Federated Learning (FL), an innovative distributed paradigm, has attracted significant interest for its inherent privacy preservation in collaborative model training. However, recent studies demonstrate that publicly shared gradients are vulnerable to malicious reconstruction of sensitive client data. While countermeasures like differential privacy and homomorphic encryption exist, they typically compromise model accuracy or computational efficiency, hindering practical deployment. This work simultaneously addresses two critical challenges in the FL training process: 1) efficient protection of client privacy, and 2) guaranteeing the authenticity of client gradients while ensuring the verifiability of the server's aggregation result. To this end, we propose an efficient and authentication-enhanced privacy-preserving protocol. Our solution allows clients to mask their local gradients and furnish corresponding proofs. The aggregation server subsequently verifies all submissions, aggregates only the valid masked gradients, and generates a proof for clients to verify the correctness of the aggregation result. Furthermore, the protocol is designed to be robust against client dropout. We provide formal proof that our protocol meets all security requirements in a semi-trusted environment. Both comprehensive theoretical analysis and extensive experimental evaluations confirm that our approach achieves more robust security, better dropout resilience, and superior overall efficiency compared to state-of-the-art protocols such as PSA, VerifyNet, and EVP.

In end-to-end encrypted (E2EE) messaging systems, protecting communication metadata, such as who is communicating with whom, at what time, etc., remains a challenging problem. Existing designs mostly fall into the balancing act among security, performance, and trust assumptions: 1) designs with cryptographic security often use hefty operations, incurring performance roadblocks and expensive operational costs for large-scale deployment; 2) more performant systems often follow a weaker security guarantee, like differential privacy, and generally demand more trust from the involved servers. So far, there has been no dominant solution. In this paper, we take a different technical route from prior art, and propose Boomerang, an alternative metadata-private messaging system leveraging the readily available trust assumption on secure enclaves (as those emerging in the cloud). Through a number of carefully tailored oblivious techniques on message shuffling, workload distribution, and proactive patching of the communication pattern, Boomerang brings together low latency, horizontal scalability, and cryptographic security, without prohibitive extra cost. With 32 machines, Boomerang achieves 99th percentile latency of 7.76 seconds for$2^{20}$clients. Upon Boomerang, we also propose and implement a new client instantiation based on modern web browser extensions. We hope Boomerang offers attractive alternative options to the current landscape of metadata-private messaging designs.

For those seeking end-to-end private communication free from pervasive metadata tracking and censorship, the Tor network has been the de-facto choice in practice, despite its susceptibility to traffic analysis attacks. Recently, numerous metadata-private messaging proposals have emerged with the aim to surpass Tor in the messaging context by obscuring the relationships between any two messaging buddies, even against global and active attackers. However, most of these systems face an undesirable usability constraint: they require a metadata-private “dialing” phase to establish mutual agreement and timing or round coordination before initiating any regular chats among users. This phase is not only resource-intensive but also inflexible, limiting users’ ability to manage multiple concurrent conversations seamlessly. For stringent privacy requirement, the often-enforced traffic uniformity further exacerbated the limitations of this roadblock. In this paper, we introduce PingPong, a new end-to-end system for metadata-private messaging designed to overcome these limitations. Under the same traffic uniformity requirement, PingPong replaces the rigid “dial-before-converse” paradigm with a more flexible “notify-before-retrieval” workflow. This workflow incorporates a metadata-private notification subsystem, PING, and a metadata-private message store, PONG. Both PING and PONG leverage hardware-assisted secure enclaves for performance and operates through a series of customized oblivious algorithms, while meeting the uniformity requirements for metadata protection. By allowing users to switch between conversations on demand, PingPong achieves a level of usability akin to modern instant messaging systems, while also offering improved performance and bandwidth utilization for goodput We have built a prototype of PingPong with 32 8-core servers equipped with enclaves and conducted a case study on a real-world messaging metadata dataset to validate our claims.

