Attribute-Based Encryption (ABE) is an advanced public-key encryption paradigm that enforces fine-grained access control over encrypted data. For instance, the data owner can generate the ciphertext associated with ((”Cardiology” OR ”Critical Care Medicine”) AND ”Consultant Physician”), which can only be decrypted by other data users whose attributes satisfy this access policy. However, a major efficiency drawback of ABE is that ciphertext size, encryption time, and decryption time grow with the complexity of the access policy and the number of attributes. To address this issue, we propose an adaptively secure, offline/online and outsourcing ABE scheme under the Generic Group Model. The majority of encryption operation is performed during the offline phase, while ABE ciphertext is quickly assembled during the online phase. Decryption outsourcing enables the edge node to convert the original ABE ciphertext into an ElGamal-style ciphertext using a transformation key without revealing the plaintext message to the edge node. Our approach is efficient and suitable for mobile devices. Performance evaluation demonstrates the system can balance computation and power consumption over an extended period, effectively addressing challenges in data sharing.

Self-Sovereign Identity (SSI) aims to enable a physical-world persona to autonomously own and manage his digital identity, which serves as a mapping of his real-world identity into cyberspace and has become an essential paradigm in trusted digital identity management. Although current state-of-the-art SSI schemes provide security properties such as Sybil-resistance, privacy-preserving, or regulation, they typically employ static identifier(s) to represent a persona's identity, rendering them vulnerable to identity forgery or theft, and they still fail to simultaneously address the problems of privacy leakage, Sybil attacks, and inadequate regulation. To overcome these limitations, we propose a secure self-sovereign identity scheme that integrates SoulBound Token (SBT) and a trusted personal data space. In our design, each physical-world persona has a unique, individual-specific identity engine generated from verified biometric data and metadata, with a non-transferable SBT bound to it via a smart contract, thereby enhancing resistance to Sybil attacks and making the identity misappropriation significantly harder. To further prevent an identity from being linked by service providers, we construct a distinct child identity engine for each service using behavioral history stored in a trusted personal data space. Moreover, we design a conditional and collaborative regulation mechanism that ensures malicious digital identities and service providers are traceable and subject to supervision. Finally, we perform a security and performance analysis to demonstrate that our scheme is practical, secure, and offers several advantages over state-of-the-art solutions.

Sharding is an important solution to improve the scalability of blockchain. The basic idea of blockchain sharding is to separate transactions among multiple disjoint shards processing in parallel to maximize system performance. The current sharding protocols mainly rely on node rotation (namely, node allocation and migration) randomly among shards periodically to ensure security, which is often considered the most challenging when developing a sharding system. However, (1) if a shard or multiple shards are corrupted, the sharding system will not be available anymore; (2) to avoid shard corruption, the demand of large size of each shard limits the throughput performance of sharding protocols. To solve (1), we introduce a blockchain sharding protocol with scale-out transaction processing capacity called CShard. The main idea of CShard is to use repairable fountain codes (RFCs), an information coding method with the locality feature, to innovate sharding design. By adjusting encoding parameters, topological associations among shards are constructed, which are then utilized to define the verification logic for transactions. The blocks of corrupted shard(s) can be recovered through decoding by its corresponding shard group(s), and the sharding system is still secure and available. Our approach utilizes encoding techniques to build a general architecture of a sharding system, establishing a paradigm of “encoding as verification” and showcases new horizons in the field of blockchain sharding. To solve (2), we propose the ghost reporter mechanism that gives all nodes chances to verify a transaction by submitting reports in the sharding network. The mechanism brings two direct benefits. Firstly, it provides the way to detect corrupted shards and recover the blocks by RFCs; the second is to make the number of nodes in a single shard smaller, which solves the limitation of existing sharding schemes that usually require a larger number of nodes in a single shard to ensure security. In principle, this mechanism can also be applicable to the known and even unknown sharding protocols for its generality.

