive computational power. This promising computing paradigm inevitably brings in new security concerns and challenges, such as input/output privacy and result verifiability. Since matrix inversion computation (MIC) is a quite common scientific and engineering computational task, we are motivated to design a protocol to enable secure, robust cheating resistant, and efficient outsourcing of MIC to a malicious cloud in this paper. The main idea to protect the privacy is employing some transformations on the original matrix to get a encrypted matrix which is sent to the cloud; and then transforming the result returned from the cloud to get the correct inversion of the original matrix. Next, a randomized Monte Carlo verification algorithm with one-sided error is employed to successfully handle result verification. In this paper, the superiority of this novel technique in designing inexpensive result verification algorithm for secure outsourcing is well demonstrated. We analytically show that the proposed protocol simultaneously fulfills the goals of correctness, security, robust cheating resistance, and high-efficiency. Extensive theoretical analysis and experimental evaluation also show its high-efficiency and immediate practicability.