With the rapid advancement of Internet of Things (IoT) technology, the security and utilization of data outsourced to the cloud is a prerequisite for IoT application in actual production. Attribute-based keyword search (ABKS) has emerged as a powerful primitive for fine-grained search over encrypted data for IoT. While recent advanced ABKS schemes support more abundant functions and query structures, they do not consider multi-owner setting. Moreover, these schemes typically rely on a single trusted attribute authority for user certificate verification and private key distribution. This centralization creates a single point of failure and raises security concerns, such as key escrow. Furthermore, the existence of malicious entities necessitates verification mechanisms. However, most existing approaches introduce unvetted third-party validators, leading to reliability issues and privacy risks. Nevertheless, in numerous schemes, malicious entities persist in operational status, thereby compromising systemic security. To address these challenges, we propose ABKS with user-generated keys (ABKS-UGK), which decentralizes key generation to individual data users, fundamentally resolving the key escrow vulnerabilities in traditional schemes. It not only leverages blockchain’s immutability for secure result verification, but also incorporates a revocation mechanism against malicious entities. Extensive experimental evaluations demonstrate its efficiency and reliability, making it suitable for secure, verifiable data sharing in real world.

The Internet of Vehicles (IoV) faces critical challenges in balancing real-time data processing, privacy preservation, and secure data sharing amid growing intelligent transportation demands. While mobile edge computing (MEC) reduces latency by offloading tasks to MEC servers, efficient encrypted search and dynamic access control remain unresolved. Attribute-based keyword search (ABKS) enables privacy-preserving queries on encrypted data but exhibits critical limitations such as lack of revocable access for dynamic user privileges, exposed access policy that risk sensitive attribute leakage, and data integrity verification. Moreover, existing ABKS schemes further suffer from centralized key management in attribute-based encryption (ABE), introducing single points of failure and key escrow issues. To address these issues, we propose BC-RMABSE, a blockchain-enabled ABKS scheme. Our scheme leverages the vector space model to enable ranked multi-keyword searches, returning top-k relevant results for improved efficiency. Policy-hiding mechanisms and attribute revocation ensure flexible fine-grained access control while safeguarding sensitive attributes. A decentralized key distribution strategy using Pedersen’s (k, n) secret sharing protocol eliminates reliance on central authority, mitigating security risks. Blockchain technology enforces data integrity through tamper-proof consensus and resolves the "service-payment" imbalance via smart contracts, ensuring transactional fairness between users and untrusted service providers. Experimental analysis indicates that our scheme performs well in terms of both security and search efficiency.

With the rapid expansion of the Internet of Things (IoT), the shift from cloud computing to Mobile Edge Computing (MEC) has become necessary to address the low-latency requirements of real-time applications. Verifiable computation (VC) enables resource-limited clients to outsource their computation-intensive tasks to a powerful cloud while ensuring the correctness of the computation result. However, traditional VC schemes, originally designed for cloud computing, face challenges when applied to MEC environments, such as scalability issues, robustness, and efficiency concerns. To this end, we propose a verifiable distributed computation scheme for MEC, where computation tasks are distributed between a cloud server cluster (consisting of$n$servers) and an edge server. The cloud handles most of the computation through parallel sub-tasks, while the edge server verifies intermediate results and performs minimal computation to recover the final outcome. Our scheme guarantees that the result can be recovered if at least$t$servers, out of a total of$n$servers in the cloud server cluster, perform their computations honestly. By leveraging batch verification and matrix-optimized polynomial evaluations, our scheme significantly enhances scalability, fault tolerance, and efficiency. The extensive analysis and simulations demonstrate that our proposed scheme is more feasible than existing solutions.

Smart healthcare provides more convenient services to patients and medical institutions. However, it also suffers from medical data privacy leakage and broad query results. Although many dynamic symmetric searchable encryption (DSSE) schemes solve these problems, they still suffer from forward and backward security, the absence of non-interactive queries, and large computational and communication overhead for conjunctive queries. To address these issues, we propose a conjunctive forward-backward secure dynamic symmetric searchable encryption scheme for smart healthcare called CFB-DSSE. First, we utilize inner product predicate encryption technology to achieve conjunctive queries while preserving user privacy. Second, we employ tailored proxy re-encryption technology to ensure forward and backward security, thereby enhancing smart healthcare system security. Third, we design a double-layer encrypted bitmap index structure to replace the traditional homomorphic encryption technology to encrypt the bitmap index, reducing computational and communication overhead and enabling non-interactive queries. Through experiments and analysis, CFB-DSSE scheme demonstrates considerable advancements in protecting medical data privacy and improving query efficiency. CFB-DSSE can save at least 100ms of search time compared to other related schemes.

