Mobile devices enable the widespread adoption of One-Time Passwords (OTPs) as a crucial component of Two-Factor Authentication (2FA). The impact of OTP leakage is relatively manageable compared to static passwords. However, existing OTP standards, such as S/key, HOTP, and TOTP are vulnerable to key-compromise impersonation attacks, desynchronization attacks, and “small n” attacks. These vulnerabilities allow adversaries to bypass 2FA by exploiting pre-shared symmetric keys once either the device or the server is compromised. Furthermore, asymmetric (chain-based) OTP schemes incur high computational overhead and require periodic initialization, which limits their usability. In this work, we propose HP-OTP, a challenge-response OTP scheme that achieves password hardening without modifying password-OTP implementation architectures. Password hardening on the device side allows the server to store only a non-reversible verification credential used to generate challenges. The device's response OTP integrates the candidate password, possession factor, and a random salt. By redefining the role of OTPs in 2FA from representing only the device to jointly representing both the password and the device, HP-OTP prevents adversaries from bypassing the possession factor or exploiting compromises of either the device or the server. Comprehensive security and performance evaluation demonstrate the security of HP-OTP, with verification taking less than 5 milliseconds.

Service providers inevitably store data online, and even if the data is encrypted, adversaries who compromise the service provider may still gain the same decryption advantages. Password Hardening (PH) encryption introduces an additional security layer by incorporating an external PH server to restrict unauthorized decryption. However, existing PH encryption schemes (at USENIX SEC’18, ACM CCS’20) have limitations in encryption/decryption efficiency, making them less suitable for handling large amounts of data. Additionally, these schemes still have privacy shortcomings, as the external PH server can infer user habits by learning authentication results.For the first time, we propose a brand-new PH encryption scheme named HPHE and a hash-based Puncturable Pseudo-random Function (PPRF), which together establish a hybrid PH encryption architecture. The architecture is extensible to other PH schemes and avoids key reuse by deriving high-entropy keys to achieve one-data-one-key. In comparisons with non-hybrid original PH schemes, HPHE achieves at least a 61% improvement in the efficiency of interactive PH encryption/decryption. In one-data-one-key scenarios, HPHE achieves approximately 450× higher encryption/decryption efficiency than original PHE (USENIX SEC’18) by replacing complex interaction with key derivation. Additionally, HPHE achieves irrecoverable secure deletion and access restrictions by puncturing keys.For the first time, the novel construction of our HPHE achieves theHidingof password verification results in PH. In addition, we formally define thePrivacysecurity attributes in PH encryption and demonstrate that HPHE meets the strictest security requirements. This work extends PH encryption towards efficient large-scale data processing and more comprehensive privacy protection.

One-Time Passwords (OTPs) play a crucial role in Two-Factor Authentication (2FA) and Multi-Factor Authentication (MFA) by adding an additional layer of security. OTPs effectively reduce the risk of static passwords being intercepted and reused. Nevertheless, both academic schemes and industrial solutions face security threats stemming from server/device compromises and OTP factor forgery. Chain-based asymmetric OTP schemes are a promising approach to addressing the problem of server compromise but still face threats from device compromise and pre-generated chain leakage. We emphasize that since devices directly store the OTP seed, OTP authentication is essentially equivalent to verifying device possession. This means that in existing OTP schemes, OTP forgery and device compromise remain prevalent and difficult to overcome. In this work, we propose a brand new scheme to address OTP factor forgery and server/device compromises. For the first time, our scheme constructs a tightly coupled architecture between the password factor and the OTP factor. The OTP seed is derived from a password and a device-stored salt, preventing OTP seed extraction and OTP forgery even in the event of a device compromise. Through the integration of “honeywords” with the tightly coupled OTP architecture, the server stores decoy OTP seeds generated by decoy passwords, providing resistance against server compromises and partial password guessing from devices. We conduct a comprehensive evaluation of our OTP schemes. The computational overhead is correlated with the number of honeywords, and with the recommended set size of 20, the total verification overhead is approximately$0.24~ms$. Additionally, we propose formal security properties and application metrics, and rigorously prove our scheme’s resistance against server/device compromise attacks and guessing attacks. Our scheme is the first to achieve comprehensive OTP security with low overhead.

Few-shot multi-label recognition (FS-MLR) presents a significant challenge due to the need to assign multiple labels to images with limited examples. Existing methods often struggle to balance the learning of novel classes and the retention of knowledge from base classes. To address this issue, we propose a novel Cross-Modality Prompts (CMP) approach. Unlike conventional methods that rely on additional semantic information to mitigate the impact of limited samples, our approach leverages multimodal prompts to adaptively tune the feature extraction network. A new FS-MLR benchmark is also proposed, which includes single-label training and multi-label testing, accompanied by benchmark datasets constructed from MS-COCO and NUS-WIDE. Extensive experiments on these datasets demonstrate the superior performance of our CMP approach, highlighting its effectiveness and adaptability. Our results show that CMP outperforms CoOp on the MS-COCO dataset with a maximal improvement of 19.47% and 23.94% in mAPharmonicfor 5-way 1-shot and 5-way 5-shot settings, respectively.

