Abstract JavaScript code is often included in web applications to implement various functionalities. However, namespace is absent in JavaScript(JS), and all JavaScript code in a same frame shares a common namespace. The absence of namespace may lead to mutual interference among JavaScript code, which results in abnormal program execution. In this paper, we investigate the issue of global identifier conflicts in JavaScript code that cause anomalies across entire web pages. Unlike existing dynamic detection methods like JSOBSERVER which introduce significant runtime performance overhead and can only detect conflicts in executed code paths, our approach avoids execution dependency and performance penalty. Aimed to this issue, we develop a static analysis tool, called DetecJS, to analyze dependencies and conflict relationships among JavaScript code. It can be used to assists developers in identifying global identifier conflicts in the program early during development without executing the code. Based on DetecJS, we identify 2618 global identifier conflicts across 1000 websites. Additionally, we conduct a performance evaluation of DetecJS, the results indicated that the tool exhibits high performance, with an average analysis time of only 5.56 s per web page and conflict detection taking just 15.15 ms.

Blockchain-based information storage and retrieval systems face significant challenges in achieving efficiency, privacy, and auditability when operating across heterogeneous blockchain platforms. Existing solutions often struggle to balance these requirements, particularly in cross-chain environments involving both public and consortium blockchains. This paper proposes a novel framework that leverages cross-chain technology to address these limitations. The framework integrates multi-party threshold cross-chain consensus to optimize verification efficiency and reduce the computational burden on trusted nodes. To ensure privacy-preserving information querying and retrieval, advanced cryptographic techniques are employed. Additionally, a dedicated auditor set within the consortium blockchain is introduced to detect malicious behavior and enforce regulatory compliance. Comparative evaluations demonstrate that the proposed framework outperforms existing methods in terms of privacy protection, efficiency, and auditability. Experimental results on Hyperledger Fabric demonstrate significant improvements in throughput, achieving at least 20 Transactions Per Second (TPS), along with latency below 3.5 seconds and 300MB memory utilization under standard PC configurations. These findings validate the framework's practical viability for secure and efficient cross-chain information retrieval while maintaining superior performance compared to existing solutions.

Face recognition systems offer a range of applications that enhance security, efficiency, and personalization, e.g., access control, identity verification, and personalized services. Mainstream facial recognition systems employ the Edge-Cloud architecture to protect user privacy by storing facial feature data instead of original facial images. However, recently emerging reconstruction attacks based on deep learning can recover the visual information of original facial images from facial features, resulting in face privacy disclosure. Existing anti-reconstruction approaches either compromise facial recognition accuracy or fail to meet real-time requirements. In this article, we propose a practical privacy-preserving approach based on adversarial perturbations against reconstruction attacks. By incorporating subtle adversarial interference into facial features, the mapping relationship from facial features to original facial images is disrupted, and the baseline reconstruction networks cannot recover the original face image. We conducted experiments on two facial recognition models, FaceNet and ArcFace, both widely deployed in practical scenarios. The results show that the face recognition accuracy sacrifice of less than 1% can significantly reduce the quality of the reconstructed image. In terms of efficiency, the average time to generate an adversarial facial feature is less than 10 ms, meeting the real-time requirements of facial recognition.

Machine Learning (ML) demonstrates dermatologist level accuracy in skin cancer diagnosis, yet its practical adoption is constrained by data silos and privacy issues. While Federated Learning (FL) addresses these limitations, it remains susceptible to data heterogeneity and gradient leakage attacks. To overcome these challenges, we introduce a privacy-preserving FL framework tailored for encrypted dermoscopic image analysis. Our proposed framework integrates a Fully Homomorphic Encryption (FHE)-enabled variant of Stochastic Controlled Averaging (SCA), enhancing model convergence with Non-IID data. To further minimize computational and communication overhead, we develop a layer-wise Packed FHE (PFHE) approach that improves the efficiency of encrypted model aggregation. Moreover, we design a lightweight, FHE-Friendly Deep Neural Network (DNN) optimized for encrypted inference. This architecture incorporates a DO-EncConv module specifically engineered to balance inference efficiency and precision within FHE computational constraints. Experimental results on the HAM10000 and ISIC2019 datasets confirm the effectiveness of our proposed framework, demonstrating F1-Score improvements of 2.2% and 4.0%, respectively, over baseline FL approaches. Additionally, our method achieves communication overhead reductions of 94.85% and 93.48%, while encrypted inference is performed in approximately 17.8 seconds per sample, with less than 2% accuracy degradation compared to centralized plaintext models. These outcomes underscore the framework's practicality and effectiveness for secure, scalable clinical deployment.

