The development of machine learning models increasingly relies on high-quality data that resides in private domains. To enable secure and value-driven data exchange under strict privacy regulations, federated learning (FL) has emerged as a key primitive by enabling the trading of model utilities instead of raw data. Among existing solutions, martFL (CCS 2023) represents the state-of-the-art FL-based data marketplace architecture, integrating privacy-preserving model evaluation and verifiable trading protocols to enable robust and fair model utility trading without revealing raw data. Despite its strengths, martFL suffers from critical weaknesses at the evaluation layer, including plaintext score exposure and unverifiable and manipulable participant selection. To address these challenges, we propose MartDE, a dedicated evaluation framework that builds model-centric data marketplaces with robust, privacy-preserving, and verifiable mechanisms. MartDE introduces encrypted utility scoring with client-side decryption to preserve score confidentiality, formally bounded anomaly filtering, adaptive participant selection based on global model performance, and commitment-based verification to ensure consistency between declared and evaluated scores and selection verification. We implement MartDE and evaluate it across diverse datasets and adversarial conditions. Results show that MartDE achieves superior accuracy, robustness, and cost-efficiency, providing a strong foundation for secure and trustworthy utility-driven data marketplaces.

Model Context Protocol (MCP) standardizes interface mapping for large language models (LLMs) to access external data and tools, which revolutionizes the paradigm of tool selection and facilitates the rapid expansion of the LLM agent tool ecosystem. However, as the MCP is increasingly adopted, third-party customized versions of the MCP server expose potential security vulnerabilities. In this paper, we first introduce a novel security threat, which we term the MCP Preference Manipulation Attack (MPMA). An attacker deploys a customized MCP server to manipulate LLMs, causing them to prioritize it over other competing MCP servers. This can result in economic benefits for attackers, such as revenue from paid MCP services or advertising income generated from free servers. To achieve MPMA, we first design a Direct Preference Manipulation Attack (DPMA) that achieves significant effectiveness by inserting the manipulative word and phrases into the tool name and description. However, such a direct modification is obvious to users and lacks stealthiness. To address these limitations, we further propose Genetic-based Advertising Preference Manipulation Attack (GAPMA). GAPMA employs four commonly used strategies to initialize descriptions and integrates a Genetic Algorithm (GA) to enhance stealthiness. The experiment results demonstrate that GAPMA balances high effectiveness and stealthiness. Our study reveals a critical vulnerability of the MCP in open ecosystems, highlighting an urgent need for robust defense mechanisms to ensure the fairness of the MCP ecosystem.

Backdoor attacks pose a significant threat to Large Language Models (LLMs), where adversaries can embed hidden triggers to manipulate LLM's outputs. Most existing defense methods, primarily designed for classification tasks, are ineffective against the autoregressive nature and vast output space of LLMs, thereby suffering from poor performance and high latency. To address these limitations, we investigate the behavioral discrepancies between benign and backdoored LLMs in output space. We identify a critical phenomenon which we term sequence lock: a backdoored model generates the target sequence with abnormally high and consistent confidence compared to benign generation. Building on this insight, we propose ConfGuard, a lightweight and effective detection method that monitors a sliding window of token confidences to identify sequence lock. Extensive experiments demonstrate ConfGuard achieves a near 100% true positive rate (TPR) and a negligible false positive rate (FPR) in the vast majority of cases. Crucially, the ConfGuard enables real-time detection almost without additional latency, making it a practical backdoor defense for real-world LLM deployments.

In the digital age of the Internet of Things, users rely extensively on online accounts to access a variety of IoT services and applications. However, password leakage significantly threatens users’ privacy, assets, and reputations, making passwords primary targets for cyberattacks, including credential-guessing attacks. To address this vulnerability, this paper proposes FastPaD, a Fast privacy-preserving protocol designed to detect password similarity leakage using homomorphic encryption. FastPaD employs a novelhorizontal homomorphic batch encoding method, facilitating efficient batch detection of similar passwords. The protocol also incorporates optimization strategies such aspolynomial partitioning and power computation windowing, significantly reducing the depth of homomorphic multiplications. This enables the use of smaller encryption parameters, which improves computational efficiency. Moreover, FastPaD features a customizable mechanism to balance functionality and performance, effectively optimizing the trade-off between communication and computational overhead. Experimental results demonstrate that in scenarios without similarity detection, FastPaD achieves a detection computation time of 0.17 seconds and a total communication overhead of 3.88 MB, surpassing state-of-the-art protocols. When similarity detection is enabled, FastPaD completes the detection process in 6.45 seconds with a communication overhead of 10.64 MB. Compared to the Pipa protocol, FastPaD provides approximately a 2.70× improvement in computation time and a 22.27× improvement in communication efficiency. Relative to Yu’s protocol, FastPaD demonstrates a 15.78× faster computation and a 1.31× reduction in communication overhead.

Exchange-assisted cloud-based data trading (ECDT) is a promising paradigm in current marketplaces, where an exchange provides underlying trading services while the cloud serves as a fundamental base for data sellers, brokers, and data buyers to enable them to benefit from data trading. However, directly integrating existing commercial cloud services into an exchange system suffers from practicality issues. In existing ECDT systems, the data outsourced to the cloud generally follows an “encrypt-then-outsource” paradigm, and the encrypted database makes it impractical for brokers to generate and deliver on-demand data products to the buyer, thereby hindering subscription-based data trading. In this paper, we propose a secure and efficient data delivery scheme, dubbed ESECDT, for subscription-based ECDT. ESECDT consists of data entrustment and data delivery and supports continuous data entrustment and customized data delivery while freeing the broker from heavy costs in terms of computation and communication. We formally define and prove the security of ESECDT in the random oracle model. We also implement an ESECDT prototype and conduct a comprehensive performance evaluation, which demonstrates the efficiency and practicality of ESECDT.

Edge coverage-guided fuzzing has demonstrated remarkable achievements in vulnerability discovery. Some studies with fine-grained coverage metrics have been proposed to enhance the vulnerability mining capabilities of fuzzing by capturing more program paths. However, this refinement often results in a significant increase in seeds, which are highly homogeneous and may limit vulnerability detection. Additionally, finer granularity requires more bitmap hits, increasing the risk of hash collisions. To address these shortages, the paper proposes the structure of a basic block unit with multiple predecessors and successors (referred to as MPS). Then, a fine-grained coverage method called MPS-Fuzz is designed based on the MPS structure. In this approach, it is convenient to exclude basic blocks involving loop structures when determining MPS units, which helps reduce seed homogeneity. Additionally, we introduce an additional bitmap to record the coverage status of MPS units, ensuring that the collision rate of the edge bitmap does not increase. Moreover, these additional operations do not incur excessive time overhead. To demonstrate the properties of the MPS-Fuzz, we implement our approach on AFL and conduct experiments on 16 benchmarks from FuzzBench and Unifuzz. The result indicates that, after 24-hour fuzzing, MPS-Fuzz explores an average of 9.6% more edges and an average of 25.7% more bugs than AFL. Compared to other fine-grained coverage methods (N-gram and PathAFL), MPS-Fuzz also achieves better performance. Moreover, MPS-Fuzz has discovered a previously unknown bug on real-world program and got a CVE assigned.

