Spatial crowdsourcing can quickly assign tasks and obtain feedback based on task requirements and workers’ locations, which brings great convenience to task assignment. However, sensitive information can also be easily obtained by spatial crowdsourcing platforms. To prevent information leakage, various privacy-preserving task assignment schemes have been proposed. However, existing schemes have low query efficiency and may leak pattern privacy, task content, or worker preference. To address the above challenges, this paper proposes a differentiated privacy-preserving task assignment scheme based on generative adversarial networks in spatial crowdsourcing–DPGAN-SC. This scheme leverages generative adversarial networks to generate disguised locations for both tasks and workers, which are then used in the task-matching process. Within the standard area range, no location can be distinguished, ensuring location privacy while preventing adversaries from analyzing search patterns through matching results. The combination of location disguise and task content encryption makes it impossible for adversaries to infer worker preferences and access patterns through the matching process. In addition, to meet differentiated privacy requirements, DPGAN-SC leverages generative adversarial networks to design a three-level privacy-classification mechanism. This mechanism categorizes private data while minimizing unnecessary privacy overhead. Compared to existing schemes, DPGAN-SC improves query efficiency by 100 times while ensuring comprehensive privacy preservation.

Existing schemes that combine provable data possession (PDP) and proof of ownership (PoW) for data integrity and efficient deduplication face several practical shortcomings. First, integrity tag generation relies on data block indices or user keys, causing redundant tags for duplicate data and increasing storage overhead. Second, dynamic operations like data insertion and deletion require linear scanning, resulting in a high computational complexity of$O(N)$. Furthermore, in multi-cloud backup environments, existing mechanisms struggle to ensure consistency between data ciphertexts and their tags. If an audit fails, locating damaged replicas requires repetitive verification by the third-party auditor (TPA), leading to high inefficiency. To overcome these issues, this paper proposes a multi-cloud data auditing mechanism (MDAM), which is based on an authenticated data structure called variable merkle hash tree (VMHT). MDAM utilizes message-derived RSA tags and secret-sharing-based proxy re-signing to achieve efficient deduplication and secure user-tag association. By integrating updatable block-level message-locked encryption (UMLE) technology with a variable branching structure, it supports dynamic updates with an$O(\log N)$complexity, saving storage and improving update efficiency. Additionally, MDAM employs a dynamic Bloom filter for efficient fault localization. Experimental results demonstrate that MDAM surpasses existing schemes in computational overhead, update efficiency, and fault localization performance.

With the rapid development of edge computing and the explosive growth of image data generated by IoT and mobile devices, an increasing number of users prefer to perform privacy-preserving image storage and retrieval tasks directly at the edge. However, existing solutions typically rely on basic encryption methods and shallow feature extraction, leading to inadequate data security and poor retrieval performance. In this paper, we propose a Dynamic Multi-Stage Encryption (DMSE) method combined with a semantically rich fusion feature to achieve high-precision and privacy-preserving image retrieval in edge environments. Specifically, the proposed method first divides the image into blocks and applies random shuffling, followed by channel and pixel-level XOR encryption to generate a hybrid encrypted image. Then, we extract global features from the encrypted image using the histogram of Discrete Cosine Transform (DCT) coefficients. In addition, a multi-scale convolution block is designed to extract stable and robust local features under encryption. Finally, deep learning is utilized to fuse the global and local features, capturing both the holistic structure and fine-grained semantics of the image. This comprehensive feature representation significantly improves retrieval accuracy while ensuring privacy. Extensive experiments validate that our approach outperforms existing methods in both security and retrieval effectiveness, making it well-suited for edge computing scenarios with limited resources and high privacy demands.