Searchable encryption enables privacy-preserving queries over data outsourced to cloud services. Classical symmetric schemes deliver efficient search but largely assume a single client setting; multi-client variants permit delegation yet typically treat authorization as an owner-local decision, overlooking regulations enforced by higher-level authorities (e.g., sector-specific compliance). In practice, limited familiarity with regulatory detail or operational lapses can lead owners to delegate search permissions that violate authority regulations, rendering existing systems unsuited to regulated, multi-client cloud environments. To address this gap, we propose two systems. First, we propose SENTRY, a multi-client dynamic searchable encryption framework with a built-in compliance-check service via sanitized authorization. Its core is a tag-based sanitization protocol: the authority encodes prohibited keywords as hidden tags, and the sanitizer uses these tags to remove non-compliant per-keyword search permissions before they reach readers, without learning the underlying keywords. As a result, readers receive only compliant search capabilities. We then proposeF-SENTRY, a forward private variant of SENTRY for settings where regulations evolve over time.F-SENTRY preserves the same sanitized-authorization mechanism and further adds forward privacy through a tailored constrained shiftable encryption, which binds search permissions and newly added encrypted updates to regulatory epochs. Consequently, permissions issued before a policy change cannot be used to retrieve data added afterward unless they are refreshed for the new epoch. We formalize the security of both SENTRY andF-SENTRY and prove them secure under standard assumptions. Experiments under cloud-like workloads show that SENTRY achieves regulation-compliant authorization with modest over head, whileF-SENTRY provides stronger protection under changing regulations at practical additional cost.

Federated learning (FL) has emerged as a promising paradigm for privacy-preserving distributed machine learning, yet it remains highly vulnerable to model poisoning attacks. Malicious clients can submit manipulated updates to degrade model performance or implant hidden backdoors. While robust aggregation and attack detection have been extensively studied, efficiently recovering the global model after poisoning remains challenging. Retraining from scratch incurs prohibitive costs, whereas rollback-based approaches fail to eliminate incremental contamination. To overcome these limitations, we propose FedReconPP, a lightweight recovery framework. We design an importance-driven compressed storage mechanism to significantly reduce overhead. We introduce a time-decayed contamination tracking mechanism with rigorous theoretical foundation that captures and mitigates incremental poisoning and develop a quality-aware privacy-preserving recovery strategy with formal differential privacy guarantees to strengthen robustness against inference attacks while maintaining model utility. Extensive experiments on multiple datasets, demonstrate that FedReconPP achieves reliable recovery with substantially lower resource consumption, offering practicality and strong protection for federated learning systems.

In recent years, cross-device federated learning (FL), particularly in the context of Internet of Things (IoT) applications, has demonstrated its remarkable potential. Despite significant efforts, empirical evidence suggests that FL algorithms have yet to gain widespread practical adoption. The primary obstacle stems from the inherent bandwidth overhead associated with gradient exchanges between clients and the server, resulting in substantial delays, especially within communication networks. To deal with the problem, various solutions are proposed with the hope of finding a better balance between efficiency and accuracy. Following this goal, we focus on investigating how to design a lightweight FL algorithm that requires less communication cost while maintaining comparable accuracy. Specifically, we propose a Sketch-based FL algorithm that combines the incremental singular value decomposition (ISVD) method in a way that does not negatively affect accuracy much in the training process. Moreover, we also provide adaptive gradient error accumulation and error compensation mechanisms to mitigate accumulated gradient errors caused by sketch compression and improve the model accuracy. Our extensive experimentation with various datasets demonstrates the efficacy of our proposed approach. Specifically, our scheme achieves nearly a 93% reduction in communication cost during the training of multi-layer perceptron models (MLP) using the MNIST dataset.

Multi-party computation (MPC) has gained increasing attention in both research and industry, with many protocols adopting the preprocessing model to optimize online performance through the strategic use of offline-generated, data-independent correlated randomness (or correlation). However, while extensive research has been dedicated to enhancing the online phase, the equally critical offline phase remains largely overlooked. This gap imposes significant yet unaddressed challenges in both security and efficiency, hindering the practical adoption of MPC systems. To address these challenges, we build upon the pseudorandom correlation generator (PCG) concept by Boyle et al. (CRYPTO’19, FOCS’20) and propose HPCG, a programmable, verifiable, and concretely efficient PCG construction using small security hardware. Our core technique, termed verifiable silent preprocessing, enables virtually unbounded, on-demand generation of diverse correlated randomness with provable correctness while effectively reducing offline overhead in a correlation-agnostic manner. To demonstrate the benefits of our approach, we experimentally evaluate HPCG and compare it with other preprocessing techniques. We also show how HPCG can further optimize specialized secure computation tasks (e.g., shuffling and equality test) by promoting new, customized correlations, which may be of new interest.