Deploying deep learning models for remote medical diagnosis presents critical privacy challenges, particularly with regard to safeguarding sensitive patient data and protecting proprietary model parameters. Existing privacy-preserving techniques, such as Multi-Party Computation (MPC) and Fully Homomorphic Encryption (FHE), often suffer from high communication overhead or inadvertent exposure of model internals, limiting their practicality in real-world applications. In response, we propose a hybrid inference framework that integrates Split Neural Networks (SplitNN) with FHE to enable secure and efficient Client-Server medical diagnosis. Our approach ensures end-to-end encryption of patient data using CKKS scheme and preserves model confidentiality through an authenticated ReLU blinding protocol, which prevents information leakage during interactive computation. Additionally, we introduce a Channel-Aligned Feature Packing scheme optimized with the H-S Diagonal method to maximize throughput and minimize latency. Empirical evaluations on complex medical imaging tasks show that our framework maintains near-plaintext accuracy (within 1 %) while reducing encrypted inference latency to under 0.9 s per image, underscoring its practicality for privacy-preserving diagnostic AI.

With the continuous growth of open data on the Web, dataset search has become a prominent specialized retrieval problem to find datasets relevant to a query. Recent solutions rank datasets based on not only their metadata, but also data snippets extracted from their actual data. While the goodness of a data snippet has been studied from various aspects, in this paper we propose to, for the first time, jointly optimize compactness, relevance, representativeness, and cohesiveness in snippet extraction. To extract such multi-objective data snippets, we formulate a new combinatorial optimization problem and design an efficient algorithm with a proved worst-case approximation ratio. We evaluate the data snippets extracted by our algorithm intrinsically through a set of quality metrics and extrinsically by applying them to dataset search.

Reconstruction attackers can exploit facial features to recover the original user’s face, resulting in user privacy leakage. One new strategy to enhance the “Edge-Cloud” face recognition system’s privacy is to add adversarial perturbations to facial features, preventing the attackers from high-quality user image recovery. However, the existing works following this strategy suffer from unacceptable damage to face recognition accuracy. Achieving robust privacy enhancement and face recognition accuracy simultaneously is still challenging. To tackle this challenge, we propose an adversarial perturbation-based plug-and-play privacy-enhancing method (Patronus) with robustness against face image reconstruction attacks and near-lossless face recognition performance. The key insight is derived from our observation that the feature distance between two face images of the same person is significantly lower than the threshold set in the face recognition system. This leaves room for adding adversarial perturbations to the facial features without compromising face recognition accuracy. Our strategy limits the amount of adversarial perturbations in a fine-grained manner to ensure that they are within the range of not damaging face recognition accuracy. Our evaluation shows the superior performance ofPatronusin robustness against reconstruction attacks and near-lossless face recognition accuracy compared to state-of-the-art (SOTA) methods.Patronuscan be easily integrated into deployed face recognition systems as a plug-in privacy-enhancing module with low overhead.

The emergence of quantum computing poses a significant threat to contemporary mainstream cryptographic systems, such as RSA, Diffie-Hellman and ECC. In this context, lattice-based cryptography has garnered widespread interest among researchers due to its potential resistance to quantum attacks. Lattice cryptography's security is underpinned by a set of hard problems, with the Shortest Vector Problem (SVP) being one of the most fundamental and crucial. Discrete pruning enumeration is one of the key algorithms used to solve the SVP. In this paper, we present a parallel version of the discrete pruning enumeration and optimize it for CPU-GPU heterogeneous systems. The experimental results show that the parallel implementation using both CPU and GPU can achieve up to a 54x speed-up in the 100-dimensional SVP challenge, and up to a 77x speed-up in the 95-dimensional instances.

In light of the growing availability and significance of open data, the problem of dataset search has attracted great attention in the field of information retrieval. Nevertheless, current metadata-based approaches have revealed shortcomings due to the low quality and availability of dataset metadata, while the magnitude and heterogeneity of actual data hindered the development of content-based solutions. To address these challenges, we propose to convert different formats of structured data into a unified form, from which we extract a compact data snippet that indicates the relevance of the whole data. Thanks to its compactness, we feed it into a dense reranker to improve search accuracy. We also convert it back to the original format to be presented for assisting users in relevance judgment. The effectiveness of our approach has been demonstrated by extensive experiments on two test collections for dataset search.

