Federated Learning (FL) preserves client data privacy by distributing model training but remains vulnerable to inference attacks (e.g., gradient inversion). Existing secure aggregation schemes mitigate basic privacy threats, but most of them are under the semi-honest server assumption. Malicious servers can corrupt the global model through forging aggregation results. Moreover, the high interaction rounds and communication complexity of the existing schemes still constrain their feasibility in large-scale distributed deployment scenarios. To tackle these challenges, we propose EvaFL, an efficient verifiable privacy-preserving federated learning against malicious servers, which reduces the communication overhead and privacy threats from malicious severs. We propose the system model of EvaFL and give the concrete protocol. We leverage the linear homomorphism property of Shamir secret sharing under discrete logarithm assumption to reuse the mask seed shares, which avoids the communication overhead caused by share distribution in multiple rounds of iterations. In addition, by integrating consistency checking into the unmasking step, we further reduce one round interaction. To resist malicious servers, we adopt linear homomorphic hash to realize the correctness verification of the aggregation results. Finally, we implement and evaluate our EvaFL based on MNIST and CIFAR10 datasets to show its feasibility for privacy training. The single round aggregation completion time of EvaFL is reduced by 69% compared to BBGLR (CCS 2020) and by 11% compared to Flamingo (S&P 2023).

Centralized issuer in Anonymous Counting Tokens (ACT) is prone to single-point failure and imposes prohibitive computational overhead on resource-constrained IoT devices, hindering practical deployment. To overcome these limitations, we propose a user-side pairing-free lightweight distributed anonymous counting tokens protocol called LDACT. LDACT enables efficient issuance within a distributed environment and ensures that each client receives at most one valid token per message without disclosing their identity. LDACT eliminates pairing operations for user-side, enhancing scalability for source-constrained scenarios. Additionally, the tokens are publicly verifiable, allowing any party to verify their validity without compromising user anonymity. We conduct security analysis that LDACT satisfies unforgeability and unlinkability. We evaluate the computational overhead of LDACT on both Ubuntu and Raspberry Pi system, and compare it with other schemes. The result of the experiment demonstrates that LDACT achieves computational overhead in milliseconds for source-constrained IoT devices.

In NDSS 2024, Yu et al. proposed AAKA, an Anonymous Authentication and Key Agreement scheme designed to protect users' privacy from mobile tracking by Mobile Network Operators (MNOs). AAKA aims to provide both anti-tracking privacy and traceability (lawful de-anonymization), allowing subscribers to access the network via anonymous proofs while enabling a Law Enforcement Agency (LEA) to trace the real identity if misbehaviors are detected. However, we identify that the AAKA scheme in NDSS 2024 is insecure since the subscriber's identity is exposed within the protocol, thereby failing to achieve the claimed privacy and traceability. Building on the repair of AAKA, we propose AAKA +, Anonymous Authentication and Key Agreement with Verifier-Local Revocation, a new mobile authentication scheme, to ensure privacy against mobile tracking. In addition to the privacy and traceability introduced in NDSS 2024, AAKA + additionally allows the MNO to immediately assert whether the associated subscriber has been traced and revoked upon receiving an anonymous proof We formally define the syntax and the security model of AAKA + and propose two concrete schemes, AAKA+BB andAAKA+PS, based on the Boneh-Boyen signature and the Pointcheval-Sanders signature schemes, respectively. Both AAKA+BB and AAKA+PS are pairing-free on the user equipment side and compatible with existing cellular infrastructure. Experimental results show that our schemes are practical, with anonymous proof generation taking approximately 18 milliseconds for a constrained device.

As online application services evolve, an increasing number of users are opting for subscription-based or paywall models to access high-quality content. Anonymous counting tokens (ACTs), which regulate user access while protecting user privacy, are widely adopted in the online paywall model. However, the centralized server of ACT may lead to a single point of failure, thereby exposing users’ privacy. To address this challenge, in this paper, we propose threshold anonymous counting tokens with batch proofs (ThrACT) that balance privacy preservation and access count limitation for online paywalls. We define the system model for ThrACT and provide its concrete construction. We utilize the threshold Boneh-Boyen signature to facilitate distributed issuance of anonymous tokens and enable batch issuance. In addition, our ThrACT employs non-interactive zero-knowledge proofs to verify the label and token requests while allowing the correctness of multiple blind token shares to be validated simultaneously. We also prove that ThrACT satisfies unforgeable and unlinkable security properties. Finally, we evaluate the computational cost of our ThrACT and compare it with other schemes. The experiment result demonstrates that ThrACT not only supports distributed issuance, batch verification, and counting functionalities but also achieves computational overhead in milliseconds. In particular, when the threshold is set to (3,5), the token issuance time is approximately 9 milliseconds.

