Website Fingerprinting (WF) is an emerging traffic analysis technique that enables a passive adversary to infer which websites a user visits. However, most existing studies, whether in single-tab or multi-tab settings, rely on the unrealistic assumption that users only access website homepages, diverging significantly from real-world browsing behavior. Even recent works extending WF to subpages primarily focus on website-level identification, without distinguishing which specific subpages are visited, thereby limiting the attack's granularity and scope. In this paper, we propose HiFi-WF (Hierarchical Fine-grained Website Fingerprinting), a novel framework that breaks the homepage-only assumption and extends WF to multi-tab recognition and fine-grained subpage identification. We formulate the task as a hierarchical multi-label classification problem, jointly modeling the distinctions and correlations between homepages and subpages. To this end, HiFi-WF integrates a unified CNN-based extractor and layered encoder with a Feature Interaction Module based on multi-head cross-attention to capture inter-level dependencies. An Enhanced SubHead enforces hierarchical constraints to suppress invalid subpage predictions, while a cascaded channel–spatial attention mechanism refines discriminative features for precise hierarchical identification. Experimental results demonstrate that HiFi-WF achieves state-of-the-art performance at both hierarchical levels, attaining F1-scores of 92.1% (homepage) and 81.9% (subpage), thereby validating its effectiveness in advancing WF attacks toward realistic, fine-grained, and multi-tab browsing scenarios. Related codes and datasets can be found in https://github.com/wusongyang02-blip/HiFi-WF.

Natural Language Generation (NLG) applications have gained immense popularity due to the utilization of powerful deep learning techniques and large training corpora. However, the increasing prevalence of NLG models also poses a significant risk of unauthorized access or theft of intellectual property (IP). To safeguard NLG models, watermarking has emerged as a promising tool, but existing watermarking techniques based on pre-processing are prone to attacker detection and can potentially harm NLG applications. This paper proposes a novel, semantic, and stealthy watermarking scheme for IP protection of NLG models. Our approach embeds a semantic combination water mark, which is generated through a multi-stage process designed to be semantic and stealthy. This scheme endows an NLG model with a verifiable preference for specific semantic combinations, which are initiated by a foundational pattern but holistically constructed to preserve model functionality. To enhance the robustness, data embedding is systematically performed through a masked location injection. Consequently, the watermark is seamlessly integrated into NLG models without misleading their original attention mechanism. Comprehensive experiments are conducted to demonstrate that the proposed scheme is highly effective and robust in protecting the IP of NLG models while remaining stealthy to potential attackers.

The rapid evolution of the Industrial Internet of Things (IIoT) has driven unprecedented growth in industrial data volumes. To enhance cost efficiency and data-sharing capabilities, massive amounts of this data are stored in the cloud. Public Key Encryption with Keyword Search (PEKS) technology enables efficient encrypted data retrieval without key management and distribution issues and has been extensively studied for this purpose. However, due to inherent IIoT characteristics—such as heterogeneous data formats, resource-constrained devices, and heightened vulnerability to attacks, existing PEKS schemes face significant limitations: 1) typically restricted to single-keyword searches; 2) prohibitive computational overhead for resource-limited IIoT devices; 3) heightened risks of exploitation by attackers. To address these issues, we propose a lightweight certificateless authenticated encryption with multi-keyword search scheme, named CLAEMKS. It enables efficient multi-keyword search while substantially enhancing computational efficiency by eliminating the intensive bilinear pairing operations. Meanwhile, by leveraging certificateless cryptography, CLAEMKS solves certificate management problems while avoiding key escrow issues. Furthermore, formal security proofs and efficiency analyses are conducted to validate the effectiveness of our proposed scheme. The results demonstrate that CLAEMKS delivers substantial performance and security improvements.

The sixth-generation (6G) mobile communication networks are perceived as large-scale heterogeneous networks. With their increased heterogenization and densification, it is crucial to guarantee the security and efficiency of user equipment's handovers between networks. However, existing cross-domain handover authentication schemes cannot ensure handover authentication efficiency and cannot balance privacy and system efficiency, which thus cannot be directly applied in heterogeneous networks. In this paper, we present PECHA, a privacy-preserving and efficient cross-domain handover authentication scheme for heterogeneous networks, which enables anonymous authentication on user equipment (UE) through the collision property of chameleon hash functions. PECHA ensures authentication efficiency by employing the interplanetary file system and blockchain to synchronize UE's authentication information to target networks in advance. The privacy and system efficiency are balanced by modeling the unlinkability of UE's new and old chameleon hash values and determining the update frequency of UE chameleon hash value. PECHA also achieves correctness, mutual authentication and key agreement, anonymity, unlinkability, conditional privacy, forward/backward secrecy, robustness, known randomness secrecy, key escrow freeness and rapid response, and resists against spoofing attacks, replay attacks and man-in-the-middle attacks. Comprehensive performance analysis, evaluation and comparisons show that PECHA is efficient with respect to both computation and communication.