Searchable symmetric encryption (SSE) supporting conjunctive queries has garnered significant attention over the past decade due to its practicality and wide applicability. While extensive research has addressed common leakages, such as the access pattern and search pattern, efforts to mitigate these vulnerabilities have primarily focused on structural issues inherent to scheme construction. In this work, we shift the focus to a less explored yet critical leakage stemming from users’ inherent querying behaviors: query correlation. Originally introduced by Grubbs et al. [USENIX SEC’20], formally defined by Oya and Kerschbaum [USENIX SEC’22], and leveraged to mount a high-success query recovery attack against single-keyword SSE, query correlation raises a crucial question: does it pose a similar threat to the security of conjunctive SSE? To tackle this issue, we undertake two key efforts. First, we generalize the notion of query correlation in the context of conjunctive SSE, introducing the “generalized query correlation pattern”, which captures the co-occurrence relationships among queried tokens within a conjunctive query. Second, we develop a new passive query recovery attack, QCCK, which exploits both the search pattern and generalized query correlation pattern to infer the mapping between tokens and keywords. Comprehensive evaluations on the Enron dataset confirm QCCK’s efficacy, achieving a query recovery rate of approximately 80% with a keyword universe size ranging from 200 to 1000 and an observed query size between 5000 and 50,000. These findings highlight the significant threat posed by query correlation in conjunctive SSE and underscore the urgent need for robust countermeasures.

Federated edge learning (FEL) has emerged as a distributed machine learning paradigm that enables devices to jointly train a shared global model in the Industrial Internet of Things (IIoT), which greatly accelerates the advancement of Industrial 4.0. However, FEL is vulnerable to the colluded backdoor attack (CBA) at high percentages of poisonous devices and attack intensity. Meanwhile, conventional strategies against general BAs aim to mitigate the impact of degrading the accuracy of benign clients by propagating correct local updates, but they can hardly prevent CBAs. Moreover, recent work defends against CBAs at the cost of slower convergence. To tackle the above vulnerabilities, we propose RDCBA-FEL, which effectively identifies and corrects malicious updates from all local ones. Firstly, RDCBA-FEL restricts common features in poisonous updates, such as amplified magnitudes or similar descent directions. Secondly, RDCBA-FEL adopts the residual-based attack detection mechanism to identify and convert malicious updates into benign ones, thus speeding up model convergence. Thirdly, RDCBA-FEL employs the beta-based reputation model to average the weights of local updates, guaranteeing that benign updates have priority over poisoned ones. Moreover, since historical reputations can negatively affect benign weight allocation, a distributed time-decay attention mechanism is used to flexibly adjust FEL to make the model more focused on the current reputation. Extensive evaluations on five benchmark datasets show the robustness of RDCBA-FEL against advanced attacks compared to eleven state-of-the-art schemes.

Tor bridges are crucial, unlisted relays designed to enhance system accessibility and circumvent censorship in the Tor network. Currently, Tor BridgeDB will randomly distribute 1–3 bridge relays to the user per request. Yet, those randomly selected bridges may not meet users' specific needs, e.g., adequate bandwidth for large-file sharing in a certain region. Also, a user's usage metadata (e.g., bridge choices) collected by Tor BridgeDB would inevitably reveal sensitive information about the user, discouraging the use of this censorship-circumvention service. In light of them, we introduce HiddenTor, a user-centric and privacy-focused bridge distribution system that allows Tor users to retrieve bridges privately and precisely (i.e., based on a range of specific criteria). At its core, HiddenTor designs a condition-based private information retrieval (PIR) protocol by building atop a suite of lightweight cryptographic primitives (i.e., function secret sharing). Besides, HiddenTor also crafts several optimization designs to balance the trade-offs between query efficiency and service reliability. The extensive experimental results have confirmed the feasibility and practicality of HiddenTor. For example, our prototype can efficiently handle private queries over 3000 bridges in approximately 2 seconds, which can further be reduced to 0.21 seconds using parallel computing techniques.

