This paper defines the conditional constant function problem (CCFP), and for a special case of CCFP, presents a quantum algorithm for solving it efficiently. Such an algorithm enables us to make new evaluations of the quantum security of Feistel block cipher in the case where quantum attackers can only perform online classical queries. Specifically, the chosen-plaintext key recovery attacks on two Feistel block cipher variants, known as Feistel-KF and Feistel-FK, are significantly improved. For Feistel-KF, a 3-round distinguisher based on the special case of CCFP is constructed, and key recovery attacks forr> 3 rounds are proposed. For Feistel-FK, the CCFP based distinguisher covers 4 rounds and the key recovery attacks are applicable forr> 4 rounds. Based on the CCFP solving algorithm, the key recovery attacks can reduce the classical memory complexity from the previous exponentialO(2cn) toO(1), wherec’s are constants. The query complexity of key recovery attacks on Feistel-KF is also significantly reduced fromO(2cn) toO(1). Besides, the CCFP solving algorithm can be extended to reduce the query complexity exponentially in attacking the 2IEM and pEDM constructions. These results indicate that quantum algorithms solving CCFP could be more promising than those solving the period finding problem.

Due to their simple security assessments, permutation-based pseudo-random functions (PRFs) have become widely used in cryptography. It has been shown that PRFs using a single n-bit permutation achieve n/2 bits of security, while those using two permutation calls provide 2n/3 bits of security in the classical setting. This paper studies the security of permutation-based PRFs within the Q1 model, where attackers are restricted to classical queries and offline quantum computations. We present improved quantum-time/classical-data tradeoffs compared with the previous attacks. Specifically, under the same assumptions/hardware as Grover’s exhaustive search attack, i.e. the offline Simon algorithm, we can recover keys in quantum time Õ(2n/3), with O(2n/3) classical queries and O(n2) qubits. Furthermore, we enhance previous superposition attacks by reducing the data complexity from exponential to polynomial, while maintaining the same time complexity. This implies that permutation-based PRFs become vulnerable when adversaries have access to quantum computing resources. It is pointed out that the above quantum attack can be applied to several cryptographic schemes, including PDMMAC and pEDM, as well as general instantiations like XopEM, EDMEM, EDMDEM, and others.

Deep learning is a powerful technique for data-driven learning in the era of Big Data. However, most deep learning models are deterministic models that ignore the uncertainty of data. Fuzzy neural networks are proposed to tackle this type of problem. In this article, we proposed a novel quantum assisted hierarchical fuzzy neural network (QA-HFNN). Different from classical fuzzy neural networks, QA-HFNN uses quantum neural networks (QNNs) to learn fuzzy membership functions. The model is a multifeature fusion learning algorithm with a parallel structural design that integrates quantum and classical neural networks. The classical network is used to capture high-dimensional neural features, the QNNs are designed to capture fuzzy logic features of the data, then, the two features are fused to form the final features to be classified. The experiment is performed on a classical computer, and the quantum circuit is built through a simulated quantum environment. The results indicate that the accuracy of QA-HFNN can equal to or even surpass classical methods in image classification tasks. The quantum circuit utilizes only a single qubit which is easy to implement. In addition, the fidelity of quantum circuit in a quantum noise environment is assessed, demonstrating that QA-HFNN has strong robustness. The time and computational complexity of QNNs was analyzed, further proving the effectiveness of the model.

Rust is designed as a systems programming language that aims to provide safety guarantees and performance efficiency. In practice, programmers usually use atomic correlations to share data across threads. For example, by using atomic operations to correlate with non-atomic addresses, they can design lock-free data structures for efficient concurrency. Although atomic operations are used in safe code, memory ordering misuses can still lead to atomic concurrency bugs and performance loss.In this paper, we conduct the first empirical study of atomic operations and memory ordering usage in Rust, manual inspection of 2883 atomic usages in real-world applications, including 15 thread bugs and 150 performance issues. We also study their usage scenarios, performance comparisons and issue fixes to provide a better understanding on Rust’s memory ordering misuses and guide better code practices in the future.We design AtomVChecker, an automated static analyzer to detect memory ordering misuses. we evaluate our tool on four widely-used concurrent libraries, it can automatically analyze 228 atomic correlations with 80% accuracy. Based on the atomic correlation analysis, AtomVChecker finds a total of 51 performance loss issues in 9 Rust packages, with all of them recently confirmed by the project maintainer based on our reports.