Abstract With the development of information networks, the entities from different network domains interact with each other more and more frequently. Therefore, identity management and authentication are essential in cross-domain setting. The traditional Public Key Infrastructure (PKI) architecture has some problems, including single point of failure, inefficient certificate revocation status management and also lack of privacy protection, which cannot meet the demand of cross-domain identity authentication. Blockchain is suitable for multi-participant collaboration in multi-trust domain scenarios. In this paper, a cross-domain certificate management scheme CD-BCM based on the consortium blockchain is proposed. For the issue of Certificate Authority’s single point of failure, we design a multi-signature algorithm. In addition, we propose a unified structure for batch certificates verification and conversion, which improve the efficiency of erroneous certificate identification. Finally, by comparing with current related schemes, our scheme achieves good functionality and scalability in the scenario of cross-domain certificate management.

Distance computation is a bottleneck that limits the performance of many applications based on knowledge graphs (KGs). One common approach to improving online distance computation is to offline precompute certain information to be stored in an index called distance oracle. However, its effectiveness remains under-studied in the setting where edges are methodologically weighted to capture the structure and semantics of edge types in a KG. To fill the gap, in this paper, we present the first evaluation of representative distance oracles on KGs with commonly used edge weighting schemes. Our negative results and empirical justifications provide insights and a motivation for future studies of this unique setting.

Abstract Attribute-based signature (ABS) allows signers with a set of attributes to sign messages anonymously using a specific signing policy. However, previous schemes suffer from some efficiency issues which are not widely applied on the blockchain. In this paper, we investigate ABS regarding its features and efficiency in the blockchain setting and provide our solution correspondingly. To solve the revocation problem of ABS in a more efficient manner, we introduce the update-free revocation function. Instead of the passive attribute expiration approaches, we take the active method to ensure that no parameter updates are required by users after the execution of the revocation function. In terms of efficiency, we first address the problem that the signer has to provide proof for all attributes in the predicate for privacy, which is one of the efficiency bottlenecks for ABS. By taking advantage of the blockchain architecture, we propose a new solution which can achieve the constant signature size and verification cost, while the signing cost can be greatly reduced. The corresponding security levels are satisfied according to their strict criteria. A generic construction as well as an instantiation are provided which is provably secure in the standard model satisfying the newly defined formal security definitions. Finally, a purer primitive is discussed.

Abstract With the outbreak of Covid‐19, both people's health and the world economy are facing great challenges. Contact tracing scheme based on Bluetooth of smartphones has been regarded as a viable way to mitigate the spread of Covid‐19. The existing schemes mainly belong to the centralized or the decentralized structure, both of which have their own limitations. It is infeasible for the existing schemes to balance the different demands of governments and users for user privacy and tracing efficiency at different periods of the epidemic. In this paper, we propose a hybrid contact tracing scheme named MLCT (multi‐level contact tracing scheme) which is mainly based on short group signature. MLCT provides multiple privacy levels by applying anonymous credential technology and secret sharing technology to desensitize user identity privacy and encounter privacy. Comparing to the previous schemes, MLCT fully considers the different demands of the government, patients, and close contacts for user privacy and tracing efficiency in the different stages of Covid‐19. The experimental results show viability in terms of the required resource from both server and mobile phone perspectives. And the security analysis demonstrates that MLCT can achieve the five targets security goals. It is expected that MLCT can contribute to the design and development of contact tracing schemes.

Summary While the social network services (SNS) have dominate the ways that people communicate with each other on the Internet, identity impersonation remains to be a serious issue that needs to be solved due to the anonymity in the cyber network. Currently, the potential solution to the problem relies heavily on the administration from the central server, which requires intensive workload of the identity management. In this article, we propose a threshold identity authentication signature scheme to solve the impersonation problem from the protocol layer rather than software design in the traditional upper level. In our scheme, with the help of some authenticated accounts, trusted relationship can be shared in a group to other unauthenticated accounts, which largely decrease the workload of authenticating all the accounts. Users are given the ability to verify other accounts' identity information by their signatures. Then, we establish three security goals to prevent the malicious adversary to launch the impersonation attack on a group. We claim that our scheme is suitable for the SNS scenario since the procedure of generating a signature to prove the identity requires little computation cost, it is user‐friendly especially on the lightweight devices such as mobile devices and so on.

