We unveil discernible temporal (or historical) trajectory imprints resulting from adversarial example (AE) attacks. Standing in contrast to existing studies, which focus on spatial (or static) imprints within the targeted underlying victim models, we present a novel temporal paradigm for understanding these attacks. These imprints are encapsulated within a single loss metric, spanning universally across diverse tasks such as classification and regression, and modalities including image, text, and audio. Recognizing the distinct nature of loss between adversarial and clean examples, we exploit this temporal imprint for AE detection by proposing (Traceable Adversarial Temporal Imprints). TRAIT operates under minimal assumptions without prior knowledge of attacks, thereby framing the detection challenge as a one-class classification problem. However, detecting AEs is still challenged by significant overlaps between the constructed synthetic losses of adversarial and clean examples due to the absence of ground truth for incoming inputs. TRAIT addresses this challenge by converting the synthetic loss into a spectrum signature, using the technique of Fast Fourier Transform to highlight the discrepancies, drawing inspiration from the temporal nature of the imprints, analogous to time-series signals. Across 12 AE attacks including SMACK (USENIX Sec'2023), TRAIT demonstrates consistent outstanding performance across comprehensively evaluated modalities (image, text, audio), tasks (classification and regression), datasets (nine datasets), and model architectures (e.g., ResNeXt50, BERT, RoBERTa, AudioNet). In all scenarios, TRAIT achieves an AE detection accuracy exceeding 97%, often around 99%, while maintaining a false rejection rate of 1%. TRAIT remains effective under the formulated strong adaptive attacks.

As cloud storage is extensively utilized in the contemporary digital age, assuring data integrity and conserving cloud storage space has become a priority for all. However, existing cross-user deduplication audit schemes conflict with the pay-as-you-go model, causing unnecessary costs and violating data isolation. Moreover, retaining a single copy of identical data across multiple users introduces maintenance challenges during data operations. To address these issues, we propose a new blockchain-enabled efficient deduplication and mixed auditing scheme which intricately integrates Message-Locked Encryption (MLE) to construct Homomorphic Verifiable Tags (HVTs), enabling deduplication without exposing confidential data. Our scheme supports single-user deduplication at both block and file levels, as well as plaintext-ciphertext mixed auditing, thereby preventing redundant payments while preserving data isolation to simplify maintenance during data operations and ownership transfers. By employing Elliptic Curve Cryptography (ECC) to encrypt keys and storing the encrypted keys on the blockchain, we ensure data confidentiality while reducing the burden of local key management. Leveraging blockchain-based smart contracts, we further design a self-auditing mechanism that eliminates reliance on trusted third-party auditors. Moreover, our scheme embraces dynamic data operations through an optimized Merkle Hash Tree (MHT) and enables secure cloud data ownership transfer via identity verification. Finally, we prove the correctness and security of our scheme and evaluate its performance through experiments and comparisons with state-of-the-art works, demonstrating its efficiency, particularly in the data upload phase.

Federated Learning (FL) enables collaborative machine learning training while preserving data privacy. However, reliance on a central server of the typical FL confronts the risk of single server failure. Decentralized Federated Learning (DFL) emerges as a promising distributed framework, allowing clients to directly share models without server intervention, thereby addressing this challenge. Nevertheless, due to its decentralized nature, DFL is highly susceptible to Byzantine attacks orchestrated by malicious clients. Existing Byzantine-resilient DFL algorithms, though few, remain vulnerable to adaptive attacks due to their heavy reliance ongradient checksof local models, which can be adaptively manipulated by intelligent adversaries. To tackle this issue, we propose a DFL aggregation scheme called FORCE (Byzantine-Resilient Decentralized Federated Learning via Game-Theoretic Contribution Aggregation). Drawing inspiration from the Shapley value in game theory, FORCE shifts from gradient-checking approaches to employ a universal metric, the loss of the local model—independent of specific gradients, to identify potentially malicious clients. Moreover, to reduce the computational overhead of FORCE as the number of neighboring clients scales up, we propose a computationlightweight variant, FORCE−, which is optimized through approximating Shapley value computation. This variant becomes more scalable for resource-restricted DFL clients that are also aggregators. Experimental results on three diverse datasets (two image modalities and one textual modality datasets) under three existing attacks demonstrate that FORCE outperforms existing state-of-the-art Byzantine-resilient DFL aggregation methods, effectively defending against Byzantine attacks.

As a critical component of industrial infrastructure, the security of power information systems is directly related to the stable operation of power dispatch and supply. However, due to insufficient security considerations during the design phase and the diversity of customized implementations, power information systems widely suffer from defect at the software, firmware, and communication protocol levels, facing a variety of complex attack threats. This paper systematically reviews the development and research progress of existing defect detection techniques, based on the typical layered architecture of power information systems. First, focusing on customized industrial control software, it summarizes various detection methods, including classical program analysis, machine learning, and large language models (LLMs). Second, for embedded firmware security, it provides an in-depth comparison of static and dynamic analysis techniques, with a focus on key technologies such as taint analysis, firmware emulation, and fuzzing. Finally, for industrial communication protocols, it comprehensively analyzes the application scenarios and limitations of detection methods such as formal verification, symbolic execution, and protocol fuzzing. Building upon this, the paper further explores future research directions, including the deep application of LLMs, AI-driven firmware and protocol defect detection, efficient detection for complex industrial control protocols, and enhanced firmware emulation.

Protocol Reverse Engineering (PRE) serves as the foundation for numerous security analysis techniques, such as vulnerability mining and intrusion detection, etc. The PRE analysis precision can directly affect the accuracy of these downstream techniques. The network-trace-based PRE technique has become the mainstream PRE technique attributed to its ease of implementation. However, without the prerequisite of additional dedicated devices or knowledge of information, the analysis precision of existing network-trace-based PRE methods is often achievable at only byte or half-byte level but not the fine-grained bit-level, which makes it increasingly challenging to meet the precision requirements of those downstream security applications. In this work, we propose a fine-grained PRE scheme, named FineBID, which makes the identification capability in a fine-grained manner for existing network-trace-based PRE methods into bit-level fields. FineBID follows the global characteristics of protocol fields and constructively models the bit-level field identification problem as a multi-objective decision model, which thus effectively overcomes the insufficient representativeness of bit-level fields’ local characteristics. Then, the multi-objective decision model is solved to obtain the Pareto solution set for different field segmentation levels, and the utility value per bit is further computed. The utility value can be used as the immediate indicator to determine whether each bit is a field boundary or not. Meanwhile, we propose an Actual Ground Truth that is more in line with the actual usage of each bit. With extensive experiments on the Internet, wireless, and industrial protocols, we affirm that FineBID can not only significantly reduce the search space for Ground Truth or Actual Ground Truth with a space reduction of 95.3% compared to exhaustive search, but also identify Ground Truth or Actual Ground Truth more accurately than other similar methods.

Model watermarking is a widely adopted mechanism for protecting deep learning (DL) model intellectual property (IP). Black-box verifiable watermarking typically involves injecting backdoors that cause the model to produce predetermined outputs for specific inputs. In contrast, white-box verifiable watermarking uses steganographic techniques to embed watermarks into weight parameters or activation values. However, the former poses new security risks, while the latter often lacks robustness against removal techniques. In this paper, we propose a latent model watermarking, constructing upon the model Division and Union operating concept, dubbed as DUO, leveraging the strengths of two watermarking methods above while eliminating each shortcoming. Once the model owner or provider embeds a watermark into the model using watermark data, the watermarked model is divided into two parts: the main model, which corresponds to the primary task and is made publicly available, and a small sub-network privately reserved by the owner. The watermark resides latently within the main model and can only be activated through the private sub-network (the reserved parameters) when they are united. Consequently, DUO does not adversely affect the performance of the main model on its primary task and does not induce any security risks, even in the presence of watermark data. We extensively validate DUO on four benchmark datasets (CIFAR-10, ImageNette, CIFAR-100, and Tiny-ImageNet) using various model architectures, including standardized ResNet and VGG. The results affirm its capability to accurately verify model ownership without compromising model accuracy. It exhibits a 100% detection accuracy on pirated/positive testing models (96 models are tested) with a 0% false positive rate on normal/negative testing models (64 models are tested). Due to its latent nature, DUO is both effective and robust, capable of withstanding a wide range of state-of-the-art watermark laundering including severe model fine-tuning and pruning. We further evaluate and demonstrate that DUO remains robust against adaptive attacks, even when both the watermark data and the reserved parameters are known to the adversary.

