Federated Learning (FL), an innovative distributed paradigm, has attracted significant interest for its inherent privacy preservation in collaborative model training. However, recent studies demonstrate that publicly shared gradients are vulnerable to malicious reconstruction of sensitive client data. While countermeasures like differential privacy and homomorphic encryption exist, they typically compromise model accuracy or computational efficiency, hindering practical deployment. This work simultaneously addresses two critical challenges in the FL training process: 1) efficient protection of client privacy, and 2) guaranteeing the authenticity of client gradients while ensuring the verifiability of the server's aggregation result. To this end, we propose an efficient and authentication-enhanced privacy-preserving protocol. Our solution allows clients to mask their local gradients and furnish corresponding proofs. The aggregation server subsequently verifies all submissions, aggregates only the valid masked gradients, and generates a proof for clients to verify the correctness of the aggregation result. Furthermore, the protocol is designed to be robust against client dropout. We provide formal proof that our protocol meets all security requirements in a semi-trusted environment. Both comprehensive theoretical analysis and extensive experimental evaluations confirm that our approach achieves more robust security, better dropout resilience, and superior overall efficiency compared to state-of-the-art protocols such as PSA, VerifyNet, and EVP.

Dynamic Searchable Symmetric Encryption (DSSE) plays a crucial role in secure cloud-based database systems, as it enables efficient keyword search and dynamic updates over encrypted data. However, practical deployment of DSSE schemes faces two significant challenges. First, clients may inadvertently perform faulty updates—such as re-adding an existing keyword-identifier pair or attempting to delete a non-existent one—which can compromise the correctness of subsequent search results. Second, even with correctly issued updates, malicious servers may return incorrect or incomplete search results, undermining data integrity. To address these challenges, we propose FVDSSE, the first fault-tolerant DSSE scheme that tolerates client-side operational faults and provides result verifiability against malicious servers. Moreover, it simultaneously ensures strong privacy by guaranteeing forward and backward privacy—two essential properties for any practical DSSE. To further optimize performance, we present FVDSSE-C, an enhanced variant that leverages caching techniques. Experimental evaluations on a real-world dataset show that FVDSSE-C achieves up to 130× improvement in search efficiency and 3× reduction in communication overhead compared to the state-of-the-art scheme (YCR22-C).

3D point cloud recognition plays a critical role in autonomous driving, robotics, and medical diagnostics. However, its vulnerability to backdoor attacks remains underexplored, posing significant security risks in real-world applications. Current defense mechanisms against 3D point cloud backdoor attacks are still in their infancy and lacking effective solutions. To address this, we propose a cross-modal driven object restoration framework that leverages 3D reconstruction to mitigate backdoor attacks. Specifically, we introduce a cross-modal semantic encoding module that projects 3D point clouds into multi-view depth maps and utilizes CLIP to extract aligned text-image features, providing semantic guidance for 3D reconstruction. Furthermore, we leverage cross-modal information as conditional guidance to drive dynamic diffusion-based 3D reconstruction and adaptively fuse semantic and geometric features through a gated self-conditioned modulator. This module dynamically selects features for fusion, effectively mitigating noise interference and distribution shifts during latent diffusion, significantly enhancing robustness to noise, and thereby achieving precise restoration of clean point clouds. Extensive experiments on ModelNet40, and ShapeNetPart datasets demonstrate that our method robustly defends against adaptive attacks under varying noise levels and significantly restores classification performance degraded by backdoor triggers.

Linear code, a foundational construct extensively employed in communication, data transmission, and error correction, has been the subject of rigorous study for decades. Despite significant academic successes and widespread adoption, recent studies show that decoding methods for general linear codes, such as syndrome decoding, require the storage and search of large decoding tables, leading to inefficiencies. To mitigate this, Debris-Alazard et al. first proposed adapting Babai's algorithm and the LLL algorithm from lattice theory to binary codes, achieving considerable performance gains. Inspired by this, in this paper, we aim to explore the design of more general linear codes to overcome the limitations of baseline binary codes and enhance their applicability in more advanced applications such as DNA storage and 5G communication systems. To address this gap, we extend the foundational domain and decoding algorithms from lattices to q-ary codes. Specifically, we define a new fundamental domain and propose a polynomial-time decoding algorithm, RedtoFun. To validate our findings, we conduct a series of experiments to evaluate its real-world performance. The results demonstrate that our optimized RedtoFun algorithm surpasses the syndrome decoding scheme in terms of memory overhead and runtime while maintaining performance on par with the SizeRed decoding scheme.

The widespread application of Internet of Things technology in the medical field results in the generation of a large amount of healthcare data. Adequately learning valuable knowledge from the massive healthcare data brings a huge potential for improving the efficiency, quality, and safety of healthcare services. Online learning over the cloud offers decent training and fast inference services. However, outsourcing healthcare data learning to the cloud might cause patient privacy disclosure and data integrity and authenticity compromises. These security threats further affect the accuracy of the trained model or distort the inference results. Although researchers have tried to solve the privacy-preserving or data integrity issues with different techniques, none of them satisfy the security demands in online training of healthcare data. In this paper, we present an efficient redactable group signature scheme (RGSS) for the online learning healthcare system. The security analysis shows that our construction not only prevents privacy compromise but also provides integrity and authenticity verification. In addition to the private property of RGSS, the signer-anonymous also enhances patient privacy-preserving. Compared with other solutions, our RGSS is secure and efficient in promoting scientific research on learning large amounts of healthcare data that aim to improve healthcare services.