Recently, in IEEE Transactions on Dependable and Secure Computing (TDSC), the VERSA scheme proposed by Hahnet al. uses a double aggregation method for verifying the correctness of results returned from the server. The authors proposed that the correctness of the model aggregation can be verified with lower verification overhead by utilizing only a lightweight pseudorandom generator. To support verifiability of results returned from the server, a method of sharing a pair of vectors$(a,b)$by all clients is proposed, which is one of the most important work in VERSA. Unfortunately, in this paper, we show that the method is incorrect, which leads clients to consistently conclude that the aggregated results are incorrect. Furthermore, the model training process in federated learning is forced to abort. Finally, we demonstrate our view through theory analysis and instantiation verification.

Abstract By introducing the BHT algorithm into the slide attack on 1K-AES and the related-key attack on PRINCE, we present the corresponding quantum attacks in this paper. In the proposed quantum attacks, we generalize the BHT algorithm to the situation where the number of marked items is unknown ahead of time. Moreover, we give an implementation scheme of classifier oracle based on Quantum Phase Estimation algorithm in presented quantum attacks. The complexity analysis shows that the query complexity, time complexity and memory complexity of the presented quantum attacks are all $\mathcal{O}(2^{n/3})$ when the success probability is about $63\%$, where $n$ is the block size. Compared with the corresponding classical attacks, the proposed quantum attacks can achieve subquadratic speed-up under the same success probability no matter on query complexity, time complexity or memory complexity. Furthermore, the query complexity of the proposed quantum slide attack on 1K-AES is less than Grover search on 1K-AES by a factor of $2^{n/6}.$ When compared with the Grover search on PRINCE, the query complexity of the presented quantum attack on PRINCE is reduced from $\mathcal{O}(2^{n})$ to $\mathcal{O}(2^{n/2}).$ When compared with the combination of Grover and Simon’s algorithms on PRINCE, the query complexity of our quantum attack on PRINCE is reduced from $\mathcal{O}(n\cdot 2^{n/2})$ to $\mathcal{O}(2^{n/2}).$ Besides, the proposed quantum slide attack on 1K-AES indicates that the quantum slide attack could also be applied on Substitution-Permutation Network construction, apart from the iterated Even-Mansour cipher and Feistel constructions.

In the 6G era, Internet of Things (IoT) devices can form a blockchain network, which also faces the problems of data sharing. The data transmitted and stored through the network have the risk of privacy leaking. Encrypting the shared data can satisfy the need of the privacy, and retrieving the encrypted data can make the data used efficiently. However, to enable users to retrieve encrypted data and perform fine-grained authorization on their encrypted files is still a great challenge. Although attribute-based keyword search (ABKS) is a well-received solution to the challenge, there are still privacy and efficiency issues if the traditional ABKS schemes are directly used in blockchain data sharing. In order to solve the problems, this article proposes privacy protection data retrieval scheme with an inverted index, which is an application of attribute-based encryption. First, our scheme is proved secure against the outside keyword guessing attack (KGA) and chosen keyword attack (CKA) under the semitrusted model. Second, the scheme returns a multikeywords ranked result. Third, we analyze the efficiency of our scheme and verify it by simulation. The results show that our scheme has improvement in efficiency and can meet the data sharing needs of the blockchain network composed of IoT devices.

Federated learning (FL) enables multiple worker devices share local models trained on their private data to collaboratively train a machine learning model. However, local models are proved to imply the information about the private data and, thus, introduce much vulnerabilities to inference attacks where the adversary reconstructs or infers the sensitive information about the private data (e.g., labels, memberships, etc.) from the local models. To address this issue, existing works proposed homomorphic encryption, secure multiparty computation (SMC), and differential privacy methods. Nevertheless, the homomorphic encryption and SMC-based approaches are not applicable to large-scale FL scenarios as they incur substantial additional communication and computation costs and require secure channels to delivery keys. Moreover, differential privacy brings a substantial tradeoff between privacy budget and model performance. In this article, we propose a novel FL framework, which can protect the data privacy of worker devices against the inference attacks with minimal accuracy cost and low computation and communication cost, and does not rely on the secure pairwise communication channels. The main idea is to generate the lightweight keys based on computational Diffie–Hellman (CDH) problem to encrypt the local models, and the FL server can only get the sum of the local models of all worker devices without knowing the exact local model of any specific worker device. The extensive experimental results on three real-world data sets validate that the proposed FL framework can protect the data privacy of worker devices, and only incurs a small constant of computation and communication cost and a drop in test accuracy of no more than 1%.