In contrast to prevalent Federated Learning (FL) privacy inference techniques such as generative adversarial networks attacks, membership inference attacks, property inference attacks, and model inversion attacks, we devise an innovative privacy threat: the Data Distribution Decompose Attack on FL, termedDecaf. This attack enables an honest-but-curious FL server to meticulously profile the proportion of each class owned by the victim FL user, divulging sensitive information like local market item distribution and business competitiveness. The crux ofDecaflies in the profound observation that the magnitude of local model gradient changes closely mirrors the underlying data distribution, including the proportion of each class.Decafaddresses two crucial challenges: accurately identify the missing/null class(es) given by any victim user as a premise and then quantify the precise relationship between gradient changes and each remaining non-null class. Notably,Decafoperates stealthily, rendering it entirely passive and undetectable to victim users regarding the infringement of their data distribution privacy. Experimental validation on five benchmark datasets (MNIST, FASHION-MNIST, CIFAR-10, FER-2013, and SkinCancer) employing diverse model architectures, including customized convolutional networks, standardized VGG16, and ResNet18, demonstratesDecaf’s efficacy. Results indicate its ability to accurately decompose local user data distribution, regardless of whether it is IID or non-IID distributed. Specifically, the dissimilarity measured using$L_{\infty }$distance between the distribution decomposed byDecafand ground truth is consistently below 5% when no null classes exist. Moreover,Decafachieves 100% accuracy in determining any victim user’s null classes, validated through formal proof.

The right to be forgotten has incentivized machine unlearning, but a key challenge persists: the lack of reliable methods to verify unlearning conducted by model providers. This gap facilitates dishonest model providers to deceive data contributors. Current approaches often rely on invasive methods like backdoor injection. However, it poses security concerns and is also inapplicable to legacy data—already released data. To tackle this challenge, this work initializes the first non-invasive unlearning verification framework which operates at triple-granularity (class-, volume-, sample-level) to assess the data facticity and volume integrity of machine unlearning. In this paper, we propose a framework, named TruVRF, encompasses three Unlearning-Metrics, each tailored to counter different types of dishonest model providers or servers (Neglecting Server, Lazy Server, Deceiving Server). TruVRF leverages non-invasive model sensitivity to enable multi-granularity verification of unlearning. Specifically, Unlearning-Metric-I checks if the removed class matches the data contributor’s unlearning request, Unlearning-Metric-II measures the amount of unlearned data, and Unlearning-Metric-III validates the correspondence of a specific unlearned sample with the requested deletion. We conducted extensive evaluations of TruVRF efficacy across three datasets, and notably, we also evaluated the effectiveness and computational overhead of TruVRF in real-world applications for the face recognition dataset. Our experimental results demonstrate that TruVRF achieves robust verification performance: Unlearning-Metric-I and -III achieve over 90% verification accuracy on average against dishonest servers, while Unlearning-Metric-II maintains an inference deviation within 4.8% to 8.2%. Additionally, TruVRF demonstrates generalizability across diverse conditions, including varying numbers of unlearned classes and sample volumes. Significantly, TruVRF is applied to two state-of-theart unlearning frameworks: SISA [3] (presented at Oakland’21) and Amnesiac Unlearning [18], representing exact and approximate unlearning methods, respectively, which affirm TruVRF’s practicality. In addition, we conducted extensive evaluations around TruVRF, including ablation experiments, trade-offs in computational overhead, and the robustness of model sensitivity, among others.

Personal digital data is a critical asset, and governments worldwide have enforced laws and regulations to protect data privacy. Data users have been endowed with the "right to be forgotten" (RTBF) of their data. In the course of machine learning (ML), the forgotten right requires a model provider to delete user data and its subsequent impact on ML models upon user requests. Machine unlearning (MU) emerges to address this, which has garnered ever-increasing attention from both industry and academia. Specifically, MU allows model providers to eliminate the influence of unlearned data without retraining the model from scratch, ensuring the model behaves as if it never encountered this data. While the area has developed rapidly, there is a lack of comprehensive surveys to capture the latest advancements. Recognizing this shortage, we conduct an extensive exploration to map the landscape of MU including the (fine-grained) taxonomy of unlearning algorithms under centralized and distributed settings, debate on approximate unlearning, verification and evaluation metrics, and challenges and solutions across various applications. We also focus on the motivations, challenges, and specific methods for deploying unlearning in large language models (LLMs), as well as the potential attacks targeting unlearning processes. The survey concludes by outlining potential directions for future research, hoping to serve as a beacon for interested scholars.

All current backdoor attacks on deep learning (DL) models fall under the category of a vertical class backdoor (VCB).In VCB attacks, any sample from a class activates the implanted backdoor when the secret trigger is present, regardless of whether it is a sub-type source-class-agnostic backdoor or a source-class-specific backdoor. For example, a trigger of sunglasses could mislead a facial recognition model when either an arbitrary (source-class-agnostic) or a specific (source-class-specific) person wears sunglasses. Existing defense strategiesoverwhelmingly focus on countering VCB attacks, especially those that are source-class-agnostic. This narrow focus neglects the potential threat of other simpler yet general backdoor types, leading to false security implications. It is, therefore, crucial to discover and elucidate unknown backdoor types, particularly those that can be easily implemented, as a mandatory step before developing countermeasures.

The Chinese L-band twin-satellite SAR constellation, LuTan-1, that was launched in 2022 became the first spaceborne L-band bistatic InSAR mission. In this work, we will explore this valuable dataset of bistatic InSAR mode to estimate forest height. Since the majority of this mode only acquires single-polarization (HH-pol) data, we use the few-look InSAR phase histogram method developed by our previous work to estimate the digital terrain height (DTM) and InSAR phase center height simultaneously. Then, the HH-pol complex InSAR coherence measurements in combination with the DTM (or phase center height) are used to invert for forest total height using a physical model approach, namely the Random Volume over Ground (RVoG) model. Preliminary inversion results are shown and validated against spaceborne lidar (NASA’s GEDI and ICESat-2/ATLAS) and airborne lidar data over the tropical test site on the Hainan island of China.

This paper describes the Altay 2024 airborne field campaign in support of snow observation retrieved from spaceborne InSAR measurements from the Chinese LuTan-1 (a spaceborne L-band SAR constellation launched in 2022). The airborne and field measurements that are synchronized with LuTan-1 InSAR acquisitions will be conducted in January-February 2024 (snow on) and May-July 2024 (snow off). The remote sensing and in-situ measurements include various in-situ observations and drone-based lidar measurements. We first provide the overview of the Altay 2024 campaign including the choice of the in-situ measurement locations and flight tracks of the drone-based lidar. Then, historical InSAR dataset from all the available L/C-band SAR’s (e.g. JAXA’s ALOS, ESA’s Sentinel-1, China’s LuTan-1) over the study area are used to generate SWE change products, which are further compared against the in-situ measurements when available. This synergetic spaceborne airborne field campaign will directly validate the LuTan-1 derived snow products using the acquired airborne and field dataset, which can also support the design of future spaceborne mission concepts for snow retrieval.

China's first group of L-band interferometric synthetic aperture radar (InSAR) satellites LuTan-1 (LT-1) were successfully launched in 2022. This satellite mission is mainly designed for global digital elevation model (DEM) mapping and rapid surface deformation monitoring. However, the group of satellites also acquired L-band SAR observations in both bistatic and monostatic modes, which presented an opportunity for large-scale forests vertical structure detection and underlying terrain estimation. This article aims at vegetation height and underlying terrain inversion using LT-1 spaceborne bistatic InSAR data with a model-based method. Preliminary cross-validation was performed on the inversion results using terrain and forests height products obtained from spaceborne ICESat-2 products. Both results demonstrated the potential of LT-1 for large-scale vegetation height and underlying terrain inversion. This work will also provide reference for the upcoming TanDEM-L project in studying the regional and global forests parameter estimation using spaceborne bistatic InSAR data.