Abstract The ever-growing multi-modal images pose great challenges to local image storage and retrieval systems. Cloud computing provides a solution to large-scale image data storage but suffers from privacy issues and lacks the support for multi-modal image retrieval. To address these, a searchable encryption-empowered privacy-preserving multi-modal image retrieval method is proposed. First, we design a hybrid image retrieval framework that fuses visual features and textual features at a decision level and further supports similar image retrieval and multi-keyword image retrieval. Second, we construct a new hybrid inverted index structure to distinguish high-frequency terms from low-frequency terms and index them through hierarchical index trees and data blocks, respectively, which greatly improves query efficiency. Third, we design a prime encoding-based multi-keyword query method that converts mapping operations in bloom filters into inner product calculations, and further implements secure multi-keyword image query. Experiments against the Baseline schemes are conducted to verify the performance of the scheme in terms of high efficiency.

Focusing on the privacy concerns and leakage abuse of sensory data collection in mobile crowdsensing (MCS) environment, we propose a crowdsensed data-oriented distributed and secure spatial query scheme while ensuring data privacy as long as query patterns. To cater to the demands of real-world MCS workloads, we designed a distributed multi-layer architecture and leveraged distributed hash functions(DHT) and broadcast encryption(BE) to achieve load-balancing and enforce access control. Our scheme incorporates a recently developed cryptographic tool–function secret sharing (FSS) to safeguard the query pattern and sensory data from potential compromises at the server layer.The analysis demonstrates that our scheme achieves affordable query complexity while satisfying adaptive $\mathcal{L}$-semantic security. Encouraging experimental results substantiate the efficacy of our scheme, the growth rates of query cost diminishes as the number of records and participants increases. These findings emphasize the suitability of our scheme for crowdsensing applications with fine-grained access control requirements and establish it as an efficient cryptographic tool that holds promise for diverse MCS applications.

Solving the system of linear algebraic equations (LAE) is the most well known and probably the most important of all numerical computations involving real numbers. Researchers have been committed to developing distributed algorithms to solve such systems for a long time. However, traditional distributed algorithms have serious security risks when the coefficients and the solution are of great value. To address the privacy issue, we propose a new secure distributed outsourcing protocol for solving large-scale LAE systems. Specifically, we give an algorithm for generating a generic repeatedly jointly strongly connected sequence, for the first time as far as we know. Then we embed the matrix masking technique in our distributed system requiring multiple rounds of iteration while keeping the correctness of convergence. In addition, for the first time, we give a method for discriminating by the agents under masking whether the plaintext approximate solution corresponding to the current masked solution satisfies a predetermined constraint. Finally, we give the experimental result to show the practicality of our new protocol.

The object detection task is to locate and classify objects in an image. The current state-of-the-art high-accuracy object detection algorithms rely on complex networks and high computational cost. These algorithms have high requirements on the memory resource and computing capability of the deployed device, and are difficult to apply to mobile and embedded devices. Through the depthwise separable convolution and multiple efficient network structures, this paper designs a lightweight backbone network and two different multiscale feature fusion structures, and proposes a lightweight one-stage object detection algorithm—MiniYOLO. With the model size of only 4.2 MB, MiniYOLO still maintains a high detection accuracy, realizing the trade-off between the model size and detection accuracy. Experimental results on MS COCO 2017 data set show that compared to the state-of-the-art PP-YOLO-tiny, MiniYOLO achieves higher mAP with the same model size. Compared with other lightweight object detection algorithms, MiniYOLO has certain advantages in detection accuracy or model size. The code associated with this paper can be downloaded from https://github.com/CaedmonLY/MiniYOLO/.

