The Internet of Vehicles (IoV) produces massive volumes of vehicular data rich in traffic patterns, driving behavior, and location intelligence, rendering it a valuable asset for transportation systems, urban planning, and commercial applications, thus necessitating secure and efficient data asset sharing. However, existing vehicular data sharing solutions do not protect data access patterns, risking privacy leaks. In this paper, we propose OCDS, a consortium blockchain-empowered oblivious and consistent data asset sharing for IoV. OCDS enables vehicles to write and read data assets in an oblivious way by introducing BdcORAM, which employs a tree-structured world state and implements a two-phase oblivious write protocol alongside a consistent oblivious read protocol. Additionally, we further design two optimized variants of BdcORAM to optimize performance for unbalanced read-write workloads. Through comprehensive security analyses and experimental evaluation, OCDS demonstrates it achieves data confidentiality, access anonymity, and secure read consistency without incurring significant performance overhead.

Learned indexes leverage machine learning models to approximate data distributions and predict key positions, offering better performance than traditional index structures such as B+Trees. As data in real-world applications evolve rapidly, the timely and efficient updating of learned indexes has become an increasingly important research problem, attracting growing attention in recent studies. However, under update-intensive workloads with frequent insertions and deletions, existing learned indexes cannot update the model in a timely manner. Moreover, they ignore the impact of deletions on model accuracy. These limitations lead to degraded prediction accuracy and increased query latency, undermining the core advantage of learned indexes. To fill in this gap, in this paper, we design a dynamic learned index (denoted as DynaMind) that is able to timely update the model with the frequent change of data. Specifically, we propose a novel score function to determine the appropriate timing at which a learned index should initiate an update by measuring the influence of updated data on the model accuracy. To enable efficient model updates, we devise a timely learned index update algorithm that implements both lightweight incremental learning for insertions and machine unlearning for deletions together, ensuring the model continuously evolves without full retraining. Extensive experiments on real-world and synthetic datasets show that DynaMind achieves competitive throughput compared to state-of-the-art works while improving the prediction accuracy. The proportion of keys with zero prediction error increases by more than 10% after updates.

Task matching is a core component of crowdsourcing systems, enabling efficient assignment of tasks to appropriate workers. However, this process often requires both task requesters and workers to disclose sensitive contextual information, such as spatial locations and temporal availability, raising serious privacy concerns. Although various cryptographic techniques and blockchain-based solutions have been proposed to preserve privacy and enhance trust, existing schemes still face three critical limitations: reliance on centralized key authorities, lack of support for fine-grained spatio-temporal constraints, and inefficient public verification mechanisms. To address these challenges, we propose PVSTMatch, a blockchain-empowered privacy-preserving spatio-temporal task matching scheme in crowdsourcing. PVSTMatch eliminates the need for trusted third parties through an authority-free authorization mechanism, supports secure spatio-temporal matching by designing a compact secure comparison method, and enables efficient public verifiability via a succinct verification mechanism. Furthermore, we introduce GE-PVSTMatch, a gas-efficient variant that significantly reduces on-chain storage costs. Security analysis and performance evaluation demonstrate that our schemes achieve strong bilateral privacy, verification correctness, and practical efficiency, making them well-suited for real-world decentralized crowdsourcing platforms.

Dynamic searchable symmetric encryption (DSSE) schemes support keyword search queries on encrypted dynamic datasets with add-or-delete operations stored on an untrusted remote server. Multi-user DSSE (MUDSSE) further considers multiple users to access the encrypted dataset. Most works of MUDSSE focus on how to promise forward and backward privacy of queries. However, the problem in which the data owner can not revocate the deleted encrypted data on the encrypted dataset adaptively and efficiently is not sufficiently considered. To solve this problem, we propose a new multi-user DSSE scheme named X-MUSE, extending cryptographic primitives Symmetric Revocable Encryption (SRE) to design a new searchable encryption with optimal search time for the deletion operation. Furthermore, to minimize communication size and counter new integrity threats raised by malicious clients, we extend X-MUSE to design a new MUDSSE named B-MUSE by integrating blockchain-based technology. Our evaluation confirms that our schemes have practical search performance and lower storage costs on both the server and the client side compared to the state-of-the-art.