Linear code, a foundational construct extensively employed in communication, data transmission, and error correction, has been the subject of rigorous study for decades. Despite significant academic successes and widespread adoption, recent studies show that decoding methods for general linear codes, such as syndrome decoding, require the storage and search of large decoding tables, leading to inefficiencies. To mitigate this, Debris-Alazard et al. first proposed adapting Babai's algorithm and the LLL algorithm from lattice theory to binary codes, achieving considerable performance gains. Inspired by this, in this paper, we aim to explore the design of more general linear codes to overcome the limitations of baseline binary codes and enhance their applicability in more advanced applications such as DNA storage and 5G communication systems. To address this gap, we extend the foundational domain and decoding algorithms from lattices to q-ary codes. Specifically, we define a new fundamental domain and propose a polynomial-time decoding algorithm, RedtoFun. To validate our findings, we conduct a series of experiments to evaluate its real-world performance. The results demonstrate that our optimized RedtoFun algorithm surpasses the syndrome decoding scheme in terms of memory overhead and runtime while maintaining performance on par with the SizeRed decoding scheme.

Numerous studies have underscored the significant privacy risks associated with various leakage patterns in encrypted data stores. While many solutions have been proposed to mitigate these leakages, they either (1) incur substantial overheads, (2) focus on specific subsets of leakage patterns, or (3) apply the same security notion across various workloads, thereby impeding the attainment of fine-tuned privacy-efficiency trade-offs. In light of various detrimental leakage patterns, this paper starts with an investigation into which specific leakage patterns require our focus in the contexts of key-value, range-query, and dynamic workloads, respectively. Subsequently, we introduce new security notions tailored to the specific privacy requirements of these workloads. Accordingly, we propose and instantiate Swat, an efficient construction that progressively enables these workloads, while provably mitigating system-wide leakage via a suite of algorithms with tunable privacy-efficiency trade-offs. We conducted extensive experiments and compiled a detailed result analysis, showing the efficiency of our solution. Swat is about an order of magnitude slower than an encryption-only data store that reveals various leakage patterns and is two orders of magnitude faster than a trivial zero-leakage solution. Meanwhile, the performance of Swat remains highly competitive compared to other designs that mitigate specific types of leakage.

Multi-source multi-client (M/M) searchable encryption has drawn increasing attention as data sharing becomes prevalent in the digital economics era. It allows data from multiple sources to be securely outsourced to third parties and queried by authorized clients. In response to these demands, various schemes sprung up in the last few years. However, empirical results show that they suffer from performance limitations. Specifically, they either require per-interaction in per-query between data sources and clients or time-consuming public-key encryption. To address these issues, we propose a searchable encryption scheme that allows authorized clients to efficiently search encrypted data from multiple sources. Compared to previous schemes, our design reduces the interaction overhead of authorization and query with the aid of a set-constrained pseudo-random function. Given practical considerations in the M/M setting, we further refine the forward privacy (FP) as “FP with client” and “FP with server” for data addition. To achieve these new security notions, we construct a new M/M scheme only with efficient symmetric cryptographic tools. We perform a formal security analysis of the proposed schemes and implement them to compare with prior arts. The theoretical and experimental results confirm that our designs are practical with lower communication and computation overhead.

Encrypted databases have garnered considerable attention for their ability to safeguard sensitive data outsourced to third parties. However, recent studies have revealed the vulnerability of encrypted databases to leakage-abuse attacks on their search module, prompting the development of countermeasures to address this issue. While most studies have focused on static databases, limited research has been conducted on dynamic encrypted databases. To bridge this gap, this paper focuses on undertaking a comprehensive examination of leakage exploitation in dynamic encrypted databases, with the aim of providing effective mitigations. Our investigation begins with two attacks that can be employed to recover encrypted queries. The first attack, known as an active attack, involves injecting encoded files and utilizing correlated file volume information. The second attack, referred to as a passive attack, identifies unique relational characteristics of queries across database updates, assuming certain background knowledge of the plaintext databases. To mitigate these attacks, a two-layer encrypted database hardening approach is proposed, which obfuscates both search indexes and files in a continuous way. Doing so allows us to eliminate the unique characteristics emerging after data updates constantly. We conduct a series of experiments to confirm the severity of our attacks and the effectiveness of our countermeasures.