Deep Neural Network (DNN) models are often deployed in resource-sharing clouds as Machine Learning as a Service (MLaaS) to provide inference services. To steal model architectures that are of valuable intellectual properties, a class of attacks has been proposed via different side-channel leakage, posing a serious security challenge to MLaaS.Also targeting MLaaS, we propose a new end-to-end attack, DeepTheft, to accurately recover complex DNN model architectures on general processors via the RAPL (Running Average Power Limit)-based power side channel. While unprivileged access to the RAPL has been disabled in bare-metal OSes, we observe that the RAPL is still legitimately accessible in a platform as a service, e.g., the latest docker environment of version 20.10.18 used in this work. However, an attacker can acquire only a low sampling rate (1 KHz) of the time-series energy traces from the RAPL interface, rendering existing techniques ineffective in stealing large and deep DNN models. To this end, we design a novel and generic learning-based framework consisting of a set of meta-models, based on which DeepTheft is demonstrated to have high accuracy in recovering a large number (thousands) of models architectures from different model families including the deepest ResNet152. Particularly, DeepTheft has achieved a Levenshtein Distance Accuracy of 99.75% in recovering network structures, and a weighted average F1 score of 99.60% in recovering diverse layer-wise hyperparameters. Besides, our proposed learning framework is general to other time-series side-channel signals. To validate its generalization, another existing side channel is exploited, i.e., CPU frequency. Different from RAPL, CPU frequency is accessible to unprivileged users in bare-metal OSes. By using our generic learning framework trained against CPU frequency traces, DeepTheft has shown similarly high attack performance in stealing model architectures.

In the context of globalization and rapid development of information technology, cross-border flow of data has become an important part of international trade. This paper firstly analyzes the necessity and risk of data cross-border and discusses the relevant legal framework in China. Secondly, this paper, for the first time, uses Petri nets to model the business process of cross-border data flow, effectively and comprehensively describing the steps and interrelationships in the three phases of data transmission: before transmission, during transmission, and overseas maintenance. Finally, the proposed model is simulated and experimented by PIPE software, which verifies the boundedness, security and deadlock-free characteristics of the model, and proves the feasibility and necessity of Petri nets in the application of cross-border business processes of data.

In the context of the information age, promoting digital government and smart cities has made government data sharing a key trend. Given its special nature, securing government data requires an effective security system for safe and efficient management. This paper explores government data security and technical systems, examines China's current data management situation, and compares management strategies in China, the EU, and the US. This paper adopts a data lifecycle-driven security management approach and leverages two widely recognized frameworks to propose a system that balances data openness and security. Finally, we propose an integrated learning method based on BERT and Random Forest, use real data sets to verify the feasibility of data grouping, and promote the integration of government data management and efficient technology.

Backdoor attacks on deep learning (DL) models emerge as the most worrisome security threats to their secure and safe usage, especially for security-sensitive tasks. Great efforts have been devoted to thwarting backdoor attacks by devising detection or prevention countermeasures. By default, these countermeasures are designed and evaluated on models with full-precision parameters (e.g., floating32). It is unclear whether they are immediately applicable to mitigate backdoor attacks in the quantized model that are being pervasively deployed on mobile devices and Internet of Things (IoT) devices to save resources (i.e. power and memory) and reduce latency and privacy risks. This work, for the first time, initializes the critical examination of the robustness or applicability of existing state-of-the-art (SOTA) DL backdoor defenses for detecting or preventing backdoor attacks on quantized models. Based on extensive evaluations of four representative defenses (Neural Cleanse, ABS, Fine-Pruning and Trojan Signature) with three datasets (CIFAR10, GTSRB, and STL10), we found that only Neural Cleanse's defensive robustness is generally independent of model quantization, while all others exhibit degraded effectiveness or failures against quantized models (in particular, widely used int-8 and 1-bit models), especially when the model is quantized to be 1-bit. The identified main failure reason is that these defenses are based on examining the weight values of the model or the activation values of the neuron to identify or prevent the backdoor, often using the ranking as a step. Quantization with a small bit width leads to less fine-grained discrete values (e.g., 1-bit quantization only possesses two value elements of -1 and +1), rendering ranking effectiveness deteriorate in this case. Note that the quantization not only applies to the weight but also to activation, thus making these defenses less robust or trivially fail. This work highlights the demand for devising backdoor defenses that are generic to different quantization formats on top of the default full-precision model.

Access tokens have been thoroughly researched in website and mobile application security. However, we believe that the traditional application of access tokens must fulfill new security requirements in smart home environments due to the distinct features of multiuser sharing usage. Smart home platforms allow different types of users to share access to a single IoT device through mobile apps, with varying levels of permissions that are closely tied to access tokens. One security concern is that existing security standards or literature, as well as the development and implementation by vendors, may overlook these features, thereby introducing potential security risks to the application of access tokens. In this work, we propose a novel testing framework and conduct a systematic study to test the extent to which real-world smart home platform implementations neglect these new requirements. The testing results show that seven out of the 11 real-world smart home platforms are plagued by access token management flaws, which collectively violate four security properties. We have found that these security flaws can be exploited to enable unrestricted file upload, DoS attack, remote command execution, and illegal surveillance in real-world scenarios. Finally, we conducted responsible disclosure of these flaws and attacks and obtained seven China national vulnerability database vulnerability IDs and one CVE vulnerability ID. Additionally, we also provide suggestions for mitigating the vulnerabilities.

Due to their low latency and high privacy preservation, there is currently a burgeoning demand for deploying deep learning (DL) models on ubiquitous edge Internet of Things (IoT) devices. However, DL models are often large in size and require large-scale computation, which prevents them from being placed directly onto IoT devices, where resources are constrained, and 32-bit floating-point (float-32) operations are unavailable. Commercial framework (i.e., a set of toolkits) empowered model quantization is a pragmatic solution that enables DL deployment on mobile devices and embedded systems by effortlessly post-quantizing a large high-precision model (e.g., float-32) into a small low-precision model (e.g., int-8) while retaining the model inference accuracy. However, their usability might be threatened by security vulnerabilities. This work reveals that standard quantization toolkits can be abused to activate a backdoor. We demonstrate that a full-precision backdoored model which does not have any backdoor effect in the presence of a trigger—as the backdoor is dormant—can be activated by (i) TensorFlow-Lite (TFLite) quantization, the onlyproduct-readyquantization framework to date, and (ii) thebeta releasedPyTorch Mobile framework. In our experiments, we employ three popular model architectures (VGG16, ResNet18, and ResNet50), and train each across three popular datasets: MNIST, CIFAR10 and GTSRB. We ascertain that all trained float-32 backdoored models exhibit no backdoor effecteven in the presence of trigger inputs. Particularly, four influential backdoor defenses are evaluated, and they fail to identify a backdoor in the float-32 models. When each of the float-32 models is converted into an int-8 format model through the standard TFLite or PyTorch Mobile framework's post-training quantization, the backdoor is activated in the quantized model, which shows a stable attack success rate close to 100% upon inputs with the trigger, while it usually behaves upon non-trigger inputs. This work highlights that a stealthy security threat occurs when an end-user utilizes the on-device post-training model quantization frameworks, informing security researchers of a cross-platform overhaul of DL models post-quantization even if these models pass security-aware front-end backdoor inspections. Significantly, we have identified Gaussian noise injection into the malicious full-precision model as an easy-to-use preventative defense against the PQ backdoor. The attack source code is released athttps://github.com/quantization-backdoor.

Byzantine-robust federated learning (FL) endeavors to empower service providers in acquiring a precise global model, even in the presence of potentially malicious FL clients. While considerable strides have been taken in the development of robust aggregation algorithms for FL in recent years, their efficacy is confined to addressing particular forms of Byzantine attacks, and they exhibit vulnerabilities when confronted with a spectrum of attack vectors. Notably, a prevailing issue lies in the heavy reliance of these algorithms on the examination of local model gradients. It is worth noting that an attacker possesses the ability to manipulate a carefully chosen small gradient of a model within a context where there could be millions of gradients available, thereby facilitating adaptive attacks. Drawing inspiration from the foundational Shapley value methodology in game theory, we introduce an effective FL scheme namedCareFL. This scheme is designed to provide robustness against a spectrum of state-of-the-art Byzantine attacks. Unlike approaches that rely on the examination of gradients,CareFLemploys a universal metric, the loss of the local model—independent of specific gradients, to identify potentially malicious clients. Specifically, in each aggregation round, the FL server trains a reference model using a small auxiliary dataset— the auxiliary dataset can be removed with a slight defense degradation trade-off. It employs the Shapley value to assess the contribution of each client-submitted model in minimizing the global model loss. Subsequently, the server selects client models closer to the reference model in terms of Shapley values for the global model update. To reduce the computational overhead ofCareFLwhen the number of clients is relatively scaled-up, we construct its variant, namelyCareFL+ generally by grouping clients. Extensive experimentation conducted on well-established MNIST and CIFAR-10 datasets, encompassing diverse model architectures, including AlexNet, demonstrates thatCareFLconsistently achieves accuracy levels comparable to those attained under attack-free conditions when faced with five formidable attacks.CareFLand CareFL+ outperform six existing state-of-the-art Byzantine-robust FL aggregation methods, includingFLTrust, across both IID and non-IID data distribution settings.