In recent years, Building Information Modeling (BIM) has been widely used in the field of rail transit and plays an important role. Due to the numerous and complex elements of BIM file data, they are shared and used by multiple departments. Traditional BIMs that exist in the form of files are stored independently on centralized servers or local machines, lacking systematic management methods. Data update and maintenance are quite cumbersome. Besides, multi-departmental interaction and collaboration are inefficient and untrustworthy. Therefore, we propose a blockchain-based trusted sharing method for rail transit BIM data. First, a blockchain-based distributed BIM data sharing system architecture is proposed. Second, smart contracts are designed to achieve on-chain protection and shared use of digital resources such as rail transit BIM models. Third, the BIM data access control mechanism based on attribute-based encryption is proposed, and we implement a prototype of a trusted shared access system with permission control for multiple departments based on the InterPlanetary File System (IPFS) and the security mechanisms of Software Guard Extensions (SGX). Finally, the feasibility of the method is verified through scheme comparison, security analysis, and prototype system performance testing.

DDoS (Distributed Denial of Service) attacks are increasingly becoming a major threat in the field of cybersecurity. They overwhelm target servers by sending large-scale requests from multiple locations, causing the servers to become unresponsive. The distributed nature of DDoS attacks also makes detection and defense even more challenging. As the damage caused by such attacks grows, the development of efficient detection and mitigation mechanisms has become an urgent priority. While traditional machine learning methods are useful, they still require manual feature extraction, which not only involves significant human intervention, but also is time-consuming. In contrast, deep learning offers an automated approach to feature extraction and can learn more abstract patterns, which leads to improved detection performance. Therefore, this paper reviews and analyzes existing deep learning methods for DDoS attack detection. We provide a comprehensive analysis of the various types of DDoS attacks and explore different deep learning models employed for attack detection. Additionally, we explore techniques such as federated learning that can be integrated with deep learning, and analyze their related literature in DDoS attack detection. Finally, we specify future research directions on DDoS attack detection using deep learning.

Blockchain-based federated learning (BFL) has gained attention for its potential to establish decentralized trust. While existing research primarily focuses on personalized frameworks for various applications, essential aspects including incentive mechanisms—critical for ensuring stable system operation—remain under-explored. To bridge this gap, we propose a game-theoretic incentive mechanism designed to foster active participation in BFL tasks. Specifically, we model a BFL system comprising a model owner (MO), i.e., task publisher, multiple miners, and training terminals, framing their interactions through two-tier Stackelberg games. In the first-tier game, the MO designs reward strategies to incentivize training terminals to contribute more data, enhancing model accuracy. The second-tier game introduces a multi-leader multi-follower Stackelberg game, enabling miners to set model packaging prices based on competitors' strategies and anticipated user behavior. By deriving the Stackelberg equilibrium, we identify optimal strategies for all participants, leading to an incentive mechanism balancing individual interests with overall performance. Compared to its benchmarks, our incentive mechanism offers 5.8% and 53.4% higher utilities in the two games compared to its alternatives, accelerating convergence and improving accuracy.

The disruptive blockchain technology is expected to have broad applications in many areas due to its advantages of transparency, fault tolerance, and decentralization, but the open nature of blockchain also introduces severe privacy issues. Since anyone can deduce private information about relevant accounts, different privacy-preserving techniques have been proposed for cryptocurrencies under the UTXO model, e.g., Zerocash and Monero. However, it is more challenging to protect privacy for account-model blockchains (e.g., Ethereum) since it is much easier to link accounts in the account-model blockchain. In this article, we proposeBlockMaze, an efficient privacy-preserving account-model blockchain based on zk-SNARKs. Along with dual-balance model, BlockMaze achieves strong privacy guarantees by hiding account balances, transaction amounts, and linkage between senders and recipients. Moreover, we provide formal security definitions and prove the security ofBlockMaze. Finally, we implement a prototype ofBlockMazebased on Libsnark and Go-Ethereum, and conduct extensive experiments to evaluate its performance. Our 300-node experiment results show that BlockMaze has high efficiency in computation and transaction throughput: one transaction verification takes about 14.2 ms, one transaction generation takes 6.1-18.6 seconds, and its throughput is around 20 TPS.