The outbreak of COVID-19 has brought great pain to people around the world. As an epidemic prevention and control measure, the health QR code (HC) has been designed to trace the confirmed cases and close contacts quickly. Although some existing health code schemes preserve the privacy, but most of them are either unsupported for fine-grained auditability or centralised health code storage. Therefore, we propose a multi-dimension traceable privacy-preserving HC scheme based on blockchain. It prevents health code information being tampered with and supports the traceability of virus transmission chain. We utilise attribute-based encryption to protect residents' privacy information and achieve fine-grained access control. Furthermore, to support the multi-dimension traceability by the epidemic prevention and control departments, the searchable encryption has been introduced. Finally, we give the security analysis and performance evaluation to verify the feasibility and practical significance of our scheme.

Outsourcing encrypted data to cloud servers that has become a prevalent trend among Internet users to date. There is a long list of advantages on data outsourcing, such as the reduction cost of local data management. How to securely operate encrypted data (remotely), however, is the top-rank concern over data owner. Lianget al.proposed a novel encrypted cloud-based data share and search system without loss of privacy. The system allows users to flexibly search and share encrypted data as well as updating keyword field. However, the search complexity of the system is of extreme inefficiency,$O(n d)$, where$d$is the total number of system files and$n$is the size of query formula. This article, for the first time, leverages the “oblivious cross search” technology in public key searchable encryption context to reduce the search complexity toonly$O(nf(w))$, where$f(w)$is the number of files embedded with the “least frequent keyword”$w$. The new scheme maintains efficient encrypted data share and keyword field update as well. This article further revisits the security models for payload security, keyword privacy and search token privacy (i.e., search pattern privacy) and meanwhile, presents security and efficiency analysis for the new scheme.

Big data analytics has been regarded as a promising technology to yield better insights into future development by government and industry. Data collection and aggregation are necessary pre-steps to enable data analysis. However, data may be dispersed across multiple places and in different formats. Even worse, data can be encrypted under various encryption mechanisms when data owners try to secure the confidentiality of the data. This makes data aggregation extremely challenging, if not impossible, especially when the encryption keys cannot be shared for various reasons. In this paper, we take the first step in addressing this problem. More specifically, we propose a new notion of cross-domain encryption switching service that securely bridges two well-studied encryption mechanisms, namely traditional public key encryption and identity-based encryption. As of independent interest, our notion supports keyword search over encrypted data, i.e., after encryption switching one may search over the (outsourced) data without loss of data and query secrecy. We provide a provably-secure instantiation satisfying the notion, and further present the efficiency analysis to show the scalability. Our proposed scheme may be applicable in multi-domain cloud storage system.

has gone through a rapid development in today's internet connected world.With the wide application of the booming technologies such as the Internet of ings (IoT) and the cloud computing, huge amount of data are generated and collected.While the data can be used to better serve the corresponding business needs, they also pose big challenges for the cyber security and privacy protection.It becomes very di cult if not impossible to discover the malicious behavior among the big data in real time.us, this gives rise to the cyber security solutions which are driven by AI-based technologies, such as machine learning, statistical inference, big data analysis, deep learning, and so on.AIdriven cyber security analytics has already found its applications in the next generation rewall which includes the automatic intrusion detection system, encrypted tra c classi cation, malicious software detection, and so on.In the area of cryptography, AI-driven solution starts to help the researchers optimize the algorithm design and can largely reduce the cryptanalysis e ort such as searching the di erential trails which is crucial in di erential cryptanalysis.

Summary A constrained device is an emerging technology that has enormous applications in our daily life such as access control, inventory control, luggage tracking, bar‐code reader, and IoT. However, it has certain drawbacks of low memory and less computing power. Thus, one of the cracking challenges is to provide efficient and secure cryptographic solution for the constrained device in the aspect of security issue. An (n,n) blockcipher‐based cryptographic compression function is applicable to provide provable security to the constrained device. Though, there are many constructions of (n,n) blockcipher such as MDC‐2, MDC‐4, MJH, Bart‐12, and SKS‐15. However, most of the familiar schemes are not suitable for short and variable message encryption without padding because of their internal structures. Furthermore, the security margin is provided based on blocklength rather than the flexible size of message. In this paper, we present two different (n,n) blockcipher compression function schemes. The first scheme (FS) satisfies better efficiency such as less call of blockcipher, less key scheduling, and higher efficiency rate. On the contrary, the second scheme (SS) has upper security bound. Moreover, both of the schemes are suitable for small and variable message encryption (message size = tn|t < 1,n:blocklength), which is handy for the constrained device. The collision and preimage security bound of the FS are O(2tn/2) and O(2tn). In addition, the SS's collision resistance and preimage resistance are bounded by O(2tn) and O(22tn). Moreover, the efficiency rate of the proposed two schemes are respectively t and t/3. The numbers of key scheduling are 2 for the constructions of FS and SS. We use two calls of blockcipher in the FS. On the contrary, three calls of blockcipher are used in the SS. Copyright © 2016 John Wiley & Sons, Ltd.

