Service migration is crucial in mobile edge computing (MEC) to ensure seamless service provision as users move. Although some migration schemes have been proposed, they fail to efficiently support the migration of microservices in a directed acyclic graph (DAG)-based service across different edge servers, resulting in high service latency. This paper focuses on the DAG-based service migration problem and proposes a collaborative microservice migration framework for MEC, aiming to minimize the service migration latency while efficiently distributing the migration workload across edge servers. We divide edge servers into clusters and formulate the DAG-based service migration problem as a two-stage optimization problem. In the first stage, a deep reinforcement learning-based service pre-migration algorithm is developed to identify the optimal cluster of edge servers for hosting the migrated service. In the second stage, a microservice migration algorithm is devised, utilizing topological sorting and network flow techniques to further determine the target edge server for each microservice. Our design addresses the inherent dependencies among microservices within a DAG task and adapts well to dynamic network environments. Experimental results on real-world datasets demonstrate that our approach significantly reduces service migration latency.

Rising concerns about data privacy and volume have driven the development of encrypted and compressed key-value (KV) storage systems. To defend against pattern-analysis attacks, the length and access frequency distributions of packs should appear uniform to adversaries. The design of the packing algorithm is crucial because it determines both pack length and frequency distributions, thereby impacting the overhead for hiding pack pattern information. Existing algorithms focus on minimizing length differences, leading to large variations in pack frequency and thus causing large bandwidth overhead. In this paper, we study the optimal packing problem for encrypted and compressed KV stores, aiming to minimize the overheads for protecting both pack length and frequency information. We propose DualPacking, a two-dimensional packing algorithm with an approximation ratio that depends on the length and frequency distributions of KV pairs. We further develop an encrypted and compressed KV storage system that adapts well to dynamic updates of outsourced stores. Finally, we formally analyze the security of our design and implement it on Redis and RocksDB. Experimental results indicate that, compared to existing packing algorithms, our design reduces the bandwidth overhead by up to 25% and the storage overhead for pack length protection by 33%, confirming its superior efficiency.

Key-value store is adopted by many applications due to its high performance in processing big data workloads. With the increasing concern for privacy, some privacy-preserving key-value storage systems have been proposed. A remarkable solution is to group key-value pairs into packs and then compress and encrypt each pack separately. The selection of pack size is important for key-value storage systems because it affects both the storage cost in the cloud and the bandwidth cost for data retrieval. However, existing data packing strategies do not consider the trade-off between them. In this paper, we study the optimal compression problem for encrypted key-value stores, aiming to minimize the overall cost of data outsourcing. To solve this problem, we devise an optimal pack size computation scheme, which considers both storage and bandwidth costs. Then, we propose a privacy-preserving key-value storage system. It balances the impact caused by encryption and compression without compromising system performance. Meanwhile, it supports dynamic updates and rich types of queries. Finally, we formally analyze the security of our design. Performance evaluations demonstrate that our proposed pack size computation scheme can minimize the overall cost of data outsourcing, and the designed key-value storage system is feasible in practice.

With the increasing concern about data privacy and data explosion, some encrypted and compressed key-value (KV) stores have been proposed. A remarkable way to combine encryption and compression is to pack KV pairs into packs, and then compress and encrypt each pack separately. Recent research has shown that even if the data is encrypted, adversaries can still use the leaked information about data length and access frequency to launch pattern-analysis attacks. For this problem, some schemes have been proposed to protect the length and frequency distribution of packs. However, existing solutions protect such information at the cost of high storage and bandwidth overhead. In this paper, we propose an encrypted and compressed KV store with pattern-analysis security, which can resist pattern-analysis attacks with minimal overhead. We first devise a secure KV pair packing scheme, which guarantees pack length security with bounded storage overhead. Then we propose a$K$-indistinguishable pack frequency smoothing scheme. It can protect the distribution of pack frequency with minimal bandwidth overhead. We formally analyze the security of our design and implement our proposed secure KV storage system on Redis and RocksDB. Performance evaluation results demonstrate that our design minimizes the overhead of achieving pattern-analysis security.