Cloud service models intrinsically cater to multiple tenants. In current multi-tenancy model, cloud service providers isolate data within a single tenant boundary with no or minimum cross-tenant interaction. With the booming of cloud applications, allowing a user to search across tenants is crucial to utilize stored data more effectively. However, conducting such a search operation is inherently risky, primarily due to privacy concerns. Moreover, existing schemes typically focus on a single tenant and are not well suited to extend support to a multi-tenancy cloud, where each tenant operates independently. In this article, to address the above issue, we provide a privacy-preserving, verifiable, accountable, and parallelizable solution for “privacy-preserving keyword search problem" among multiple independent data owners. We consider a scenario in which each tenant is a data owner and a user’s goal is to efficiently search for granted documents that contain the target keyword among all the data owners. We first propose a verifiable yet accountable keyword searchable encryption (VAKSE) scheme through symmetric bilinear mapping. For verifiability, a message authentication code (MAC) is computed for each associated piece of data. To maintain a consistent size of MAC, the computed MACs undergo an exclusive OR operation. For accountability, we propose a keyword-based accountable token mechanism where the client’s identity is seamlessly embedded without compromising privacy. Furthermore, we introduce the parallel VAKSE scheme, in which the inverted index is partitioned into small segments and all of them can be processed synchronously. We also conduct formal security analysis and comprehensive experiments to demonstrate the data privacy preservation and efficiency of the proposed schemes, respectively.

The widespread application of Internet of Things technology in the medical field results in the generation of a large amount of healthcare data. Adequately learning valuable knowledge from the massive healthcare data brings a huge potential for improving the efficiency, quality, and safety of healthcare services. Online learning over the cloud offers decent training and fast inference services. However, outsourcing healthcare data learning to the cloud might cause patient privacy disclosure and data integrity and authenticity compromises. These security threats further affect the accuracy of the trained model or distort the inference results. Although researchers have tried to solve the privacy-preserving or data integrity issues with different techniques, none of them satisfy the security demands in online training of healthcare data. In this paper, we present an efficient redactable group signature scheme (RGSS) for the online learning healthcare system. The security analysis shows that our construction not only prevents privacy compromise but also provides integrity and authenticity verification. In addition to the private property of RGSS, the signer-anonymous also enhances patient privacy-preserving. Compared with other solutions, our RGSS is secure and efficient in promoting scientific research on learning large amounts of healthcare data that aim to improve healthcare services.

Dynamic searchable symmetric encryption (DSSE) enables a server to efficiently search and update over encrypted files. To minimize the leakage during updates, a security notion named forward and backward privacy is expected for newly proposed DSSE schemes. Those schemes are generally constructed in a way to break the linkability across search and update queries to a given keyword. However, it remains underexplored whether forward and backward private DSSE is resilient against practical leakage-abuse attacks (LAAs), where an attacker attempts to recover query keywords from the leakage passively collected during queries.

To keep web users away from unsafe websites, modern web browsers enable the embedded feature of safe browsing (SB) by default. In this work, through theoretical analysis and empirical evidence, we reveal two major shortcomings in the current SB infrastructure. First, we derive a feasible tracking technique for industry best practice. We show that the current mitigation techniques cannot eliminate the threat of de-anonymization permanently. Second, we gauge the effectiveness of blacklists provided by major vendors. Our discovery indicates the urge for blacklist integration in order to boost service quality. In light of this, we propose a new three-party paradigm${{\sf PEBA}}$with an intermediate third party decoupling the direct interaction of users and proprietary blacklist vendors. To satisfy practical usage requirements, we instantiate our design with trusted hardware, detailing how it can be leveraged to fulfill the requirements of privacy enhancement and broader content coverage at the same time. We also tackle numerous implementation challenges that emerged from this proxy-based and hardware-enabled solution. Extensive evaluation confirms that${{\sf PEBA}}$can balance well among desirable goals of security, usability, performance, and elasticity, making it suitable for deployment in practice.