Nowadays, several image-based smart services have been widely used in our daily lives, generating many digital images. Since smart devices outsource digital images to the cloud, researchers prefer to select some desired targets from the massive images within the cloud for analysis and improve smart services. Therefore, protective image retrieval on the cloud has attained maximum concentration for privacy-preserving purposes, and the availability assurance of images on the cloud is also a crucial link. Ensuring image security and availability in the cloud environment and precisely preserving retrieval accuracy is comes as a utility-security dilemma while few existing works have explicitly addressed it. Therefore, this paper proposes privacy-preserving image retrieval in the distributed environment based on the combination of image encryption for similarity search and secret image sharing. On the basis of them, we define two-stage encryption. The first-stage encryption algorithm is introduced by modifying Wolfram's reversible cellular automata-based image encryption, which can create a set of processing images to ensure image security and retrieval accuracy. Then, the second-stage encryption algorithm is put forward based on secret image sharing to improve image security and availability. The color histogram could be extracted from the encrypted images for similarity retrieval, and the shadows could be extracted for similar image recovery. Security analysis demonstrates that image privacy and query privacy could be well protected. Moreover, the proposed work achieves more efficient performance for similarity search and similar image recovery compared with some recent works and realizes a reasonable retrieval accuracy on encrypted images for similarity search.

Verifiable delegated set intersection over outsourced private datasets (VDPSI) enables two parties to outsource their private datasets and delegate the computation of set intersection to the cloud while being able to check the correctness of the result. In this process, the cloud learns nothing about the datasets and the intersection result. However, the existing VDPSI schemes suffer from three substantial shortcomings that limit their use: i) the whole dataset consists of only one subset, ii) they are designed for the static data, and iii) they cannot support other operations. To resolve these problems, we introduce a novel primitive called tag-based VDPSI (TVDPSI), which is designed for the multi-subset case where each subset is associated with one single tag for data classification. To protect privacy, the data is encrypted before being resided to the cloud. The tag is implicitly hidden in each encrypted element. As a result, the cloud cannot learn which data belongs to the same subset beyond the intersection set. Besides, the cloud cannot calculate the intersection except under the permissions of data owners. To the best of our knowledge, TVDPSI is the first VDPSI scheme supporting dynamic update and count operations. The detailed performance evaluation and simulation show that our protocol is more practical in cloud computing.

Verifiable databases (VDB) enables the data owner to outsource a huge unencrypted database to the powerful but untrusted cloud such that any client could later retrieve the database and check whether the cloud returns valid records or not. To the best of our knowledge, there is no prior work considering privacy. Besides, they assume that the data owner and the client are fully trusted while they may be semi-honest in the real world. To address these problems, we propose a new primitive called privacy-preserving publicly verifiable database (PPVDB), which not only guarantees the integrity of the queried result but also leaks no information. At the end of this protocol, the client can check whether the cloud returns a valid result and learns the queried result but nothing else about the database. Besides, the cloud learns nothing about the database and the query, and the data owner does not know which item that the client has queried. Motivated by the comparison among some strawman solutions, we incorporate verifiable computation for the polynomial with oblivious pseudorandom function to construct a PPVDB scheme, which is the first VDB scheme providing stronger security against the malicious cloud and the semi-honest client and data owner.

With the development and innovation of new techniques for 5G, 5G networks can provide extremely large capacity, robust integrity, high bandwidth, and low latency for multimedia image sharing and storage. However, it will surely exacerbate the privacy problems intrinsic to image transformation. Due to the high security and reliability requirements for storing and sharing sensitive images in the 5G network environment, verifiable steganography-based secret image sharing (SIS) is attracting increasing attention. The verifiable capability is necessary to ensure the correct image reconstruction. From the literature, efficient cheating verification, lossless reconstruction, low reconstruct complexity, and high-quality stego images without pixel expansion are summarized as the primary goals of proposing an effective steganography-based SIS scheme. Compared with the traditional underlying techniques for SIS, cellular automata (CA) and matrix projection have more strengths as well as some weaknesses. In this paper, we perform a complimentary of these two techniques to propose a verifiable secret image sharing scheme, where CA is used to enhance the security of the secret image, and matrix projection is used to generate shadows with a smaller size. From the steganography perspective, instead of the traditional least significant bits replacement method, matrix encoding is used in this paper to improve the embedding efficiency and stego image quality. Therefore, we can simultaneously achieve the above goals and achieve proactive and dynamic features based on matrix projection. Such features can make the proposed SIS scheme more applicable to flexible 5G networks. Finally, the security analysis illustrates that our scheme can effectively resist the collusion attack and detect the shadow tampering over the persistent adversary. The analyses for performance and comparative demonstrate that our scheme is a better performer among the recent schemes with the perspective of functionality, visual quality, embedding ratio, and computational efficiency. Therefore, our scheme further strengthens security for the images in 5G networks.