In vehicular ad-hoc networks (VANETs), existing traffic accident handling schemes are adoptable only in the scenario with roadside unit (RSU) deployment, and the generation of accident reports relies on RSUs and witness vehicles. Without the confirmation from involved vehicles in the accident, it will probably cause disputes afterward, and RSU captured attacks may also affect authentication of vehicles and correctness of accident reports. To address the above issues, we propose a vehicle to vehicle (V2V) and vehicle to RSU (V2R) authentication and traffic accident handling protocol, in which accident vehicles are sufficient to generate accident reports, thereby enhancing autonomy of the vehicular communication system and reducing reliance on external infrastructure. Furthermore, for ensuring integrity and traceability of accident reports, we utilize blockchain to keep registration information and jointly signed reports, which realizes efficient and secure mutual authentications in V2V and V2R protocols. Finally, for preserving privacy of vehicles, we integrate elliptic curve cryptosystem (ECC) and symmetric encryption to design a dynamic pseudo-identity strategy, which still allows the registration center to track malicious vehicles. The formal security proof and comparative analysis validate that our protocol preserves higher security and lower overhead by comparison with related schemes.

Multi-label recognition (MLR) with incomplete labels is very challenging. Recent works strive to explore the image-to-label correspondence in the vision-language model, i.e., CLIP [22], to compensate for insufficient annotations. In spite of promising performance, they generally overlook the valuable prior about the label-to-label correspondence. In this paper, we advocate remedying the deficiency of label supervision for the MLR with incomplete labels by deriving a structured semantic prior about the label-to-label corre-spondence via a semantic prior prompter. We then present a novel Semantic Correspondence Prompt Network (SCP-Net), which can thoroughly explore the structured semantic prior. A Prior-Enhanced Self-Supervised Learning method is further introduced to enhance the use of the prior. Comprehensive experiments and analyses on several widely used benchmark datasets show that our method significantly out-performs existing methods on all datasets, well demonstrating the effectiveness and the superiority of our method. Our code will be available at https://github.com/jameslahm/SCPNet.

Collecting full annotations to construct multi-label datasets is difficult and labor-consuming. As an effective solution to relieve the annotation burden, single positive multi-label learning (SPML) draws increasing attention from both academia and industry. It only annotates each image with one positive label, leaving other labels unobserved. Therefore, existing methods strive to explore the cue of unobserved labels to compensate for the insufficiency of label supervision. Though achieving promising performance, they generally consider labels independently, leaving out the inherent hierarchical semantic relationship among labels which reveals that labels can be clustered into groups. In this paper, we propose a hierarchical prompt learning method with a novel Hierarchical Semantic Prompt Network (HSPNet) to harness such hierarchical semantic relationships using a large-scale pretrained vision and language model, i.e., CLIP, for SPML. We first introduce a Hierarchical Conditional Prompt (HCP) strategy to grasp the hierarchical label-group dependency. Then we equip a Hierarchical Graph Convolutional Network (HGCN) to capture the high-order inter-label and inter-group dependencies. Comprehensive experiments and analyses on several benchmark datasets show that our method significantly outperforms the state-of-the-art methods, well demonstrating its superiority and effectiveness. Our code will be available at https://github.com/jameslahm/HSPNet.

Vehicular Ad-hoc Networks (VANETs) enable the connection and information exchange between vehicles and transportation infrastructure (V2I), vehicle and vehicle (V2V) to improve the safety and efficiency of the transportation system. In previous protocols, V2I and V2V authentication protocols based on bilinear pairings or identity-based cryptography are computationally heavy or difficult to protect the user’s identity and privacy. In addition, lightweight authentication protocols have not achieve both V2I and V2V authentication, and may suffer from Onboard Unit (OBU) intrusion attacks, Roadside Unit (RSU) captured attacks, and difficult to track malicious vehicles. Therefore, a lightweight and anonymous V2I and V2V authentication protocol with batch verification based on Elliptic Curves Cryptography (ECC) is proposed. We use Physical Unclonable Function (PUF) and biological key to avoid RSU captured attacks and OBU intrusion attacks, design a feature embedding strategy with dynamic pseudo-identity to recover the malicious vehicle’s identity by the Trusted Authority (TA). In the application test simulating the actual scenario, our protocol is more efficient because of lower overhead and batch authentication strategy. The semantic security of the protocol is formally proved under the random oracle model. The comparative analysis and security proof results show that our protocol is more superior to others.

The Internet of things is playing more and more important role in smart healthcare, smart grids, and smart transportation, and using wireless sensor network (WSN), we can easily obtain and transmit information. However, the data security and users’ privacy are the biggest challenges for WSN because sensor nodes have low computing power and low storage capacity and are easy to be captured, and wireless networks are vulnerable. In 2021, Shuai et al. proposed a lightweight three-factor anonymous authentication scheme for WSN. However, we found that their protocol is vulnerable to stolen-verifier attack, modification of messages’ attack, and no perfect forward secrecy. Then, a new three-factor anonymous authentication scheme using elliptic curve cryptography (ECC) is proposed. Through informal and formal security analyses, our scheme can resist various known attacks and maintains low computational complexity.

In Software-Defined Networking (SDN), Ternary Content Addressable Memory (TCAM) enables fast lookup with flexible wildcard rule patterns for flow tables, however, the scarcity and expensiveness of TCAM dramatically limit the number of rules that switches can support. Rule caching for TCAM breaks the flow table size constraint by appropriate combinations of hardware and software processing. Nevertheless, previous literatures, from the viewpoint of maximizing cache hit ratio, ignore the TCAM update operations incurred by cache replacement, which is severely time-consuming. In this paper, we solve the TCAM cache replacement problem from a standpoint of reducing update cost. Upon comprehensively analyze and measure on cache hit ratio and update cost while sticking to the rule dependency constraints, we propose an effective cache replacement algorithm that can dynamically and adaptively adjust TCAM rules on a switch. Our experimental results show that our proposed algorithm can effectively eliminate over 60% update operations with less than 5% cache hit loss.