TCP incast has become a practical problem for high-bandwidth, low-latency transmissions, resulting in throughput degradation of up to 90% and delays of hundreds of milliseconds, severely impacting application performance. However, in virtualized multi-tenant data centers, host-based advancements in the TCP stack are hard to deploy from the operators’ perspective. Operators only provide infrastructure in the form of virtual machines, in which only tenants can directly modify the end-host TCP stack. In this paper, we present R-AQM, a switch-powered reverse ACK active queue management (R-AQM) mechanism for enhancing ACK-clocking effects through assisting legacy TCP. Specifically, R-AQM proactively intercepts ACKs and paces the ACK-clocked in-flight data packets, preventing TCP from suffering incast collapse. We implement and evaluate R-AQM in NS-3 simulation and NetFPGA-based hardware switch. Both simulation and testbed results show that R-AQM greatly improves TCP performance under heavy incast workloads by significantly lowering packet loss rate, reducing retransmission timeouts, and supporting 16 times (i.e., 60 to 1000) more senders. Meanwhile, the forward queuing delays are also reduced by 4.6 times.

Edge computing brings data computation and storage closer to the mobile device to save response time for decision making. After being processed at the edge, commonly, the data will be uploaded to the cloud for further enriched analysis. For privacy concerns, local devices may encrypt the collected data before sending it to the cloud server. However, this treatment increases the servers processing time and makes it hard to pick out the desired data. In this paper, to address this problem, we design an encrypted data validation scheme, which enables the edge to clean the encrypted data to be uploaded. Because edge computing encompasses numerous edge devices from different service providers, we explore the public-key cryptographic mechanism to implement our secure data validation scheme. Considering potential risks from quantum computers, we propose to leverage ideal lattice to realize our protocol, which reaches better performance in both time and storage for edge devices. Extensive evaluation results show that our proposed proposal achieves considerable performance improvements in terms of communication and computation aspects. Particularly, compared to prior work, nearly 123x-238x speed up is achieved in our key derivation procedure and the storage cost of the secret key is reduced from 547MB to 1.7MB.

In Machine Learning, the emergence of the right to be forgotten gave birth to a paradigm named machine unlearning, which enables data holders to proactively erase their data from a trained model. Existing machine unlearning techniques focus on centralized training, where access to all holders’ training data is a must for the server to conduct the unlearning process. It remains largely underexplored about how to achieve unlearning when full access to all training data becomes unavailable. One noteworthy example is Federated Learning (FL), where each participating data holder trains locally, without sharing their training data to the central server. In this paper, we investigate the problem of machine unlearning in FL systems. We start with a formal definition of the unlearning problem in FL and propose a rapid retraining approach to fully erase data samples from a trained FL model. The resulting design allows data holders to jointly conduct the unlearning process efficiently while keeping their training data locally. Our formal convergence and complexity analysis demonstrate that our design can preserve model utility with high efficiency. Extensive evaluations on four real-world datasets illustrate the effectiveness and performance of our proposed realization.

[J1C2 Presentation Abstract at IEEE SERVICES 2021 for IEEE Transactions on Services Computing DOI 10.1109/TSC.2021.3111208]

The rapid growth of storage overhead on public blockchains has urged the use of light clients that only store a small fraction of blockchain data and rely on other bootstrapped full nodes for data retrievals. Unfortunately, current blockchain light client designs are far from satisfactory. First, outsourcing retrieval requests could raise severe concerns about result correctness and privacy threats. Second, current light clients do not support rich query and enforce fee payments to full nodes. Given that blockchain storage increases day by day, enabling effective rich blockchain queries and fairly compensating full nodes’ ever growing costs has become extremely necessary. In this article, we propose a general and secure paid query framework to simultaneously meet those demands above. Specifically, we leverage the integration of trusted hardware (e.g., Intel SGX) and smart contract as a starting point for building efficient yet secure query processing with fair payments. Then, we further craft several crucial performance and security refinement designs to boost query efficiency and enforce result correctness, and also explore an enclave-facilitated fair settlement mechanism for on-chain cost optimizations. We implement a prototype of our paid query framework and the experimental result has demonstrated its practically affordable cost.

Due to its capabilities of searches and updates over the encrypted database, the dynamic searchable symmetric encryption (DSSE) has received considerable attention recently. To resist leakage abuse attacks, a secure DSSE scheme usually requires forward and backward privacy. However, the existing forward and backward private DSSE schemes either only support single keyword queries or require more interactions between the client and the server. In this article, we first give a new leakage function for range queries, which is more complicated than the one for single keyword queries. Furthermore, we propose a concrete forward and backward private DSSE scheme by using a refined binary tree data structure. Finally, the detailed security analysis and extensive experiments demonstrate that our proposal is secure and efficient, respectively.

