Federated learning (FL) is a prevalent distributed machine learning framework that allows multiple clients to train one model by uploading gradients without sharing data, enabling cooperative learning while preserving the training data privacy. Nevertheless, recent research has revealed that shared gradients can still expose clients' private training data. These attacks, however, often become ineffective in two practical scenarios: (1) gradients are computed on high-resolution data; (2) labels are duplicated within the attacked batch. In this work, we introduce an advancedGradientLeakageAttack againstDuplicate labels (GLAD), which can effectively recover high-resolution training data from gradients while considering duplicate labels, making it applicable in more realistic FL scenarios. The key technique ofGLADis to formalize the relationships between model outputs, gradients, model parameters, and training data labels. Based on these relationships,GLADfurther reconstructs the model outputs and inverts the reconstructed model outputs back to the corresponding model inputs. Our method can achieve state-of-the-art recovery accuracy while ensuring efficiency. Extensive experimental results demonstrate thatGLADcan reconstruct images of 224× 224pixels with a batch size of 256 with duplicate labels. Our source code is available athttps://github.com/SuperX612/GLAD.

Recently, private and robust federated learning (FL) schemes have been proposed to address privacy inference and Byzantine attacks simultaneously. However, existing schemes are inefficient in private and robust aggregation protocols due to the employment of heavy cryptographic techniques. To approach the above problem, we propose Sanitizer, an efficient, private, and robust FL framework. Specifically, we first design a Byzantine-robust defense for communication-efficient sign-based FL. We further propose a customized private and robust aggregation scheme built on our Byzantine-robust defense for FL. The core of our construction is two new efficient protocols, i.e.,high-dimensional boolean summationandweighted boolean majority vote, which serve as the main building blocks of Sanitizer. Extensive evaluations on real-world datasets demonstrate that Sanitizer is blazing fast, achieving 19 ∼ 23× less runtime compared to the state-of-the-art. Meanwhile, Sanitizer achieves the same accuracy as the plaintext and superior Byzantine robustness against various classic attacks.

Federated learning allows clients to share model gradients instead of privacy-sensitive data, which can solve the issue of data silos, but lead to the problem of data privacy leakage due to the model gradient revealing the characteristics of the training data. Privacy-preserving federated learning based on homomorphic encryption schemes (HE-based PPFL) can properly solve the issues of participantsfs data privacy leakage, but they encounter some new challenges. Existing PPFL-based single-key homomorphic encryption schemes face the problem that clients can obtain othersf model gradients due to the shared key and PPFL-based multi-key homomorphic encryption schemes face the issues of incomplete privacy protection for models and high communication overhead due to the requirement of the collaborated decryption. Moreover, existing PPFL schemes either assume the server is always honest or the verification method is unreliable and expensive. To tackle these emerging challenges in HE-based PPFL, we propose an enhancing privacy-preserving and verifiable federated learning scheme. Specifically, we first construct a novel multi-key homomorphic encryption algorithm that achieves single-key decryption instead of the collaborated decryption in traditional PPFL-based multi-key homomorphic encryption. Meanwhile, we design a blockchain-based public verification method for the global model by applying a vector homomorphic hash, which can properly solve the issues of unreliable and expensive global model verification of the existing global model verification methods. Formal security analysis shows that the proposed scheme can well provide complete privacy protection and guarantee the integrity of the global model. Extensive experiments demonstrate that the proposed schemes can keep high accuracy (≈95%) compared with existing differential privacy-based PPFL schemes (≤90%). Meanwhile, the proposed schemes can achieve no decryption share size (0MB) compared to existing HE-based PPFL schemes and efficient verification compared wit

Call detail records (CDRs) provide valuable insights into user behavior, which are instrumental for telecom companies in optimizing network coverage and service quality. However, while cloud computing facilitates clustering analysis on a vast scale of CDR data, it introduces privacy risks. The challenge lies in striking a balance between efficiency, security, and cost-effectiveness in privacy-preserving algorithms. To tackle this issue, we propose a privacy-preserving and cost-effective incremental density peak clustering scheme. Our approach leverages homomorphic encryption and order-preserving encryption to enable direct computations and clustering on encrypted data. Moreover, it employs reaching definition analysis to optimize the execution flow of static tasks, pinpointing the optimal junctures for transitioning between the two types of encryption to reduce communication overhead. Furthermore, our scheme utilizes a game theory-based verification strategy to ascertain the accuracy of the results. This methodology can be effectively deployed on the Ethereum blockchain via smart contracts. A comprehensive security analysis confirms that our scheme upholds both privacy and data integrity. Experimental evaluations substantiate the clustering accuracy, communication load, and computational efficiency of our scheme, thereby validating its viability in real-world applications.