The redactable blockchain provides the editability of blocks, which guarantees the data immutability of blocks while removing illegal content on the blockchain. However, the existing redactable blockchain relies on trusted assumptions regarding a single editing authority. Ateniese et al. (EuroS&P 2017) and Li et al. (TIFS 2023) proposed solutions by using threshold chameleon hash functions, but these lack accountability for malicious editing. This paper delves into this problem and proposes an accountability weight threshold blockchain editing scheme. Specifically, we first formalize the model of a redactable blockchain with accountability. Then, we introduce the novel concept of the Accountable Weight Threshold Chameleon Hash Function (AWTCH). This function collaboratively generates a chameleon hash trapdoor through a weight committee protocol, where only sets of committees meeting the weight threshold can edit data. Additionally, it incorporates a tracer to identify and hold accountable any disputing editors, thus enabling supervision of editing rights. We propose a generic construction for AWTCH. Then, we introduce an efficient construction of AWTCH and develop a redactable blockchain scheme by leveraging AWTCH. Finally, we demonstrate our scheme’s practicality. The editing efficiency of our scheme is twice that of Tian et al. (TIFS 2023) with the same number of editing blocks.

Monero uses ring signatures to protect users’ privacy. However, Monero’s anonymity covers various illicit activities, such as money laundering, as it becomes difficult to identify and punish malicious users. Therefore, it is necessary to regulate illegal transactions while protecting the privacy of legal users. We present a revocable linkable ring signature scheme (RLRS), which balances the privacy and supervision for privacy-preserving blockchain transactions. By setting the role of revocation authority, we can trace the malicious user and revoke it in time. We define the security model of the revocable linkable ring signature and give the concrete construction of RLRS. We employ accumulator and ElGamal encryption to achieve the functionalities of revocation and tracing. In addition, we compress the ring signature size to the logarithmic level by using non-interactive sum arguments of knowledge (NISA). Then, we prove the security of RLRS, which satisfies anonymity, unforgeability, linkability, and non-frameability. Lastly, we compare RLRS with other ring signature schemes. RLRS is linkable, traceable, and revocable with logarithmic communication complexity and less computational overhead. We also implement RLRS scheme and the results show that its verification time is 1.5s with 500 ring members.

Identity-based threshold signature (IDTHS) allows a threshold number of signers to generate signatures to improve the deterministic wallet in the blockchain . However, the IDTHS scheme cannot determine the identity of malicious signers in case of misinformation . To solve this challenge, we propose an identity-based threshold (multi) signature with private accountability (for short AIDTHS) for privacy-preserving blockchain . From the public perspective, AIDTHS is completely private and no user knows who participated in generating the signature. At the same time, when there is a problem with the transaction, a trace entity can trace and be accountable to the signers. We formally define the syntax and security model of AIDTHS. To address the issue of identifying malicious signers, we improve upon traditional identity-based threshold signatures by incorporating zero-knowledge proofs as part of the signature and leveraging a tracer holding tracing keys to identify all signers. Additionally, to protect the privacy of signers, the signature is no longer achievable by anyone, which requires a combiner holding the keys to produce a valid signature. We give a concrete construction of AIDTHS and prove its security. Finally, we implement the AIDTHS scheme and compare it with existing schemes. The key distribution algorithm of AIDTHS takes 13.04 ms and the signature algorithm takes 34.60 μ s . The verification algorithm takes 1 s , which is one-third of the time the TAPS scheme uses.

Internet of Things (IoT) connects massive physical devices to capture and collect useful data, which are used to make accurate decisions by taking advantage of the machine learning techniques. However, the collected data may contain users’ sensitive information. When guaranteeing the utility of data, we need to consider privacy of users’ data. To balance the utility and the privacy of data, the existing approaches usually adopt the privacy-preserving signature technology, where the privacy-preserving data are classified by a designated converter (data processor) interacting with a semihonest verifier (data center). However, for the malicious behavior of the data center and data processor, this kind of approach is insufficient. To prevent the malicious data center/data processor while guaranteeing the utility and privacy of data, we propose blockchain-based auditable privacy-preserving data classification (PPDC) scheme for IoT. We put forth a new controllably linkable group signature (CL-GS) to balance the utility and privacy of data and take advantage of blockchain to audit the correctness of privacy-preserving data classification against malicious data processor/data center. We formalize the system model of the auditable privacy-preserving data classification in the blockchain setting and its security model. Then, we present a concrete construction and prove its security in the random oracle model. Finally, we deploy a prototype system to evaluate the performance ofPPDC.