Federated learning is a technique that enables multiple parties to collaboratively train a model without sharing raw private data, and it is ideal for smart healthcare. However, it raises new privacy concerns due to the risk of privacy-sensitive medical data leakage. It is not until recently that the privacy-preserving FL (PPFL) has been introduced as a solution to ensure the privacy of training processes. Unfortunately, most existing PPFL schemes are highly dependent on complex cryptographic mechanisms or fail to guarantee the accuracy of training models. Besides, there has been little research on the fairness of the payment procedure in the PPFL with incentive mechanisms. To address the above concerns, we first construct an efficient non-interactive designated decryptor function encryption (NDD-FE) scheme to protect the privacy of training data while maintaining high communication performance. We then propose a blockchain-based PPFL framework with fair payment for medical image detection, namely ESB-FL, by combining the NDD-FE and an elaborately designed blockchain. ESB-FL not only inherits the characteristics of the NDD-FE scheme, but it also ensures the interests of each participant. We finally conduct extensive security analysis and experiments to show that our new framework has enhanced security, good accuracy, and high efficiency.

In the context of drone swarms, achieving efficient group secure communication is a challenging problem, due to the inherent limitations imposed by the drones’ limited energy and constrained resources. Physical layer group key generation (PLGK) is a promising technology to enable efficient group security communication. However, most existing PLGK schemes struggle to adapt to the dynamic nature of drone swarms. To address this gap, this paper proposes a novel satellite cluster state information (SCSI)-based PLGK, which leverages signal status information from all visible navigation satellites to establish the group key. The presented method utilizes the regional similarity of SCSI as a random information source to generate group keys between different drones, and employs a novel updating framework based on a fuzzy generator and a hash chain to enhance key update and alignment robustness. The proposed scheme not only significantly reduces the overhead of group key generation also mitigates the issues of key loss and reconstruction. The security of the proposed scheme is validated through formal protocol security proof and security analysis against possible attacks. Finally, experiments with real-world drones demonstrate the efficiency and effectiveness of the SCSI-based PLGK.

Visual Question Answering (VQA) is the vision-language task of answering text-based questions presented in an image and has been advanced by the remarkable success of multimodal deep networks. Similar to unimodal networks, multimodal VQA models are also vulnerable to adversarial examples, which raises severe threats to the corresponding applications. Although several adversarial training methods have been proposed, most of them focus on improving the generalization ability of VQA models on clean samples instead of mitigating the adversarial attacks. In this paper, we systemically analyze the core structure of multimodal VQA networks and propose a novel adversarial training algorithm to mitigate adversarial attacks on VQA models. Specifically, our key component is a regularization term with our carefully designed Contrastive Fusion Representation (CFR), which can reduce the sensitivity of VQA models to adversarial perturbations of both the vision and language inputs. We further enhance the adversarial training with augmented CFRs. Comprehensive experimental results show that our method can mitigate adversarial attacks as well as preserve the generalization ability on clean samples under various system settings and outperforms other defense methods.

The Industrial Internet of Things (IIoT) incorporates massive physical devices to collect ambient data. Due to the limited types of equipment in IIoT, most of the data has to be saved on a cloud server before it can be processed and analyzed. The ciphertext generated by traditional encryption techniques is difficult to search in subsequent use. Public-key encryption with keyword search (PEKS) can provide data encryption as well as confidential searching, but traditional PEKS schemes are susceptible to internal keyword guessing attacks (IKGAs) caused by the limited space of commonly used keywords. To address this issue, the cryptographic primitive of public-key authenticated encryption with keyword search (PAEKS) was proposed, while most of the existing schemes are not appropriately applied to IIoT for involving time-consuming bilinear pairing operations. In this article, we first propose a user-friendly PAEKS scheme that totally circumvents bilinear pairing operations during generating keyword ciphertext and trapdoor. Then, we prove its multiciphertext indistinguishability (MCI) and trapdoor privacy based on decisional$q$-ABDHE and computational Diffie–Hellman assumptions in the random oracle model together with conducting the theoretical and experimental comparisons. The results show that the computational overhead of our proposal is significantly reduced comparing with most existing classical PAEKS schemes without causing other communication costs or security loss. Due to its better performance and security, our scheme is better suited for lightweight devices in the IIoT.