Deep neural networks (DNNs) are known to be susceptible to various malicious attacks, such as adversarial and backdoor attacks. However, most of these attacks utilize additive adversarial perturbations (or backdoor triggers) within an$L_{p}$-norm constraint. They can be easily defeated by image preprocessing strategies, such as image compression and image super-resolution. To address this limitation, instead of using additive adversarial perturbations (or backdoor triggers) in the pixel space, this work revisits the design of adversarial perturbations (or backdoor triggers) from the perspective of color space and conducts a comprehensive analysis. Specifically, we propose a color space backdoor attack and a color space adversarial attack where the color space shift is used as the trigger and perturbation. To find the optimal trigger or perturbation in the black-box scenario, we perform an iterative optimization process with the Particle Swarm Optimization algorithm. Experimental results confirm the robustness of the proposed color space attacks against image preprocessing defenses as well as other mainstream defense methods. In addition, we also design adaptive defense strategies and evaluate their effectiveness against color space attacks. Our work emphasizes the importance of the color space when developing malicious attacks against DNN and urges more research in this area.

Federated learning (FL) is a distributed machine learning technique that guarantees the privacy of user data. However, FL has been shown to be vulnerable to gradient leakage attacks (GLA), which have the ability to reconstruct private training data from public gradients with high probability. These attacks are either analytic-based, requiring modification of the FL model, or optimization-based, requiring long convergence times and failing to effectively address the challenge of dealing with highly compressed gradients in practical FL systems. This paper presents a pioneering generation-based GLA method called FGLA that can reconstruct batches of user data without the need for the optimization process. We specifically design a feature separation technique that first extracts the features of each sample in a batch and then directly generates the user data. Our extensive experiments on multiple image datasets show that FGLA can reconstruct user images in seconds with a batch size of 256 from highly compressed gradients (0.8% compression ratio or higher), thereby significantly outperforming state-of-the-art methods.

The two-factor authentication (2FA) has been increasingly used with the popularity of mobile devices. Currently, many existing 2FA schemes extract the devices’ acoustic fingerprints as the second factor. Nevertheless, they mainly consider deriving fingerprints from the raw acoustic waveforms for authentication, which are susceptible to the fingerprint variations caused by the environmental noise or the varying distance between devices. To address these vulnerabilities, we propose a robust system utilizing the distortions of modulated signals, which are incurred by the acoustic elements of mobile devices, as the proof for 2FA. Specifically, our system first designs a channel delay estimation scheme to accurately estimate the propagation delay from the speaker to the microphone by deriving the phase change of the received sinusoidal signal. To perform a robust authentication, we design a new acoustic fingerprinting scheme to remove the impacts of the varying distance and environmental noise from the demodulated PSK signals for fingerprint extraction. Moreover, our device authentication component designs a transfer learning-based scheme to capture the subtle differences in devices’ fingerprints for accurate device authentication. To the best of our knowledge, this is the first 2FA system that could extract acoustic fingerprints in modulation domain and can effectively withstand the impacts of channel distortions. We also confirm the accuracy and security of our system through extensive user experiments.

Physical layer-based secret key generation has garnered significant attention due to its inherent advantages of lightweight implementation, information-theoretic security, and broad applicability for mobile devices. The reciprocal randomness of the wireless channel ensures the consistent generation of secret bits between two communicating parties. However, it also suffers from the degradation of the efficiency of key generation attributed to the adverse impact of ambient noise, despite sustained efforts to mitigate the inconsistency during quantization. We find that a slight perturbation of the pilot signal, without affecting the correct reception of data frames, induces a corresponding change in the channel response, making it possibly adaptable to the target quantization strategies, thereby reducing the probability of key mismatch. Therefore, we take a different viewpoint on proactive contamination of the pilot signals to obtain the desired channel measurements for accurate physical layer secret key generation. Specifically, we design an adaptive pilot manipulation to avoid the expected channel measurements being too close to the quantization thresholds, enabling high quantization consistency. Furthermore, we also develop a random cross-threshold mechanism to prevent attackers from inferring the quantization results by monitoring the trend of pilot signal variations. A reliable long training sequence (LTS) modification mechanism is incorporated into our method to ensure communication performance by adaptively adjusting the scale of the pilot signal. To validate the effectiveness of our proposed method, we implement a prototype by re-configuring software modules in GNU radio running on the USRP platform. Extensive experiments demonstrate that our scheme outperforms existing representative quantization schemes with better key generation performance.

