The Polymorphic Network (PINet) is a future network architecture that can dynamically load multiple network modalities (NM), solving the rigidity and single IP bearer problem. However, due to the different design concepts and protocol stacks of each NM, it is challenging to provide compatible data access control for different NMs. In this paper, we propose a unified attribute-based data access control framework within PINet. This framework ensures consistent access control across NMs by managing user attribute identifiers and seamlessly integrating access policies. We design Span-hiding Cipher-policy Attribute-based Encryption (SHCP-ABE). The design of span attribute cuckoo filter and two-round encryption in SHCP-ABE implements access control that supports comparing attribute values and policy hiding. We further modified the linear secret sharing scheme in SHCP-ABE to achieve isolation of access policy information among NMs. The proposed SHCP-ABE scheme is unified, fine-grained, privacy-preserving, and can effectively adapt to heterogeneous future network architectures such as PINet. Security analysis shows that SHCP-ABE is secure against the adaptive chosen plaintext attack under the generic group model. Experimental results show that SHCP-ABE reduces the time overhead of key generation and decryption and the key storage overhead by about 50% over the existing comparable CP-ABE scheme, providing excellent efficiency.

As agriculture and food industries evolve toward smarter and more efficient practices, uncrewed aerial vehicles (UAVs) are playing an increasingly vital role in tasks, such as data collection and precision spraying, and the reliable identity authentication has emerged as a critical issue for ensuring operational security and data privacy. Traditional authentication mechanisms, including public-key infrastructure-based and ID-based, have provided mutual trust and security of UAVs. However, when deployed on a large scale of UAVs, they suffer from a single point of failure, a heavy computational overhead, and challenges in managing UAVs at a large scale. In this article, we propose a lightweight decentralized authentication scheme with dynamic management for UAVs. Specifically, by leveraging the self-sovereign property of decentralized identifiers (DIDs), we enable each UAV to autonomously generate its own identifier, thereby realizing the decentralized authentication. And for the key pairs required in authentication, we design a secure and lightweight secret key generator based on the physical unclonable function (PUF), which prevents key leakage. In terms of identity management, we propose a cryptographic accumulator-based dynamic lightweight management module (DLMM), which is endowed with dynamic scalability and provides efficient dynamic management with low communication and computation overhead. We evaluate the performance of the proposed scheme, and the results show that the proposed scheme has significant advantages in security and computation overhead compared with the existing schemes.

Cloud computing provides users with cost-effective on-demand resource sharing, but the shared resources also creates additional security risks due to co-location with malicious tenants. In addition to static defensive technologies, Virtual Machine (VM) migration, a type of Moving Target Defense (MTD) technique, provides an alternative solution to mitigate co-resident attacks by dynamically migrating services/tasks among various servers. Although significant progress has been made in this area, critical gaps remain regarding the quantification of these techniques' synergistic effectiveness in cloud computing, as previous research focused on either evaluating the defensive capability of MTD or on examining the characteristics of static strategies. In this paper, we aim to use analytical modeling techniques to quantitatively evaluate the synergistic effectiveness of integrating MTD with VM allocation policies. We designed a synergistically defensive architecture and proposed a Stochastic Reward Net (SRN) model to describe the execution and attacking processes of tasks migrating among multiple servers under three commonly used allocation policies. Moreover, experiments were implemented using SimPy to verify the analytical results obtained from the SRN model and to broaden the evaluation scope. Our comprehensive assessment, using both SRN and experiments, evaluates the defensive capacity and corresponding features for different scenarios. The obtained simulation results were approximate, with an error rate of less than 3.40 %, reflecting the reliability of our methods. Several defensive suggestions were further summarized based on the evaluation.

Projection maintenance is one of the core data structure tasks. Efficient data structures for projection maintenance have led to recent breakthroughs in many convex programming algorithms. In this work, we further extend this framework to the Kronecker product structure. Given a constraint matrix ${\sf A}$ and a positive semi-definite matrix $W\in \mathbb{R}^{n\times n}$ with a sparse eigenbasis, we consider the task of maintaining the projection in the form of ${\sf B}^\top({\sf B}{\sf B}^\top)^{-1}{\sf B}$, where ${\sf B}={\sf A}(W\otimes I)$ or ${\sf B}={\sf A}(W^{1/2}\otimes W^{1/2})$. At each iteration, the weight matrix $W$ receives a low rank change and we receive a new vector $h$. The goal is to maintain the projection matrix and answer the query ${\sf B}^\top({\sf B}{\sf B}^\top)^{-1}{\sf B}h$ with good approximation guarantees. We design a fast dynamic data structure for this task and it is robust against an adaptive adversary. Following the beautiful and pioneering work of [Beimel, Kaplan, Mansour, Nissim, Saranurak and Stemmer, STOC'22], we use tools from differential privacy to reduce the randomness required by the data structure and further improve the running time.