Friends query is one of the critical components in online social networks (OSNs). However, with the advent of OSNs, more and more private information of individuals (e.g., personal sensitive profiles, relationships and locations) will be collected by the service providers during the query. Some existing privacy-preserving solutions either can provide only approximate queries or need trust assumption on the service providers. To overcome these limitations, we propose PPFQ-a Privacy-Preserving Friends Query scheme over OSNs. To the best of our knowledge, this is the first work that aims at preventing attack launched by the service provider and attackers, but still allow users to make friends query based on profile and geo-distance. In PPFQ, we design a profile-based friends query protocol where user's profiles can be encrypted and searched by his friends privately with different keys. In addition, for the first time, we design a k-nearest friends query protocol to achieve location-based search on encrypted domain. By deploying the two-server secure distance computation and comparison mechanism with Batcher's sorting network, this protocol achieves accurate nearby friends retrieving while preventing the privacy of geo-location and the distance order from revealing them to the servers. We also give a comprehensive analysis of the correctness and security of PPFQ with mathematical proofs. Finally, we provide extensive experimental results to demonstrate the efficiency of our proposed construction.

Abstract Vector commitment (VC) schemes allow committing to an ordered sequence of ${q}$ values ${(m_1,\cdots ,m_q)}$ in such a way that one can later open the commitment at specific positions. However, the existing VC schemes suffer from two substantial shortcomings that limit their use: (i) the commitments cannot be opened except at some specific positions, and (ii) their security only captures position-binding but offers no privacy: the client may learn additional information about the committed sequence through the proofs and the commitments. To resolve these problems, we first extend VC to a more expressive primitive called VC with sum binding (VCS), in which the commitment can also be opened to the sum of all elements in the committed sequence. VCS additionally satisfies the security of sum binding, which guarantees that the commitment cannot be opened to different sums. To enhance its privacy, we extend VCS to zero-knowledge VCS (ZKVCS), in which commitments and proofs constructed during the protocol execution leak nothing about the committed sequence. We formalize this new property by a standard real/ideal experiment. Meanwhile, the detailed performance analyses and simulations show that our proposed schemes are more practical. Finally, we introduce a novel notion of (zero-knowledge) verifiable database supporting sum and show how to construct it from our (ZK)VCS scheme.

Summary Since cloud computing and cloud storage have become a common practice in our daily life, people are paying more attention on protecting the privacy of their sensitive data. In this paper, we consider the problem of graph encryption in such a way that one can perform all‐path queries over an encrypted graph in a privacy‐preserving manner. A solution for such problem has many potential applications in network virtualization since graph data structures are commonly used to represent the topology of substrate and virtual networks. We propose a searchable symmetric encryption scheme for graph data that support all‐path queries. The scheme allows a client to encrypt a sensitive graph and outsource it to an untrusted server for storage. After that, the client can perform arbitrary all‐path queries between a source and a destination. For each query, the server computes and returns all the paths that satisfied the query. We prove that our scheme is secure against adaptive chosen‐query attacks in the semi‐honest setting.

With development of online social networks, many criminal suspects use social network to communicate with each other. In order to obtain valuable criminal clues, considerable research works have been done to analyze criminal suspects' social data. However, most of them did not pay much attention on privacy-preserving problems, which may leak some sensitive data in the analysis process. To solve this problem, we propose a novel analysis approach of criminal suspects by exploiting social data and crime data that are collected by social network and police information systems. We enable the social cloud server and public security cloud server to exchange social information of criminal suspects and user's public information in a privacy-preserving way. Specifically, we propose a privacy-preserving data retrieving method based on oblivious transfer to guarantee that only the authorized entities can perform queries on suspects' social data, while the social cloud server cannot infer anything during the query. Moreover, several building blocks, such as encrypted data comparing, secure classification and regression tree (CART) model are also proposed. Based on these building blocks, we designed a privacy-preserving criminal suspects sensing scheme. Finally, we demonstrate a performance evaluation which shows that our scheme can enhance analysis of criminal suspects without privacy leakage, while with low overhead.