Federated learning is exposed to model poisoning attacks as compromised clients may submit malicious model updates to pollute the global model. To defend against such attacks, robust aggregation rules are designed for the centralized server to winnow out outlier updates, and to significantly reduce the effectiveness of existing poisoning attacks. In this paper, we develop an advanced model poisoning attack against defensive aggregation rules. In particular, we exploit the catastrophic forgetting phenomenon during the process of continual learning to destroy the memory of the global model. Our proposed framework, called Oblivion, features two special components. The first component prioritizes the weights that have the most influence on the model accuracy for poisoning, which induces a more significant degradation on the global model than equally perturbing all weights. The second component smooths malicious model updates based on the number of selected compromised clients in the current round, adjusting the degree of poisoning to suit the dynamics of each training round. We implement a fully-functional prototype of Oblivion in PLATO, a real-world scalable federated learning framework. Our extensive experiments over three datasets demonstrate that Oblivion can boost the attack performance of model poisoning attacks against unknown defensive aggregation rules.

Dynamic Searchable Symmetric Encryption (DSSE) is a practical cryptographic primitive that assists servers to provide search and update functionalities in the ciphertext domain. Recent work on DSSE schemes has focused on the direction of forward-privacy, requiring that newly added files cannot be linked to previously query results. However, due to the complexity of forward-privacy updates, existing schemes can only address an honest-but-curious server. It is difficult to verify updated results while preserving forward-privacy. In this paper, we explore how blockchain techniques can help us achieve a verifiable and forward-privacy DSSE scheme. Our scheme resorts to the emerging smart contract as a trusted platform to store digests for public result verification, and carefully crafts dynamic query protocols to enable encrypted search with forward-privacy. In our design, indexes are collocated with encrypted files and stored at storage-servers, which makes the blockchain light-weighted and search operations more efficient. Moreover, we propose a hybrid index design to support efficient files deletion. By using our blockchain-assisted primitive, the property collision between dynamic result verification and forward-privacy can be solved. We formally analyze the security strengths and provide the prototype implementation on Ethereum. Experiment results demonstrate the feasibility and usability of our blockchain-assisted DSSE scheme.

Electronic Health Record (EHR) and its privacy have attracted widespread attention with the development of the healthcare industry in recent years. As locking medical data in a single healthcare center causes information isolation, healthcare centers are motivated to build medical data sharing systems. However, existing systems highly rely on the trusted centralized servers, which are vulnerable to distributed denial of service (DDoS) attacks and the single point of failure. Moreover, it is a non-trivial matter to authorize multiple users to search and access EHR in a privacy-preserving manner. In this paper, we propose MedShare, a decentralized framework for secure EHR sharing. Our design utilizes the smart contract technique of blockchain to establish a trusted platform for healthcare centers to share their encrypted EHR. Considering that fine-grained access control is essential in practical EHR sharing service, we devise a constant-size attribute-based encryption (ABE) scheme, where the access policy is embedded in search result on the blockchain. Besides, we propose an efficient scheme that enables authorized MedShare users to perform multi-keyword boolean search operations over encrypted EHR. We formally analyze the security strengths and implement the system prototype on Ethereum. Evaluation results demonstrate that MedShare is efficient for EHR sharing.

Data deduplication at the network edge significantly improves communication efficiency in edge-assisted cloud storage systems. With the increasing concern about data privacy, secure deduplication has been proposed to provide data security while supporting deduplication. Since conventional secure deduplication schemes are mainly based on deterministic encryption, they are vulnerable to frequency analysis attacks. Some recent research has focused on this problem, where several works studied the trade-off between deduplication efficiency and resistance to frequency analysis attacks. However, no existing work can provide different deduplication efficiency and protection for different data chunks. In this paper, we propose a security-aware and efficient data deduplication scheme for edge-assisted cloud storage systems. It not only improves the efficiency of deduplication but also reduces information leakage caused by frequency analysis attacks. In particular, we first define the security level for chunks to measure the security needs of users. Then, we develop an encryption scheme with multiple levels of security for deduplication. It provides higher security protection for chunks with higher security levels, while sacrificing security to achieve higher deduplication efficiency for chunks with lower security levels. We also analyze the security of our proposed scheme. Evaluations on the real-world datasets show the efficiency of our design.

Key-value store is adopted by many applications due to its high performance in processing big data workloads. Recent research on secure cloud storage has shown that even if the data is encrypted, attackers can learn the sensitive information of data by launching access pattern attacks such as frequency analysis. For this issue, some schemes have been proposed to protect encrypted key-value stores against access pattern attacks. However, existing solutions protect access pattern information at the cost of large storage and bandwidth overhead, which is unacceptable for large-scale key-value stores. In this paper, we devise a K-indistinguishable frequency smoothing scheme for encrypted key-value stores, which can resist access pattern attacks launched by passive persistent adversaries with minimal storage and bandwidth overhead. Then, we propose a dynamic K-indistinguishable frequency smoothing scheme. It can efficiently adapt to the changes in access distribution while ensuring the K-indistinguishable security level and bandwidth efficiency. Finally, we formally analyze the security of our design. Extensive experiments demonstrate that our design achieves high throughput while minimizing storage and bandwidth overhead.