Smart contracts emerged as programs running on the blockchain. Security is one of the major concerns against smart contracts which also exist various vulnerabilities as for any other traditional programs. What was worse, security vulnerabilities in smart contracts may lead to irreversible economic losses. Hence, there is an apparent demand for security audits of contracts before deployment. In recent years, a large number of smart contract vulnerability detection tools have emerged. The methods used by these tools include formal verification, symbolic execution, machine learning, and fuzz testing. These methods can well analyze vulnerabilities, but there are still limitations. In this paper, we optimized and extended the Mythril symbolic execution tool. The optimized pruning algorithm improves the speed of symbolic execution, while the proposed detection algorithm for Transaction Order Dependence vulnerability expands the range of detecting vulnerability. In addition, a machine learning vulnerability detection model is introduced as an auxiliary detection method, which is used to build the complete smart contract vulnerability detection system. The experimental results show that the proposed system reduces the execution time, and improves the accuracy as well as the recall of vulnerability detection compared with the original Mythril tool.

In distributed storage systems, the replication mechanisms are usually used to ensure system reliability and data availability. Random replication is widely used in cloud storage systems to prevent data loss. Copyset Replication (CR) as a replication strategy, makes a nearly optimal trade-off between the number of scattered nodes and the probability of data loss. Compared with random replication, CR greatly reduces the probability of data loss caused by node failure. However, CR's random selection strategy makes it difficult to select the optimal copyset based on data characteristics such as calculation and storage. In response to this problem of CR, the Optimal Copyset Replication (OCR) proposed in this paper can select the optimal copyset according to the specified data characteristics and its corresponding node conditions. Finally, combined with Cyberspace Mimicry Defense (CMD) , we implemented OCR in a distributed object storage system and conducted related experiments. When the calculation type data reaches 300,000, the experimental results prove that compared with CR randomly selecting copyset, OCR reduces the data processing time by nearly 10% through selecting the optimal copyset. By setting relevant parameters, OCR can also ensure that the data distribution of each node is relatively uniform, and avoid data skew.

In this paper, we propose a Space-Terrestrial Integrated Multi-identifier Network (STI-MIN), which has the characteristic of efficient routing scheme, co-governed network space, and endogenous security. The fundamental theory is proposed to depict the overview of STI-MIN firstly. Then a multi-identifier management system based on hierarchical consortium blockchain and a scalable space-terrestrial integrated routing scheme are designed to build the efficient management plane and data plane of STI-MIN respectively. The endogenous security mechanism of STI-MIN is also proposed based on trusted computing and identity self-authentication. A testbed covering six provinces or regions of China and a high throughput satellite has been built. The experiment done in the testbed shows that STI-MIN has many merits while comparing it with the traditional network.

The rapid growth of data on the Internet has brought huge challenges to storage systems. Data deduplication technology is proposed to solve the problem of data redundancy. As one of the data deduplication technologies, the memory-assisted method uses an approximate membership data structure to greatly reduce the space consumption of membership determination. The approximate membership data structures represented by the cuckoo filter have been widely used. However, there is a lack of efficient ways to solve the problem that the insertion time increases exponentially with the load rate of the cuckoo filter. In this paper, an efficient cuckoo filter named TSCF is proposed with a two-stage insertion algorithm. The TSCF balances the load of the filter through active relocations in the first stage, laying the foundation for the second stage. Through the experiments, the cumulative relocation times of the TSCF are reduced to 37% and 46% respectively compared with the SCF and the CFBF, indicating that the TSCF greatly reduces the relocation times and insertion time of the entire insertion process, and improves the performance of the cuckoo filter.

Moving target defense (MTD) techniques are effective solutions to improve the network security by continuously reconfiguring the system setting. On the other hand, continuously transforming also increase the cost of defenders, so it is important to analyze the effectiveness of MTDs compared with their cost. Current researches lack of analyzing the effectiveness by mathematical theory compared with analyzing by experiment. Motivated by the above, we propose a novel three-dimension model named NPM jointly use N-version programming, Poisson process, Markov chain and martingale theory to analyze the effectiveness of the proposed MTD model. Our analysis points out the difficulty for a successful adversary to defeat the MTD system, which is related to the system configuration, such as the number of executors and the judgment criterion in every node, the transforming period and rang of system MTD transformation. Finally, we give advices on the design of the system in the daily defense and the attacked defense, with the goal of guaranteeing security with minimal cost.

As the Internet and the big data system evolve rapidly, the deployment of distributed applications becomes widespread, promoting the development of Distributed File System (DFS). The existing defense technologies for DFS, such as detection or patching, mainly aim to protect the system from known attacks and vulnerabilities. However, it is difficult for those systems to solve the growing security issues from the unknown threats due to their passiveness and hysteresis. In this paper, we propose MDFS, a mimic defense theory based architecture for DFS with the capability to improve the data security. Mimic Defense (MD), a proactive defense embedded in MDFS, emphasizes dynamism, heterogeneity and redundancy. The key benefits of MD are transferring the attack surface as well as increasing the cost of modification.