Decentralized finance has experienced phenomenal growth, revolutionizing the landscape of financial transactions and asset management via blockchain. Yet, this swift growth brings with it substantial challenges, notably the surge in scam tokens, imposing significant security threats on cryptocurrency investments and trading. Existing detection methods of scam token, primarily relying on analyzing contract codes or transaction patterns, struggle to catch increasingly sophisticated tactics employed by scammers. For example, contract-based analysis are unable to identify scams lacking overt malicious code, e.g., most rugpulls, while transaction-based methods generally lack the foresight to early-detect potential risks. In this paper, we present TOKENSCOUT, the first temporal GNN-based framework for scam token early detection. TOKEN SCOUT formulates token transfer data as a dynamic temporal attributed multigraph and leverages the temporal graph learning model to learn graph representations. It also builds a graph rep resentation refining model based on contrastive learning to learn a more discriminative representation space for risk identification. We evaluated TOKENSCOUT using a comprehensive dataset of 214,084 standard ERC20 tokens from 2015 to February 2023. TOKENSCOUT achieves a balanced accuracy of 98.41%. Additionally, from March to May 2023, deploying TOKENSCOUT on Ethereum effectively identified 706 rugpulls, 174 honeypots, and 90 Ponzi schemes, thereby alerting to potential risks exceeding $240 million.

Federated learning (FL) is a prevalent distributed machine learning framework that allows multiple clients to train one model by uploading gradients without sharing data, enabling cooperative learning while preserving the training data privacy. Nevertheless, recent research has revealed that shared gradients can still expose clients' private training data. These attacks, however, often become ineffective in two practical scenarios: (1) gradients are computed on high-resolution data; (2) labels are duplicated within the attacked batch. In this work, we introduce an advancedGradientLeakageAttack againstDuplicate labels (GLAD), which can effectively recover high-resolution training data from gradients while considering duplicate labels, making it applicable in more realistic FL scenarios. The key technique ofGLADis to formalize the relationships between model outputs, gradients, model parameters, and training data labels. Based on these relationships,GLADfurther reconstructs the model outputs and inverts the reconstructed model outputs back to the corresponding model inputs. Our method can achieve state-of-the-art recovery accuracy while ensuring efficiency. Extensive experimental results demonstrate thatGLADcan reconstruct images of 224× 224pixels with a batch size of 256 with duplicate labels. Our source code is available athttps://github.com/SuperX612/GLAD.

Robot vacuum cleaners (RVCs) with autonomous navigation and decision-making capabilities have become an integral part of modern homes. During their operations, these devices may inadvertently enter privacy-sensitive areas, leading to potential privacy breaches. However, existing defense methods risk exposing the location of private areas, require root privileges, or are designed for infrared sensors that are ineffective for camera-based RVCs. To overcome these limitations, we propose a novel solution, a ground-view adversarial patch named GPatch, preventing RVCs from entering privacy-sensitive areas. Users only need to place GPatch at the entrance of restricted areas to prevent an RVC's unauthorized access, while also providing a warning to unauthorized individuals. We evaluate GPatch in realworld environments with an average success rate of 87.27%, and experimental results demonstrate its effectiveness, robustness, and transferability, making it a practical, user-friendly, and reliable solution for safeguarding privacy in home environments.

Traffic sign recognition (TSR) systems are crucial for autonomous driving but are vulnerable to backdoor attacks. Existing physical backdoor attacks either lack stealth, provide inflexible attack control, or ignore emerging Vision-Large-Language-Models (VLMs). In this paper, we introduce FIGhost, the first physical-world backdoor attack leveraging fluorescent ink as triggers. Fluorescent triggers are invisible under normal conditions and activated stealthily by ultraviolet light, providing superior stealthiness, flexibility, and untraceability. Inspired by real-world graffiti, we derive realistic trigger shapes and enhance their robustness via an interpolation-based fluorescence simulation algorithm. Furthermore, we develop an automated backdoor sample generation method to support three attack objectives. Extensive evaluations in the physical world demonstrate FIGhost's effectiveness against state-of-the-art detectors and VLMs, maintaining robustness under environmental variations and effectively evading existing defenses.

Pre-trained language models (PTLMs) have become integral to modern natural language processing (NLP), yet their reuse exposes them to supply chain risks such as backdoor attacks. Existing studies assume that attackers target specific downstream tasks, overlooking how a backdoored PTLM behaves when fine-tuned for unrelated applications. In practice, such unintended adaptation can trigger anomalous and inconsistent predictions, revealing the backdoor and compromising its stealthiness. We define this phenomenon asbackdoor complications, i.e., unintended behavioral side effects emerging on non-target tasks. This work presents the first systematic quantification and mitigation of backdoor complications. Through extensive experiments on 3 widely used PTLMs and 15 benchmark datasets, we show that complications are pervasive across both single- and multi-task attack settings, causing triggered outputs to collapse into arbitrary classes. To address this issue, we propose theComplication-Suppressed Backdoor Attack(CSBA), a task-agnostic, multi-objective framework that leverages auxiliary non-target datasets to suppress backdoor complications. CSBA effectively suppresses complications on unseen downstream tasks while maintaining near-perfect attack success rates. Our work reveals a critical side effect in backdoored PTLMs and provides a new perspective on the stealthiness and robustness of model supply chain security.

Vision-Language Models (VLMs) are increasingly deployed in real-world applications, but their high inference cost makes them vulnerable to resource consumption attacks. Prior attacks attempt to extend VLM output sequences by optimizing adversarial images, thereby increasing inference costs. However, these extended outputs often introduce irrelevant abnormal content, compromising attack stealthiness. This trade-off between effectiveness and stealthiness poses a major limitation for existing attacks. To address this challenge, we proposeHidden Tail, a stealthy resource consumption attack that crafts prompt-agnostic adversarial images, inducing VLMs to generate maximum-length outputs by appending special tokens invisible to users. Our method employs a composite loss function that balances semantic preservation, repetitive special token induction, and suppression of the end-of-sequence (EOS) token, optimized via a dynamic weighting strategy. Extensive experiments show thatHidden Tailoutperforms existing attacks, increasing output length by up to 19.2× and reaching the maximum token limit, while preserving attack stealthiness. These results highlight the urgent need to improve the robustness of VLMs against efficiency-oriented adversarial threats. Our code is available athttps://github.com/zhangrui4041/Hidden_Tail.

Third-party applications (TPAs) are integral components of managed Kubernetes clusters, but are also frequently exploited in takeover attacks. Recent incidents have demonstrated that TPAs can be weaponized to gain control over clusters. Given their critical role within the Kubernetes ecosystem, it is essential to explore the potential attack surfaces associated with various types of TPAs. To address this, we propose${\sf KubeSec}$, a framework that systematically investigates these risks by analyzing application permission configurations and component code dependencies. This investigation revealed a significant number of insecure RBAC binding patterns, uncovering 562 such patterns and identifying 375 vulnerabilities linked to 134 CVEs. These vulnerabilities impact millions of users, with an average remediation time exceeding 10 months. All findings have been reported to the relevant teams, leading to the assignment of 21 new CVEs by the community. These results highlight substantial security risks associated with TPAs in Kubernetes clusters and emphasize the urgent need for further research to develop more secure cluster management practices.

Recently, private and robust federated learning (FL) schemes have been proposed to address privacy inference and Byzantine attacks simultaneously. However, existing schemes are inefficient in private and robust aggregation protocols due to the employment of heavy cryptographic techniques. To approach the above problem, we propose Sanitizer, an efficient, private, and robust FL framework. Specifically, we first design a Byzantine-robust defense for communication-efficient sign-based FL. We further propose a customized private and robust aggregation scheme built on our Byzantine-robust defense for FL. The core of our construction is two new efficient protocols, i.e.,high-dimensional boolean summationandweighted boolean majority vote, which serve as the main building blocks of Sanitizer. Extensive evaluations on real-world datasets demonstrate that Sanitizer is blazing fast, achieving 19 ∼ 23× less runtime compared to the state-of-the-art. Meanwhile, Sanitizer achieves the same accuracy as the plaintext and superior Byzantine robustness against various classic attacks.