Cloud-assisted electronic health records (EHRs) provide convenient medical services for patients by storing and analyzing medical data records in the cloud, but searching for sensitive data (e.g., identity, medical history) in the cloud conflicts with privacy protection requirements. Searchable encryption (SE) is a good cryptographic primitive for solving this conflict, which allows the user to store their encrypted data in the cloud and search them later in encrypted domain. However, the direct applications of most existing SE schemes in cloud-assisted EHRs may result in challenges, for example in terms of functionality, security and efficiency. In this paper, we propose BPVSE, a new verifiable and dynamic SE scheme for cloud-assisted EHR. BPVSE has the following advantages over existing approaches. First, leveraging blockchain and hash-proof chain, BPVSE allows the user to publicly verify the search result returned by the cloud without a trusted authority. Second, BPVSE supports dynamic datasets with forward and backward security, using our newly designed new hidden data structure. Third, BPVSE enables the user to launch parallel search with efficient encryption. We formally prove the security of the proposed BPVSE, and also conduct theoretical comparison and experimental evaluation to show its superiority of functionality, security, and efficiency.

Medical image fusion generates a fused image containing multiple features extracted from different source images, and it is of great help in clinical analysis and diagnosis. However, training a deep learning model for image fusion usually requires enormous computing power, especially for large volumes of medical data. Meanwhile, the privacy of images is also a critical issue. In this article, we propose a privacy-preserving blockchain-based medical image fusion (BMIF) framework. First, to ensure fusion performance, we design a new medical image fusion model based on convolutional neural network and Inception network and integrate the proposed model into the consensus process of blockchain. Next, to save computing power of blockchain, we design a consensus mechanism by requesting consensus nodes to train the fusion model instead of calculating useless hash values in traditional blockchain. Then, to protect data privacy, we further present an efficient homomorphic encryption to realize the training of fusion model on encrypted medical data. Finally, we conduct theoretical analysis and extensive experiments on public datasets to evaluate the feasibility and the performance of our proposed BMIF. The results exhibit that BMIF is efficient and secure, and our medical image fusion network performs better than state-of-the-art approaches.

In cloud storage, how to search sensitive data efficiently and securely is a challenging problem. The searchable encryption technique provides a secure storage method without loss of data confidentiality and usability. As an important branch of searchable encryption, public-key encryption with keyword search (PEKS) is widely studied by scholars. However, most of the traditional PEKS schemes are vulnerable to the inside keyword guessing attack (IKGA). Resisting the inside keyword guessing attack is likely to become an essential property of all new PEKS schemes. For a long time, mitigating IKGA has been inefficient and difficult, and most existing PEKS schemes fail in achieving their security goals. To address the above problems, we define the notion ofDual-serverPublic-keyAuthenticatedEncryption withKeywordSearch (DPAEKS), which protects against IKGA by leveraging two servers that do not cooperate, and supports the authentication property. Then, we provide a construction of DPAEKS without bilinear pairings. Experimental results obtained using a real-world dataset show that our scheme is highly efficient and provides strong security, making it suitable for deployment in practical applications.

Smart home is a good exemplification of the Internet of Things (IoT). Many researchers study how to make smart home systems (SHS) smarter. However, the security of SHS is also worth studying as user's information is collected from the devices and security-sensitive data are communicated through an open network. Therefore, how to guarantee the security of the data transmission in SHS is an important problem. In this paper, we propose a new secure data transmission scheme with access control to protect the data transmission in SHS. In our scheme, data transmission is secured by a new cryptographic primitive called access control encryption (ACE). Different from other existing solutions in SHS, our scheme controls not only which messages smart devices can receive, but also which messages they can send. Our experimental results demonstrate the effectiveness and efficiency of our proposed mechanism.

The Internet of Things (IoT) is gradually stepping out of its infancy into maturity. Its widespread applications cover from tiny wearable devices to large industrial systems. Although many security solutions have been introduced to address data security and privacy problems caused by the unique characteristics of IoT, how to simultaneously achieve data confidentiality, protect the privacy of access control policy, and provide reasonable data source identification has been a challenging problem. Moreover, lacking one of the above properties may result in serious issues (e.g., leakage information and forging identity), and the situation grows steadily worse with the expansion of “things” scale. To address the above issues, we propose a new cryptographic primitive named certificateless matchmaking encryption (CL-ME), which inherits the security properties of certificateless cryptosystem and matchmaking encryption. Meanwhile, we also present two effective concrete constructions with formal security proofs based on the standard hard assumptions. The basic construction is the first instance of CL-ME based on bilinear pairing, and the enhanced construction is a pairing-free lightweight solution. Finally, we implement our proposed schemes using popular cryptography library and compare their performance with existing works. Theoretical analysis and experimental evaluations demonstrate that our proposed schemes are more suitable for IoT environment.