Along with the fast development of wireless technologies, smart devices have become an integral part of our daily life. Authentication is one of the most common and effective methods for these smart devices to prevent unauthorized access. Moreover, smart devices tend to have limited computing power, and they may possess sensitive data. In this paper, we investigate performing graph operations in a privacy-preserving manner, which can be used for anonymous authentication for smart devices. We propose two protocols that allow two parties to jointly compute the intersection and union of their private graphs. Our protocols utilize homomorphic encryption to prevent information leakage during the process, and we provide security proofs of the protocols in the semihonest setting. At last, we implement and evaluate the efficiency of our protocols through experiments on real-world graph data.

Accurate classification on pathological images is a significant research focus such as for non-Hodgkin lymphomas (NHL). To this end, this paper proposes a hierarchical classification model based on the labels' statistics for three NHL pathological images, including chronic lymphocytic leukemia (CLL), follicular lymphoma (FL) and mantle cell lymphoma (MCL). First, each pathological image is converted onto the grayscale channel and then divided into 130 non-overlapped patches with 100100 pixels. Next, the sparse autoencoder (SAE), an unsupervised feature extraction method, is utilized to learn the representations of all patches and meanwhile texture features are extracted on these patches which are considered as the hand-craft features. Following this process, we can obtain a 680-dimension feature set. Finally, a hierarchical classification model trained by these 680-dimension features is applied to classify NHL as CLL, FL and MCL, where the label of each NHL pathological image is determined via the output labels of its 130 patches. The experimental results and comparisons demonstrate the advantages of the proposed hierarchical classification model.

Private set intersection (PSI) allows two parties to compute the intersection of their private sets while revealing nothing except the intersection. With the development of fog computing, the need has arisen to delegate PSI on outsourced datasets to the fog. However, the existing PSI schemes are based on either fully homomorphic encryption (FHE) or pairing computation. To the best of our knowledge, FHE and pairing operations consume a huge amount of computational resource. It is therefore an untenable scenario for resource-limited clients to carry out these operations. Furthermore, these PSI schemes cannot be applied to fog computing due to some inherent problems such as unacceptable latency and lack of mobility support. To resolve this problem, we first propose a novel primitive called “faster fog-aided private set intersection with integrity preserving”, where the fog conducts delegated intersection operations over encrypted data without the decryption capacity. One of our technical highlights is to reduce the computation cost greatly by eliminating the FHE and pairing computation. Then we present a concrete construction and prove its security required under some cryptographic assumptions. Finally, we make a detailed theoretical analysis and simulation, and compare the results with those of the state-of-the-art schemes in two respects: communication overhead and computation overhead. The theoretical analysis and simulation show that our scheme is more efficient and practical.

Summary The intersection operation on multisets has many applications in different scenarios, such as data mining and pattern matching. This motivates us to study the problem that when users outsource their private encrypted sets and delegate the set‐intersection operation on the corresponding plaintexts to the cloud, the cloud can manage to conduct the operation and make the result verifiable without the decryption capability. We formally introduced a model of Verifiable Intersection Operations on Encrypted Data in Cloud and presented the definitions of the correctness and security properties. We also proposed a concrete scheme basing on the bilinear‐map accumulator and re‐encryption. The scheme was proved secure under some cryptographic assumptions. And the experimental results of the algorithm implementation show the scheme is partly practical for real scenarios. Copyright © 2016 John Wiley & Sons, Ltd.

In 2015, Wang proposed the first identity-based provable data possession scheme named ID-DPDP (IEEE Transactions on Services Computing, vol. 8, no. 2, pp. 328-340, Mar./Apr. 2015) to verify outsourced data publicly without the implementation of PKI. Unfortunately, in this letter, we demonstrate that this scheme is insecure in the sense that cloud servers can generate valid proofs without possessing the original data blocks. We also show another security issue in this scheme which leads to some data blocks can never be verified unless all the data blocks are challenged. Meanwhile, we provide solutions to these problems while preserving the security features of the original scheme.

Key management is very crucial in a secure multicast system. The key storage of the group controller and group members, the communication cost and computation cost caused by joining/leaving members, are the determining factors for the performance of the key management system. A scheme is high-performed, if it has the optimal rekeying cost and the lower storage requirements. In order to get the high efficiency and security, a novel scheme (TOFT) based on threshold-based one-way function tree is proposed in this paper. The quad-tree and the threshold-key-mechanism are used in the scheme, which improves the performance of the key management system. We present the design principle, the realization protocols including keys generation and distribution, dynamic membership management. The TOFT scheme is compared with other protocols from the following four aspects: computation cost, communication cost, storage requirements, and security. Finally, we conclude that our scheme is more efficient than others.