In the Machine Learning as a Service paradigm, a service provider (e.g., a server) hosting a model offers inference APIs to clients, who can send their queries and receive the inference results. While most recent secure inference works focus on addressing privacy issues, they overlook the importance of checking the service quality and reliability. A malicious server may deviate from the protocol specification to deliberately provide incorrect services such as using low-quality models. Thus, it is necessary to design new solutions to empower clients to verify the server’s model accuracy and inference integrity while protecting both parties’ privacy. We present Conan, a new secure and reliable inference framework against malicious servers to achieve accuracy verification, inference integrity, and privacy simultaneously. In Conan, the server first commits to the model and proves in zero-knowledge that the committed model achieves the claimed accuracy. Then both parties perform secure inference on the committed model against the malicious server. To instantiate the above framework, we design generic maliciously secure two-party computation (2PC) protocols with a fixed corrupted party, which may be of independent interest. Our protocols achieve high efficiency by utilizing the advantage that the semi-honest party can check the behavior of the corrupted party. Furthermore, they support both arithmetic and Boolean circuit evaluation, a crucial attribute for secure inference on complicated machine learning models. We implement the fixed-corruption 2PC protocols for our secure and reliable inference. The experimental results show 1 ~ 2 orders of magnitude improvements over conventional maliciously secure protocols in terms of communication and computation costs.

Vehicular Ad Hoc Networks (VANETs) are the cornerstone of intelligent transportation systems and autonomous driving. Vehicle-to-road communication, as one of the core services, faces increasing risks of privacy breaches. Signcryption technology effectively ensures secure information transmission. However, existing signcryption schemes still have deficiencies in terms of transmission robustness and identity privacy protection. To solve these issues, this paper proposes a Robust Identity-based Signcryption scheme (RIBSC) for VANETs. In RIBSC, we first design an area session key distribution mechanism based on Chinese Residual Theorem (CRT), which can dynamically revoke the decryption ability of malicious Roadside Units (RSUs) in real time. Only RSUs approved by Trusted Detection Center (TDC) can obtain a valid session private key by conducting one modular operation. We then utilize the traceable pseudonym mechanism to protect the identity privacy of vehicles and RSUs, which can track their true identities when illegal activities occur. We finally provide a rigorous security proof under the random oracle model, and demonstrate the performance advantages of RIBSC through extensive experiments. More attractively, the session information is fixed at only 148 bytes, regardless of the number of RSUs.

Outsourcing image management to a cloud should not only protect the confidentiality of image data, but also maintain the capability of reverse image search, which requires identifying the existing stored images that are similar to an input image. Previous studies build on cryptographic approaches to realize reverse image search on encrypted images, yet failing to achieve either security or performance. This paper explores trusted image search, which uses Intel SGX to realize reverse image search in an enclave, in order to provide security guarantees via SGX while performing search on plain data (inside the enclave) for performance. However, due to the resource limits of SGX, directly realizing the search process in the enclave incurs high performance overhead. We present TRUSTSEARCH, which implements various design approaches to mitigate the resource overhead of SGX. We evaluate TRUSTSEARCH using real-world image datasets, and show that it outperforms state-of-the-art approaches for search performance while preserving space efficiency for the enclave.

Mainstream backdoor attacks on large language models (LLMs) typically set a fixed trigger in the input instance and specific responses for triggered queries. However, the fixed trigger setting (e.g., unusual words) may be easily detected by human detection, limiting the effectiveness and practicality in real-world scenarios. To enhance the stealthiness of backdoor activation, we present a new poisoning paradigm against LLMs triggered by specifying generation conditions, which are commonly adopted strategies by users during model inference. The poisoned model performs normally for output under normal/other generation conditions, while becomes harmful for output under target generation conditions. To achieve this objective, we introduce BrieFool, an efficient attack framework. It leverages the characteristics of generation conditions by efficient instruction sampling and poisoning data generation, thereby influencing the behavior of LLMs under target conditions. Our attack can be generally divided into two types with different targets: Safety unalignment attack and Ability degradation attack. Our extensive experiments demonstrate that BrieFool is effective across safety domains and ability domains, achieving higher success rates than baseline methods, with 94.3% on GPT-3.5-turbo.

Single Sign-On (SSO) allows users to sign on to multiple relying providers (RPs) with a single authentication token issued by an identity provider (IdP), which provides users a convenient and efficient way to access multiple services from different RPs. As the security of SSO relies on the reliability of IdP (which needs to well maintain a secret used to issue tokens), it suffers from the single-point-of-failure problem. Existing schemes address the problem by utilizing multiple IdPs to issue tokens in a threshold way, so as to make the task of compromising the secret for adversaries as difficult as possible. However, no security guarantee is considered once the secret is compromised by adversaries. In this paper, we propose a distributed forward-secure SSO scheme, dubbed DFSSO, to achieve security in the “post-compromising case” with minimized costs: after the secret is compromised, only a small portion of users need to re-authenticate themselves with IdPs. The key technique behind DFSSO is a new cryptographic primitive, i.e., threshold forward-secure signature, which is interesting in its own right. We integrate DFSSO into OpenID Connect (i.e., OIDC, a popular SSO standard), implement a prototype, and conduct a comprehensive performance evaluation, which demonstrates that DFSSO is efficient and practical.

The widespread adoption of facial recognition (FR) models raises serious concerns about their potential misuse, motivating the development of anti-facial recognition (AFR) to protect user facial privacy. In this paper, we argue that the static FR strategy, predominantly adopted in prior literature for evaluating AFR efficacy, cannot faithfully characterize the actual capabilities of determined trackers who aim to track a specific target identity. In particular, we introduce DynTracker, a dynamic FR strategy where the model's gallery database is iteratively updated with newly recognized target identity images. Surprisingly, such a simple approach renders all the existing AFR protections ineffective. To mitigate the privacy threats posed by DynTracker, we advocate for explicitly promoting diversity in the AFR-protected images. We hypothesize that the lack of diversity is the primary cause of the failure of existing AFR methods. Specifically, we develop DivTrackee, a novel method for crafting diverse AFR protections that builds upon a text-guided image generation framework and diversity-promoting adversarial losses. Through comprehensive experiments on various image benchmarks and feature extractors, we demonstrate DynTracker's strength in breaking existing AFR methods and the superiority of DivTrackee in preventing user facial images from being identified by dynamic FR strategies. We believe our work can act as an important initial step towards developing more effective AFR methods for protecting user facial privacy against determined trackers.

Social network alignment has made significant progress in social network analysis, with representative applications such as cross-domain recommendation and community detection. However, existing approaches require institutions to share raw user data, raising significant privacy concerns. To address this issue, we propose a Privacy-Preserving Network Alignment (PPNA) scheme that eliminates the need for raw data sharing. In concrete, PPNA leverages homomorphic encryption to enable computation over the ciphertext domain without decryption. It ensures provable data privacy. PPNA also presents a secure multiparty computation protocol to eliminate reliance on trusted third-party servers, which is often impractical in real-world scenarios. Furthermore, its well-designed iterative update mechanism is well-suited for iterative alignment algorithms. Comprehensive experimental results have demonstrated that PPNA improves performance compared to the scenario where raw data sharing is unfeasible due to privacy concerns. It achieves an average F1-score increase of 1.65 times and up to 2.28 times. The performance gain is more pronounced in decentralized settings, highlighting PPNA’s practicality in real-world scenarios when multi-institution collaboration is imperative.