TCP incast has become a practical problem for high-bandwidth, low-latency transmissions, resulting in throughput degradation of up to 90% and delays of hundreds of milliseconds, severely impacting application performance. However, in virtualized multi-tenant data centers, host-based advancements in the TCP stack are hard to deploy from the operators perspective. Operators only provide infrastructure in the form of virtual machines, in which only tenants can directly modify the end-host TCP stack. In this paper, we present R-AQM, a switch-powered reverse ACK active queue management (R-AQM) mechanism for enhancing ACK-clocking effects through assisting legacy TCP. Specifically, R-AQM proactively intercepts ACKs and paces the ACK-clocked in-flight data packets, preventing TCP from suffering incast collapse. We implement and evaluate R-AQM in NS-3 simulation and NetFPGA-based hardware switch. Both simulation and testbed results show that R-AQM greatly improves TCP performance under heavy incast workloads by significantly lowering packet loss rate, reducing retransmission timeouts, and supporting 16 times (i.e., 60 → 1000) more senders. Meanwhile, the forward queuing delays are also reduced by 4.6 times.

Searchable symmetric encryption (SSE) enables users to make confidential queries over always encrypted data while confining information disclosure to pre-defined leakage profiles. Despite the well-understood performance and potentially broad applications of SSE, recent leakage-abuse attacks (LAAs) are questioning its real-world security implications. They show that a passive adversary with certain prior information of a database can recover queries by exploiting the legitimately admitted leakage. While several countermeasures have been proposed, they are insufficient for either security, i.e., handling only specific leakage like query volume, or efficiency, i.e., incurring large storage and bandwidth overhead. We aim to fill this gap by advancing the understanding of LAAs from a fundamental algebraic perspective. Our investigation starts by revealing that the index matrices of a plaintext database and its encrypted image can be linked by linear transformation. The invariant characteristics preserved under the transformation encompass and surpass the information exploited by previous LAAs. They allow one to unambiguously link encrypted queries with corresponding keywords, even with only partial knowledge of the database. Accordingly, we devise a new powerful attack and conduct a series of experiments to show its effectiveness. In response, we propose a new security notion to thwart LAAs in general, inspired by the principle of local differential privacy (LDP). Under the notion, we further develop a practical countermeasure with tunable privacy and efficiency guarantee. Experiment results on representative real-world datasets show that our countermeasure can reduce the query recovery rate of LAAs, including our own.

The rapid growth of Ethereum blockchain has brought extremely heavy overhead for coin owners or developers to bootstrap and access transactions on Ethereum. To address this, light client is enabled, which only stores a small fraction of blockchain data and relies on bootstrapped full nodes for transaction retrievals. However, because the retrieval requests are outsourced, it raises several severe concerns about the integrity of returned results and the leakage of sensitive blockchain access histories, largely hindering the wider adoption of this important lightweight design. In addition to security issues, the continuously increasing blockchain storage also urges for more effective query functionalities for the Ethereum blockchain, so as to enable more flexible and precise transaction retrievals.In this paper, we propose EncELC, a new Ethereum light client design that enforces full-fledged protections for clients and enables rich queries over the Ethereum blockchain. EncELC leverages trusted hardware (e.g., Intel SGX) as a starting point for building efficient yet secure processing, and further crafts several crucial performance and security refinement designs to boost query efficiency and conceal leakages inside and outside SGX enclave. We implement a prototype of EncELC and test its performance in several real settings, and the results have confirmed the practicality of EncELC.

Multi-Writer Searchable Encryption, also known as public-key encryption with keyword search(PEKS), serves a wide spectrum of data sharing applications. It allows users to search over encrypted data encrypted via different keys. However, most of the existing PEKS schemes are built on classic security assumptions, which are proven to be untenable to overcome the threats of quantum computers. To address the above problem, in this paper, we propose a lattice-based searchable encryption scheme from the learning with errors (LWE) hardness assumption. Specifically, we observe that the keys of each user in a basic scheme are composed of large-sized matrices and basis of the lattice. To reduce the complexity of key management, our scheme is designed to enable users to directly use their identity for data encryption. We present several optimization techniques for implementation to make our design nearly practical. For completeness, we conduct rigorous security, complexity, and parameter analysis on our scheme, and perform comprehensive evaluations at a commodity machine. With a scenario of 100 users, the cost of key generation for each user is 125s, and the cost of searching a document with 1000 keywords is 13.4ms.

