In this article, our primary focus is on the current lack of privacy-preserving queries tailored to real-number fields rather than integers. We take multisource private data counting on real numbers (R-PDC) within IoT architecture as a breakthrough point to enable diverse query services without revealing sensitive data. The advantage of this is that the parameters required for queries remain stable and minimal in the scenario of wide numerical domain and dynamic changed data set. First, we present a general R-PDC method based on curve approximation, in which an approximate query function (AQF) is established to approximate the constructed ideal counting curve for element queries on target set. We also demonstrate curve construction process of AQF and provide the feasibility theorem of AQF for counting a target element within an allowable error. By integrating the R-PDC method with fixed-point fully homomorphic encryption, an efficient R-PDC scheme is presented to perform multiparty collaborative queries in IoT. In security aspect, the R-PDC scheme on$(m,\epsilon)$-AQF is proved to be statistically secure against chosen element attack (CEA) for cumulative error$\epsilon $and data set size$m$. Moreover, the scheme achieves$O(nm\gamma)$computation and$O(n^{2}m\gamma)$communication complexities for$n$servers and$\gamma $-length fraction. Finally, as an extension of AQF over single attribute, multidimensional R-PDC method is applied into privacy-preserving Naive Bayes classifier and Apriori algorithm over multiple attributes. Our work provides substantial support and insights for the advancement of privacy computation.

To face urgent concern of privacy leakage on mobile crowdsourcing, some Lattice-Based Cryptographic (LBC) schemes have been applied to the cloud-fog-edge data sharing platform for privacy protection. As an important factor of LBC’s security, current key generation usually involves Preimage Gaussian Sampling for Lattice Trapdoor (PGS-LT) to sample short preimage vector from dual lattice. However, there lacks researches on the implementation of PGS-LT according to entities’ computation and storage capacities. To address this issue, we present a fast double-perturbation scheme that is applied to the cloud-fog-edge data sharing platform. Firstly, we design a fast spherical G-lattice sampling algorithm including two samplers: G-perturbation sampler and G-lattice sampler. Among them, the fast non-spherical G-lattice sampling algorithm is extended to arbitrary bases, and deployed on the G-lattice sampler. Meanwhile, the G-perturbation sampler is designed to sample G-perturbation for converting the non-spherical distribution of output G-lattice vector to the spherical one. Secondly, we optimize the assignment of computational tasks in PGS-LT by considering entities’ abilities in the cloud-fog-edge platform. Moreover, we analyze three types of delegated preimage sampling in terms of Gaussian quality and complexity. The analysis and experimental results show that fast spherical G-lattice sampling provides high Gaussian quality of output vector. Meanwhile, in the aspect of complexity, the G-perturbation sampler has lower time & space complexity than the existing works. The G-lattice sampler remains good performance as it only involves extra integer multiplications in linear time complexity.

In the light of the advantages of ring, more and more Lattice-Based Cryptography (LBC) schemes are designed over it to provide small storage cost and high performance. Gaussian Sampler for Lattice Trapdoor (GSLT) plays an important role for these schemes, especially for key extraction. In this paper, we present an efficient GSLT scheme with On-line and Off-line stages. In the On-line stage, we extend the fast non-spherical Gadget-lattice sampling into the ring setting for high performance, and analyze the covariance matrix of output vectors. Subsequently, two optimized perturbation sampling constructions are designed for non-spherical Gadget-lattice sampler to avoid inefficient Cholesky decomposition during Off-line stage. The first construction aims to the spherical Gaussian distribution of preimage vectors, which is beneficial for theoretical analysis. In contrast, the second one is designed on the non-spherical distribution to improve the efficiency of perturbation sampling without leakage of trapdoor in statistic, and we further provide the method how to choose the Gaussian parameters. The complexity analysis and experimental results show that the On-line stage of our scheme has a better performance in comparison with the other works. In the Off-line stage, both of two perturbation sampling constructions can avoid low efficiency of Cholesky decomposition, and are more suitable for the non-spherical G-lattice sampling. In short, our work provides two candidates on either Gaussian parameter or sampling efficiency, thereby offering more options for key generation in LBC schemes.