Searchable encryption (SE) is a powerful technology that enables keyword-based search over encrypted data becomes possible. However, most SE schemes focus on exact keyword search which can not tolerate misspellings and typos. Existing fuzzy keyword search schemes only support fuzzy search within a limited similarity threshold$d$, the storage cost will grow exponentially or the precision of search results will greatly decrease as$d$increases. Moreover, the current fuzzy keyword ranked search schemes consider only the keyword weight, and disregard the influence of keyword morphology similarity on the ranking. In this article, we propose a scalable fuzzy keyword ranked search scheme over encrypted data under hybrid clouds architecture. We use the edit distance to measure the similarity of keywords and design an edit distance algorithm over encrypted data, in which our scheme achieves fuzzy keyword search for any similarity threshold$d$with a constant storage size and accurate search results. Furthermore, we design a two-factor ranking function combining keyword weight with keyword morphology similarity, which is utilized to rank the search results and enhance system usability. Extensive experiments are performed to demonstrate the trade-off of efficiency and security of the proposed scheme.

Multi-access Edge Computing (MEC) enables mobile users to run various delay-sensitive applications via offloading computation tasks to MEC servers. However, the location privacy and the usage pattern privacy are disclosed to the untrusted MEC servers. The most related work concerning privacy-preserving offloading schemes in MEC either consider an impractical MEC scenario consisting of a single user or take a large amount of computation and communication cost. In this article, we propose a deep reinforcement learning based joint optimization of delay and privacy preservation during offloading for multiple-user wireless powered MEC systems, preserving users’ both location privacy and usage pattern privacy. The main idea is that, to protect both the two kinds of privacy, we propose to disguise users’ offloading decisions and deliberately offloading redundant tasks along with the actual tasks to the MEC servers. On this basis, we further formalize the task offloading as an optimization problem of computation rate and privacy preservation. Then, we design a deep reinforcement learning based offloading algorithm to solve such an non-convex problem, aiming to obtain the better tradeoff between the computation rate and the privacy preservation. Finally, extensive simulation results demonstrate that our algorithm can maintain a high level of computation rate while protecting users’ usage pattern privacy and location privacy, compared with two learning-based methods and two Baselines.

Abstract The ability of Fog computing to admit and process huge volumes of heterogeneous data is the catalyst for the fast expansion of Internet of things (IoT). The critical challenge is secure and differentiated access to the data, given limited computation capability and trustworthiness in typical IoT devices and Fog servers, respectively. This paper designs and develops a new approach for secure, efficient and differentiated data access. Secret sharing is decoupled to allow the Fog servers to assist the IoT devices with attribute-based encryption of data while preventing the Fog servers from tampering with the data and the access structure. The proposed encryption supports direct revocation and can be decoupled among multiple Fog servers for acceleration. Based on the decisional $q$-parallel bilinear Diffie–Hellman exponent assumption, we propose a new extended $q$-parallel bilinear Diffie–Hellman exponent (E$q$-PBDHE) assumption and prove that the proposed approach provides ‘indistinguishably chosen-plaintext attacks secure’ data access for legitimate data subscribers. As numerically and experimentally verified, the proposed approach is able to reduce the encryption time by 20% at the IoT devices and by 50% at the Fog network using parallel computing as compared to the state of the art .