To mitigate recent insidious backdoor attacks on deep learning models, advances have been made by the research community. Nonetheless, state-of-the-art defenses are either limited to specific backdoor attacks (i.e., source-agnostic attacks) or non-user-friendly in that machine learning expertise and/or expensive computing resources are required. This work observes that all existing backdoor attacks have an inadvertent and inevitable intrinsic weakness, termed as non-transferability —that is, a trigger input hijacks a backdoored model but is not effective in another model that has not been implanted with the same backdoor. With this key observation, we propose non-transferability enabled backdoor detection to identify trigger inputs for a model-under-test during run-time. Specifically, our detection allows a potentially backdoored model-under-test to predict a label for an input. Moreover, our detection leverages a feature extractor to extract feature vectors for the input and a group of samples randomly picked from its predicted class label, and then compares the similarity between the input and the samples in the feature extractor’s latent space to determine whether the input is a trigger input or a benign one. The feature extractor can be provided by a reputable party or is a free pre-trained model privately reserved from any open platform (e.g., ModelZoo, GitHub, Kaggle) by a user and thus our detection does not require the user to have any machine learning expertise or perform costly computations. Extensive experimental evaluations on four common tasks affirm that our detection scheme has high effectiveness (low false acceptance rate) and usability (low false rejection rate) with low detection latency against different types of backdoor attacks.

Deep learning models with backdoors act maliciously when triggered but seem normal otherwise. This risk, often increased by model outsourcing, challenges their secure use. Although countermeasures exist, their defense against adaptive attacks is under-examined, possibly leading to security misjudgments. This study is the first intricate examination illustrating the difficulty of detecting backdoors in outsourced models, especially when attackers adjust their strategies, even if their capabilities are significantly limited. It is relatively straightforward for attackers to circumvent detection by trivially violating its threat model (e.g., using advanced backdoor types or trigger designs not covered by the detection). However, this research highlights that various leading detection defenses can simultaneously be evaded using simple adaptive strategies, even under their defined threat models and with limited adversary capabilities (e.g., using easily detectable triggers while maintaining a high attack success rate). To be more specific, this study introduces a novel methodology that employs trigger specificity enhancement and training regulation in a symbiotic manner. This approach allows us to evade multiple backdoor detection defenses simultaneously, including Neural Cleanse (Oakland 19’), ABS (CCS 19’), and MNTD (Oakland 21’). These were the detection tools selected for the Evasive Trojans Track of the 2022 NeurIPS Trojan Detection Challenge. Even when applied in conjunction with these defenses under stringent conditions, such as a high attack success rate (> 97%) and the restricted use of the simplest trigger (small white square), our straightforward method garnered the second prize in NeurIPS Trojan Detection Challenge. Notably, for the first time, our adaptive attack successfully evaded other recent state-of-the-art defenses, including FeatureRE (NeurIPS 22’) and Beatrix (NDSS 23’). This study suggests that existing model outsourcing backdoor defenses remain vulnerable to adaptive attacks, and thus, the use of third-party models should be avoided whenever possible.

Since Deep Learning (DL) backdoor attacks have been revealed as one of the most insidious adversarial attacks, a number of countermeasures have been developed with certain assumptions defined in their respective threat models. However, their robustness is currently inadvertently ignored, which can introduce severe consequences, e.g., a countermeasure can be misused and result in a false implication of backdoor detection. For the first time, we critically examine the robustness of existing backdoor countermeasures. As an initial study, we first identify five potential non-robust failure factors including binary classification, poison rate, model complexity, single-model justification, and hyperparameter sensitivity. As exhaustively examining defenses is infeasible, we instead focus on influential backdoor detection-based countermeasures consisting of model-inspection ones including Neural Cleanse (S&P’19), ABS (CCS’19), and MNTD (S&P’21), and data-inspection ones including SCAn (USENIX SECURITY’21) to examine their failure cases under one or more of these factors. Although these investigated countermeasures claim that they work well under their respective threat models, they have inherent unexplored non-robust cases, which are not even rooted from delicate adaptive attacks. We demonstrate how to trivially bypass them aligned with their respective threat models by simply varying the aforementioned factors. Particularly, for each defense, formal proofs or empirical studies are used to reveal its non-robust cases where it is not as robust as it claims or expects. This work highlights the necessity of thoroughly evaluating the robustness of backdoor countermeasures to avoid their misleading security implications in unknown non-robust cases.

As a critical threat to deep neural networks (DNNs), backdoor attacks can be categorized into two types, i.e., source-agnostic backdoor attacks (SABAs) and source-specific backdoor attacks (SSBAs). Compared to traditional SABAs, SSBAs are more advanced in that they have superior stealthier in bypassing mainstream countermeasures that are effective against SABAs. Nonetheless, existing SSBAs suffer from two major limitations. First, they can hardly achieve a good trade-off between ASR (attack success rate) and FPR (false positive rate). Besides, they can be effectively detected by the state-of-the-art (SOTA) countermeasures (e.g., SCAn [40]).

This article introduces the Chinese Terrestrial Ecosystem Carbon Inventory Satellite(TECIS), the first mission with the integration of active and passive sensors for forest carbon mapping. TECIS utilizes time-synchronized multiple-beam LiDAR and multi-angle optical imagery for forest carbon monitoring. We first provide an overview of the satellite's features and discuss the observational capabilities of the LiDAR and multi-angle payload. The preliminary results for forest height estimation analysis were shown using the payloads. The Bidirectional Reflectance Distribution Function (BRDF) features such as hot/dark spot information, were calculated based on the multi-angle images. A deep learning approach for forest parameter estimation through the fusion of LiDAR and BRDF data.

Object detection is the foundation of various critical computer-vision tasks such as segmentation, object tracking, and event detection, which can be deployed on pervasive Internet of Things (IoT) and edge devices. A large amount of data is often required to train an object detector with satisfactory accuracy. However, due to the intensive workforce involved with collecting and annotating large datasets, data curation task is often outsourced to a third party (e.g., Amazon Mechanical Turk) or volunteers. This work reveals severe vulnerabilities in this data curation pipeline. We propose TransCAB, the first work to craft clean-annotated images to stealthily implant the backdoor into the object detectors later trained on them by the data curator/user even when the data curator can manually audit the images and fully controls the training process. Existing clean-label poisoned images are only shown in classification tasks but not non-classification tasks, in particular, object detection due to unique challenges faced, generally owing to the complexity of having multiple objects within each frame (image), including the victim and non-victim objects. Furthermore, we demonstrate that the backdoor effect of both cloaking and misclassification are robustly achieved in the wild when the backdoor is activated with inconspicuously natural physical object as trigger (i.e., T-shirt). The efficacy of our TransCAB is ensured by constructively i) applying the image-camouflage attack that abuses the image-scaling function widely used by the deep learning framework (i.e., PyTorch), ii) incorporating the devised clean image replica technique, and iii) combining identified poison data selection criteria given constrained attacking budget. Extensive experi-ments on YOLOv3, YOLOv4, CenterNet, and Faster R-CNN affirm that TransCAB exhibits more than 90% attack success rate under various real-world scenes even when a very small (i.e., 0.14%) dataset fraction is poisoned. In addition, the small set of poisoned images crafted on one detector (i.e., YOLOv3) can be effectively transferred to insert a backdoor on another detector (i.e., CenterNet). A comprehensive video demo is at https://youtu.be/MA7L_LpXkp4, where a poison rate of merely 0.14% is set for YOLOv4 cloaking backdoor and Faster R-CNN misclassification backdoor. Our collected dataset with T-shirt as a natural trigger (about 11,350 frames in total) is open to the public at https://github.com/inconstance/T-shirt-natural-backdoor-dataset, which is the first relatively large-scale natural trigger backdoor dataset.

We present an inner‐product matchmaking encryption (IP‐ME) scheme achieving weak privacy and authenticity in prime‐order groups under symmetric external Diffie–Hellman (SXDH) assumption in the standard model. We further present an IP‐ME with Monotone Span Program Authenticity (IP‐ME with MSP Auth) scheme, where the chosen sender policy is upgraded to MSP, and the scheme also achieves weak privacy and authenticity in prime‐order groups under SXDH assumption in the standard model. Both of the schemes have more expressive functionalities than identity‐based matchmaking encryption (IB‐ME) scheme, and are simpler than Ateniese et al.’s modular ME scheme (Crypto’ 19). But our schemes only achieve a very limited flavor of security, which is reflected in the privacy.