Content based video search services find extensive applications across various domains including video surveillance and object detection. In recent times, researchers have increasingly turned their attention towards enhancing the security of video search over outsourced encrypted videos. Nonetheless, prior researchers often leverage cost-expensive techniques like Homomorphic encryption or Order-preserving encryption to ensure privacy preservation. To reduce the overhead, Bloom Filter (BF)-encoded keyword search is a promising technology for retrieving encrypted videos with image queries. However, it generally suffers from serious data privacy leakage since it will reveal the inclusion relationship between “1” and “0” in the BF. Fortunately, the privacy-preserving bloom filter-based search scheme (PBKS) was recently proposed to achieve secure and effective search while protecting the values in BFs, but it still has two limitations. One is the size of a search token is very large in some cases and the other is the cloud server can infer the true value of each bit in the BF by doing a few operations. In this paper, we propose an efficient and confidentiality-preserving bloom filter-encoded video search (ECVS) scheme for retrieving encrypted videos with image queries. We first design a new CPRF (prefix-constrained pseudorandom function)-based token compression method to reduce the size of the search token and reduce the communication cost largely. Furthermore, we customize a periodic refresh mechanism to conceal the true value of each bit in the BF while avoiding excessive computational pressure on resource-limited users. Security analysis and experiments confirm the security and efficiency of our schemes.

Permissioned blockchain is a promising methodology to build zero-trust storage foundation with trusted data storage and sharing for the zero-trust network. However, the inherent full-backup feature of the permissioned blockchain poses potential data privacy risks and substantial storage costs, hindering its usage as a storage medium. These issues necessitate the usage of secure data deduplication technology to mitigate them. Unfortunately, current secure data deduplication schemes are predominantly designed with centralized cloud servers in mind and are not suitable for distributed blockchain systems. The reason is that the full backup feature of the permissioned blockchain renders a wide attack surface to offline brute-force and frequency analysis attacks. In response, we propose DedupChain, a secure blockchain-enabled storage system with deduplication for zero-trust networks. DedupChain employs a trusted execution environment (i.e., Inter SGX enclave) in conjunction with Oblivious RAM (ORAM) to offer a novel security guarantee namedoblivious data deduplication, which empowers DedupChain with the ability to defend offline brute-force and frequency analysis attacks. DedupChain also proposes several novel techniques to address the security and efficiency issues raised by the SGX enclave. We implemented a system prototype of DedupChain and evaluated its performance metrics. Our experimental results show that DedupChain exhibits satisfactory operational delays, throughput, and storage overhead. Security analysis shows that DedupChain is robust enough to withstand several types of attacks. To the best of our knowledge, we are the first to apply secure data deduplication techniques to address data privacy and storage cost issues raised by permissioned blockchain when used as a zero-trust storage medium.

Paging and exit overheads have been proven to be the performance bottlenecks when adopting Searchable Symmetric Encryption (SSE) with trusted hardware such as Intel SGX for keyword search. This problem becomes more serious when incorporating ORAM and SGX to design oblivious SSE schemes such as POSUP [1] and Oblidb [2] which can defend against inference attacks. The main reason comes from high round communication complexity of ORAM and constrained trusted memory created by SGX. To overcome this performance bottleneck, we propose a set of novel SSE constructions with realistic security/performance trade-offs. Our core idea is to encode the keyword-identifier pairs into a bloom filter to reduce the number of ORAM operations during the search procedure. Specifically, Construction 1 loads the bloom filter into the enclave sequentially, which outperforms about$1.7\times$when the dataset is large compared with the performance of the baseline that directly combines ORAM and SGX. To further improve the performance of Construction 1, Construction 2 classifies keywords into groups and stores these groups in different bloom filters. By additionally leaking the keywords in search token belonging to which groups, Construction 2 outperforms Construction 1 by$16.5\sim 36.8\times$and provides an improvement of at least one order over state-of-the-art oblivious protocols.