Oblivious Random Access Machine (ORAM) is a kind of cryptographic primitive that allows a client to access its private data from the server without disclosing the access pattern. To deal with consecutive requested blocks at a time efficiently, range ORAM (rORAM) is presented. In the previous rORAM scheme, the locality, namely, the number of discontinuous seeks to complete a request, is reduced to O(log2 N), nevertheless, the bandwidth cost is increased to the poly-logarithmic level. Hence, there exists an open question, that is, whether rORAM can be constructed with the same bandwidth efficiency as a regular ORAM, that is, O(log N)-block? In this paper, we propose a new rORAM scheme, called L2-rORAM. In our scheme, a compatible superblock technique is proposed, and it is combined together with an eviction technique for range blocks, so that it avoids duplication of multiple copies and extra dummy access. As a result, it obtains O(log N)-block bandwidth cost, which affirmatively answers the above open question. Meanwhile, the data locality is reduced to O(log N). In addition, the client storage is maintained at the small level of O(log N)-block, and the server storage is maintained at the unexpanded level of O(N)-block. Finally, experimental results show that the average response time of our L2-rORAM is reduced by one order of magnitude over the state-of-the-art rORAM scheme.

Dynamic searchable encryption (SE) aims at achieving varied search function over encrypted database in dynamic setting, which is a trade-off in efficiency, security, and functionality. Recent work proposes a file-injection attack which can successfully attack by utilizing some information leaked in the update process. To mitigate this attack, some SE schemes with forward privacy are proposed. However, these schemes are designed to achieve single keyword or conjunctive keyword search, which cannot support multikeyword search. Moreover, these schemes do not consider the function of results ranking. In this paper, we propose a forward privacy multikeyword ranked search scheme over encrypted database. We design a forward privacy multikeyword search scheme based on the classic MRSE scheme. Our scheme makes the cloud cannot obtain the actual match results of the past query with the newly updated files by adding the well-chosen dummy elements to the original index and query vectors. We rank the search results based on the matched keyword number and the T F × I D F $TF\times IDF$ rule in the dynamic setting. Our scheme uses only the symmetric encryption primitive. We implement our scheme for COVID-19 data set and the experimental evaluation results show that the proposed scheme is secure and efficient.

Attribute-based keyword search (ABKS) has a broad developing prospect in providing search service for users and realizing fine-grained access control over ciphertext in the background of cloud computing. However, two open problems prevent further development and application of ABKS. First, most of ABKS schemes suffer from inside keyword guessing attack (KGA) inherently, which is a great threat to the security of the scheme. Second, the existing ABKS schemes focus on single or conjunctive keyword search, these inflexible retrieval modes may lead to efficiency loss caused by inaccurate positioning of user’s interest and greatly reduce user search experience. In this article, we introduce a semi-trusted server and build a dual server model. Based on the dual server model and our proposed techniques, we are the first to put forward an attribute-based multi-keyword ranked search scheme against inside keyword guessing attack (ABKRS-KGA) to solve the mentioned two problems simultaneously. In our scheme, the queries of users contain weighted keywords and the returned files can be ranked according to user’s query interest. We provide strict security definitions for two types of adversaries and we are the first to prove that the construction is adaptively secure against both chosen-keyword attack (CKA) and KGA. Finally, all-side simulation with real-world data set is implemented for the proposed scheme, and the simulation results show that the efficiency of the proposed scheme is acceptable.

Cloud storage attracts a lot of clients to join the paradise. For a high data availability, some clients require their files to be replicated and stored on multiple servers. Because clients are generally charged based on the redundancy level required by them, it is critical for clients to obtain convincing evidence that all replicas are stored correctly and are updated to the up-to-date version. In this article, we propose a dynamic proof of data possession and replication (DPDPR) scheme, which is proved to be secure in the defined security model. Our scheme shares a single authenticated tree across multiple replicas, which reduces the tree's storage cost significantly. Our scheme allows for batch verification for multiple challenged leaves and can verify multiple replicas in a single batch way, which considerably save bandwidth and computation resources during audit process. We also evaluate the DPDPR's performance and compare it with the most related scheme. The evaluation results show that our scheme saves almost 66 percent tree's storage cost for three replicas, and obtains almost 60 and 80 percent efficiency improvements in terms of the overall bandwidth and computation costs, respectively, when three replicas are checked and each challenged with 460 blocks.