Internet of Things (IoT) devices can utilize deep learning (DL) to boost their intelligence, but also suffer from the long model training process. IoT devices thus may reuse public pretrained models to expedite the training through transfer learning. However, pretrained models may be subject to model-reuse attacks initiated by malicious DL servers, causing models to misclassify targeted data, which poses a threat to the security of IoT devices. In this work, we propose a new model usability detection scheme, the defense against model-reuse attacks (DMRAs), suitable for IoT scenarios. DMRA employs a variant of Lagrange’s mean value theorem to reverse-check the model, which is computationally efficient, thus, suitable for resource-constrained devices. Experimental evaluations on different data sets first validate that model-reuse attacks can attack models in federated learning. And, then demonstrate that DMRA detects such insidious attacks with up to 80% success rate at a lightweight computational cost.

To improve the modeling resilience of silicon strong physical unclonable functions (PUFs), in particular, the APUFs that yield a very large number of challenge-response pairs (CRPs), a number of composited APUF variants, such as XOR-APUF, interpose-PUF (iPUF), feed-forward APUF (FF-APUF), and OAX-APUF, have been devised. When examining their security in terms of modeling resilience, utilizing multiple information sources, such as power side channel information (SCI) or/and reliability SCI, given a challenge is under-explored, which poses a challenge to their supposed modeling resilience in practice. Building upon multilabel/head deep learning (DL) model architecture, this work proposes multilabel multiside-channel-information-enabled DL attacks (MLMSAs) to thoroughly evaluate the modeling resilience of aforementioned APUF variants. Despite its simplicity, MLMSA can successfully break large-scaled APUF variants, which has not previously been achieved. More precisely, the MLMSA breaks 128-stage 30-XOR-APUF, (9, 9)- and (2, 18)-iPUFs, and$(2,2,30)$-OAX-APUF when CRPs, power SCI, and reliability SCI are concurrently used. It breaks 128-stage 12-XOR-APUF and$(2,2,9)$-OAX-APUF even when only the easy-to-obtain reliability SCI and CRPs are exploited. The 128-stage six-loop FF-APUF and one-loop 20-XOR-FF-APUF can be broken by simultaneously using reliability SCI and CRPs. All these attacks are normally completed within an hour with a standard personal computer. Therefore, MLMSA is a useful technique for evaluating other existing or any emerging strong PUF designs.

Currently, a high demand for on-device deep neural network (DNN) model deployment is limited by the large model size, computing-intensive floating-point operations (FLOPS), and intellectual property (IP) infringements (i.e., easy access to model duplication for the avoidance of license payments). One appealing solution to addressing the first two concerns is model quantization, which reduces the model size and uses integer operations commonly supported by microcontrollers (MCUs usually do not support FLOPS). To this end, a 1-bit quantized DNN model or deep binary neural network (BNN) significantly improves the memory efficiency, where each parameter in a BNN model has only 1 bit. However, BNN cannot directly provide IP protection (in particular, the functionality of the model is locked unless there is a license payment). In this article, we propose a reconfigurable BNN (RBNN) to further amplify the memory efficiency for resource-constrained Internet of Things (IoT) devices while naturally protecting the model IP. Generally, RBNN can be reconfigured on demand to achieve any one of$M$($M>1$) distinct tasks with the same parameter set, thus only a single task determines the memory requirements. In other words, the memory utilization is improved by a factor of$M$. Our extensive experiments corroborate that up to seven commonly used tasks ($M=7$, six of these tasks are image related and the last one is audio) can co-exist (the value of$M$can be larger). These tasks with a varying number of classes have no or negligible accuracy drop-off (i.e., within 1%) on three binarized popular DNN architectures, including VGG, ResNet, and ReActNet. The tasks span across different domains, e.g., computer vision and audio domains validated herein, with the prerequisite that the model architecture can serve those cross-domain tasks. To fulfill the IP protection of an RBNN model, the reconfiguration can be controlled by both a user key and a device-unique root key generated by the intrinsic hardware fingerprint (e.g., SRAM memory power-up pattern). By doing so, an RBNN model can only be used per paid user per authorized device, thus benefiting both the user and the model provider. The source code is released athttps://github.com/LearningMaker/RBNN.

Swarm attestation, as an important branch of Remote Attestation (RA), enables a trusted party (verifier) to verify the security states of multiple devices (provers) in a large network (swarm) simultaneously via a challenge-response mechanism. However, swarm attestation suffers from significant redundancy overhead since all devices in the swarm need to be attested in each attestation round. Besides, it faces challenges such as verifier-impersonation Denial of Service (DoS) attacks, highly dynamic networks, transient & self-relocating malware, and Time-Of-Check-Time-Of-Use (TOCTOU) attacks. In this paper, considering not only the detection accuracy but also the privacy of swarm owners in real Internet of Things (IoT) scenarios, we propose an Automatic Federated Swarm Attestation scheme (FeSA). Under this scheme, we design a federated-learning-based automatic swarm attestation protocol that enables theverifiersto identify the suspicious devices by a neural network model and then attest them. To the best of our knowledge, this is the first scheme to apply a federated learning method to RA, ruling out the redundancy attestation rounds while preserving data privacy. The FeSA redesigns the interaction model of RA by a challenge-query mechanism to reduce the overhead of an individual device to a constant. In order to evaluate our scheme, we first set up a smart office environment with 12 types of smart IoT devices for real-world data collection up to 21 days. Based on the real dataset, we demonstrate that FeSA can indeed identify the compromised IoT devices while reducing redundancy. We further simulate large-scale swarms of up to 1,000,000 devices to validate the efficiency of FeSA in large-scale swarms. Last, the security analysis proves the ability of FeSA to resist various attacks.

Rowhammer is a hardware vulnerability in DRAM memory, where repeated access to hammer rows can induce bit flips in neighboringvictim rows. Rowhammer attacks have enabled privilege escalation, sandbox escape, cryptographic key disclosures, etc. A key requirement ofallexisting rowhammer attacks is that an attacker must have access to at least part of an exploitable hammer row. We term such rowhammer attacks as Explicit Hammer. Recently, several proposals leverage the spatial proximity between the accessed hammer rows and the location of the victim rows for a defense against rowhammer. These all aim to deny the attacker's permission to access hammer rows near sensitive data, thus defeating explicit hammer-based attacks. In this paper, we question the core assumption underlying these defenses. We present Implicit Hammer, a confused-deputy attack that causes accesses to hammer rows that the attacker is not allowed to access. It is a paradigm shift in rowhammer attacks since it crosses privilege boundary to stealthily rowhammer an inaccessible row by implicit DRAM accesses. Such accesses are achieved by abusing inherent features of modern hardware and/or software. We propose a generic model to rigorously formalize the necessary conditions to initiate implicit hammer and explicit hammer, respectively. Compared to explicit hammer, implicit hammer can defeat the advanced software-only defenses, stealthy in hiding itself and hard to be mitigated. To demonstrate the practicality of implicit hammer, we have created two implicit hammer's instances, called PThammer and SyscallHammer.

Internet of Things (IoT) devices upload their data into the cloud for storage because of their limited resources. However, cloud storage data has been subject to potential integrity threats, and consequently auditing techniques are demanded to ensure the integrity of stored data. Unfortunately, existing auditing approaches require owners to undertake expensive tag calculations, which is unsuitable for resource-constrained IoT devices. To resolve the issue, we present aFairCloudAuditing proposal by employing theBlockchain (FCAB). We combine certificateless signatures with the designed dynamic structure to constructively offload the cost of tag computation from the IoT device to the introduced fog node, significantly reducing the local burden. Considering that fog nodes may behave dishonestly during auditing, FCAB enables the IoT device to verify the audit result's authenticity by extracting reliable checking records from the blockchain, thereby achieving auditing fairness, which ensures that thehonestcloud and fog node will gain the corresponding reward. Finally, FCAB is proved to satisfy tag unforgeability, proof unforgeability, privacy preserving, and auditing fairness. Experiment evaluations affirm that FCAB is computationally and communicationally efficient and retains a smaller and fixed computation locally at the data processing stage (mainly including tag computation) than existing auditing methods.