Dynamic searchable symmetric encryption (DSSE) enables clients to store encrypted data on untrusted servers while retaining the ability to search and update the data efficiently. However, most existing DSSE schemes are vulnerable to incorrect update queries, such as duplicated insertions or invalid deletions, which can compromise both security and availability. Although existing robust schemes have made progress in addressing these issues, they still suffer from significant search inefficiencies, particularly when handling large numbers of updates. To overcome these limitations, we proposeRO(SE)2, a novel robust DSSE scheme that simultaneously achieves robustness, forward-and-Type-III-backward security, and optimal search performance.RO(SE)2introduces a hierarchical binary tree structure combined with an oblivious map (OMAP) to handle incorrect updates during the update phase, eliminating the need for filtering during search queries and significantly improving search efficiency. Additionally,RO(SE)2employs a two-layer encryption mechanism to ensure forward security and supports efficient search result verification through its verifiable extension,RO(SE)2-v. Rigorous security analysis proves thatRO(SE)2can achieve not only robustness, forward and backward security but optimal search efficiency as well. Comparative analysis reveals thatRO(SE)2outperforms existing robust schemes in terms of search performance, whileRO(SE)2-v outperforms the state-of-the-art verifiable robust schemes in verification performance.

As the integration of the Internet of Vehicles and social networks, vehicular social networks (VSNs) are promising to boost the realization of intelligent transportation system. Recently, vehicular data privacy has been paid increasing attention in data sharing. Searchable encryption as a promising cryptographic primitive can be utilized to ensure vehicular data confidentiality without sacrificing data searchability. However, most vehicular data sharing schemes rely on centralized cloud servers, which are vulnerable to the single point of failure and distributed denial of service (DDoS) attacks. In this paper, we propose VehShare, a decentralized framework for privacy-preserving vehicular data sharing. We resort to the smart contract to implement a trusted platform for vehicles to share their encrypted vehicular data. To provide efficient access control, we design an authorization-based on-chain access control scheme with a lightweight cryptographic primitive. Moreover, we design a time synchronization-based non-interactive search token generation scheme to achieve efficient privacy-preserving search queries, while satisfying forward and backward security. We formally analyze the security of VehShare and extensive experiments demonstrate the efficiency of VehShare.

The rapid development of Internet of Things (IoT) enables digital twin (DT) technology to precisely represent a real product in a virtual space by generating a multitude of IoT data items to record many aspects of the product. To support various DT-based applications, the generated IoT data items need to be shared among multiple parties involving the lifecycle of the product, which raises increasing demand for data access control. The decentralization and tamper-proofing properties of blockchain enable it a promising technology to support immutability protection of shared IoT data items. Meanwhile, to protect the confidentiality of the shared IoT data items, attribute-based encryption (ABE) can be used as a common tool to construct a cryptographic enforced data access control scheme. However, its adoption has been severely hindered by the incompatibility between the immutability of blockchain and secure authority update of cryptographic enforced data access control. In this paper, a blockchain-aware rollbackable data access control scheme (Bdacs) is proposed to reconcile the above tension. Bdacs uses two novel encryption schemes named hierarchical encryption scheme and privacy-preserving rollback re-encryption scheme to realize secure dynamic access control while preserving the immutability of blockchain. We prove the security of Bdacs and evaluate it through theoretical comparison and experimental analysis to confirm its efficiency. This work can serve as a basis of development of future DT-based applications to enable privacy-preserving IoT data-sharing systems deployed on blockchain.

Recently, the counting algorithm of local topology structures, such as triangles, has been widely used in social network analysis, recommendation systems, user portraits and other fields. At present, the problem of counting global and local triangles in a graph stream has been widely studied, and numerous triangle counting steaming algorithms have emerged. To improve the throughput and scalability of streaming algorithms, many researches of distributed streaming algorithms on multiple machines are studied. In this article, we first propose a framework of distributed streaming algorithm based on the Master-Worker-Aggregator architecture. The two core parts of this framework are an edge distribution strategy, which plays a key role to affect the performance, including the communication overhead and workload balance, and aggregation method, which is critical to obtain the unbiased estimations of the global and local triangle counts in a graph stream. Then, we extend the state-of-the-art centralized algorithm TRIÈST into four distributed algorithms under our framework. Compared to their competitors, experimental results show that DVHT-i is excellent in accuracy and speed, performing better than the best existing distributed streaming algorithm. DEHT-b is the fastest algorithm and has the least communication overhead. What’s more, it almost achieves absolute workload balance.