Mobile crowdsourcing federated learning (FL-MCS) allows a requester to outsource its model-training tasks to other workers who have the desired data as well as strong computing power. FL-MCS can thereby overcome the limitations of computing capability as well as the data availability of participants. However, FL-MCS still faces the problem of workers’ data privacy leakage when diverse malicious attacks (e.g., gradient inference attacks) are launched. To address these problems, some privacy-preserving FL-MCS (PPFL-MCS) schemes are proposed to aggregate local models at a central server. Unfortunately, these schemes are vulnerable to single-point-of-failure and other malicious attacks at the central server. Meanwhile, the workers may drop from the online task due to the erratic communication network in PPFL-MCS schemes, thereby resulting in the failure of the entire model aggregation. To solve these issues, we propose a novel dropout-tolerated and privacy-preserving decentralized FL-MCS scheme, namely DTPP-DFL-MCS based on blockchain. Specifically, we define a novel cryptographic primitive, i.e., ID-based Aggregated Decryptable Broadcast Encryption (AD-IBBE) based on traditional ID-based broadcast encryption. In AD-IBBE, the senders’ ciphertexts can only be decrypted by themselves while the aggregated ciphertexts can be decrypted by all receivers in the broadcast group. Then, we design a homomorphic AD-IBBE algorithm, which is formally proved to be semantically secure. We next devise the decentralized PPFL-MCS scheme to guarantee the confidentiality of model gradients against internal and external adversaries. Moreover, we design a dropout-tolerated aggregation method to ensure the robustness of our decentralized PPFL-MCS scheme even if some workers lose connection. Extensive experimental results on different models and datasets demonstrate that the proposed scheme guarantees a close model accuracy to the non-dropout case. Even when some workers are offline, our scheme still performs more efficiently than existing schemes in terms of dropout aggregation overhead.

In information security, random number quality is closely related to cryptographic system security; moreover, random number quality depends on the corresponding entropy source quality. Therefore, evaluating the entropy source quality is extremely important. For existing evaluation methods, the ability of statistical-based entropy estimators to extract and learn data information is weak, resulting in lower entropy evaluation accuracies for some complex entropy sources. The prediction-based (especially neural network-based) entropy estimators with machine learning techniques have strong data-fitting and feature-extracting capabilities and can more accurately estimate the entropy values of complex entropy sources. However, owing to the relatively simple architecture of 1D neural networks, the 1D neural networks used by these estimators frequently reach bottlenecks, seriously limiting the further improvement in entropy estimation accuracy. Considering the above issues, this paper innovatively proposes an entropy estimation method based on a 2D-CNN and a multi-head self-attention mechanism. First, we built the MA-DG Net model. This model converts 1D random number sequences into 2D images via the GAF and DFT methods and then uses a 2D-CNN to extract and learn feature information from 2D images while retaining the original 1D sequential feature information via a multi-head self-attention mechanism. Next, we train the model to find its optimal parameters. Finally, we test the evaluation effect of the model using simulated datasets with known min-entropy and a real-world dataset with unknown min-entropy. The results show that compared with the entropy estimators in the experiment, our model achieves the lowest average relative error in entropy estimation on the simulated dataset of only 1.03%. In the real-world dataset, our model achieves the lowest entropy estimation value, which is an average of 0.88 lower than that of the other entropy estimators in the experiment.

The indoor location awareness has drawn increasing attention as the mobile apps are used extensively in our daily lives. Existing indoor localization solutions either require a pre-installed infrastructure or can only achieve room-level accuracy, which could not provide a function-location service for mobile devices. In this work, we propose a new active sensing system that enables smartphones to identify some pre-defined indoor locations robustly without requiring any additional sensors or pre-installed infrastructure. The main idea behind our system is to utilize the acoustic signatures, which are derived from the mobile device by emitting a beep signal and selecting its echoes created by dominant reflectors, as the robust fingerprint for location identification. Given the microphone samplings, our system designs a correlation based technique to accurately detect the beginning points of echoes from the received beep signal. To achieve a robust location identification, we develop a new echo selection scheme to select echoes created by dominant reflectors by exploiting the relationships between propagation delays of different orders of echoes. To deal with the variable number of selected echoes, our location identification component then derives histograms from selected echoes and uses the one-against-all SVM classifiers to determine the current location. Our experimental results show that our proposed system is accurate and robust for location identification under various real-world scenarios.

Federated learning (FL) is a distributed machine learning technology that preserves data privacy. However, it has been shown to be vulnerable to gradient leakage attacks (GLA), which can reconstruct private training data from public gradients with an overwhelming probability. Nevertheless, these attacks either require modification of the FL model (analytics-based) or take a long time to converge (optimization-based) and fail in dealing with highly compressed gradients in practical FL systems. In this paper, we pioneer a generation-based GLA method called FGLA that can reconstruct batches of user data, forgoing the optimization process. Specifically, we design a feature separation technique that extracts the feature of each data in a batch and then generates user data directly. Extensive experiments on multiple image datasets demonstrate that FGLA can reconstruct user images in milliseconds with a batch size of 256 from highly compressed gradients (0.8% compression ratio or higher), thus substantially outperforming state-of-the-art methods.