Multisource Private Data Counting (PDC) as a collaborative query service allows different organizations or individuals to combine their data and perform various queries without revealing sensitive information. It is especially crucial for multiple competing institutions, having economic interests and holding sensitive business information. To do it, we first design a practical privacy-preserving query service framework to meet the requirements of data and query privacy, computation fairness, and query flexibility. On this basis, we present a new PDC method over Finite Support Polynomials with Integer Coefficients (PDC-FSP-IC), in which curve fitting method is adopted to generate a query curve for given data set and target set. Especially, the symmetry of curve and Peak-Shift method are introduced to increase the flexibility and applicability for constructing query curves. By integrating PDC-FSP-IC with Multi-Party Fully Homomorphic Encryption (MP-FHE), we further present an efficient PDC scheme to perform collaborative query services on multisource data. This scheme is proved to be statistically secure against chosen element attack for both data privacy and query privacy. Furthermore, the scheme is applied into Private Blacklist-drived Credit Assessment (PBCA) and Privacy-Preserving ID3 (PP-ID3) to preserve data privacy of all participants in joint counting process. The results of performance evaluation demonstrate that our scheme is enough efficient for collaborative query services.

The increasing popularity of remote Cloud File Sharing (CFS) has become a major concern for privacy breach of sensitive data. Aiming at this concern, we present a new resource sharing framework by integrating enterprise-side Attribute-Based Access Control/eXtensible Access Control Markup Language (ABAC/XACML) model, client-side Ciphertext-Policy Attribute-Based Encryption (CP-ABE) scheme, and cloud-side CFS service. Moreover, the framework workflow is provided to support the encrypted-file writing and reading algorithms in accordance with ABAC/XACML-based access policy and attribute credentials. However, an actual problem of realizing this framework is that policy matrix, derived from access policy, seriously affects the performance of existing CP-ABE from Lattice (CP-ABE-L) schemes. To end it, we present an optimal generation algorithm of Small Policy Matrix (SPM), which only consists of small elements, and generates an all-one reconstruction vector. Based on such a matrix, the improved CP-ABE-L scheme is proposed to reduce the cumulative errors to the minimum and prevent the enlargement of error bounds. Furthermore, we give the optimal estimation of system parameters to implement a valid Error Proportion Allocation (EPA). Our experimental results indicate that our scheme has short size of parameters and enjoys efficient computation and storage overloads. Thus, our new framework with optimization methods is conducive to enhancing the security and efficiency of remote work on CFS.

In this article, we address the problem of data privacy in multisource data mining. To do it, we present a new multiparty fully homomorphic encryption (MP-FHE) scheme, in which all participants are completely fair to perform the same computation. At first, the proposed MP-FHE scheme is divided into five stages (i.e., calculation, configuration, recombination, resharing, and reconstruction stage) to achieve the unified computation form of addition and multiplication. Meanwhile, random bivariate polynomials and commutative encryption are used to achieve the degree reduction of polynomials and the continuity of computation. Moreover, we prove that the scheme meets result consistency and program termination under the fail-stop adversary model. Especially, three kinds of error detection criteria are presented to find errors in three different stages (i.e., recombination, resharing, and reconstruction stage), which provides the monitor basis for the fail-stop adversary model. In addition, the MP-FHE scheme is applied into privacy preserving k-means clustering algorithm. Finally, we evaluate the computation and communication performance of our scheme from both theoretical and experimental aspects, and the evaluation results show that the scheme is efficient enough for multisource data mining.

Usage-based pricing or Pay-as-You-Go is a relatively new SaaS business model that may provide customers the option to pay for only what they use. Yet, it is more challenging to implement than traditional Pay-before-Use subscriptions considering that it need not only realize financial payment on consumption-based behaviors, but also regulate the rights and obligations among the providers, consumers, and platforms in a legal form. To address these challenges, in this article Smart Legal Contract (SLC) is integrated into a service computing platform by introducing a new architecture, called Service as a Smart Contract (SaaSC). On the aspect of service legalization, through combining SaaS and SaaSC, we establish three kinds of terms in SLC-based software subscription contract to support service's registration, discovery and customization, so that a complete transaction procedure can be regulated in terms of service states, transaction process, and interactions among contracting parties. On the aspect of service financialization, we propose a new scheme of service interface declaration in the SLC-based SPESC contract. By automatically executing smart contracts and checking the terms, the pay-as-you-go billing form can be made fine-grained payment after using service interface calls. Moreover, we take weather forecast service as a case to implement and analyze the acquisition, delivery, and contractual payment of software service on Blockchain smart contract. The experimental results demonstrate the feasibility and effectiveness of the proposed SaaS+SaaSC architecture so that it provides a practicable approach for contractual software service.