Presently, under the condition of privacy preserving, vertical federated learning (VFL) has played an important role in training the machine learning (ML) models in the application scenarios, such as medical prediction, fraud detection, in which the data is distributed vertically. Random forest (RF) is one of the most widely used ML methods in VFL, which has the advantages of strong predictive performance, availability, and the ability to parallel tasks. However, current research on privacy preserving of vertical federated RF is limited, and none of them can achieve the application level of security, that is, in a system where users are dynamically changing, not only privacy can be preserved, but also data integrity can be verified. Therefore, we propose a verifiable privacy-preserving scheme (VPRF) based on vertical federated RF, in which the users are dynamic change. First, we design homomorphic comparison and voting statistics algorithms based on multikey homomorphic encryption for privacy preservation. Then, we propose a multiclient delegated computing verification algorithm to make up for the disadvantage that the above algorithms cannot verify data integrity. Finally, we used the data sets in UCI ML warehouse to evaluate the proposed scheme. The experiment results indicate that our scheme is more efficient than the existing ones that can achieve the same security level.

Today, cloud storage becomes one of the critical services, because users can easily modify and share data with others in cloud. However, the integrity of shared cloud data is vulnerable to inevitable hardware faults, software failures or human errors. To ensure the integrity of the shared data, some schemes have been designed to allow public verifiers (i.e., third party auditors) to efficiently audit data integrity without retrieving the entire users’ data from cloud. Unfortunately, public auditing on the integrity of shared data may reveal data owners’ sensitive information to the third party auditor. In this paper, we propose a new privacy-aware public auditing mechanism for shared cloud data by constructing a homomorphic verifiable group signature. Unlike the existing solutions, our scheme requires at leasttgroup managers to recover a trace key cooperatively, which eliminates the abuse of single-authority power and provides non-frameability. Moreover, our scheme ensures that group users can trace data changes through designated binary tree; and can recover the latest correct data block when the current data block is damaged. In addition, the formal security analysis and experimental results indicate that our scheme is provably secure and efficient.

To improve data availability and durability, cloud users would like to store multiple copies of their original files at servers. The multi-copy auditing technique is proposed to provide users with the assurance that multiple copies are actually stored in the cloud. However, most multi-replica solutions rely on Public Key Infrastructure (PKI), which entails massive overhead of certificate computation and management. In this article, we propose an efficient multi-copy dynamic integrity auditing scheme by employing certificateless signatures (named MDSS), which gets rid of expensive certificate management overhead and avoids the key escrow problem in identity-based signatures. Specifically, we improve the classic Merkle Hash Tree (MHT) to achieve batch updates for multi-copy storage, which allows the communication overhead incurred for dynamics to be independent of the replica number. To meet the flexible storage requirement, we propose a variable replica number storage strategy, allowing users to determine the replica number for each block. Based on the fact that auditors may frame Cloud Storage Servers (CSSs), we use signature verification to prevent malicious auditors from framing honest CSSs. Finally, security analysis proves that our proposal is secure in the random oracle model. Analysis and simulation results show that our proposal is more efficient than current state-of-the-art schemes.

Backdoor attacks cause model misbehaving by first implanting backdoors in deep neural networks (DNNs) during training and then activating the backdoor via samples with triggers during inference. The compromised models could pose serious security risks to artificial intelligence systems, such as misidentifying ‘stop’ traffic sign into ‘80km/h’. In this paper, we investigate the connection characteristic between the backdoor and the trigger in DNNs and observe the fact that the backdoor is implanted via establishing a link between a cluster of neurons, representing the backdoor, and the triggers. Based on this observation, we design LinkBreaker, a new generic scheme for defending against backdoor attacks. In particular, LinkBreaker deploys a neuron consistency check mechanism for identifying compromised neuron set related to the trigger. Then, the LinkBreaker regulates the model to make predictions based on benign neuron set only and thus breaks the link between the backdoor and the trigger. Compared to previous defenses, LinkBreaker offers a more general backdoor countermeasure that is not only effective against input-agnostic backdoors but also source-specific backdoors, which the later can not be defeated by majority of state-of-the-arts. Besides, LinkBreaker is robust against adversarial examples, which, to a large extent, provides a holistic defense against adversarial example attacks on DNNs, while almost all current backdoor defenses do not have such consideration and capability. Extensive experimental evaluations on real datasets demonstrate that LinkBreaker is with high efficacy of suppressing trigger inputs while incurring no noticeable accuracy deterioration on benign inputs.

Due to the strong analytical ability of big data, deep learning has been widely applied to model on the collected data in industrial Internet of Things (IoT). However, for privacy issues, traditional data-gathering centralized learning is not applicable to industrial scenarios sensitive to training sets, such as face recognition and medical systems. Recently, federated learning has received widespread attention, since it trains a model by only sharing gradients without accessing training sets. But existing research works reveal that the shared gradient still retains the sensitive information of the training set. Even worse, a malicious aggregation server may return forged aggregated gradients. In this article, we propose the VFL, a verifiable federated learning with privacy-preserving for big data in industrial IoT. Specifically, we use Lagrange interpolation to elaborately set interpolation points for verifying the correctness of the aggregated gradients. Compared with existing schemes, the verification overhead of VFL remains constant regardless of the number of participants. Moreover, we employ the blinding technology to protect the privacy of the privacy gradients. If no more than$\boldsymbol{n}$-2 of$\boldsymbol{n}$participants collude with the aggregation server, VFL could guarantee the encrypted gradients of other participants not being inverted. Experimental evaluations corroborate the practical performance of the presented VFL with high accuracy and efficiency.

It is inevitable and evident that outsourcing complicated intensive tasks to public cloud vendors would be the primary option for resource-constrained clients in order to save cost. Unfortunately, the public cloud vendors are usually untrusted. They may inadvertently leak the data or misuse the user’s data, compromise user’s privacy or intentionally corrupt computational results to make the system unreliable. It is therefore important how to stop this happening whilst embracing the computational power of public cloud vendors. Non-negative matrix factorization (NMF) is a significant method for conducting data dimension reduction, which has been widely used in large-scale data processing. Nevertheless, due to its non-polynomial hardness, NMF cannot be conducted efficiently using local computation resources, especially when dealing with big data. Motivated by this issue, we address this by presenting a novel outsourced scheme for NMF (O-NMF), which aims to lessen clients’ computing burden and tackle secure problems faced by outsourcing NMF. Particularly, based on two non-collusion servers, O-NMF exploits Paillier homomorphism to preserve data privacy. Additionally, O-NMF allows a verification mechanism to assist clients in verifying returned results with high probability. Security analysis and experimental evaluation demonstrates that the validity and practicality of O-NMF is also provided in this work.

Deep learning makes the Internet-of-Things (IoT) devices more attractive, and in turn, IoT facilitates the resolution of the contradiction between data collection and privacy concerns. IoT devices with small-scale computing power can contribute to model training without sharing data in collaborative learning. However, collaborative learning is susceptible to generative adversarial network (GAN) attack, where an adversary can pretend to be a participant engaging in the model training and learn other participants' data. In this article, we propose a secure collaborative deep learning model which resists GAN attacks. We isolate the participants from the model parameters, and realize the local model training of participants via the interaction mode, ensuring that neither the participants nor the server would have access to each other's data. In particular, we target convolutional neural networks, the most popular network, design specific algorithms for various functionalities in different layers of the network, making it suitable for deep learning environments. To our best knowledge, this is the first work designing specific protocol against GAN attacks in collaborative learning. The results of our experiments on two real data sets show that our protocol can achieve good accuracy, efficiency, and image processing adaptability.

With the rapid development of cloud computing, more and more enterprises would like to upload and store their data in the public cloud. When the parts of the business of an enterprise are purchased by another enterprise, the corresponding data will be transferred to the acquiring enterprise. For the usual case, how to outsource the computation cost of data transfer to the cloud? How to ensure the remote purchased data integrity? Thus, it is important to study provable data possession with outsourced data transfer (DT-PDP). In this paper, for the first time, we propose the novel concept: DT-PDP. By taking use of DT-PDP, the following three security requirements can be satisfied: (1) the other un-purchased data security of acquired enterprise can be ensured; (2) the purchased data integrity and privacy can be ensured; (3) the data transferability’s computation can be outsourced to the public cloud servers. For the security concept of DT-PDP, we give its motivation, system model and security model. Then, we design a concrete DT-PDP scheme based on the bilinear pairings. At last, we analyze the security, efficiency and flexibility of the concrete DT-PDP scheme. It shows that our scheme is provably secure and efficient.