In today's world of the internet, billions of computer systems are connected to one another in a global network. The internet provides an unsecured channel in which hundreds of terabytes of data is being transmitted daily. Computer and software systems rely on encryption algorithms such as block ciphers to ensure that sensitive data remains confidential and secure. However, adversaries can leverage the statistical behavior of underlying ciphers to recover encryption keys. Accurate evaluation of the security margins of these encryption algorithms remains to be a big challenge. In this paper, we tackle this issue by introducing several searching strategies based on differential cryptanalysis. By clustering differential paths, the searching algorithm derives more accurate distinguishers as compared to examining individual paths, which in turn provides a more accurate estimation of cipher security margins. We verify the effectiveness of this technique on ciphers with the generalized Feistel and SPN structures, whereby the best distinguishers for each of the investigated ciphers were obtained by discovering clusters with thousands of paths. With the KATAN block cipher family as a test case, we also show how to apply the searching algorithm alongside other cryptanalysis techniques such as the boomerang attack and related-key model to obtain the best cryptanalytic results. This also depicts the flexibility of the proposed searching scheme, which can be tailored to improve upon other differential attack variants. In short, the proposed searching strategy realizes an automated security evaluation tool with higher accuracy compared to previous techniques. In addition, it is applicable to a wide range of encryption schemes which makes it a flexible tool for both academic research and industrial purposes.

Outsourcing a huge amount of local data to remote cloud servers that has been become a significant trend for industries. Leveraging the considerable cloud storage space, industries can also put forward the outsourced data to cloud computing. How to collect the data for computing without loss of privacy and confidentiality is one of the crucial security problems. Searchable encryption technique has been proposed to protect the confidentiality of the outsourced data and the privacy of the corresponding data query. This technique, however, only supporting search functionality, may not be fully applicable to real-world cloud computing scenario whereby secure data search, share as well as computation are needed. This work presents a novel encrypted cloud-based data share and search system without loss of user privacy and data confidentiality. The new system enables users to make conjunctive keyword query over encrypted data, but also allows encrypted data to be efficiently and multiply shared among different users without the need of the "download-decrypt-then-encrypt" mode. As of independent interest, our system provides secure keyword update, so that users can freely and securely update data's keyword field. It is worth mentioning that all the above functionalities do not incur any expansion of ciphertext size, namely, the size of ciphertext remains constant during being searched, shared and keyword-updated. The system is proven secure and meanwhile, the efficiency analysis shows its great potential in being used in large-scale database.

The success probability of differential and linear cryptanalysis against block ciphers heavily depend on finding differential or linear paths with high statistical bias compared with uniform random distribution. For large number of rounds, it is not a trivial task to find such differential or linear paths. Matsui first investigated this problem and proposed a solution based on a branch and bound algorithm in 1994. Since then, the research on finding good concrete differential or linear path did not receive much attention. In this paper, we revisit the differential attack against several S-Box based block ciphers by carefully studying the differential characteristics. Inspired by Matsui's algorithm, we provide an improved solution with the aid of several searching strategies, which enable us to find by far the best differential characteristics for the two investigated ciphers (LBlock, TWINE) efficiently. Furthermore, we provide another way to evaluate the security of ciphers against differential attack by comparing the strength of the ciphers from differential characteristic's point of view, and we also investigate the accuracy when using the active S-Box to evaluate the security margin against differential attack, which is the common method adapted when new ciphers are designed.

ABSTRACT Vehicle ad hoc network (VANET) provides communication between vehicles and vehicle‐to‐infrastructure communication. High mobility, high speed of vehicles, fast topology changes, and sheer scale are some characteristics that establish VANET as an intensive research topic different from other types of mobile ad hoc network. In this paper, we improve an existing batch verification system on ID‐based group signature and also compare the performance achieved. Then, we analyze the best possible value of the number of signatures to batch at a time for large‐scale VANET. In addition, we introduce a scheduling algorithm for signature verification where batch verification cannot be implemented efficiently. Copyright © 2014 John Wiley & Sons, Ltd.