Mobile edge computing (MEC) can significantly reduce latency by pushing resources away from remote clouds to distributed base stations (BSs) equipped with MEC servers, which are closer to users and deployed by service providers (SPs) at the edge of cellular networks. To improve user experience and increase their own revenue, SPs tend to use resources in their deployed BSs to provide services instead of using resources in BSs deployed by other SPs. We envision a densely-deployed multi-SP MEC network where a user equipment (UE) is covered by multiple BSs from different SPs. As the resource in BSs and MEC servers is limited, it is a challenging problem for SPs to reasonably allocate resources in the edge computing (EC) layer to improve the quality of service. In this article, we propose a novel resource allocation scheme, Decentralized Multi-SP Resource Allocation (DMRA), which aims to maximize the total profit of all SPs at the EC layer and provide high-quality services. Then, we extend our design to the online scheme. The algorithm Decentralized Multi-SP Online Resource Allocation (DMORA) is proposed to fit the dynamic network environment. Simulation results indicate that our proposed schemes can effectively maximize the total profit of all SPs at the EC layer while improving user experience.

Distributed fog computing has received wide attention recently. It enables distributed computing and data management on the network nodes within the close vicinity of IoT devices. An important service of fog-cloud based systems is data deduplication. With the increasing concern of privacy, some privacy-preserving data deduplication schemes have been proposed. However, they cannot support lossless deduplication of encrypted similar data in the fog-cloud network. Meanwhile, no existing design can protect message equality information while resisting brute-force and frequency analysis attacks. In this paper, we propose a privacy-preserving and compression-based data deduplication system under the fog-cloud network, which supports lossless deduplication of similar data in the encrypted domain. Specifically, we first use the generalized deduplication technique and cryptographic primitives to implement secure deduplication over similar data. Then, we devise a two-level deduplication protocol that can perform secure and efficient deduplication at distributed fog nodes and the cloud. The proposed system can not only resist brute-force and frequency analysis attacks but also ensure that only the data operator can capture the message equality information. We formally analyze the security of our design. Performance evaluations demonstrate that our proposed design is efficient in computing, storage, and communication.

Mobile edge computing (MEC) is a promising cloud computing convergence paradigm that improves the quality of services and reduces the traffic load on the core network. By deploying base stations (BSs) endowed with computing resources on the edge of network, MEC system can response to the user requests more efficiently and faster than the traditional cloud center which is far away from the end users. However, limited by the capacity of the computing resource and radio resource on a BS, only a few services can be placed on each BS, and the number of users that each BS can serve in each time slot is also limited. Moreover, in a densely deployed network, service placement decisions of adjacent BSs are influenced by each other, because their communication ranges are overlapped. Thus, service provider (SP) who deploys the BSs on the MEC system has to coordinate service placement among BSs so as to maximize its profit. Moreover, there are different kinds of users on the MEC system, some of them would like to pay more for higher priority to acquire computing resource. Therefore, SPs need to design a pricing method to distinguish users' priorities to get higher profit. In this paper, we will design a novel method to coordinate service placement among BSs and propose a pricing method that considering the difference of users. Our service placement method can theoretically achieve optimal result in single BS. And the simulation results also indicate that our service placement method achieve better performance in the cluster than the existing methods.

With the rapid development and widespread application of crowdsourcing, the limitations of traditional systems are gradually exposed. First, traditional systems fail to protect the privacy of task requesters and workers. They typically rely on a centralized server to aggregate the task content and workers' interests, while these data contain sensitive information. Second, crowdsourcing resources in each system are isolated. The tasks in one system cannot reach potential workers in other systems. Thus, there is a great need to build a new privacy-preserving and federated crowdsourcing system. However, the existing privacy-preserving solutions rely on a trusted third party to perform key management, which is not applicable in a federated setting. To this end, we propose the first proxy-free privacy-preserving and federated crowdsourcing system. It interconnects the existing crowdsourcing systems and can perform encrypted task matching across various systems without relying on a trusted third-party authority. Our main idea is to achieve federated crowdsourcing by moving secure task matching to the trusted smart contract. To get rid of the dependence on the trusted authority, we combine the rewritable deterministic hashing technique with searchable encryption schemes to achieve secure on-chain task-matching authorization. Moreover, we utilize the puncturable encryption technique to implement secure authorization revocation. We formally analyze the security of our design and implement a prototype on Ethereum. Evaluation results demonstrate that our design is secure and efficient for blockchain-based crowdsourcing.