Hybrid cloud has both the strong computing power of public cloud and easy control of private cloud. It provides users with robust services and convenience, meanwhile faces numerous security challenges. How to implement the effective access control is one of them, the purpose of which is deploying policy in private cloud to protect the ciphertext in public cloud. Furthermore, it becomes more and more difficult to describe the access control policy, which is suitable for multi-factor and dynamic updating. Considering the issues above, we propose a proxy re-encryption (PRE) scheme for complicated access control factors description in hybrid cloud. Firstly, we build the system model combining PRE with access control in hybrid cloud. Secondly, we design the algorithm for our scheme including the key construction with multi-factor and its weight, which achieve the target of dynamic updating. Finally, we analyze the security of this scheme by the mathematical method and performance by theory, experiment and comparisons with some other works. Our scheme has made the deployment of access control in hybrid cloud more reliable and scalable.

Due to the complexity of the data environment, many organizations prefer to train deep learning models together by sharing training sets. However, this process is always accompanied by the restriction of distributed storage and privacy. Federated learning addresses this challenge by only sharing gradients with the server without revealing training sets. Unfortunately, existing research has shown that the server could extract information of the training sets from shared gradients. Besides, the server may falsify the calculated result to affect the accuracy of the trained model. To solve the above problems, we propose a privacy-preserving and verifiable federated learning scheme. Our scheme focuses on processing shared gradients by combining the Chinese Remainder Theorem and the Paillier homomorphic encryption, which can realize privacy-preserving federated learning with low computation and communication costs. In addition, we introduce the bilinear aggregate signature technology into federated learning, which effectively verifies the correctness of aggregated gradient. Moreover, the experiment shows that even with the added verification function, our scheme still has high accuracy and efficiency.

Cloud computing provides an effective way to manage and share massive medical data for Electronic Medical Record (EMR), hence establishing cloud-based EMR has attracted more and more attention. The data integrity and privacy issue in cloud-based EMR should be emphasized since users do not want their medical records to be damaged or disclosed to others. To address the concern in this paper, we propose an efficient and secure Data Integrity Auditing scheme with Traceability for cloud-based EMR (DIAT), which provides data integrity and privacy. We store multiple copies so that data can be recovered quickly from damage as long as one copy remains intact; meanwhile, data cannot be leaked to unauthorized entities since it is stored as ciphertext. For supporting data dynamics, we have designed a two-dimensional data structure, called Dynamic Mapping Hash Table (DMHT). It does not require large auxiliary validation information, nor does it affect the sequence numbers of other blocks. Moreover, data traceability is achieved by organizing all versions of a data block as a chain so that doctors are enabled to track the changes of patients condition in their records. In addition, formal security analysis and experiment results confirm that DIAT is provably secure and efficient.

Side-channel analysis (SCA) becomes a serious realistic threat to crypto devices, it is thus imperative to evaluate the resistance of a device to SCA. Side-channel leakage detection aiming to identify the leakage points potentially revealing secrets in side channel signals, is considered as a preliminary step before further security assessment. This work proposes a novel black-box leakage detection approach, which views the side channel as a constant parameter communication channel when it outputs leakage points. The approach distinguishes leakage points by utilizing the kurtosis-based consistency check for channel parameter estimators. To examine the efficiency of this approach, false negative and false positive rates were first quantitatively analyzed by comprehensive experiments. Considering the fact that side-channel leakage can be from multiple channels in practice, we further investigated the applicability of the proposed approach to multi-channel leakage detection. Interestingly, equipped with the proposed detection approach, we correspondingly devised a novel side-channel attack exploiting a kurtosis-based distinguisher. Overall, extensive experiments have validated the efficiencies of our proposed leakage detection method and the novel SCA attack.

Side-channel analysis (SCA) is usually used for analyzing the side-channel resistance of a crypto device. However, it does not mean “practical secure” when a SCA attack fails since SCA only provides a success or failure conclusion. On the basis of the SCA data about scores and ranks of all candidates for each subkey, it is still possible to apply key enumeration (KE) algorithms to search the correct master key at an affordable overhead. Nevertheless, the efficiency of KE is limited by the SCA data in essence. To address the issue, we proposed two methods to exploit the SCA data and Riemann integral of the rank curves of all subkey candidates to update each correct sub key rank before carrying out KE. We applied the proposed methods for different crypto implementations running on different devices to verify their performance. Experimental studies for both mono-channel and multi-channel leakages verified that the proposed methods were effective in improving the efficiency of KE to recover the correct key. The proposed methods are designed for processing the SCA data and can be deemed as a preliminary before executing KE. The work of this paper bridges the gap between SCA and KE.

Federated learning can combine a large number of scattered user groups and train models collaboratively without uploading data sets, so as to avoid the server collecting user sensitive data. However, the model of federated learning will expose the training set information of users, and the uneven amount of data owned by users in multiple users' scenarios will lead to the inefficiency of training. In this article, we propose a privacy-preserving federated learning scheme in fog computing. Acting as a participant, each fog node is enabled to collect Internet-of-Things (IoT) device data and complete the learning task in our scheme. Such design effectively improves the low training efficiency and model accuracy caused by the uneven distribution of data and the large gap of computing power. We enable IoT device data to satisfy ε -differential privacy to resist data attacks and leverage the combination of blinding and Paillier homomorphic encryption against model attacks, which realize the security aggregation of model parameters. In addition, we formally verified our scheme can not only guarantee both data security and model security but completely resist collusion attacks launched by multiple malicious entities. Our experiments based on the Fashion-MNIST data set prove that our scheme is highly efficient in practice.

With the development of science and technology, mobile phones have gained unprecedented popularity, subsequently the applications based on mobile phone perception have become widespread. Mobile sensing encourages many users to participate in data collection tasks through their mobile phones, but this process raises privacy issues. Previous studies have either used additive homomorphism to protect data privacy or aggregated methods to provide identity privacy protection. However, little research has been done on data dynamics and how to improve aggregation efficiency in multi-user scenarios. To solve this problem, we propose a privacy preserving fog-enabled dynamic data aggregation protocol in mobile phone sensing, named FDDA. In the proposal, we first add fog nodes to our framework, allowing fog nodes to aggregate a set of user data at the same geographical location without identifying the data sources. Then, we design data dynamics strategy to support the user joining and revoking effectively. Finally, we show that our protocol can be well applied in actual scenarios through security analysis and simulation experiments.

Summary In a data sharing group, each user can upload, modify, and access group files and a user is required to generate a new signature for the modified file after modification. There is a situation that two or more users modify the same file at almost the same time, which should be avoided as it gives rise to a signature conflict. However, the existing schemes do not take it into consideration. In this paper, we proposed a new mechanism SeShare for data storing based on blockchain to realize signature uniqueness, which solves the problem of generating signatures for the same file meanwhile by different group users. Specifically, we record every signature of a file in a blockchain in chronological order, and only one user is allowed to add new signature at the end of the blockchain when modification conflicts occur. On the other hand, to provide a secure data sharing service, SeShare introduces an efficient public auditing scheme for file integrity verification when a group user leaves the group. We also prove the security of the proposed scheme and evaluate the performance at the end of this paper. Our experimental results demonstrate the efficiency of public auditing for user leaving.

An Internet of Things (IoT) system generally contains thousands of heterogeneous devices which often operate in swarms-large, dynamic, and self-organizing networks. Remote attestation is an important cornerstone for the security of these IoT swarms, as it ensures the software integrity of swarm devices and protects them from attacks. However, current attestation schemes suffer from single point of failure verifier. In this paper, we propose an Efficient and Secure Distributed Remote Attestation (ESDRA) scheme for IoT swarms. We present the first many-to-one attestation scheme for device swarms, which reduces the possibility of single point of failure verifier. Moreover, we utilize distributed attestation to verify the integrity of each node and apply accusation mechanism to report the invaded nodes, which makes ESDRA much easier to feedback the certain compromised nodes and reduces the run-time of attestation. We analyze the security of ESDRA and do some simulation experiments to show its practicality and efficiency. Especially, ESDRA can significantly reduce the attestation time and has a better performance in the energy consumption comparing with list-based attestation schemes.

In data sharing schemes, the file owners should obtain rewards by sharing files with others as they put energy in these files. Therefore, we proposed an incentive data sharing scheme in this paper which encourages users to share data and also supports customization. Customization allows the owners to decide the threshold of access, the importance of each attributive classification which determines users' priority level of file modification and file ownership obtaining when the original owner leaves according to the priority level value. To support a convincing customized data sharing scheme, we introduce the knowledge of blockchain and construct a suitable access structure based on weighted attributes. The blockchain is used to ensure the fairness in incentive. Based on weighted attributes, an attribute set is disposed to a numerical value and the owner of the attribute set is able to obtain the file when the value is not less than the threshold, which is different from the normal access control policy. We prove the security from integrity, privacy and the availability of access key. The performance of the proposed scheme is evaluated at the end of this paper.