Diffusion-based Text-to-Image (T2I) synthesis has emerged as a transformative multimodal generation technology. However, its reliance on pre-trained models introduces severe backdoor risks, including output manipulation and privacy violations. Existing attacks using specific triggers demonstrate effectiveness in monolingual settings but tend to degrade in crosslingual scenarios due to semantic inconsistency. To bridge this gap, we propose a cross-lingual transfer backdoor attack that maintains robust attack efficacy across languages through single-language poisoning. Specifically, we introduce a linguistically informed trigger selection method that identifies semantically invariant words across languages. The trigger is deliberately and naturally embedded into prompts to minimize semantic disruption, thereby helping to evade potential defense mechanisms. Our approach leverages cross-lingual semantic alignment between high-resource and low-resource languages to enable stealthy and effective backdoor activation. We assume the adversary finetunes with limited data, without knowledge of the model internals or the original training data. Our attack demonstrates the potential to bypass existing defenses in T2I models and exposes critical security vulnerabilities in multilingual T2I systems. These findings highlight the urgent need for targeted security measures to mitigate backdoor threats and prevent malicious exploitation.

Recent advances in text-to-video (T2V) generation have enabled high-fidelity video synthesis from natural language descriptions. While these models offer promising applications, their capacity to generate not safe for work (NSFW) content poses significant security concerns. In this work, we first explore the vulnerability of T2V models to jailbreak attacks, building upon methods developed for text-to-image (T2I) models. We conduct a systematic evaluation of the transferability of T2I jailbreak techniques to T2V models, revealing that naively adapted attacks yield limited effectiveness due to the unique temporal and semantic challenges in video generation. To address these limitations, we propose PromptNeedling, a jailbreak attack method tailored for T2V models. Specifically, PromptNeedling optimizes the jailbreak prompts to simplify adversarial inputs and injects high-salience NSFW keywords in a controlled manner. We conduct extensive experiments on three open-source T2V models and evaluate two categories of NSFW content (nudity and gore & violence), showing that PromptNeedling achieves higher attack success rates than prior methods. These findings highlight the urgent need for developing effective defenses against jailbreak attacks to ensure the safety of T2V models.

Currently, object detection models have achieved widespread success in real-world applications, yet remain vulnerable to backdoor attacks. Existing backdoor methods often suffer from poor stealthiness or can be easily mitigated by standard image processing techniques. In this paper, we propose a novel stealthy backdoor attack to dynamically compress target object-oriented data for backdoor embedding. By modifying the model, a high-frequency feature extraction module is added, so the model learns frequency-domain feature representations of compressed samples and achieve three attack objectives. Extensive experimental results demonstrate the effectiveness and robustness of the proposed method, achieving attack success rates exceeding 90% across three detectors.

Deep learning models have achieved unprecedented success in various domains, such as healthcare and finance. However, deploying model inference in real-world applications, where data is distributed among multiple entities, poses significant privacy concerns. Existing secure model inference work has limitations in computational overhead and scalability, especially when dealing with complex models and multiple parties with vertically partitioned data. In this work, we design and implement an efficient and scalable secure inference framework for vertically partitioned data, supporting execution with a large number of parties. Our work considers a semi-honest setting with all-but-one corruptions. The core of our framework is a series of secure and efficient protocols for complex non-linear functions of the model inference, such as ReLU and Maxpool. These protocols are designed based on secure multi-party computation preliminaries, significantly enhancing efficiency while maintaining rigorous security guarantees. We conduct comprehensive experiments to evaluate the performance of our framework. Experimental results show that SecInfer substantially improves the communication and computation performance of secure naive inference works by up to 3.71 × and 3.42 ×, respectively.

In recent years, deep neural networks (DNNs) have driven rapid advancements in various fields. As DNNs continue to grow in size, the amount of training data required is also increasing. Many researchers crawl publicly available data from the internet for training, which raises issues of unauthorized exploitation and potential privacy leakage. Recent work against unauthorized exploitation primarily focuses on the image domain, while the audio domain remains underexplored. In this paper, we propose an effective method to generate audio unlearnable examples, which injects imperceptible perturbations into training samples, making them unlearnable for models to train. Specifically, we employ an error minimization optimization algorithm to iteratively optimize the generated perturbations. To ensure these perturbations remain imperceptible, we leverage both the Short-Time Objective Intelligibility (STOI) score and the$L_{2}$norm as measures to constrain the perceptibility of the unlearnable examples. To further improve the transferability of the unlearnable effects, we use an ensemble model and threshold constraint to effectively enhance generated unlearnable examples. Experimental results demonstrate that our method effectively generates samples that prevent models from accurately learning and making predictions, while remaining indistinguishable from clean samples to human observers.

Recent advancements in deep learning have led to remarkable progress in autonomous driving technology, with deep neural network (DNN)-based traffic sign recognition systems (TSRS) playing a crucial role. However, recent studies indicate that TSRS are vulnerable to backdoor attacks, where the backdoor TSRS behaves normally on clean traffic signs but consistently misclassifies backdoor-triggered traffic signs into a designated target class. Notably, while backdoor attacks in the digital domain are effective, their effectiveness may diminish in the physical world due to quality degradation during image transmission. Existing physical backdoor attacks typically rely on specific stickers or transformations as backdoor triggers, which are not stealthy and natural enough in the physical world. To address these limitations, we propose two stealthy physical backdoor attacks against DNN-based TSRS from two different perspectives. On the one hand, we utilize the natural phenomenon of chipped paints on traffic signs as the backdoor trigger. Specifically, we develop an automatic traffic sign segmentation algorithm to identify the edges of the target sign and simulate chipped paint to create poisoned samples. On the other hand, instead of manipulating the target traffic sign, we use the specific filter lens (attached to the in-vehicle camera) as the backdoor trigger, where the parameters of the filter lens are optimized by the Genetic Algorithm (GA). Extensive experiments conducted on the GTSRB and TSRD datasets demonstrate the effectiveness of our proposed backdoor attacks in both digital and physical environments.

Machine Learning as a Service (MLaaS) providers often promote the robustness of their models as a selling point for their API services. Existing methods commonly evaluate the robustness of Deep Neural Networks (DNNs) by generating highly transferable adversarial examples However, dishonest MLaaS providers may deceive consumers by falsely exaggerating the robustness of their models. In this paper, contrary to enhancing the transferability of adversarial examples, we attempt to craft adversarial examples that fail under a shielded model. In other words, ensuring that the adversarial examples fail to attack a shielded model but successfully attack other models, which we refer to as controllable transferability. To achieve this goal, we propose the Controllable Transferability Method (CTM), a framework that generates adversarial examples with controllable transferability. CTM involves generating transferable adversarial examples and refining their transferability using gradient antagonism. Experimental results demonstrate that CTM achieves high transferability across models, with controlled adversarial effects on selected models.

Electronic voting (e-voting) plays a key role in modern democratic processes, especially in scenarios where consensus or collective decisions need to be reached. Existing e-voting schemes share the same paradigm of "one-person-one-vote" and treat all voters equally, which is unsatisfactory for weighted settings where every voter is associated with a weight. Furthermore, existing schemes suffer from critical threats towards voters’ privacy and voting results, which becomes a major hindrance towards the broad adoption of e-voting schemes in reality. In this paper, we propose a verifiable e-voting scheme, dubbed WEAPT, to support weighted e-voting with a strong security guarantee. The key technique behind WEAPT is a threshold weighted matrix aggregation mechanism with public verifiability and privacy preservation, where the Shamir secret sharing scheme, Pedersen vector commitment scheme, and zeroknowledge proofs are deployed. We provide security analyses to show that WEAPT is secure against internal and external adversaries. We implement a WEAPT prototype and conduct a comprehensive performance evaluation, which demonstrates its practical efficiency.

Text-to-image generative models have garnered immense attention for their ability to produce high-fidelity images from text prompts and enjoyed great popularity among the community. Unfortunately, previous studies have demonstrated that text-to-image models suffer from backdoor attacks, which enforce the text-guided generative models to generate images that align the backdoor target via embedding the textual triggers. However, the currently proposed backdoor attacks rely on numerous training data and complex computing resources for poisoning the core components in generative models, limiting the effectiveness and practicality in real-world scenarios. In this work, we first investigate the backdoor attack against Text-to-image generation by manipulating text tokenizer. Our backdoor attack exploits the semantic conditioning role of text tokenizer in the text-to-image generation. We propose an Automatized Remapping Framework with Optimized Tokens (AROT) for finding the best target tokens to remap the trigger token in the mapping space, according to different tasks. We conduct extensive experiments on Stable Diffusion and two defined tasks to demonstrate the effectiveness, stealthiness and robustness of our attack.