Dynamic Symmetric Searchable Encryption (SSE) is a practical cryptographic primitive that enables data owners to search and update encrypted data hosted on untrusted servers. Recently, there is a growing interest to design dynamic SSE schemes with forward security. That is, the server cannot learn the association between the updated data and any query made in the past. However, due to the complexity of update operations, this security property introduces a great challenge of designing verifiable SSE schemes. It is difficult to verify the correctness of updated search results while preserving forward privacy. In this work, we explore how blockchain techniques can help us achieve a verifiable and dynamic SSE construction with forward security. First, we propose a new dynamic SSE scheme based on blockchain techniques, and apply it as the underlying building blocks to preserve forward-secure updates. Second, we resort to the emerging smart contract technique to customize a verification scheme, making updated results easily verifiable. Based on this new primitive, the robustness of the encrypted search service is ensured and forward security is preserved for update operations. Finally, we implement the prototype in Python and Solidity, and conduct performance evaluations on Ethereum. The extensive security analysis and performance evaluations on the real-world dataset demonstrate that our blockchain-assisted SSE scheme is secure and feasible.

Crowdsourcing is a promising computing paradigm that utilizes collective intelligence to solve complex tasks. While it is valuable, traditional crowdsourcing systems lock computation resources inside each individual system where tasks cannot reach numerous potential workers among the other systems. Therefore, there is a great need to build a federated platform for different crowdsourcing systems to share resources. However, the security issue lies in the center of constructing the federated crowdsourcing platform. Although many studies are focusing on privacy-preserving crowdsourcing, existing solutions require a trusted third party to perform the key management, which is not applicable in our federated platform. The reason is that it is difficult for a third party to be trusted by various systems. In this paper, we present a secure crowdsourcing framework as our initial effort toward this direction, which bridges together the recent advancements of blockchain and cryptographic techniques. Our proposed design, named PFcrowd, allows different crowdsourcing systems to perform encrypted task-worker matching over the blockchain platform without involving any third-party authority. The core idea is to utilize the blockchain to assist the federated crowdsourcing by moving the task recommendation algorithm to the trusted smart contract. To avoid third-party involvement, we first leverage the re-writable deterministic hashing (RDH) technique to convert the problem of federated task-worker matching into the secure query authorization. We then devise a secure scheme based on RDH and searchable encryption (SE) to support privacy-preserving task-worker matching via the smart contract. We formally analyze the security of our proposed scheme and implement the system prototype on Ethereum. Extensive evaluations of real-world datasets demonstrate the efficiency of our design.

Mobile Edge Computing (MEC) is a burgeoning paradigm that pushes data and services away from remote clouds to distributed Base Stations (BSs) equipped with MEC servers, which are deployed by Service Providers (SPs) at the edge of cellular networks. Normally, a SP prefers to use its own BSs, instead of those deployed by other SPs, to provide data and storage services. This can not only improve the quality of user experience but also increase its own revenue. In a densely deployed MEC network where a User Equipment (UE) tends to be covered by multiple BSs from varied SPs, how to allocate the resources in the BSs to provide the best service is a challenging problem. In this paper, we propose a novel resource allocation scheme, Decentralized Multi-SP Resource Allocation (DMRA), for densely-deployed MEC networks in order to maximize the total profit of all SPs and provide high-quality services. Our experimental results indicate that the proposed scheme outperforms the existing resource allocation algorithms for MEC.

Multicasting is an important task in Wireless Sensor Networks (WSNs). The minimum energy multicasting problem has been studied intensively. In duty-cycled WSNs, switching between the active and sleep state makes this problem more complicated. In this paper, the problem of minimum energy multicasting with adjustable transmission power in duty-cycled WSNs is studied. Specifically, we propose a novel algorithm named ATPM, with which an extended graph is first constructed, then a multicast tree and the transmission schedule are generated. Our experimental results indicate that the proposed algorithm outperforms the state-of-art algorithms in terms of energy cost.