This paper solves Split Demand Vehicle Routing Problem with minimal vehicles and controlled task splits. Our algorithm encodes the mapping between task splits and vehicles into a binary matrix and uses Genetic Quantum Algorithm to control the evolvement process. To convert the binary matrix solution into task loading schemes, we design a novel cost function and successfully convert task assignment problem to Transportation Problem which can be solved by Transportation Simplex Method. Our algorithm uses a simple nearest-neighborhood based heuristic to generate vehicle routes and adopts a local search method tailored for SDVRP to improve solution quality. The experimental results show that our algorithm splits few tasks and can obtain many solutions better than CVRP best-known in TSPLIB 95. Further analysis reveals that savings of SDVRP mostly come from CVRP’s failure to combine tasks geographically close into one route, when the number of vehicles are restricted to minimum.

Abstract Public key encryption with equality test (PKEET) can check whether two ciphertexts are encrypted from the same message or not without decryption. This attribute enables PKEET to be increasingly utilized in cloud storage, where users store their encrypted data on the cloud. In traditional PKEET, the tester is authorized by the data receiver to perform equality test on its ciphertexts. However, the tester can only test one ciphertext or all ciphertexts of one receiver with one authorization. It means that the receiver cannot adaptively authorize the test right of any number of ciphertexts to the tester. A trivial solution is authorizing one ciphertext each time and repeating multiple times. The corresponding size of trapdoor in this method is linear with the number of authorized ciphertexts. This will incur storage burden for the tester. To solve the aforementioned problem, we propose the concept of PKEET supporting partial authentication (PKEET-PA). We then instantiate the concept to a lightweight PKEET-PA, which achieves constant-size trapdoor. Besides, we prove the security of our PKEET-PA scheme against two types of adversaries. Compared with other PKEET schemes that can be used in trivial solution, our PKEET-PA is more efficient in receivers’ computation and has lower trapdoor size.

The development of the Internet of Things (IoT) has brought various IoT services, which facilitate and enrich human life. All these services are at risk of privacy leakage. The privacy-preserving issue of IoT query, which is a typical service, has attracted much attention. A superior candidate for solving the above issue is classical cryptographic schemes based on the computational difficulty. With the advent of quantum computation, the security of such schemes may be broken by the strong ability of some advanced quantum algorithms. How to design a secure scheme for privacy-preserving query under the threat of quantum computation is crucial. To this end, we construct a general architecture of privacy-preserving query in IoT scenarios. Besides trust or honesty-but-curious models, we present a scheme for privacy-preserving query which is also valid in the scenario of untrusted devices. We provide a detailed security analysis. The result shows our scheme achieves private preservation of both service providers and clients.

Ridge regression (RR) is an important machine learning technique which introduces a regularization hyperparameter$\alpha$to ordinary multiple linear regression for analyzing data suffering from multicollinearity. In this paper, we present a quantum algorithm for RR, where the technique of parallel Hamiltonian simulation to simulate a number of Hermitian matrices in parallel is proposed and used to develop a quantum version of$K$-fold cross-validation approach, which can efficiently estimate the predictive performance of RR. Our algorithm consists of two phases: (1) using quantum$K$-fold cross-validation to efficiently determine a good$\alpha$with which RR can achieve good predictive performance, and then (2) generating a quantum state encoding the optimal fitting parameters of RR with such$\alpha$, which can be further utilized to predict new data. Since indefinite dense Hamiltonian simulation has been adopted as a key subroutine, our algorithm can efficiently handle non-sparse data matrices. It is shown that our algorithm can achieve exponential speedup over the classical counterpart for (low-rank) data matrices with low condition numbers. But when the condition numbers of data matrices are large to be amenable to full or approximately full ranks of data matrices, only polynomial speedup can be achieved.

Abstract To date cloud computing may provide considerable storage and computational power for cloud-based applications to support cryptographic operations. Due to this benefit, attribute-based keyword search (ABKS) is able to be implemented in cloud context in order to protect the search privacy of data owner/user. ABKS is a cryptographic primitive that can provide secure search services for users but also realize fine-grained access control over data. However, there have been two potential problems that prevent the scalability of ABKS applications. First of all, most of the existing ABKS schemes suffer from the outside keyword guessing attack (KGA). Second, match privacy should be considered while supporting multi-keyword search. In this paper, we design an efficient method to combine the keyword search process in ABKS with inner product encryption and deploy several proposed techniques to ensure the flexibility of retrieval mode, the security and efficiency of our scheme. We later put forward an attribute-based conjunctive keyword search scheme against outside KGA to solve the aforementioned problems. We provide security notions for two types of adversaries and our construction is proved secure against chosen keyword attack and outside KGA. Finally, all-side simulation with real-world data set is implemented for the proposed scheme, and the results of the simulation show that our scheme achieves stronger security without yielding significant cost of storage and computation.