Deep learning models employed in face recognition (FR) systems have been shown to be vulnerable to physical adversarial attacks through various modalities, including patches, projections, and infrared radiation. However, existing adversarial examples targeting FR systems often suffer from issues such as conspicuousness, limited effectiveness, and insufficient robustness. To address these challenges, we propose a novel approach for adversarial face generation, UVHat, which utilizes ultraviolet (UV) emitters mounted on a hat to enable invisible and potent attacks in black-box settings. Specifically, UVHat simulates UV light sources via video interpolation and models the positions of these light sources on a curved surface, specifically the human head in our study. To optimize attack performance, UVHat integrates a reinforcement learning-based optimization strategy, which explores a vast parameter search space, encompassing factors such as shooting distance, power, and wavelength. Extensive experimental evaluations validate that UVHat substantially improves the attack success rate in black-box settings, enabling adversarial attacks from multiple angles with enhanced robustness.

Recent research highlights concerns about the trustworthiness of third-party Pre-Trained Language Models (PTLMs) due to potential backdoor attacks. These backdoored PTLMs, however, are effective only for specific pre-defined downstream tasks. In reality, these PTLMs can be adapted to many other unrelated downstream tasks. Such adaptation may lead to unforeseen consequences in downstream model outputs, consequently raising user suspicion and compromising attack stealthiness. We refer to this phenomenon as backdoor complications. In this paper, we undertake the first comprehensive quantification of backdoor complications. Through extensive experiments using 4 prominent PTLMs and 16 text classification benchmark datasets, we demonstrate the widespread presence of backdoor complications in downstream models fine-tuned from backdoored PTLMs. The output distribution of triggered samples significantly deviates from that of clean samples. Consequently, we propose a backdoor complication reduction method leveraging multi-task learning to mitigate complications without prior knowledge of downstream tasks. The experimental results demonstrate that our proposed method can effectively reduce complications while maintaining the efficacy and consistency of backdoor attacks.

Text-to-image diffusion models have advanced controllable image generation, with ControlNet plugins enabling precise structural guidance and domain-specific adaptations. As these plugins become widely shared and personalized, protecting their ownership and preventing misuse becomes crucial. Existing watermarking methods address robustness against fine-tuning and personalization at the model level, but fail to address ControlNet-like plugins or modules specifically. To address this gap, we propose CtrlMark, the first watermarking framework designed specifically for ControlNet plugin modules. CtrlMark embeds a robust, triggerable watermark as a benign backdoor, activated by a composite trigger combining text and structural inputs. Furthermore, CtrlMark achieves few misactivations and strong robustness against downstream fine-tuning, by watermark penalization and leveraging a fixed latent residual embedding localized to a spatial region. Extensive experiments demonstrate CtrlMark maintains high watermark activation rates and visual fidelity, providing effective and practical protection for modular ControlNet components in diverse generation scenarios.

Natural language processing (NLP) systems have been demonstrated to be vulnerable to backdoor attacks. Specifically, attackers embed the backdoor into the model by poisoning training data, producing the desired results when the input contains pre-defined triggers. Typical textual backdoor attacks adopt static triggers such as words or phrases, which make them detectable by existing defense methods. To enhance stealthiness, this paper introduces a hidden backdoor attack method utilizing formal text style transfer (FTST). Specifically, we adopt a formal text style transfer model to convert part of the benign training samples into formal samples, which serve as the backdoor samples. Compared to static textual triggers, FTST-based triggers can maintain original semantics while evading common defenses and human detections. We conduct extensive experiments on typical NLP tasks, including topic and sentiment classification tasks utilizing three prominent pre-trained language models and four datasets. The results show that our approach achieves the desired attack performance while preserving the normal-functionality of the model. Furthermore, compared to common word-level triggers and sentence-level triggers, our approach has been demonstrated to be more stealthy under GPT-2-based perplexity detection and more robust under backdoor defense methods.

With the widespread adoption of deep learning in image recognition, backdoor attacks have emerged as a significant security threat, drawing increasing attention from the research community. Traditional backdoor attacks are often limited to the digital domain, while few existing physical-world attacks suffer from a lack of stealthiness. In this paper, inspired by the natural defocus blur commonly caused by camera optics in real-world environments, we propose a physically-aware backdoor attack method called DBBA based on the defocus blur phenomenon. By leveraging Gaussian blur to simulate this natural phenomenon, the proposed method enhances both the stealthiness and plausibility of the trigger. To further optimize the attack effectiveness while maintaining stealthiness, we introduce a Particle Swarm Optimization (PSO) algorithm to automatically search for the optimal Gaussian blur parameters that best simulate the defocus phenomenon. We conduct extensive experiments on multiple mainstream image classification datasets and across various model architectures. Experimental results demonstrate that the proposed defocus-blur based trigger achieves a high attack effectiveness with minimal degradation in the classification accuracy of the model. In addition, evaluations against representative defense techniques reveal that the proposed method exhibits strong stealthiness and robustness.

Recently, traffic sign recognition (TSR) systems have become a prominent target for physical adversarial attacks. These attacks typically rely on conspicuous stickers and projections, or using invisible light and acoustic signals that can be easily blocked. In this paper, we introduce a novel attack medium, i.e., fluorescent ink, to design a stealthy and effective physical adversarial patch, namely FIPatch, to advance the state-of-the-art. Specifically, we first model the fluorescence effect in the digital domain to identify the optimal attack settings, which guide the real-world fluorescence parameters. By applying a carefully designed fluorescence perturbation to the target sign, the attacker can later trigger a fluorescent effect using invisible ultraviolet light, causing the TSR system to misclassify the sign and potentially leading to traffic accidents. We conducted a comprehensive evaluation to investigate the effectiveness of FIPatch, which shows a success rate of 98.31% in low-light conditions. Furthermore, our attack successfully bypasses five popular defenses and achieves a success rate of 96.72%.

Abstract Artificial intelligence (AI) is revolutionizing both industries and reshaping the global economy. However, the rapid advancement of AI technologies brings significant security and privacy challenges. Recent incidents highlight vulnerabilities in AI systems, such as data leakage and malicious code injection, leading to severe financial losses and privacy breaches. Although existing studies have discussed specific security threats, they often lack detailed granularity and cover a limited scope. In this survey, we fill this gap by systematically categorizing and analyzing the threats and countermeasures in AI systems, which span both the training and inference stages, encompass centralized and distributed settings, and address both conventional and foundation AI models. By reviewing existing literature, we aim to provide AI researchers and practitioners with a thorough understanding of system vulnerabilities and current countermeasures. We hope to inspire further research into robust solutions, ultimately contributing to the development of resilient AI technologies.

Unmanned aerial vehicles (UAVs) are vulnerable to interception and attacks when operated remotely without a unified and efficient identity authentication. Meanwhile, the openness of wireless communication environments potentially leads to data leakage and system paralysis. However, conventional authentication schemes in the UAV network are centered on the fixed trust boundary, ignoring potential internal threats and failing to flexibly respond to the dynamic requirements of UAV access and identity authentication. Additionally, UAVs are not subjected to periodic repetitive identity authentication, leading to difficulties in controlling access anomalies. Therefore, in this work, we consider a zero-trust framework for UAV network authentication, aiming to achieve UAV identity authentication through the principle of "never trust and always verify". We introduce a blockchain-assisted zero-trust authentication scheme, namely BAZAM, designed for multi-UAV wireless networks. In this scheme, UAVs follow a key generation approach using physical unclonable functions (PUFs), and cryptographic technique helps verify registration and access requests of UAVs. The blockchain is applied to store UAVs authentication-related information in immutable storage. Through thorough security analysis and extensive evaluation, we demonstrate the effectiveness and efficiency of the proposed BAZAM.