Driven by legal and service demands, redactable blockchains (RBC) have been proposed to balance the editability and immutability of blockchain technology. However, RBC may allow the same block to have multiple valid versions, which malicious nodes could exploit to deceive lightweight nodes, thereby compromising the consistency and integrity of the ledger. To address this issue, we propose an efficient auditing and querying scheme for verifiable redactable blockchain (EAQ-VRBC). It is an auditable verifiable data streaming (VDS) protocol that establishes the RSA accumulator-based revocation mechanism to invalidate outdated blocks in RBC. The trusted node maintains a revocation list stored in a dynamic RSA accumulator. The validity of new blocks is verified by non-membership proofs, ensuring that only the latest data version is considered valid, effectively preventing old data version deception. Compared with existing auditable VDS protocols tailored for RBC, the verification cost of EAQ-VRBC in the query and audit phases is reduced by approximately one order of magnitude. Additionally, EAQ-VRBC uses identity-based RSA signature auditing to ensure data integrity. Finally, security analysis and performance evaluation confirm the feasibility and efficiency of the proposed solution.

Encrypted deduplication is attractive because it can provide high storage efficiency while protecting data privacy. Most existing schemes achieve encrypted deduplication against brute-force attacks (BFAs) based on server-aided encryption. Unfortunately, the centralized key server in server-aided encryption can potentially become a single point of failure. To this end, distributed server-aided encryption is presented, which splits a system-level master key into multiple shares and distributes them across several key servers. However, it is hard to improve security and scalability with this method simultaneously.This paper presents a secure and scalable encrypted deduplication scheme ScalaDep. ScalaDep achieves a new design paradigm centered on location-hiding secret sharing of data keys. As the number of deployed key servers increases, the attack cost of adversaries increases while the number of requests handled by each key server decreases, enhancing both scalability and security. Furthermore, we propose a two-phase duplicate detection method for our paradigm, which utilizes short hashes and key identifiers to achieve secure duplicate detection against BFAs. Additionally, based on the allreduce algorithm, ScalaDep enables all key servers to collaboratively record the number of client requests and resist online BFAs by enforcing rate limiting. Security analysis and performance evaluation demonstrate the security and efficiency of ScalaDep.

With the increasing popularity of geo-positioning technologies and mobile Internet, spatial data query services have attracted extensive attention. To protect the confidentiality of sensitive information outsourced to cloud servers, much efforts have been devoted to designing geometric range query schemes over encrypted spatial data without affecting availability. However, existing works focus on the privacy-preserving schemes with traditional tree indexes, causing more computing and storage issues. In this paper, we propose an efficient conjunctive geometric range query scheme over encrypted spatial data with a learned index. In particular, we design a new privacy-preserving learned index for spatial data to reduce the search space and storage overhead. The main idea is to add noise disturbance to the objective function instead of directly adding it to output results, reducing the leakage of private information and ensuring the correctness of output results. Moreover, we propose a spatial segmentation algorithm to avoid accessing a large number of unnecessary Z codes in the query process. The formal security analysis shows that our scheme ensures index data security and query privacy. Simulation results show that the query efficiency is improved while the storage overhead is significantly reduced compared with the state-of-the-art schemes.

Encrypted deduplication is attractive for outsourced storage as it provides both data confidentiality and storage savings. Conventional encrypted deduplication schemes protect data confidentiality based on expensive cryptographic primitives, leading to performance degradation. Recently, several SGX-based schemes have been proposed to accelerate encrypted deduplication. However, these schemes have limitations in both security and performance aspects. This paper presents a SGX-based basic scheme to address these limitations, which first performs proof of ownership (PoW), followed by key generation and data encryption, realizing a new paradigm known as PoW-before-encryption (PbE) to solve the security issue in existing schemes. Additionally, the basic scheme implements deduplication-before-encryption (DbE) to reduce redundant computations, thus improving performance. Despite these improvements, the duplicate detection and key generation in the basic scheme still involve redundant computations. Consequently, we propose an epoch-based enhanced scheme that utilizes data locality and computation deduplication, which caches fresh computations in an epoch and reuses them to enhance performance. We provide a security analysis and evaluate the performance of our schemes using both synthetic and real-world workloads. The results demonstrate that our schemes offer stronger security guarantees while outperforming state-of-the-art schemes in terms of performance.