Searchable encryption (SE) is a practical crypto-graphic primitive to build encrypted databases. Recently there has been much attention in leakage-abuse attacks against SE. Among others, attacks based on inference of keyword frequency can easily identify query keywords from the access pattern, i.e., query results. To mitigate these attacks, database padding is considered as a conceptually simple yet effective counter-measure. Unfortunately, none of the existing studies formally understand the relationship between padding security strength and its overhead. Also, how to craft padding is not restricted in current countermeasures, where bogus files are likely to be distinguishable from real ones. In this paper, we propose an information theory based framework to analyse the security strength under certain padding overhead. First, we leverage relative entropy to measure the “closeness” between the distributions of the original dataset and padded dataset. Second, we quantity the attack efforts against padding countermeasures by entropy analysis. Apart from theoretical findings, we further devise an algorithm via outlier detection for padding generation, which considers both the padded dataset distribution and the similarity between real and bogus files. Evaluations on a real-world dataset confirm our theoretical results and demonstrate the efficiency and effectiveness of our proposed padding generation algorithm.

Many-to-one traffic pattern in datacenter networks introduces the problem of Incast congestion for Transmission Control Protocol (TCP) and puts unprecedented pressure to the cloud service providers. To address heavy Incast, we present an Receiver-oriented Datacenter TCP (RDTCP). The proposal is motivated by oscillatory queue size when handling heavy Incast traffic and substantial potential of receiver in congestion control. Finally, RDTCP adopts both open- and closed-loop congestion controls. We provide a systematic discussion on its design issues and implement a prototype to examine its performance. The evaluation results indicate that RDTCP has an average decrease of 47.5% in the mean queue size, 51.2% in the 99th-percentile latency in the increasingly heavy Incast over TCP, and 43.6% and 11.7% over Incast congestion Control for TCP (ICTCP).

Multi-Path Transmission Control Protocol (MPTCP) is emerging as a dominant paradigm that enables users to utilize multiple Network Interface Controllers (NICs) simultaneously. Due to the complexity of its protocol design, the steady-state performance of MPTCP still remains largely unclear through model analysis. This introduces severe challenges to quantitatively study the efficiency, fairness and stability of existing MPTCP implementations. In this paper, we for the first time investigate the modeling of coupled congestion control and flow control algorithms in MPTCP. By proposing a closed-form throughput model, we reveal the relationship between MPTCP throughput and subflow characters, such as Round Trip Time (RTT), packet loss rate and receive buffer size. The extensive NS2-based evaluation indicates that the proposed model can be applied to understand the throughput of MPTCP in various situations. In particular, when MPTCP subflows have similar RTTs, the average Error Rate (ER) of the proposed model is less than 8%. Even in the situation where huge RTT difference exists between subflows, the model can still behave well with average ER less than 10%.

Recent years have witnessed video-on-demand (VoD) as an efficient means for providing reliable streaming service for Internet users. It is known that peer-assisted VoD systems, such as NetFlix and PPlive, generally incur a lower deployment cost in terms of server bandwidth consumption. However, some fundamental issues still need to be further clarified, particularly for VoD service providers. In particular, how far can we push peer-assisted VoD forward, and at the scale of VoD systems, the maximum reduction of server bandwidth consumption that can be achieved with peer-assisted approaches. In this paper, we provide extensive model analysis to understand the minimum server bandwidth consumption for peer-assisted VoD systems. We first propose a basic model that can optimally schedule user demands at given snapshots. Our model analysis reveals the optimal performance bound and shows that the existing peer-assisted protocols are still far from being optimal. How to push the server bandwidth consumption to the limit remains a big challenge in VoD system design. To approach the optimal bandwidth consumption in real deployment, we further extend our model to a realistic case to capture the peer dynamic across continuous time-slots. The simulation result indicates that the optimal load scheduling problem is still achievable through a dynamic programming algorithm. Its design principle further motivates a fast priority-based algorithm that achieves near-optimal performance. These proposed algorithms can significantly reduce the bandwidth consumption of dedicated VoD servers.