Abstract For a high level of data availability and reliability, a common strategy for cloud service providers is to rely on replication, i.e. storing several replicas onto different servers. To provide cloud users with a strong guarantee that all replicas required by them are actually stored, many multi-replica integrity auditing schemes were proposed. However, most existing solutions are not resource economical since users need to create and upload replicas of their files by themselves. A multi-replica solution called Mirror is presented to overcome the problems, but we find that it is vulnerable to storage saving attack, by which a dishonest provider can considerably save storage costs compared to the costs of storing all the replicas honestly—while still can pass any challenge successfully. In addition, we also find that Mirror is easily subject to substitution attack and forgery attack, which pose new security risks for cloud users. To address the problems, we propose some simple yet effective countermeasures and an improved proofs of retrievability and replication scheme, which can resist the aforesaid attacks and maintain the advantages of Mirror, such as economical bandwidth and efficient verification. Experimental results show that our scheme exhibits comparable performance with Mirror while achieving high security.

Abstract Location-based services have attracted much attention in both academia and industry. However, protecting user’s privacy while providing accurate service for users remains challenging. In most of the existing research works, a semi-trusted proxy is employed to act on behalf of a user to minimize the computation and communication costs of the user. However, user privacy, e.g. location privacy, cannot be protected against the proxy. In this paper, we design a new blind filter protocol where a user can employ a semi-trusted proxy to determine whether a point of interest is within a circular area centered at the user’s location. During the protocol, neither the proxy nor the location-based service provider can obtain the location of the user and the query results. Moreover, each type of query is controlled by an access tree and only the users whose attributes satisfy this access tree can complete the specific type of query. Security analysis and efficiency experiments validate that the proposed protocol is secure and efficient in terms of the computation and communication overhead.

Self-testing refers to a device-independent way to uniquely identify an unknown quantum device based only on the observed statistics. Earlier results on self-testing of multipartite state were restricted either to Dicke states or Graph states. In this paper, we propose self-testing schemes for a large family of symmetric three-qubit states, namely the superposition of W state and GHZ state. We first propose and analytically prove a self-testing criterion for the special symmetric state with equal coefficients of the canonical bases, by designing subsystem self-testing of partially and maximally entangled state simultaneously. Then we demonstrate for the general case, the states can be self-tested numerically by the swap method combining semidefinite programming (SDP) in high precision.

Most existing quantum private query (QPQ) protocols can hardly work in the presence of noise. The user Alice may obtain a false database item in noisy environments and both participants may cheat under the disguise of noise, so dealing with the noise needs an overall consideration of error correction, user privacy and database security. However, the only two existing protocols aiming to correct errors in QPQ lack such an overall consideration (at least one party's privacy can be revealed), and they did not estimate what extent of errors can be tolerated (actually, noise is seldom discussed in quantum two-party secure computations, and to the best of our knowledge, relevant bounds on tolerable errors remain unattainable so far). To solve this problem, we first exemplify how one participant reveals the other party's privacy in the existing QPQ protocols aiming to correct errors. Then we propose a practical protocol which can really work via noisy channel, that is, the error rate of the retrieved database item is reduced significantly and both parties' privacy are well protected. Besides, we deduce that the final error rate, user privacy and database security are pairwise in a “trade-off” relationship. By balancing them according to the required level of security and reliability, we obtain an upper bound on tolerable errors.

Replication is a fundamental solution for the cloud service provider (CSP) to guarantee data availability. To provide users with convincing evidence that the copies required by them are all stored correctly, a number of multi-copy integrity auditing schemes were presented. Recently, Barsoum and Hasan proposed a map-based provable multi-copy dynamic data possession scheme (IEEE Transactions on Information Forensics and Security, vol. 10, no. 3, pp. 485-497, 2015), which was claimed to be secure and can ensure that the CSP possesses all copies required by the contract. However, in this letter, we show that the scheme is easily subject to a copy-summation attack and a single-copy attack, by which a cheating CSP only needs to invest a storage cost of a single copy-while can still pass the verifier's challenge at all times. Therefore, the scheme is no longer secure in this case. Furthermore, we propose some simple but effective countermeasures and give a repaired scheme which is free from the above two attacks.

