With the rapid development of the Internet of Things (IoT) and the increase in the number of various sensor devices, there is an increasingly urgent need for cross-domain sharing of massive data in scenarios such as industrial control and smart healthcare, while the limitations of traditional encryption mechanisms in terms of inter-domain segregation and dynamic privilege management have made proxy re-encryption (PRE) technology the core solution to address the secure flow of cross-domain data. Among them, attribute-based proxy re-encryption is a promising approach. However, the existing schemes suffer from the inefficiency of inter-domain transformation and the lack of dynamic privilege revocation mechanism which is crucial for data sharing systems. Therefore, in this paper, we propose an efficient proxy re-Encryption (PRE) scheme that supports dynamic privilege management and realizes secure cross-domain conversion from Identity-Based Encryption (IBE) to Attribute-Based Encryption (ABE). In this scheme, data is first encrypted by IBE mechanism and uploaded to a semi-trusted proxy server for storage, and the data owner can authorize the proxy server to convert the ciphertext to ABE ciphertext. Notably, our scheme achieves real-time updating of keys through an attribute revocation algorithm, which ensures that historical data cannot be decrypted after authorization changes and satisfies forward security. Meanwhile, the solution builds anti-collusion mechanism by jointly generating re-encryption key by the data owner and proxy server, which effectively protects against the joint attack of malicious users and proxy server, and prevents unauthorized users from decrypting the ciphertext. In addition, the computational burden is outsourced to the proxy server, and the user only needs to perform lightweight operations, which significantly reduces the computational overhead of the data owner in data sharing. Formal security proofs show that the scheme is indistinguishable under the chosen ciphertext attack model (IND-CCA). Theoretical analysis and experimental results show that the structure is more efficient than previous schemes.

DNS over HTTPS (DoH) reduces the risk of privacy leakage of DNS queries, but it also provides a covert communication channel for malicious activities. In this paper, we propose a method for malicious encrypted traffic identification, which harnesses the advanced context comprehension of Large Language Model (LLM) and incorporates expert features to detect anomalies. The evaluation results show that the method proposed in this paper can not only identify common and emerging malicious DoH tunnel tools such as dns2tcp, iodine, and dnstt, but also identify weaponized DoH traffic within a real APT attack, with a recall of 0.9995.

Attribute-based anonymous credentials offer users fine-grained access control in a privacy-preserving manner. However, in such schemes obtaining a user's credentials requires knowledge of the issuer's public key, which obviously reveals the issuer's identity that must be hidden from users in certain scenarios. Moreover, verifying a user's credentials also requires the knowledge of issuer's public key, which may infer the user's private information from their choice of issuer. In this paper, we introduce the notion of double issuer-hiding attribute-based credentials (${\sf DIHAC}$) to tackle these two problems. In our model, a central authority can issue public-key credentials for a group of issuers, and users can obtain attribute-based credentials from one of the issuers without knowing which one it is. Then, a user can prove that their credential was issued by one of the authenticated issuers without revealing which one to a verifier. We provide a generic construction, as well as a concrete instantiation for${\sf DIHAC}$based on structure-preserving signatures on equivalence classes (JOC's 19) and a novel primitive which we calltag-based aggregatable mercurial signatures. Our construction is efficient without relying on zero-knowledge proofs. We provide rigorous evaluations on personal laptop and smartphone platforms, respectively, to demonstrate its practicability.

Summary The publish/subscribe paradigm provides loosely coupled and scalable communication for the Internet of Things (IoT). In this paradigm, access control is an efficient approach to guaranteeing security. However, existing access control methods are not suitable for the publish/subscribe paradigm in the sensing layer of the IoT due to their coarse‐grained controls and lack of self‐configuration. To address these problems, in this paper, we propose a topic‐centric access control model (TCAC) to realize fine‐grained authorization for the sensing layer of the IoT. First, we use topics, a fundamental concept for the publish/subscribe paradigm, as the basic access control unit to dynamically authorize access according to the attributes of devices, users, and topics. Second, an administration model for TCAC is proposed to manage these attributes and configure access policies to effectively implement user‐driven access controls. Finally, a healthcare case is used to demonstrate the security of the proposed TCAC. The results show that our model is dynamic, fine‐grained, and user driven.

This paper analyzes and designs a Testing and Communication System (TCS), which is used for the simulation of controlling and communicating for the space robot arm. Arming at enhancing the reliability of the operation of the space robot arm, a new Hot Double redundant strategy is adopted during the designing of TCS. The new Hot Double Redundant way is utilized to back up CAN BUS, which is the medium of data transmission and reception. The new network structure based on CAN BUS is validated on a nine nodes experiment system. The simulation results demonstrate the effectiveness of the redundancy strategy, and also the reliability and fault-tolerant ability of the TCS is testified by experiments.