Federated learning (FL) preserves data privacy by exchanging gradients instead of local training data. However, these private data can still be reconstructed from the exchanged gradients. Deep leakage from gradients (DLG) is a classical reconstruction attack that optimizes dummy data to real data by making the corresponding dummy and real gradients as similar as possible. Nevertheless, DLG fails with highly compressed gradients, which are crucial for communication-efficient FL. In this study, we propose an effective data reconstruction attack against highly compressed gradients, called highly compressed gradient leakage attack (HCGLA). In particular, HCGLA is characterized by the following three key techniques: 1) Owing to the unreasonable optimization objective of DLG in compression scenarios, we redesign a plausible objective function, ensuring that compressed dummy gradients are similar to the compressed real gradients. 2) Instead of simply initializing dummy data through random noise, as in DLG, we design a novel dummy data initialization method, Init-Generation, to compensate for information loss caused by gradient compression. 3) To further enhance reconstruction quality, we train an ad hoc denoising model using the methods of “first optimizing, next filtering, and then reoptimizing”. Extensive experiments on various benchmark data sets and mainstream models show that HCGLA is an effective reconstruction attack even against highly compressed gradients of 0.1%, whereas state-of-the-art attacks can only support 70% compression, thereby achieving a 700-fold improvement.

Generally, power utilities can utilize smart-meter data to extract load patterns through load-profiling technologies, such as$K$-means clustering. To improve the efficiency of load profiling, both$K$-means clustering and smart-meter data can be outsourced to powerful clouds. However, clouds are not completely trustworthy: private meter data may be used for commercial interests;$K$-means clustering may also be performed with fewer iterations to save computational costs, which violates the integrity of outsourced clustering. In this article, therefore, a secure$K$-means-clustering scheme is proposed, called privacy-preserving and integrity-preserving clustering (PIPC), which aims to protect the privacy and integrity of load profiling. To this end, two techniques are designed: 1) encrypted distance measurement, in which a public comparison matrix is constructed by securely embedding a secret key matrix and 2) integrity assurance, in which a specific Stackelberg game is designed to create economic incentives. The former, as the core of$K$-means clustering, can protect the privacy of meter data. The latter ensures that clouds can obtain the maximum utility only when clouds execute$K$-means clustering in an honest manner, thereby preserving the integrity of outsourced computing. Experimental results demonstrate that PIPC reaches high clustering accuracy and computational efficiency for load profiling while retaining smart-meter data privacy and outsourced-clustering integrity.

In this paper, we investigate the efficiency of network access control with the co-existence of multiple network operators and propose an efficient and secure network access control architecture (ESNAC) that offers fast identity authentication and access authorization in space-air-ground integrated networks. The major challenge lies in enabling multiple independent network operators to authorize and authenticate mobile users for network access in a secure and efficient way, even they are not mutually trusted. To address this challenge, we introduce an aggregate anonymous credential mechanism to enable a mobile user to present network access authorization of a group of network operators based on the consolidated anonymous credential that is aggregated from the partial anonymous credentials of the network operators. In addition, the efficient authentication of packet delivery is provided based on a sequential aggregate signature that allows each network operator to sign network packets for authentication and sequentially aggregate signatures for communication efficiency. Finally, we discuss the desired security properties of ESNAC and demonstrate its computational and communication efficiency by comparing with the conventional scheme without aggregation.

Outsourced inference service has enormously promoted the popularity of deep learning, and helped users to customize a range of personalized applications. However, it also entails a variety of security and privacy issues brought by untrusted service providers. Particularly, a malicious adversary may violate user privacy during the inference process, or worse, return incorrect results to the client through compromising the integrity of the outsourced model. To address these problems, we propose SecureDL to protect the model’s integrity and user’s privacy in Deep Neural Networks (DNNs) inference process. In SecureDL, we first transform complicated non-linear activation functions of DNNs to low-degree polynomials. Then, we give a novel method to generate sensitive-samples, which can verify the integrity of a model’s parameters outsourced to the server with high accuracy. Finally, We exploit Leveled Homomorphic Encryption (LHE) to achieve the privacy-preserving inference. We shown that our sensitive-samples are indeed very sensitive to model changes, such that even a small change in parameters can be reflected in the model outputs. Based on the experiments conducted on real data and different types of attacks, we demonstrate the superior performance of SecureDL in terms of detection accuracy, inference accuracy, computation, and communication overheads.