Side-channel attacks are widespread in client-side deduplication systems, compromising the privacy of outsourced data. The adversary may infer the existence status of data via the deterministic relations between duplication requests and responses to launch side-channel attacks. Random Response (RARE) is one of the state-of-the-art approaches to overcome this issue, where the cloud server returns the randomized deduplication response for two requests at once to mitigate the risk of side-channel attacks. However, it still has some inherent limitations on communication efficiency and security. In this paper, we propose Random Coding Responses (RACORE), a lightweight and secure multi-chunk coding algorithm to address the limitations of RARE. RACORE achieves efficient multi-chunk coding and obfuscation based on the linear mapping induced by a specially constructed pseudo-random matrix. Compared to existing schemes, RACORE can strike a flexible balance between security and performance by adjusting parameters. Further, we present an enhanced composite matrix generation strategy to extend the coding matrix. Based on this strategy, we design an enhanced coding algorithm RACORE$^+$to improve efficiency. Besides, we put forward a novel redundant chunk selection method to enhance the security of RACORE and RACORE$^+$. Rigorous security analysis and extensive experimental evaluation demonstrate that both RACORE and RACORE$^+$can effectively resist side-channel attacks while reducing overhead compared to existing schemes.

Popularity-based secure deduplication scheme classifies data based on their number of owners and provides different levels of security for a trade-off between privacy preservation and storage savings. Most existing schemes rely on a trusted third party to record data popularity using deterministic tags, which is impractical in reality. Recently, Ha et al. propose a scheme that uses random tags to record popularity without the need for a trusted third party. However, their scheme is vulnerable to a malicious cloud launching smuggle attacks (SAs) and popularity-faking attacks (PFAs), which poses security vulnerabilities. In this paper, we propose a privacy-preserving popularity-based deduplication scheme. For one thing, we use unforgeable random tags to record data popularity, which defends against SAs. For another thing, we design a verifiable interactive popularity detection scheme to assure the correctness of popularity detection and resist PFAs. Security analysis and evaluation results show that our proposed scheme provides stronger security guarantees with limited overhead compared with existing schemes.

Client-side deduplication system is widely used in cloud storage systems to reduce storage and communication overhead by eliminating the storing and uploading of duplicate data. However, it is vulnerable to side channel attacks, where an adversary can infer the existence status of uploaded data based on deterministic relations in duplication check responses. To address this issue, Random Response (RARE) was proposed, which sends duplication check requests for two chunks simultaneously. Nevertheless, RARE has limitations in terms of communication efficiency and security. In this paper, we propose Random Zero-one Coding Response (RZCR) to overcome these limitations. RZCR achieves lightweight coding of multiple chunks using a novel linear mapping algorithm, allowing for a balance between security and performance through the adjustment of system parameters. Furthermore, we, for the first time, formally define a security game to model these side channel attacks in client-side deduplication systems and introduce a stronger threat model compared to RARE. Security analysis demonstrates that RZCR effectively mitigates the risk of side channel attacks. We also implement a prototype of RZCR and evaluate its performance using large-scale real-world datasets (i.e., Enron Email and Fslhomes) as well as synthetic datasets. The results show that RZCR significantly reduces communication overhead compared to representative schemes.

