Abstract Software-Defined Networking (SDN), as a new network architecture, has brought convenience, but also suffered from the threat of Distributed Denial of Service (DDoS) attack. However, most existing DDoS attack detection schemes for SDN employ only a single detection method, leading to imbalances in detection speed, system overhead, and detection accuracy. Even though a few schemes improve detection efficiency and accuracy through two-stage detection, they still suffer from low system flexibility and do not support dynamic threshold adjustment. In order to resolve these issues, we propose an adaptive two-stage DDoS attack detection scheme with Dynamic Threshold Adjustment (ATS-DTA for short), which contains three sub-modules. More specifically, by dividing DDoS attack detection into two modules: a conditional entropy-based network traffic anomaly detection phase and a DDoS attack detection phase based on machine learning methods. Additionally, an adaptive threshold adjustment module is introduced to improve the system’s flexibility. Finally, the experimental results show that our scheme, compared to related schemes, not only significantly improves detection accuracy and speed but also supports flexible and dynamic threshold adjustment. Specifically, our method achieves an average accuracy improvement of 1.91% and a precision increase of 1.23% over baseline methods, underscoring its effectiveness in adapting to complex and evolving network environments. These advantages illustrate that our ATS-DTA scheme provides a more balanced, efficient, and reliable solution for DDoS detection in dynamic network scenarios.

Attribute-based encryption (ABE) provides fine-grained access control over encrypted data without restricting itself to a single access policy, making it applicable to diverse scenarios such as cloud environments. However, existing bilinear pairing-based ABE schemes are vulnerable to quantum attacks, while lattice-based ABE schemes typically lack flexible and efficient user or attribute revocation mechanisms. To address these challenges, this paper presents a fine-grained revocable attribute-based encryption (FR-ABE) scheme based on the ring learning with errors (RLWE) assumption. We introduce a two-dimensional attribute structure and an extended Shamir’s secret sharing method, which together support multi-valued attributes and flexible threshold access policies, while reducing storage and computational overhead. Furthermore, We have devised a fine-grained revocation mechanism that functions at both the attribute and user levels, thereby accommodating the frequent role and permission changes. The attribute authority centrally manages attribute revocation through an indirect revocation method, eliminating the need to re-run the sampling algorithm and instead relying solely on polynomial-level operations, which reduces time overhead. User revocation is implemented using a binary tree structure, which updates only the ciphertext and leaves all keys unchanged. Theoretical analysis suggests that our scheme performs well in terms of both computational and storage overhead, and experimental findings further corroborate its superiority. The security analysis establishes the scheme’s selective security under the RLWE assumption.

ABE as a powerful tool for secure fine-grained access control, has been widely adopted in data-sharing scenarios such as cloud computing. However, most existing traceable and revocable ABE schemes are constructed using bilinear pairings and are thus vulnerable to quantum attacks. Although lattice-based ABE schemes provide post-quantum security, they often lack critical features such as traitor tracing and timely revocation, which may lead to key abuse problem. Some revocable lattice-based schemes are unable to identify the source of leaked keys, while existing traceable and revocable lattice-based schemes also fail to resist collusion attacks between revoked and un-revoked users. In addition, the exposure of attribute values in access policies poses serious privacy risks. To solve the above issues, this paper proposes a traceable and revocable KP-ABE scheme based on RLWE assumption. The proposed scheme embeds the user identity into the key through a white-box tracing mechanism, enabling the system to detect and revoke malicious users in case of key leakage. It also protects attribute privacy by hiding attribute values in the access policy and resists collusion attacks by embedding random parameters in the key. Theoretical analysis and experimental evaluation results show that the proposed scheme ensures security and privacy while maintaining high computational efficiency and is suitable for post-quantum secure data sharing environments.

Abstract Lattice-based attribute-based encryption (ABE) combines the advantages of against quantum attack and fine-grained access control. However, most existing LWE-based or RLWE-based ABE schemes from lattices have the limitations of large storage cost and lack of support for attribute privacy protection. In 2022, a new algebraically structured LWE variant-cyclic algebra LWE (CLWE), was proposed by Grover et al. in journal of cryptology (JoC). This new variant has its inherent storage and computing advantages, especially in reducing the storage overhead. Therefore, to reduce the storage cost and protect the attribute privacy, we propose a novel lattice-based ABE scheme based on CLWE. More specifically, by introducing an extended Shamir’s secret sharing scheme on cyclic algebra and a two-dimensional (attribute label, attribute value) attribute structure, we extend the CLWE-based PKE scheme in JoC22 to a CLWE-based ABE scheme. The sizes of public key, master secret key, user’s secret key and ciphertext of our proposal are remarkably reduced. In addition, we combines a semi access policy structure and the two-dimensional attribute structure to hide the user’s attribute values, thereby preventing the leakage of user attribute privacy. Performance analysis shows that compared related lattice-based ABE schemes, our proposal is more efficient in the storage cost and it supports attribute privacy protection. Finally, our scheme is proved to be secure in the standard model.