Load profiling is to cluster power consumption data to generate load patterns showing typical behaviors of consumers, and thus it has enormous potential applications in smart grid. However, short-interval readings would generate massive smart meter data. Although cloud computing provides an excellent choice to analyze such big data, it also brings significant privacy concerns since the cloud is not fully trustworthy. In this paper, based on a modified vector homomorphic encryption (VHE), we propose a privacy-preserving and outsourced k-means clustering scheme (PPOk M) for secure load profiling over encrypted meter data. In particular, we design a similarity-measuring method that effectively and non-interactively performs encrypted distance metrics. Besides, we present an integrity verification technique to detect the sloppy cloud server, which intends to stop iterations early to save computational cost. In addition, extensive experiments and analysis show that PPOk M achieves high accuracy and performance while preserving convergence and privacy.

Machine learning has demonstrated promising application prospects in the field of vehicular technology during the past decade, for instance, it effectively propelled the development of autonomous vehicles and intelligent transportation systems. However, machine learning is still vulnerable to numerous malicious attacks. Amongst them, poisoning attack is one of the most severe security threats to the training process of machine learning, where the attacker injects some poisoned samples to the training dataset to make the learned model unavailable. As the crucial part of poisoning attack is generating poisoned samples, most proposals for poisoning attack have employed traditional gradient-based optimization algorithms to optimize the poisoned samples. Nevertheless, conventional gradient-based optimization algorithms are liable to get trapped in local optimums or saddle points and have a slow rate of convergence. As a result, these problems may lead to a reduction of the poisoned samples' effect. To address these issues, we propose two improved gradient-based poisoning attack algorithms. Specifically, in order to accelerate the convergence speed, we propose the first poisoning attack algorithm by employing momentum algorithm. Also, we propose the second poisoning attack algorithm by utilizing adam algorithm, which can get rid of some local optimums and has a faster convergence speed simultaneously. After that, support vector machines (SVM), linear regression and logistics regression are chosen as exemplary algorithms to conduct our attack algorithms and the effectiveness and computational overhead of the two attack algorithms are evaluated. Finally, we propose a countermeasure algorithm, which can detect suspicious samples using mahalanobis distance.

The k-nearest neighbors (kNN) classification has been widely used for defective product identification and anomaly detection in the Industrial Internet of Things (IIoT). In this article, we propose a secure and efficient distributed kNN classification algorithm (SEED-kNN) to prevent information and control flow exposure while supporting large-scale data classification on distributed servers. Specifically, we first design a secure and efficient vector homomorphic encryption (VHE) scheme by constructing a key-switching matrix and a noise matrix for data encryption. Based on the designed VHE, SEEDkNN is proposed to efficiently achieve the confidentiality of data flow, kNN query, and class label, while enabling homomorphic operations on the encrypted data. Moreover, by leveraging the Map/Reduce architecture, SEED-kNN enables the kNN classification over the large-scale encrypted data on distributed servers for industrial control systems. Finally, we demonstrate that SEEDkNN achieves semantic security and high classification accuracy, and is applicable in IIoT due to its high efficiency.

By leveraging deep learning-based technologies, industrial artificial intelligence (IAI) has been applied to solve various industrial challenging problems in Industry 4.0. However, for privacy reasons, traditional centralized training may be unsuitable for sensitive data-driven industrial scenarios, such as healthcare and autopilot. Recently, federated learning has received widespread attention, since it enables participants to collaboratively learn a shared model without revealing their local data. However, studies have shown that, by exploiting the shared parameters adversaries can still compromise industrial applications such as auto-driving navigation systems, medical data in wearable devices, and industrial robots' decision making. In this article, to solve this problem, we propose an efficient and privacy-enhanced federated learning (PEFL) scheme for IAI. Compared with existing solutions, PEFL is noninteractive, and can prevent private data from being leaked even if multiple entities collude with each other. Moreover, extensive experiments with real-world data demonstrate the superiority of PEFL in terms of accuracy and efficiency.

We propose Chronos+, an accurate blockchain-based time-stamping scheme for outsourced data, where both the storage and time-stamping services are provided by cloud service providers. Specifically, Chronos+integrates a file into a transaction on a blockchain once the file is created, which guarantees the file's latest creation time to be the time when the block containing the transaction is appended to the blockchain. A sufficient number of consecutive blocks that are latest confirmed on the blockchain is embedded into the file at the creation time. These blocks serve as a time-dependent random seed to prove the earliest creation time, due to blockchains' chain quality property. Chronos+makes the file's timestamp corresponding to a time interval formed by the earliest and latest creation times which are derived from the heights of the corresponding blocks. Due to blockchains' chain growth property, such a height-derived timestamp can ensure that the time intervals' range is within a few minutes so as to guarantee the accuracy. We also point out potential threats towards outsourced time-sensitive files and present security analyses to prove that Chronos+is secure against these threats. Comprehensive performance evaluations demonstrate the efficiency and practicality of Chronos+.