Smart grids have revolutionized electricity management by leveraging real-time consumption data, enabling more efficient power control through advanced algorithms. However, this transformation raises significant privacy and security concerns due to the extensive collection of user data. Current solutions face challenges, such as aggregator gateway misbehavior, lack of support for function queries, and the need to balance privacy with efficiency. In this article, we propose FEHH, a novel scheme that ensures both privacy preservation and verifiable aggregation. It allows multiple aggregators to perform inner-product computations on encrypted data while safeguarding the aggregated results from the aggregator. Additionally, it supports verification of aggregated data’s correctness using Linear Homomorphic Hash. Building on FEHH, we introduce GuardGrid, a privacy-preserving aggregation scheme for smart grids that inherits FEHH’s core features and adds support for essential arithmetic operations necessary for function queries. This allows cloud servers to respond to queries from either the control center or users without compromising data confidentiality. Experimental results show that the encryption overhead of GuardGrid is only 7% of that of the PPDA scheme, and its communication overhead is$123\times $less. These results demonstrate that GuardGrid significantly reduces computation and communication costs, providing a more sustainable and cost-effective smart grid solution.

Call detail records (CDRs) provide valuable insights into user behavior, which are instrumental for telecom companies in optimizing network coverage and service quality. However, while cloud computing facilitates clustering analysis on a vast scale of CDR data, it introduces privacy risks. The challenge lies in striking a balance between efficiency, security, and cost-effectiveness in privacy-preserving algorithms. To tackle this issue, we propose a privacy-preserving and cost-effective incremental density peak clustering scheme. Our approach leverages homomorphic encryption and order-preserving encryption to enable direct computations and clustering on encrypted data. Moreover, it employs reaching definition analysis to optimize the execution flow of static tasks, pinpointing the optimal junctures for transitioning between the two types of encryption to reduce communication overhead. Furthermore, our scheme utilizes a game theory-based verification strategy to ascertain the accuracy of the results. This methodology can be effectively deployed on the Ethereum blockchain via smart contracts. A comprehensive security analysis confirms that our scheme upholds both privacy and data integrity. Experimental evaluations substantiate the clustering accuracy, communication load, and computational efficiency of our scheme, thereby validating its viability in real-world applications.

With the rapid development of deep learning technology, deep learning-based Image-to-Image (I2I) networks have become the predominant choice for I2I tasks like image super-resolution and denoising. Despite their remarkable performance, the security of I2I networks has not been thoroughly investigated. While some studies have probed their susceptibility to adversarial attacks, none have explored the backdoor attack against I2I networks, which is a more stealthy and severe threat. In this work, for the first time, we comprehensively investigate the vulnerability of I2I networks to backdoor attacks. We propose a backdoor attack against I2I tasks, where the backdoored I2I network behaves normally on clean input images, yet outputs a specific inappropriate image when the backdoor trigger appears on the input image. To achieve such an I2I backdoor attack, we design a universal adversarial perturbation (UAP) generation algorithm for I2I networks, where the generated UAP is used as the trigger for the I2I backdoor. Besides, multi-task learning (MTL) with dynamic weighting methods is employed in the backdoor training process to gain better results. Expanding our focus beyond I2I tasks, we extend our I2I backdoor to attack downstream tasks, including image classification and object detection. Specifically, the backdoor-triggered image processed by the backdoored image denoising network can fool the downstream image classifiers and object detectors. Extensive experiments demonstrate the effectiveness of the I2I backdoor on state-of-the-art I2I network architectures as well as the robustness against different backdoor defenses.

Deep neural networks (DNNs) are known to be susceptible to various malicious attacks, such as adversarial and backdoor attacks. However, most of these attacks utilize additive adversarial perturbations (or backdoor triggers) within an$L_{p}$-norm constraint. They can be easily defeated by image preprocessing strategies, such as image compression and image super-resolution. To address this limitation, instead of using additive adversarial perturbations (or backdoor triggers) in the pixel space, this work revisits the design of adversarial perturbations (or backdoor triggers) from the perspective of color space and conducts a comprehensive analysis. Specifically, we propose a color space backdoor attack and a color space adversarial attack where the color space shift is used as the trigger and perturbation. To find the optimal trigger or perturbation in the black-box scenario, we perform an iterative optimization process with the Particle Swarm Optimization algorithm. Experimental results confirm the robustness of the proposed color space attacks against image preprocessing defenses as well as other mainstream defense methods. In addition, we also design adaptive defense strategies and evaluate their effectiveness against color space attacks. Our work emphasizes the importance of the color space when developing malicious attacks against DNN and urges more research in this area.

In this paper, we present$\mathtt {Antelope}$, a semi-honest large-scale secure inference system without revealing either clients’ data or model parameters. The main contributions of$\mathtt {Antelope}$are new two-party computation (2PC) protocols over a ring$\mathbb {Z}_{2^\ell }$for non-linear layers, which optimize the online computation and communication overhead thus outperforming the state-of-the-art 2PC systems. Specifically, we reformulate the comparison function as an Equality-to-Zero test followed by multiplication, decoupling the bit-wise rounding dependency in traditional secret sharing-based bit extraction. With this technique, the evaluation of the ReLU non-linear activation function is$1.7\times$-$84.5\times$faster than existing solutions in online communication cost. We also develop a suite of optimizations that improve the efficiency of secure division protocols, which are tailored to different divisor settings in the neural networks. We extend our protocols to construct efficient implementations for several building blocks such as ReLU, Maxpool, truncation, and Softmax. End-to-end evaluation on realistic ImageNet-scale networks demonstrates that$\mathtt {Antelope}$achieves over$22.3\times$and$23.0\times$online runtime speedups in LAN and WAN settings, respectively, without accuracy loss, compared to the state-of-the-art works.

Fueled by its successful commercialization, the recommender system (RS) has gained widespread attention. However, as the training data fed into the RS models are often highly sensitive, it ultimately leads to severe privacy concerns, especially when data are shared among different platforms. In this paper, we follow the tune of existing works to investigate the problem of secure sparse matrix multiplication for cross-platform RSs. Two fundamental and critical issues are addressed: preserving the training data privacy and breaking the data silo problem. Specifically, we propose two concrete constructions with significantly boosted efficiency. They are designed for the sparse location insensitive case and location sensitive case, respectively. State-of-the-art cryptography building blocks including homomorphic encryption (HE) and private information retrieval (PIR) are fused into our protocols with non-trivial optimizations. As a result, our schemes can enjoy the HE acceleration technique without privacy trade-offs. We give formal security proofs for the proposed schemes and conduct extensive experiments on both real and large-scale simulated datasets. Compared with state-of-the-art works, our two schemes compress the running time roughly by$10\times$and$2.8\times$. They also attain up to$15\times$and$2.3\times$communication reduction without accuracy loss.

The increasing demand for secure and efficient data sharing has underscored the importance of developing robust cryptographic schemes. However, many existing endeavors have overlooked the following critical issues: (1) unauthorized access resulting from malicious information leakage by senders; (2) absence of constraints on write and read permissions for participants; (3) and inflexibility of strategies to dynamically designate ciphertexts to multiple recipients. In this paper, we present SCPA, a cross-domain access control scheme imbued with sanitization features and propelled by policy-driven dynamic authorization, tailored for cloud-based data sharing. This scheme not only facilitates access controls, including regulations for no-read and no-write stipulations, governing the data permissible for senders to transmit and recipients to acquire but also enables the dynamic sharing of a data ciphertext subset with additional recipients beyond the originally sanctioned ones. We also provide comprehensive security proofs rigorously indicating the security of the invented SCPA. Moreover, to assess the efficacy of our SCPA, we undertake thorough theoretical and experimental analyses, showcasing its feasibility and superior performance.