The decentralization mechanism provides manufacturers and distributors with greater customization and flexibility they need through Internet of Things (IoT)-based industrial collaboration systems (IoT-ICS), but it has brought forward security concerns about the shared data-processing tasks and IoT-based access to services and resources. To address them, we propose a practical blockchain solution to achieve decentralized policy management and evaluation on attribute-based access control (ABAC). By offloading the responsibility of ABAC policy administration and decision making to blockchain nodes, a blockchain-based access control framework, called Policychain, is presented to ensure policy with high availability, autonomy, and traceability. To deliver a solid design, we first present a transaction-oriented policy expression scheme with a well-defined syntax and semantics. The scheme can translate ABAC policies into the blockchain transactions with JavaScript object notation (JSON) syntax and script-based logical expression. We further realize a script-driven policy evaluation by extending blockchain inherent scripting instructions to support attribute acquisition of ABAC entities. Furthermore, we propose a policy lifecycle management scheme from policy creation, renovation, to revocation, in which policies are verified by three validation principles at the transaction level. Finally, we provide sophisticated analysis and experiments to show that our framework is secure and practical for decentralized policy management on ABAC in IoT-ICS.

In this article, we address the problem of secure sensitive data sharing for the specified recipients in Blockchain Internet of Things (BIoT). To do it, we present a cryptographic solution to meet the requirements of decentralization and convenience through key management and programmable ciphertext. First, we design a new ciphertext-policy decentralized-key attribute-based encryption (CP-DK-ABE) scheme. After the master secret key is shared into all full nodes in the form of threshold secret sharing, a decentralized multiparty computation protocol is used to generate the user’s private key in an interactive way. Meanwhile, the attribute subkeys associated with the private key can be reconstructed by obtaining a fragment from each of full nodes, so as to achieve the cooperative management of attribute key through all of full nodes. Furthermore, following the blockchain’s script system, we introduce five new opcodes to represent ciphertext in the programmable format. Such a mechanism provides flexible capability to represent the logical relationship of the access control policy among attribute subciphers in the CP-DK-ABE ciphertext by the scripting language. As a result, the processes of encryption and decryption are implemented entirely by the script interpreter on the blockchain node, thereby greatly improving the convenience of programming in BIoT devices. In addition, we prove that the proposed CP-DK-ABE scheme is key private and semantically secure for a limited number of corrupted full nodes under the decisional linear and bilinear Diffie–Hellman assumption, respectively.

In recent years, advanced smart contract languages (ASCLs) have been proposed to solve the problem of difficult reading, comprehension, and collaboration when writing smart legal contracts among people in different fields. However, this kind of languages are still hard to put into practice due to the lack of an effective conversion method from the ASCLs to executable smart contract programs. Aiming at this problem, we take SPESC as example to explore how to design conversion rules from the contract in it to the target programming language in Solidity, and to propose a three-layer smart contract framework, including advanced smart-contract layer, general smart-contract layer, and executable machine-code layer. These rules provide an approach to convert the definition of SPESC contracting parties into party-contracts on target language, as well as to produce SPESC contract terms into main-contract on target language. Moreover, the proposed framework specifies not only program architecture and storage structure on general smart-contract layer, but also important mechanisms, including personnel management, timing control, exception handling, etc., which can assist programmers to write smart contract programs. Furthermore, taking four SPESC contracts as testing objects, we provide the whole process of converting from SPESC contracts to Solidity programs by the SPESC-Translator, and verify the efficiency and security of the conversion process, including coding, deploying, running, and testing through Ethereum. The instance results show that the conversion rules and the three-layer framework can simplify the writing of smart contracts, standardize the program structure, and help programmers to verify the correctness of the contract programs.

Smart contract is a set of digital executable protocols intended to make contractual clauses partially or fully self-executing, self-enforcing, or both. As the second-generation blockchain technology, smart contracts have greatly enriched the functional expression of blockchain to make application development more convenient. All related data of smart contracts, including program codes, intermediate states, and executed results, will be stored in blockchain to ensure that these data are not tampered with. Also, the consensus protocols of blockchain verify the correctness of the running process by executing the smart contract with the same input at all nodes. Therefore, the blockchain’s security mechanism with tamper-proof and traceable makes it possible for smart contracts to be recognized by law.