Deep learning has been applied in many areas, such as computer vision, natural language processing and emotion analysis. Differing from the traditional deep learning that collects users' data centrally, federated deep learning requires participants to train the networks on private datasets and share the training results, and hence has more gratifying efficiency and stronger security. However, it still presents some privacy issues since adversaries can deduce users' privacy from local outputs, such as gradients. While the problem of private federated deep learning has been an active research issue, the latest research findings are still inadequate in terms of security, accuracy and efficiency. In this paper, we propose an efficient and privacy-preserving federated deep learning protocol based on stochastic gradient descent method by integrating the additively homomorphic encryption with differential privacy. Specifically, users add noises to each local gradients before encrypting them to obtain the optical performance and security. Moreover, our scheme is secure to honest-but-curious server setting even if the cloud server colludes with multiple users. Besides, our scheme supports federated learning for large-scale users scenarios and extensive experiments demonstrate our scheme has high efficiency and high accuracy compared with non-private model.

It is common to certify when a file was created in digital investigations, e.g., determining first inventors for patentable ideas in intellectual property systems to resolve disputes. Secure time-stamping schemes can be derived from blockchain-based storage to protect files from backdating/forward-dating, where a file is integrated into a transaction on a blockchain and the timestamp of the corresponding block reflects the latest time the file was created. Nevertheless, blocks' timestamps in blockchains suffer from time errors, which causes the inaccuracy of files' timestamps. In this paper, we propose an accurate blockchain-based time-stamping scheme called Chronos. In Chronos, when a file is created, the file and a sufficient number of successive blocks that are latest confirmed on blockchain are integrated into a transaction. Due to chain quality, it is computationally infeasible to pre-compute these blocks. The time when the last block was chained to the blockchain serves as the earliest creation time of the file. The time when the block including the transaction was chained indicates the latest creation time of the file. Therefore, Chronos makes the file's creation time corresponding to this time interval. Based on chain growth, Chronos derives the time when these two blocks were chained from their heights on the blockchain, which ensures the accuracy of the file's timestamp. The security and performance of Chronos are demonstrated by a comprehensive evaluation.

Big data mining-driven disease risk prediction has become one of the important topics in the field of e-healthcare. However, without the security and privacy assurances, disease risk prediction cannot continue to flourish. To address this challenge, in this paper, an efficient and privacy-preserving disease risk prediction scheme for e-healthcare is proposed, hereafter referred to as EPDP. Compared with the up-to-date works, the proposed EPDP comprehensively achieves two phases of disease risk prediction, i.e., disease model training and disease prediction, while ensuring the privacy preservation. Specifically, a super-increasing sequence is combined with a homomorphic cryptographic algorithm to efficiently extract the symptom set of each disease in the phase of disease model training. Bloom filter technique is introduced to compute the prediction result in the phase of disease risk prediction. Besides, extensive performance evaluations demonstrate that our proposed EPDP attains outstanding efficiency advantage over the state-of-the-art in terms of both computational and communication overheads, and hence our EPDP is more suitable for real-time e-healthcare, especially medical emergency.

As the heart of next-generation air transportation systems, the automatic dependent surveillance-broadcast (ADS-B) is becoming a substitute for the radar, because it can enhance flight safety by requiring aircraft to regularly broadcast their precise geographic positions. Despite its promise, the lack of security mechanisms, e.g., not providing data encryption and message authentication, is a significant barrier to realistically deploy this new technology. While many methods have been proposed for ADS-B security, they can deal with either privacy or integrity unilaterally, and also need to change current ADS-B standards. In this paper, we present a new cryptographic solution to ADS-B security by first carefully exploiting some cryptographic primitives, and then adapting them to the air traffic-monitoring scenario. In contrast to previous approaches, our proposed solution is not only of high compatibility with existing protocols of ADS-B, but also lightweight for congested data links and resource-constraint avionics. Furthermore, it can also tolerate package loss and disorder that frequently occur in ADS-B wireless broadcast networks, making the proposed solution easy-to-deploy and practical. Security analysis shows that our proposal simultaneously achieves the confidentiality and authenticity of ADS-B messages. In addition, performance evaluation also demonstrates the efficiency of communication and computation for the proposal by using flight data of OpenSky-a sensor network that covers Central Europe aiming at gathering ADS-B flight data. Finally, the deployment in a real airport environment also proves the effectiveness of our solution.