Sparse inner product (SIP) has the attractive property of overhead being dominated by the intersection of inputs between parties, independent of the actual input size. It has intriguing prospects, especially for boosting machine learning on large-scale data, which are tangled with sparse data. In this paper, we investigate privacy-preserving SIP problems that have rarely been explored before. Specifically, we propose two concrete constructions, one requiring offline linear communication, which can be amortized across queries, while the other has sublinear overhead but relies on the more computationally expensive tool. Our approach exploits state-of-the-art cryptography tools including garbled Bloom filters (GBF) and Private Information Retrieval (PIR) as the cornerstone but carefully fuses them to obtain nontrivial overhead reductions. We provide formal security analysis of the proposed constructions and implement them into representative machine learning algorithms including k-nearest neighbors, naive Bayes classification, and logistic regression. Compared to existing efforts, our method achieves 2-$50\times$speedup in runtime and up to$10\times$reduction in communication.

Federated learning (FL) is a distributed machine learning technique that guarantees the privacy of user data. However, FL has been shown to be vulnerable to gradient leakage attacks (GLA), which have the ability to reconstruct private training data from public gradients with high probability. These attacks are either analytic-based, requiring modification of the FL model, or optimization-based, requiring long convergence times and failing to effectively address the challenge of dealing with highly compressed gradients in practical FL systems. This paper presents a pioneering generation-based GLA method called FGLA that can reconstruct batches of user data without the need for the optimization process. We specifically design a feature separation technique that first extracts the features of each sample in a batch and then directly generates the user data. Our extensive experiments on multiple image datasets show that FGLA can reconstruct user images in seconds with a batch size of 256 from highly compressed gradients (0.8% compression ratio or higher), thereby significantly outperforming state-of-the-art methods.

Exchange-assisted data trading (EADT) has become an essential paradigm in current data marketplaces. With data exchanges, sellers and buyers can trade data in an efficient and convenient way. However, existing EADT systems are vulnerable to privacy violations. Sensitive information about the data owned by sellers (manifested as attributes of the data) and the purchasing requirements of buyers (manifested as interests) are highly susceptible to leakage. On the one hand, buyers and sellers have direct access to the type of data supplied or desired before the data transaction is established. On the other hand, the information about transactions between the seller and buyer is transparent to the exchange, including the content of the transaction contract. In addition, the participants are likely to repudiate the content of previously accepted contracts or trigger a bidding war by contract first authorized by others, which raises threats towards authenticity and fairness. In this paper, we investigate the contract agreement in actual EADT systems, enumerate the inherent requirements of secrecy and fairness, and formally define them. Then we propose a privacy-preserving and fair contract agreement framework, dubbed PFCA, which consists of order-matching, negotiation, and authorization. We further propose a practical instantiation of PFCA, dubbed BestPFCA, utilizing efficient private set intersection (PSI), secure messaging (SM), and three-party signature (TPS). In addition, we also implement a BestPFCA prototype and conduct a comprehensive performance evaluation, which demonstrates the efficiency and practicality of BestPFCA.

In this paper, we introduce SeiFS, a Secure and Lightweight Feature Selection system designed to ensure high-quality inputs for Machine Learning (ML) tasks. Unlike previous approaches involving multiple non-colluding servers, SeiFS operates in a natural ML scenario where multiple entities interact with a single server, without relying on additional strong assumptions. Our work presents intrinsic optimizations in feature selection that yield substantial performance improvements, including a customized data encoding method, a size-optimized comparison circuit, and a shared oblivious dimensionality reduction technique. The customized data encoding method, combined with an optimized secure data access protocol, reduces expensive comparison operations from$O(m)$to$O(\log m)$, where m represents the number of samples. The size-optimized comparison circuit achieves up to a quadruple reduction in size compared to naïve implementations. Additionally, the shared oblivious dimensionality reduction technique incorporates a novel approximated top-k selection algorithm, resulting in a circuit size reduction of approximately$k\times $. Comprehensive experiments conducted across various network settings demonstrate that our protocols outperform existing solutions, delivering efficiency improvements of an order of magnitude. Specifically, the end-to-end execution of SeiFS on real-life datasets achieves at least$62.7\times $improvements in runtime compared to the naïve implementation and takes up to$112.9\times $fewer runtimes than the state-of-the-art in the LAN setting.

Voice assistants (VAs) have become ubiquitous in smart devices, and are highly valued for their ability to perform a variety of tasks through voice interaction, offering users hands-free convenience. However, the always-on microphones of VAs have raised significant privacy concerns in recent years. In this paper, we propose and implement NUSGuard, a novel and practical anti-eavesdropping system. To our knowledge, it is the first system to utilize the built-in speakers of commercial off-the-shelf (COTS) devices for anti-eavesdropping, thereby eliminating the need for dedicated ultrasonic transmitters. Specifically, it exploits human ears’ insensitivity to near-ultrasonic signals and the inherent non-linearity of mic to inject jamming noises into the microphones of unauthorized smart devices. Furthermore, we propose a robust mixed-noise scheme and a lexical-level automatic jammer control strategy, effectively disrupting unauthorized recordings while maintaining seamless voice interaction with authorized VA devices. Extensive digital and real-world experiments have demonstrated NUSGuard’s superior performance in terms of jamming effectiveness and security.

As a new paradigm of distributed learning, Federated Learning (FL) has been applied in industrial fields, such as intelligent retail, finance and autonomous driving. However, several schemes that aim to attack robust aggregation rules and reducing the model accuracy have been proposed recently. These schemes do not maintain the sign statistics of gradients unchanged during attacks. Therefore, the sign statistics-based scheme SignGuard can resist most existing attacks. To defeat SignGuard and most existing cosine or distance-based aggregation schemes, we propose an enhanced model poisoning attack, ScaleSign. Specifically, ScaleSign uses a scaling attack and a sign modification component to obtain malicious gradients with higher cosine similarity and modify the sign statistics of malicious gradients, respectively. In addition, these two components have the least impact on the magnitudes of gradients. Then, we propose MSGuard, a Multi-Strategy Byzantine-robust scheme based on cosine mechanisms, symbol statistics, and spectral methods. Formal analysis proves that malicious gradients generated by ScaleSign have a closer cosine similarity than honest gradients. Extensive experiments demonstrate that ScaleSign can attack most of the existing Byzantine-robust rules, especially achieving a success rate of up to 98.23% for attacks on SignGuard. MSGuard can defend against most existing attacks including ScaleSign. Specifically, in the face of ScaleSign attack, the accuracy of MSGuard improves by up to 41.78% compared to SignGuard.

Android malware authors often use packers to evade analysis. Although many unpacking tools have been proposed, they face two significant challenges: 1) They are easily impeded by anti-analysis techniques employed by packers, preventing efficient collection of hidden Dex data. 2) They are typically designed to unpack a specific packer and cannot handle malware packed with mixed packers. Consequently, many packed malware samples evade detection. To bridge this gap, we propose Gupacker, a novel generalized unpacking framework. Gupacker offers a generic solution for first-generation holistic packer by customizing the Android system source code. It identifies the type of packer and selects an appropriate unpacking function, constructs a deeper active call chain to achieve generic unpacking of second-generation function extraction packers, and usesJNIfunction and instruction monitoring to handle third-generation virtual obfuscation packer. On this basis, we counteract a diverse array of anti-analysis techniques. We conduct extensive experiments on 5K packed Android malware samples, comparing Gupacker with 2 commercial and 4 state-of-the-art academic unpacking tools. The results demonstrate that Gupacker significantly improves the efficiency of Android malware unpacking with acceptable system overhead. We analyze real packed applications based on Gupacker and found several are second-packed by attackers, including WPS for Android, with tens of millions of users. We receive and responsibly report 13 0day vulnerabilities and also assist in the remediation of all vulnerabilities.