The rapid development of big data has brought great convenience to human's lives. The circulation and sharing of information are two main characteristics of the big data era. However, the risk of privacy leakage is also greatly increased when we enjoy the various services of big data. Therefore, how to protect the data privacy in the complex context of big data has become a research hotspot in academic circles. Most of the current researches on privacy protection are divided into two research fields: k-anonymity and differential privacy. Some existing research shows that traditional methods of privacy protection, such as k-anonymity and its extension, cannot achieve absolutely security. The emergence of differential privacy provides a new solution for privacy protection. We draw the lessons from exiting work and propose a new privacy method based on differential privacy: AQ-DP. We propose the first method for classifying quasi-identifiers based on sensitive attributes, which divide quasi-identifiers into associated quasi-identifiers (AQI) and non-associated quasi-identifiers (NAQI). The purpose is not to lose the correlation between quasi-identifiers and sensitive attributes. Our model AQ-DP carries out random shuffling of NAQls., generalizes the AQIs., and adds random noise that satisfies the laplacian distribution to the statistics. We have conducted extensive experiments, confirming that our model can achieve a satisfying privacy level and data utility.

Large-scale matrix computation requires a lot of computing resources, but the emergence of cloud computing provides resource-limited users with an economical solution, namely outsourcing computation. Clients can use pay-per-use service of cloud resources to solve complex issues, such as matrix inversion. However, due to the inclusion of privacy information in users' data and the opacity of the calculation operations, clients are in face of the threats of privacy disclosure and fraud. In this paper, we first propose an efficient and secure scheme without precondition for outsourcing large- scale matrix inversion to a public cloud. Compared to the state-of-the-art schemes, our scheme does not require the precondition that the original matrix should be invertible. It relieves clients from checking the invertibility of matrix, which is hard to be implemented with limited resource in reality. Moreover, our scheme can protect clients from being cheated and provide data privacy protection. Experiment results also show that our scheme is highly efficient in practical.

Nowadays, cloud computing is increasingly popular. As its important application, outsourcing has aroused great concern. Modular exponentiation is an expensive discrete-logarithm operation and it is difficult for users to calculate locally. Therefore, securely outsourcing modular exponentiation to cloud is a good choice for resource-limited users to reduce computation overhead. In this paper, to outsource modular exponentiation calculation, we dope out a fully verifiable secure outsourcing scheme with single server, so as to eliminate the collusion attacks which occur in algorithms based on two untrusted servers. Meanwhile, our algorithm allows outsourcers to detect any misbehavior with probability 1, which means the checkability of our algorithm shows a significant improvement in comparison to other single server based schemes. Furthermore, to protect data privacy, we propose a new division method to hide the primitive outsourced data. Compared with the state-of-the-art schemes, our secure outsourcing algorithm has an outstanding performance in both efficiency and checkability.

Cloud data privacy-preserving and integrity verification have become major research areas. Many existing schemes use group signatures to make sure that the data stored in cloud is unbroken for the purpose of privacy and anonymity. However, group signatures do not consider user equality and the framing caused by manager. Therefore, we propose data sharing scheme for non-manager groups, which reconstructs democratic group signature with threshold traceability to homomorphic authentication. We further present a public auditing scheme for non-manager shared data. In our scheme, group manager's rights are distributed to all members equally and some of them can work together to trace the signer if it is necessary. Besides identity privacy, data privacy, traceability and non-frameability, our scheme also ensures the efficiency and the feasibility. The experimental results show the overhead of the auditing is independent of the group user numbers and effectiveness of our approach. And thanks to the low overhead, our scheme can be further used in mobile cloud storage.

With the arrival of big data era, cloud storage has become more ubiquitous. A growing number of consumers remote their data into cloud, as cloud can provide them with ample storage space and powerful computational capacity. However, storing data in cloud means that data is out of their control. How to verify the integrity of stored data and retrieve the corrupted data has become an urgent security problem. In this paper, we propose a new efficient proof of retrievability scheme, named as IPOR, for cloud storage systems. The IPOR not only can verify the integrity of remote data, but also can retrieve the original data of corrupted blocks from the healthy servers with probability 100%. Moreover, IPOR obviously decreases the complexity of data integrity tags and it requires performing a few multiplication and addition operations to retrieve the corrupted data. Therefore, our scheme is much more efficient than the state-of-the-art schemes. In addition, the security analysis indicates that our scheme is provably secure.

The accurate estimation of forest height is very important for understanding forest biomass and forest vertical structures. To investigate the potentials of forest height mapping for future Chinese satellite mission concepts with a waveform Lidar system onboard, a field campaign was designed and implemented in Weihe forest farm, Northeastern China in August of 2016. The method we proposed in this paper is that firstly we generate simulated waveforms from Unmanned Aerial Vehicles (UAV) Lidar data, then we use random forest (RF) to get the most relevant variables from 18 waveform parameters driven from our simulated results and 11 terrain parameters from ASTER-DEM. Finally, we used Cubist machine learning algorithm to establish the relationships between 4 different forest heights and the selected variables. Initial results demonstrated that the simulated waveforms could estimate forest height very well.

Abstract Machine‐type communication (MTC) is a very important application of the Internet of things. It has a vast market and application scenarios. However, supporting a large number of low‐power devices transmission is an important issue in long‐term evolution/long‐term evolution advanced (LTE/LTE‐A) networks. Specifically, when a large number of machine‐type communication devices (MTCDs) with low‐power consumption requirements simultaneously request access to the LTE/LTE‐A networks, each MTCD needs an independent complete access authentication process with core network, which may cause a serious signaling congestion in the core network. To solve this problem, in this paper, we propose a novel group authentication protocol with privacy‐preserving for MTC in the LTE/LTE‐A networks. The proposed protocol cannot only simultaneously authenticate a group of MTCDs and minimize the signaling overhead but also provide robust privacy‐preserving for each MTCD (including anonymity, unlinkability, and traceability). In particular, our scheme can avoid denial of service attack by filtering some illegal devices in the first four procedures of the mutual authentication. Moreover, our scheme fulfills all the security requirements of the MTC in LTE/LTE‐A networks. In addition, the formal verification by the ProVerif tool shows that the proposed scheme is secure against various malicious attacks, and the performance evaluation indicates that it achieves outstanding results in terms of signaling and computation overhead. Copyright © 2016 John Wiley & Sons, Ltd.

In this paper, we propose a handover authentication scheme with location privacy preserving based on the proxy ring signature scheme for EAP-based wireless networks. First, we integrate an efficient ring signature and a proxy signature into a proxy ring signature scheme, which allows the mobile node (MN) to be authenticated without revealing its identity and location privacies due to the inherent anonymity of the proxy ring signature. Second, our scheme only requires point multiplication operations on the resource-constraints MN, thus, it is suitable for low-power mobile devices in the wireless networks. Finally, an extensive simulation is given to validate the performance of the proposed scheme. The results demonstrate that our scheme is relatively efficient in terms of computation and communication overhead.

Extensible Authentication Protocol (EAP) is a framework which aims to provide a flexible authentication for wireless networks. Due to the involvement of an EAP server and several round trips between a mobile node (MN) and the EAP server, a full EAP authentication takes about 1000ms which is unacceptable in a handover process. This paper proposes a privacy preserving handover authentication scheme for EAP-based wireless networks. We use the proxy signature scheme to accomplish authentication between MN and an access point (AP) without involving the third party. The detailed security analysis shows that our scheme can achieve the privacy preserving and forward/backward security. In addition, we evaluate the latency performance of the proposed scheme by the analysis and simulation. The results demonstrate that our scheme is more efficient in terms of computation and communication overheads.

Recently, IEEE 802.16m was submitted to the ITU and acknowledged as the candidate technology of the IMT-advanced standardization. In this paper, we point out several security issues, such as key agreement blocking and Denial of Service (DoS) attacks, of the key management protocol in IEEE 802.16m. To address the found security issues, we propose an enhanced key management protocol, named as EKMP, which extends the pairwise master key and adds the integrity protection to all key agreement messages. EKMP can not only provide advanced relay station access but also avoid key agreement blocking and DoS attacks. In particular, our scheme is provably secure in the Canetti-Krawczyk model. Furthermore, our theoretical analysis shows that EKMP is much more efficient in terms of communication overhead and memory requirement.