The recent outbreak of industrial cyberattacks indicates that the current industrial network security architecture is under serious challenges. As one of the critical industrial networks, the heterogeneous and real-time substation network lacks compatibility with the conventional cryptography architecture represented by secure sockets layer/transport layer security (SSL/TLS) and public key infrastructure (PKI). To enhance the security of smart substations under the premise of low latency, in this article, we present a novel encryption-as-a-service architecture based on fog computing in this article. The architecture offloads encryption to dedicated devices and makes certificate and key management available through unified web services on the fog and cloud layers. Based on this architecture, we propose MX-SORTS, maximizing security on real-time communication of different services, an algorithm for adaptive configuration of encrypting and signing substation network traffic. By the contrast experiments with the conventional cryptography architecture, we prove that the encryption-as-a-service architecture can significantly improve the real-time and security performance of substation networks.

The visual recognition of Android malicious applications (Apps) is mainly focused on the binary classification using grayscale images, while the multiclassification of malicious App families is rarely studied. If we can visualize the Android malicious Apps as color images, we will get more features than using grayscale images. In this paper, a method of color visualization for Android Apps is proposed and implemented. Based on this, combined with deep learning models, a multiclassifier for the Android malicious App families is implemented, which can classify 10 common malicious App families. In order to better understand the behavioral characteristics of malicious Apps, we conduct a comprehensive manual analysis for a large number of malicious Apps and summarize 1695 malicious behavior characteristics as customized features. Compared with the App classifier based on the grayscale visualization method, it is verified that the classifier using the color visualization method can achieve better classification results. We use four types of Android App features: classes.dex file, sets of class names, APIs, and customized features as input for App visualization. According to the experimental results, we find out that using the customized features as the color visualization input features can achieve the highest detection accuracy rate, which is 96% in the ten malicious families.

Abstract Online data sharing has become a research hotspot while cloud computing is getting more and more popular. As a promising encryption technique to guarantee the security shared data and to realize flexible fine-grained access control, ciphertext-policy attribute-based encryption (CP-ABE) has drawn wide attentions. However, there is a drawback preventing CP-ABE from being applied to cloud applications. In CP-ABE, the access structure is included in the ciphertext, and it may disclose user’s privacy. In this paper, we find a more efficient method to connect ABE with inner product encryption and adopt several techniques to ensure the expressiveness of access structure, the efficiency and security of our scheme. We are the first to present a secure, efficient fine-grained access control scheme with hidden access structure, the access structure can be expressed as AND-gates on multi-valued attributes with wildcard. We conceal the entire attribute instead of only its values in the access structure. Besides, our scheme has obvious advantages in efficiency compared with related schemes. Our scheme can make data sharing secure and efficient, which can be verified from the analysis of security and performance.

Higher security and lower failure probability have always been people's pursuits in quantum-oblivious-key-transfer-based private query (QOKT-PQ) protocols since Jacobi et al. [Phys. Rev. A 83, 022301 (2011)] proposed the first protocol of this kind. However, higher database security generally has to be obtained at the cost of a higher failure probability, and vice versa. Recently, based on a round-robin differential-phase-shift quantum key distribution protocol, Liu et al. [Sci. China-Phys. Mech. Astron., 58, 100301 (2015)] presented a private query protocol (RRDPS-PQ protocol) utilizing ideal single-photon signal which realizes both ideal database security and zero failure probability. However, ideal single-photon source is not available today, and for large database the required pulse train is too long to implement. Here, we reexamine the security of RRDPS-PQ protocol under imperfect source and present an improved protocol using a special “low-shift and addition” (LSA) technique, which not only can be used to query from large database but also retains the features of “ideal database security” and “zero-failure” even under weak coherent source. Finally, we generalize the LSA technique and establish a generic QOKT-PQ model in which both “ideal database security” and “zero failure” are achieved via acceptable communications.