Recent advancements in the Internet of Things (IoT) and cloud computing technologies have accelerated the development of various practical applications, including healthcare systems. Adequately revealing the collected healthcare data in a cloud-assisted healthcare IoT system brings a huge potential for improving the safety, quality, and efficiency of healthcare services. However, often the data collected in a healthcare IoT system is vital and sensitive. The dissemination of such data is also vulnerable to malicious attacks such as tampering, eavesdropping, and forgery. Thus, disseminated data's integrity, authenticity, and privacy are elementary security demands to end-users and owners. Also, the resource-constrained nature of healthcare IoT devices invalidates the existing solutions. To address the above challenges, we propose a lightweight and secure redactable signature scheme with coarse-grained additional redaction control (CRS) for secure dissemination of healthcare data in a cloud-assisted healthcare IoT system. The security analysis indicates our CRS is secure against signature forgery, additional redaction attacks, and redacted version linkability. Compared to other existing solutions, our scheme can achieve some level of security but less computational complexity and communication overhead.

With the increasing development of cloud computing, a number of users choose to outsource their data to a remote database service provider and enjoy flexible data sharing with multiple parties. However, the integrity and confidentiality of outsourced data in a remote cloud server are the main threats users are concerned about. The tree structure is one of the most widely used data organization structures. It is crucial to guarantee the integrity and privacy not only for the content but also for the structure if sensitive information is organized in this structure. At present, despite some solutions have been put forward, none of these considers the additional redaction attack on tree-structured data from attackers while sharing data with others. In this article, we provide a construction of secure redactable signature scheme for tree-structured data which features a multi-party control on the redaction of vertexes in a tree while the authenticity and privacy are assured. Then, we prove that our scheme is unforgeable, private, and transparent. Furthermore, extensive theoretical and experimental analyses are conducted to assess the efficiency of our scheme. The results demonstrate our scheme achieves multi-party redaction control without sacrificing sensible resources especially when a tree has a larger number of vertexes and siblings per vertex.

In the context of Information Societies, a tremendous amount of information is daily exchanged or released. Among various information-release cases, medical document release has gained significant attention for its potential in improving healthcare service quality and efficacy. However, integrity and origin authentication of released medical documents is the priority in subsequent applications. Moreover, sensitive nature of much of this information also gives rise to a serious privacy threat when medical documents are uncontrollably made available to untrusted third parties. Redactable signatures allow any party to delete pieces of an authenticated document while guaranteeing the origin and integrity authentication of the resulting (released) subdocument. Nevertheless, most of existing redactable signature schemes (RSSs) are vulnerable to dishonest redactors or illegal redaction detection. To address the above issues, we propose two distinct RSSs with flexible release control (RSSs-FRC). We also analyse the performance of our constructions in terms of security, efficiency and functionality. The analysis results show that the performance of our construction has significant advantages over others, from the aspects of security and efficiency.

Electronic healthcare (eHealth) systems have replaced traditional paper-based medical systems due to attractive features such as universal accessibility, high accuracy, and low cost. As a major constituent part of eHealth systems, mobile healthcare (mHealth) applies Mobile Internet Devices (MIDs) and Embedded Devices (EDs), such as tablets, smartphones, and other devices embedded in the bodies of individuals, to improve the quality of life and provide more convenient healthcare services for patients. Unfortunately, MIDs and EDs have only limited computational capacity, storage space, and power supply. By taking this into account, we present a new design to guarantee the integrity of eHealth records and the anonymity of the data owner in a more efficient and flexible way. The essence of our design is a general method which can convert any secure Attribute-Based Signature (ABS) scheme into a highly efficient and secure Online/Offline Attribute-Based Signature (OOABS) scheme. We prove the security and analyze the efficiency improvement of the new design. Additionally, we illustrate the proposed generic construction by applying it to a specific ABS scheme.

In this paper, we propose a two-factor data security protection mechanism with factor revocability for cloud storage system. Our system allows a sender to send an encrypted message to a receiver through a cloud storage server. The sender only needs to know the identity of the receiver but no other information (such as its public key or its certificate). The receiver needs to possess two things in order to decrypt the ciphertext. The first thing is his/her secret key stored in the computer. The second thing is a unique personal security device which connects to the computer. It is impossible to decrypt the ciphertext without either piece. More importantly, once the security device is stolen or lost, this device is revoked. It cannot be used to decrypt any ciphertext. This can be done by the cloud server which will immediately execute some algorithms to change the existing ciphertext to be un-decryptable by this device. This process is completely transparent to the sender. Furthermore, the cloud server cannot decrypt any ciphertext at any time. The security and efficiency analysis show that our system is not only secure but also practical.