With the rapid development of cloud computing, more and more users are storing sensitive data on cloud servers, making the privacy-preserving of data particularly important. Dynamic searchable symmetric encryption enables efficient retrieval of encrypted data in cloud computing environments while preserving data privacy. However, existing solutions are not effective in defending against various query-recovery attacks. Therefore, this paper focuses on the privacy-preserving of dynamic searchable symmetric encryption, and proposes a privacy-preserving dynamic searchable symmetric encryption based on anonymization and differential privacy – DADP. Firstly, the original indexes are synthesized into fake indexes using the anonymization hash technology. The synthetic indexes possess randomness and irreversibility, making it impossible for adversaries to infer the generation process of the synthetic indexes or recover the original indexes. Additionally, by using differential privacy to process composite indexes, the privacy of keywords and index information is protected, preventing adversaries from inferring sensitive information based on query results. This approach provides dual privacy-preserving. Compared to other schemes, our scheme achieves type-I backward privacy and can withstand seven types of query recovery attacks. And it improves update and query efficiency by 10-100 times.

Individuals and companies increasingly adopt encrypted deduplication systems for their enhanced security and efficiency benefits. Server-aided encrypted deduplication systems are the state-of-the-art scheme to resist brute-force attacks. However, it is overly reliant on a single centralized key server and vulnerable to a single point of failure. To this end, existing schemes have implemented distributed key servers based on secret sharing of the master key to resist a single point of failure. Nevertheless, this design has some inherent limitations in balancing security and scalability. Secret sharing of the master key effectively mitigates single points of failure, while negatively impacting system scalability. To address the above limitations, we propose a scalable client-side encrypted deduplication with distributed key servers based on secret sharing of the data key. To resist brute-force attacks, we also design a double-layer matching mechanism to achieve secure and effective duplicate check and key delivery. Additionally, drawing inspiration from random oracle models, we put forward a pseudo-random response strategy for key servers to safeguard key privacy effectively. Rigorous theoretical analysis and extensive experiments demonstrate that our scheme achieves both security and scalability, which is well-suited for deployment in large-scale systems and offers robust protection against a single point of failure.

It is non-trivial to provide semantic security for user data while achieving deduplication in cloud storage. Some studies deploy a trusted party to store deterministic tags for recording data popularity, then provide different levels of security for data according to popularity. However, deterministic tags are vulnerable to offline brute-force attacks. In this paper, we first propose a popularity-based secure deduplication scheme with fully random tags, which avoids the storage of deterministic tags. Our scheme uses homomorphic encryption (HE) to generate comparable random tags to record data popularity and then uses the binary search in the AVL tree to accelerate the tag comparisons. Besides, we find the popularity tamper attacks in existing schemes and design a proof of ownership (PoW) protocol against it. To achieve scalability and updatability, we introduce the multi-key homomorphic proxy re-encryption (MKH-PRE) to design a multi-tenant scheme. Users in different tenants generate tags using different key pairs, and the cross-tenant tags can be compared for equality. Meanwhile, our multi-tenant scheme supports efficient key updates. We give comprehensive security analysis and conduct performance evaluations based on both synthetic and real-world datasets. The results show that our schemes achieve efficient data encryption and key update, and have high storage efficiency.

The server-aided encryption is widely used in encrypted deduplication systems to protect against brute-force attacks. However, it is non-trivial to update the master key managed by the key server in existing schemes. Once the master key is leaked, all user data are vulnerable to offline brute-force attacks. In this article, we extend the server-aided encryption with the updatable encryption (UE) and a dynamic proof of ownership (PoW) protocol to make it support efficient key updates and can be used in the client-side deduplication. Specifically, we design an updatable server-aided encryption scheme based on UE, which achieves efficient encryption and the user-transparent key update for a system-level master key. Besides, to further enable our updatable server-aided encryption to be applicable to the client-side deduplication, we propose a dynamic PoW protocol based on the Merkle tree. Compared to the state-of-the-art PoW scheme, our PoW protects data privacy and allows multi-time leakages for the target file. Finally, we analyze the security of our scheme and present the performance evaluation. The results show that our scheme provides comprehensive security protection for user data and achieves efficient encryption, PoW, and key update.

