Internet of Things (IoT) devices can utilize deep learning (DL) to boost their intelligence, but also suffer from the long model training process. IoT devices thus may reuse public pretrained models to expedite the training through transfer learning. However, pretrained models may be subject to model-reuse attacks initiated by malicious DL servers, causing models to misclassify targeted data, which poses a threat to the security of IoT devices. In this work, we propose a new model usability detection scheme, the defense against model-reuse attacks (DMRAs), suitable for IoT scenarios. DMRA employs a variant of Lagrange’s mean value theorem to reverse-check the model, which is computationally efficient, thus, suitable for resource-constrained devices. Experimental evaluations on different data sets first validate that model-reuse attacks can attack models in federated learning. And, then demonstrate that DMRA detects such insidious attacks with up to 80% success rate at a lightweight computational cost.

Privacy protection in the era of big data has attracted attention, and privacy leakage may cause severe user losses. Federated learning (FL) is a distributed machine learning framework that stores data locally in participating nodes. FL is an effective way to protect data privacy under the current background of artificial intelligence. Blockchain is a distributed data structure with the advantages of decentralization, non-tampering, and non-counterfeiting. Traditional FL relies on centralized servers and is prone to the single point of failure, and the problem can be avoided by replacing the centralized server with blockchain technology. However, unauthorized participants may launch poison attacks, and untrusted nodes in the blockchain send faulty aggregation models to users, reducing the model’s availability. Given the above problems, this paper proposes an FL (DS-AVFL) framework with authentication and verification. Blockchain technology is used for dynamic identity management, only updates uploaded by authenticated local devices can be added to the blockchain, and local devices can verify the received global model. Experimental results show that the scheme is feasible and has reasonable computing costs.

Presently, under the condition of privacy preserving, vertical federated learning (VFL) has played an important role in training the machine learning (ML) models in the application scenarios, such as medical prediction, fraud detection, in which the data is distributed vertically. Random forest (RF) is one of the most widely used ML methods in VFL, which has the advantages of strong predictive performance, availability, and the ability to parallel tasks. However, current research on privacy preserving of vertical federated RF is limited, and none of them can achieve the application level of security, that is, in a system where users are dynamically changing, not only privacy can be preserved, but also data integrity can be verified. Therefore, we propose a verifiable privacy-preserving scheme (VPRF) based on vertical federated RF, in which the users are dynamic change. First, we design homomorphic comparison and voting statistics algorithms based on multikey homomorphic encryption for privacy preservation. Then, we propose a multiclient delegated computing verification algorithm to make up for the disadvantage that the above algorithms cannot verify data integrity. Finally, we used the data sets in UCI ML warehouse to evaluate the proposed scheme. The experiment results indicate that our scheme is more efficient than the existing ones that can achieve the same security level.

Hybrid cloud has both the strong computing power of public cloud and easy control of private cloud. It provides users with robust services and convenience, meanwhile faces numerous security challenges. How to implement the effective access control is one of them, the purpose of which is deploying policy in private cloud to protect the ciphertext in public cloud. Furthermore, it becomes more and more difficult to describe the access control policy, which is suitable for multi-factor and dynamic updating. Considering the issues above, we propose a proxy re-encryption (PRE) scheme for complicated access control factors description in hybrid cloud. Firstly, we build the system model combining PRE with access control in hybrid cloud. Secondly, we design the algorithm for our scheme including the key construction with multi-factor and its weight, which achieve the target of dynamic updating. Finally, we analyze the security of this scheme by the mathematical method and performance by theory, experiment and comparisons with some other works. Our scheme has made the deployment of access control in hybrid cloud more reliable and scalable.

With the development of science and technology, mobile phones have gained unprecedented popularity, subsequently the applications based on mobile phone perception have become widespread. Mobile sensing encourages many users to participate in data collection tasks through their mobile phones, but this process raises privacy issues. Previous studies have either used additive homomorphism to protect data privacy or aggregated methods to provide identity privacy protection. However, little research has been done on data dynamics and how to improve aggregation efficiency in multi-user scenarios. To solve this problem, we propose a privacy preserving fog-enabled dynamic data aggregation protocol in mobile phone sensing, named FDDA. In the proposal, we first add fog nodes to our framework, allowing fog nodes to aggregate a set of user data at the same geographical location without identifying the data sources. Then, we design data dynamics strategy to support the user joining and revoking effectively. Finally, we show that our protocol can be well applied in actual scenarios through security analysis and simulation experiments.

An Internet of Things (IoT) system generally contains thousands of heterogeneous devices which often operate in swarms-large, dynamic, and self-organizing networks. Remote attestation is an important cornerstone for the security of these IoT swarms, as it ensures the software integrity of swarm devices and protects them from attacks. However, current attestation schemes suffer from single point of failure verifier. In this paper, we propose an Efficient and Secure Distributed Remote Attestation (ESDRA) scheme for IoT swarms. We present the first many-to-one attestation scheme for device swarms, which reduces the possibility of single point of failure verifier. Moreover, we utilize distributed attestation to verify the integrity of each node and apply accusation mechanism to report the invaded nodes, which makes ESDRA much easier to feedback the certain compromised nodes and reduces the run-time of attestation. We analyze the security of ESDRA and do some simulation experiments to show its practicality and efficiency. Especially, ESDRA can significantly reduce the attestation time and has a better performance in the energy consumption comparing with list-based attestation schemes.

Large-scale matrix computation requires a lot of computing resources, but the emergence of cloud computing provides resource-limited users with an economical solution, namely outsourcing computation. Clients can use pay-per-use service of cloud resources to solve complex issues, such as matrix inversion. However, due to the inclusion of privacy information in users' data and the opacity of the calculation operations, clients are in face of the threats of privacy disclosure and fraud. In this paper, we first propose an efficient and secure scheme without precondition for outsourcing large- scale matrix inversion to a public cloud. Compared to the state-of-the-art schemes, our scheme does not require the precondition that the original matrix should be invertible. It relieves clients from checking the invertibility of matrix, which is hard to be implemented with limited resource in reality. Moreover, our scheme can protect clients from being cheated and provide data privacy protection. Experiment results also show that our scheme is highly efficient in practical.