An accurate and efficient trust evaluation mechanism is the cornerstone of maintaining the stability of SDN networks, especially in face of the escalating threats like Distributed Denial of Service (DDoS) attacks. The traditional trust evaluation mechanisms in SDN often lack of adaptability and accuracy, due to that they typically rely on the direct trust or ignore the influence of indirect and historical trust factors which lead to inaccurate trust evaluation and lower efficiency. In order to solve these problems, we propose a novel multidimensional trust evaluation mechanism consisting of three sub-modules: Device Behavior Trust Evaluation Scheme (DBTES), Machine Learning-based Trust Evaluation Scheme (MLTES), and Bayesian-Based Trust Evaluation Scheme (BBTES). These modules work together to enhance the precision and adaptability of trust assessments by capturing various aspects of device behavior. Additionally, we introduce a trust fusion algorithm that combines the Analytical Hierarchy Process(AHP) with Criteria Importance Through Inter-criteria Correlation (CRITIC) to optimize weight distribution, further improving the accuracy and robustness of trust evaluations. Our approach overcomes the limitations of existing methods by providing a more comprehensive and adaptable trust assessment. Simulation results show that under varying Malicious Device Ratio conditions, the MDTM method improves the task success rate by up to 4.39% compared to traditional methods, along with an increase in average trust values by 5.16%. Additionally, with changing historical factors, MDTM further improves trust values by 5.33%. These results demonstrate the enhanced resilience and effectiveness of our approach in maintaining network stability and security within SDN environments.

Software-Defined Networking (SDN) has introduced flexibility and efficiency to network management but also faces challenges from flow rule conflicts, including static, dynamic, and dependency conflicts. Existing detection algorithms often focus on a single conflict type, resulting in inefficiencies and high false positive rates. To address these issues, we propose a comprehensive flow rule conflict detection scheme that improves real-time detection of explicit conflicts (both static and dynamic) and reduces false positives in implicit (dependency) conflict detection. Specifically, we present a real-time explicit conflict detection algorithm based on the Protocol-Divided Trie (PDT), which categorizes flow rules by protocol type and uses a prefix tree for rapid matching. Experimental results show that this approach significantly reduces detection times by at least 39.2% and achieves 100% detection accuracy. Additionally, we propose a two-stage detection (TSD) algorithm that combines the precision of path-based detection (PBD) with the efficiency of alias set-based detection (ASD). Our experiments reveal a 51% reduction in false positives compared to ASD and a 48% reduction in detection time compared to PBD, while maintaining equivalent false positive rates. This approach provides a robust solution for conflict detection in SDN, improving network security and resource utilization efficiency.

Fully homomorphic encryption (FHE) scheme allows for performing computations on encrypted data without decrypting it which makes it more popular in various domains. Most previous FHE constructions are limited by the large ciphertext expansion rate and error growth rate. Learning with errors (LWE) problem is a popular primitive for constructing lattice-based FHE. Many algebraic variants of LWE are also developed with further promising cryptographic features. Most previous known LWE variants (over the commutative base rings) are unified into a general framework by Peikert et al. at TCC 2019. In 2022, a new algebraically structured LWE problem over the d-degree cyclic algebra (CLWE) (with modulus q), a typical non-commutative ring, was proposed by Grover et al.. To further explore the utility and potential advantages of this new variant, it is interesting to design new lattice-based FHE schemes by using CLWE. In this paper, by following the diagrams of Gentry-Sahai-Waters (GSW13 for short), we propose a FHE scheme based on the CLWE with an even small ciphertext size. Due to our further expansion of the plaintext space, the average ciphertext expansion rate (CER for short) is smaller. More precisely, compared to original GSW13 and the related GSW-style constructions, the ciphertext size of our proposal is reduced by almost at least 23.69%, and the average CER is reduced about 96% due to our expansion of the plaintext space. Besides, our FHE has an even small error growth rate (EGR for short). After one time multiplication of two ciphertexts, the asymptotical EGR is reduced about 49.8% compared to the original GSW13 and the related GSW-style constructions. Typically, the smaller ciphertext size, CER and EGR make our FHE scheme more efficient in trusted computing environment.

Abstract Online taxi-hailing has become people’s most popular trip mode due to its convenience and low cost. However, it also poses a privacy threat to passengers and drivers, since the online taxi-hailing service providers are able to track their precise mobility trajectories. In addition, there is a certain time delay between the time of a passenger makes a request and the time of the driver arrives the passenger’s boarding position in current online taxi-hailing system. To solve these two problems, we present a new and efficient location privacy protection scheme based on the MinHash algorithm (LPPM). With the LPPM, the exact positions of passengers and drivers are generalized into a set of points of interest around them, and the distance between them is transformed into the similarity between the two sets. Thus a service provider can efficiently match passengers and drivers by using MinHash algorithm without revealing their specific location information. In this paper, we use mobile edge computing technology in the online taxi-hailing system to address the second challenge. It can speed up data processing, drivers can make decisions in advance and reduce the possibility of road congestion. Security analysis shows that LPPM has high security, and the final experimental results confirmed that LPPM is effective.

Linear secret-sharing scheme (LSSS) is a useful tool for supporting flexible access policy in building attribute-based encryption (ABE) schemes. But in lattice-based ABE constructions, there is a subtle security problem in the sense that careless usage of LSSS-based secret sharing over vectors would lead to the leakage of the master secret key. In this paper, we propose a new method that employs LSSS to build lattice-based key-policy attribute-based encryption (KP-ABE) that resolves this security issue. More specifically, no adversary can reconstruct the master secret key since we introduce a new trapdoor generation algorithm to generate a strong trapdoor (instead of a lattice basis), that is, the master secret key, and remove the dependency of the master secret key on the total number of system attributes. Meanwhile, with the purpose of reducing the storage cost and support dynamic updating on attributes, we extended the traditional 1-dimensional attribute structure to 2-dimensional one. This makes our construction remarkably efficient in space cost, with acceptable time cost. Finally, our scheme is proved to be secure in the standard model.