With the development of various applications of blockchain, blockchain-assisted searchable encryption technology has received wide attention as it can eliminate misbehaviours of malicious servers through the verification and incentive mechanism of blockchain. However, most existing solutions update the encrypted data by means of appending new transactions, which does not scale and wastes resources. In this paper, we explore the potential of redactable blockchain and propose a privacy-preserving dynamic searchable encryption framework (DSE-RB), which is a general scheme that guarantees reliable queries and updates on encrypted data. In particular, we first use transaction-level editing technology to achieve a more flexible update operation of encrypted data without additional transactions while avoiding the waste of storage on the chain. To better support practical applications, we use an index partition method to divide the traditional binary tree index into a plurality of sub-indexes and introduce the concept of polynomials to simplify the whole access control mechanism. We define the security model and conduct repeated experiments on real data sets to test the efficiency. Experimental results and theoretical analysis show the practicability and security of our scheme.

Message-locked Encryption (MLE) is the most common approach used in encrypted deduplication systems. However, the systems based on MLE are vulnerable to frequency analysis attacks, because MLE encrypts the identical plain texts into the identical ciphertexts, which is deterministic. The state-of-the- art defense scheme, which named TED, lacks key verification and uses a single key server to record frequency information. Once the key server is compromised, TED will be vulnerable to brute-force attacks. In addition, TED's key generation algorithm needs to be designed more exquisitely to strengthen protection, and its security indicator is not comprehensive. We propose SDAF, which supports key verification and enhanced protection against frequency analysis attacks. Based on chameleon hash, SDAF realizes key verification to prevent malicious key servers from generating fake encryption keys. In order to disturb the frequency information, SDAF introduces reservoir sample to generate uniformly distributed encryption keys, and uses multiple key servers, which interact with each other via multi-party PSI and rotate spontaneously to avoid the single point of failure. Moreover, a new indicator Kurtosis is pointed out to evaluate the security against frequency analysis attacks. We implement the prototypes of SDAF. The experiments of the real-world data sets show that, compared with the existing schemes, SDAF can better resist frequency analysis attacks with lower time overheads.

The encrypted deduplication can provide both storage savings and data confidentiality for cloud storage systems. Convergent encryption (CE) is a well-known solution for encrypted deduplication, but it brings huge computation and storage overheads for key management. MinHash encryption is an effective solution to this issue. It reduces the number of keys by grouping multiple consecutive chunks into segments and generating one key for each segment. However, MinHash encryption does not take full advantage of the segment similarity, which can be used to further reduce the overhead for key management. To this end, we augment MinHash encryption with Bloom filter and Locality Sensitivity Hash (LSH) to design an enhanced MinHash encryption scheme. Firstly, our scheme generates a sketch for each segment based on the Bloom filter, and projects sketches to the points in a hash table through LSH functions. Secondly, we detect the segment similarity by the distance between points, and similar segments are grouped into super-segments. Finally, we combine MinHash encryption and server-aided message-locked encryption to encrypt the super-segments for achieving encrypted deduplication. We conduct trace-driven experiments using a realworld dataset. Compared with MinHash encryption, our scheme has higher storage efficiency and better encryption performance.

It is difficult to provide semantic security for user data while using deduplication to save storage space in cloud storage. Some studies attempt to provide different levels of security for data according to their popularity for a reasonable trade-off between security and efficiency. However, existing schemes generally need a trusted third party to store deterministic data tags to record data popularity. If the trusted third party is compromised by adversaries, the deterministic tags will expose data information. In this paper, we propose a popularity-based secure deduplication scheme with fully random tags, which does not need to store deterministic tags. Our solution is using the homomorphic encryption to generate comparable random tags to record data popularity and using binary search to reduce time complexity of tag comparison to logarithmic time. Besides, we also design a proof of ownership protocol based on homomorphic encryption to prevent adversaries with only the data tag from tampering with the data popularity, which are not considered in the existing popularity-based schemes. We implement our scheme for system efficiency evaluation. Compared with the scheme of Stanek et al., our scheme has a slight improvement in encryption efficiency.