Thek-nearest neighbor (kNN) classification has been widely adopted in data mining applications. In the age of big data,kNN classification process has to be outsourced to the cloud. However, as data may contain sensitive information, outsourcing data services directly to public clouds inevitably raises privacy concerns. To ensure the privacy of data, it is a well- known method to encrypt them prior to uploading to the cloud, which also brings great challenges to effectivekNN classification. Homomorphic encryption (HE) allows operations on encrypted data, which provides a viable solution tokNN classification over encrypted data. However, existing works using HE to enable securekNN classification all encrypt data attribute-wise that are limited by classification efficiency. In this paper, we designed an efficient and securekNN classification protocol over encrypted data using vector HE, namely ESkNNC, which could encrypt data record-wise. Security analysis shows that ESkNNC achieves function secrecy, besides confidentiality of data, confidentiality of query record, and hiding data access patterns. Compared withkNN classification techniques over plaintexts, ESkNNC achieves the same 98% accuracy with the precision of 2 digits. Furthermore, we propose a batching method of test data that significantly saves communication cost up to 90%.

The recognition technology of characters is one of the important technologies of intelligent transportation. At present, one of the problems that the technology needs to solve is that the recognition speed needs to be improved. The fast determinant recursion method is originally used for adaptive and fast processing of radar signals. In this paper, FDR (Fast Determinant Recursion) is used to speed up identifying characters. The advantage of this method is that it does not need to construct the estimation of the covariance matrix of the sample, and does not need to inverse the matrix. In the case of ensuring the constant accuracy of the recognition, the algorithm can improve the recognition speed of the characters. Some measured data are used to verify the effectiveness of the method.

Automatic Dependent Surveillance - Broadcast (ADS-B), as the key component of next-generation air transportation system, becomes the replacement of secondary surveillance radar (SSR) since it will enhance air traffic control by requiring the aircraft periodically broadcast its geographical information. But the obstacle blocking the deployment of the promising ADS-B belongs to security concerns where ADS-B messages are all transmitted in the clear and can be forged and modified easily. The already proposals for ADS-B security refer to the privacy or integrity unilaterally, and all require the modification of existing ADS-B protocols. In this paper, we design ingeniously a solution for ADS-B security, by integrating carefully some recent specific crypto primitives, and then modifying properly them to adapt to ADS-B features. As opposed to previous methods, our solution is at the same time (1) lightweight for resource- constraint avionics devices and already congested data links, (2) highly-compatible to existing ADS-B protocols, (3) tolerating package loss for ADS-B broadcast data links. This makes our solution particularly practical and easy-deploying. Security analysis indicates that our solution can achieve confidentiality and integrity of ADS-B messages, and performance evaluation, based on the real-world ADS-B data, proves efficiency of our solution from cost of computation and communication. Furthermore, the deployment on a real airport environment demonstrates high compatibility of our solution.

Carpooling, as an effective and eco-friendly travel mode, becomes a kind of public spontaneous behavior with multiple travellers sharing a vehicle to reduce individuals' travel cost, carbon emissions and traffic congestion. Although ubiquitous network access offers great convenience for travellers to find carpools, the safety becomes a big obstacle for them to accept this emerging travel mode. To address the safety concern, it seems inevitable to sacrifice the identity privacy for both drivers and passengers. In this paper, we propose an Anonymous Mutual Authentication (AMA) protocol to solve the contradiction between safety and privacy preservation by utilizing the BBS+ signature. In AMA, the passenger and the driver can mutually authenticate the identities without exposing their actual identities, but showing their membership of a trustable group. The AMA also allows to trace the identity of the driver (the passenger) on behalf of a judger if the passenger (the driver) complains the misbehavior of the driver (the passenger). The AMA is secure and efficient for real applications.

Summary Mobile networks integrate cloud computing to impair the weaknesses of the mobile terminals. With mobile cloud storage, mobile users can fully enjoy the advantages from both mobile networks and cloud storage. However, a major concern of mobile users is how to guarantee the integrity of their outsourced data. Taking into account the mobility of mobile devices, in this paper, we propose a shared data integrity verification protocol with identity privacy preserving, named SDIVIP2, for mobile cloud storage. In the construction of SDIVIP2, the dynamic group key agreement technique is employed for key sharing among a group of mobile users and the proxy re‐signature mechanism is utilized to update tags efficiently when users in the group change. In this new protocol, a third party auditor is able to verify the correctness of cloud data without the knowledge of mobile users' identities during the data integrity checking process. Performance analysis demonstrates that SDIVIP2outperforms the existing schemes in the sense that it can significantly enhance the efficiency of mobile users' joining and leaving a group. Copyright © 2015 John Wiley & Sons, Ltd.

A data discovery and dissemination protocol for wireless sensor networks (WSNs) is responsible for updating configuration parameters of, and distributing management commands to, the sensor nodes. All existing data discovery and dissemination protocols suffer from two drawbacks. First, they are based on the centralized approach; only the base station can distribute data items. Such an approach is not suitable for emergent multi-owner-multi-user WSNs. Second, those protocols were not designed with security in mind and hence adversaries can easily launch attacks to harm the network. This paper proposes the first secure and distributed data discovery and dissemination protocol named DiDrip. It allows the network owners to authorize multiple network users with different privileges to simultaneously and directly disseminate data items to the sensor nodes. Moreover, as demonstrated by our theoretical analysis, it addresses a number of possible security vulnerabilities that we have identified. Extensive security analysis show DiDrip is provably secure. We also implement DiDrip in an experimental network of resource-limited sensor nodes to show its high efficiency in practice.

In smart grid, control center collects and aggregates users' electricity data via the smart meters. The aggregated data is also of great use for markets. To efficiently and securely distribute these data to markets, the existing schemes use Attribute-based Encryption (ABE) technique to achieve privacy preservation of sensitive data and fine-grained access control. However, the efficient attribute revocation problem has not been studied well. In this paper, leveraging the Third Party Auditor and Ciphertext-Policy ABE techniques, we propose a Multi-Authority Access Control with Efficient Attribute Revocation (MAAC-AR) scheme in smart grid. Security analysis demonstrates that MAAC-AR can achieve fine-grained access control, collusion resistance, privacy preservation and secure attribute revocation. Performance evaluation shows that MAAC-AR is more efficient compared with the existing schemes in terms of functionality as well as computation, communication and storage overhead.

ABSTRACT Public key encryption with keyword search is a novel cryptographic primitive enabling one to search on the encrypted data directly. In the known schemes, once getting a trapdoor, the server can search associated data without any restrictions. However, in reality, it is sometimes essential to prevent the server from searching the data all the time because the server is not fully trusted. In this paper, we propose the notion of public key encryption with revocable keyword search to address the issue. We also develop a concrete construction by dividing the whole life of the system into distinct times to achieve our goals. The proposed scheme achieves the properties of the indistinguishability of ciphertexts against an adaptive chosen keywords attack security under the co‐decisional bilinear Diffie–Hellman assumption in our security model. Compared with two somewhat schemes, ours offers much better performance in terms of computational cost. Copyright © 2013 John Wiley & Sons, Ltd.

As a special sensor network, a wireless body area network (WBAN) provides an economical solution to real-time monitoring and reporting of patients' physiological data. After a WBAN is deployed, it is sometimes necessary to disseminate data into the network through wireless links to adjust configuration parameters of body sensors or distribute management commands and queries to sensors. A number of such protocols have been proposed recently, but they all focus on how to ensure reliability and overlook security vulnerabilities. Taking into account the unique features and application requirements of a WBAN, this paper presents the design, implementation, and evaluation of a secure, lightweight, confidential, and denial-of-service-resistant data discovery and dissemination protocol for WBANs to ensure the data items disseminated are not altered or tampered. Based on multiple one-way key hash chains, our protocol provides instantaneous authentication and can tolerate node compromise. Besides the theoretical analysis that demonstrates the security and performance of the proposed protocol, this paper also reports the experimental evaluation of our protocol in a network of resource-limited sensor nodes, which shows its efficiency in practice. In particular, extensive security analysis shows that our protocol is provably secure.

Smart grid has recently emerged as the next generation of power grid due to its distinguished features, such as distributed energy control, robust to load fluctuations, and close user-grid interactions. As a vital component of smart grid, demand response can maintain supply-demand balance and reduce users' electricity bills. Furthermore, it is also critical to preserve user privacy and cyber security in smart grid. In this paper, we propose an efficient privacy-preserving demand response (EPPDR) scheme which employs a homomorphic encryption to achieve privacy-preserving demand aggregation and efficient response. In addition, an adaptive key evolution technique is further investigated to ensure the users' session keys to be forward secure. Security analysis indicates that EPPDR can achieve privacy-preservation of electricity demand, forward secrecy of users' session keys, and evolution of users' private keys. In comparison with an existing scheme which also achieves forward secrecy, EPPDR has better efficiency in terms of computation and communication overheads and can adaptively control the key evolution to balance the trade-off between the communication efficiency and security level.

With the evolution of traditional civil aviation into "e-enabled" aviation, automatic dependent surveillance-broadcast (ADS-B) system plays an important role to replace radar to become the cornerstone of the next generation air traffic management. However, ADS-B system is a broadcast-type data link and ADS-B signals are unauthenticated, thus inserting a false aircraft into the ADS-B system is easy. In this paper, to filter spoofed targets, we present ADS-B data authentication scheme based on AH protocol. Security analysis demonstrates that the proposed scheme can achieve integrity of ADS-B messages, authenticity of data origin sources and resistance against replay attacks.