Vulnerability behavior scanning plays a crucial role in securing Intelligent Autonomous Transportation Systems by ensuring protected communications and maintaining data integrity. Current scanning solutions, however, demonstrate several critical shortcomings: (1) their dependence on static analysis methods with predetermined scanning locations prevents dynamic adjustment of scanning strategies; (2) their limited capacity to capture data across multiple system layers fails to address sophisticated multi-layered attack patterns; and (3) their inability to dynamically activate monitoring probes hinders timely responses to newly emerging threats. To resolve these limitations, we present$\textsf {VBSF}$, an efficient and non-intrusive vulnerability scanning framework built upon extended Berkeley Packet Filter technology. The proposed system incorporates two key innovations: a dynamic probe activation mechanism that intelligently adjusts scanning locations in real-time to optimize resource usage, and a standardized data format that enables integrated analysis of vulnerability behaviors across different system layers. Experimental evaluations confirm that$\textsf {VBSF}$effectively identifies critical vulnerability behaviors in diverse attack scenarios while introducing only 1.47% additional system overhead.

With the rapid development of mobile computing and the popularity of mobile devices equipped with GPS technology, massive spatial data have become available. Enterprises upload encrypted spatial data to the mobile cloud to save local storage and computation costs. However, the existing secure Geometric Range Search (GRS) solutions are inefficient in terms of building, updating index structure and querying processes. Moreover, the index structures of existing GRS schemes based on Order Preserving Encryption (OPE) leak location order, which may lead to reconstruction attacks. To solve these issues, we first propose an efficient and secure GRS scheme using Radix-Tree, namely GRSRT-I. Specifically, we construct an index structure based on Radix-tree to achieve efficient search and update, then use homomorphic encryption NTRU to resist chosen-plaintext attack, finally design a dual-server architecture to alleviate the burdens on mobile users caused by multiple rounds of interactions. Furthermore, we propose an enhanced scheme, GRSRT-II, by combining Order-Revealing Encryption and OPE, which greatly improves the search efficiency while slightly reducing the security. We formally prove the security of our proposed schemes, and conduct extensive experiments to demonstrate that GRSRT-I can improve the query efficiency by up to at least 1.5 times when compared with previous solutions and GRSRT-II can achieve a higher level of search efficiency.

The two-factor authentication (2FA) has been increasingly used with the popularity of mobile devices. Currently, many existing 2FA schemes extract the devices’ acoustic fingerprints as the second factor. Nevertheless, they mainly consider deriving fingerprints from the raw acoustic waveforms for authentication, which are susceptible to the fingerprint variations caused by the environmental noise or the varying distance between devices. To address these vulnerabilities, we propose a robust system utilizing the distortions of modulated signals, which are incurred by the acoustic elements of mobile devices, as the proof for 2FA. Specifically, our system first designs a channel delay estimation scheme to accurately estimate the propagation delay from the speaker to the microphone by deriving the phase change of the received sinusoidal signal. To perform a robust authentication, we design a new acoustic fingerprinting scheme to remove the impacts of the varying distance and environmental noise from the demodulated PSK signals for fingerprint extraction. Moreover, our device authentication component designs a transfer learning-based scheme to capture the subtle differences in devices’ fingerprints for accurate device authentication. To the best of our knowledge, this is the first 2FA system that could extract acoustic fingerprints in modulation domain and can effectively withstand the impacts of channel distortions. We also confirm the accuracy and security of our system through extensive user experiments.

Decentralized finance has experienced phenomenal growth, revolutionizing the landscape of financial transactions and asset management via blockchain. Yet, this swift growth brings with it substantial challenges, notably the surge in scam tokens, imposing significant security threats on cryptocurrency investments and trading. Existing detection methods of scam token, primarily relying on analyzing contract codes or transaction patterns, struggle to catch increasingly sophisticated tactics employed by scammers. For example, contract-based analysis are unable to identify scams lacking overt malicious code, e.g., most rugpulls, while transaction-based methods generally lack the foresight to early-detect potential risks.

Deep neural networks (DNNs) have become prevalent across various domains. However, recent research has revealed their vulnerability to data poisoning attacks, where adversaries inject poisoned data to compromise the usability of the target model. Traditional data poisoning attacks focus on reducing the test accuracy of the model, but they can be detected by model performance evaluation or mitigated by data cleaning. In contrast, we propose an Adversarial Robustness Poisoning Scheme (ARPS) that aims to decrease the adversarial robustness while preserving the normal-functionality of the target model. To achieve ARPS, we first separate the features of data into robust and non-robust features, where the non-robust features are human-imperceptible and more sensitive to adversarial perturbations. After that, we construct a dataset containing only non-robust features, which serves as the poisoning data. For the malicious dataset provider, the poisoned dataset can be constructed by adding poisoning data to the original dataset. For the malicious model provider, we employ the uncertainty-weighted multi-task learning technique to train the poisoned model, facilitating a better balance between functionality-preserving (good accuracy) and attack effectiveness (bad robustness). Extensive experiments are carried out to illustrate the effectiveness of ARPS in weakening adversarial training and amplifying adversarial attacks, as well as the stealthiness of ARPS in escaping the defense of data cleaning and model fine-tuning. Additionally, we propose some potential countermeasures against ARPS, including regularization and data augmentations.

Vision Transformers (ViTs) have outperformed traditional Convolutional Neural Networks (CNN) across various computer vision tasks. However, akin to CNN, ViTs are vulnerable to backdoor attacks, where the adversary embeds the backdoor into the victim model, causing it to make wrong predictions about testing samples containing a specific trigger. Existing backdoor attacks against ViTs have the limitation of failing to strike an optimal balance between attack stealthiness and attack effectiveness.In this work, we propose an Attention Gradient-based Erosion Backdoor (AGEB) targeted at ViTs. Considering the attention mechanism of ViTs, AGEB selectively erodes pixels in areas of maximal attention gradient, embedding a covert backdoor trigger. Unlike previous backdoor attacks against ViTs, AGEB achieves an optimal balance between attack stealthiness and attack effectiveness, ensuring the trigger remains invisible to human detection while preserving the model’s accuracy on clean samples. Extensive experimental evaluations across various ViT architectures and datasets confirm the effectiveness of AGEB, achieving a remarkable Attack Success Rate (ASR) without diminishing Clean Data Accuracy (CDA). Furthermore, the stealthiness of AGEB is rigorously validated, demonstrating minimal visual discrepancies between the clean and the triggered images.

With the widespread use of deep learning systems in many applications, adversaries have strong incentives to perform attacks against these systems for their adversarial purposes. Reports have indicated that backdoor attacks on deep neural networks represent a novel form of threat. In this attack, the adversary will inject backdoors into the benign model and then mislead the model to classify the input containing backdoor triggers as a target label specified by the adversary. Existing research mainly focuses on backdoor attacks in image and text models, little attention has been paid to the backdoor attacks on text-to-speech (TTS) models. We conduct a systematic investigation of backdoor attacks on text-to-speech models and propose BadTTS, the first backdoor attack against TTS models, which is a general backdoor attack framework that tampers with input texts in three semantic levels to generate malicious output speech, including Char-Backdoor, Word-Backdoor, and Sentence-Backdoor. Our method not only efficiently injects backdoors into a TTS model but is also stealthy and has little impact on the synthesized speech quality. We implement the backdoor attack in a black-box fine-tuning setting, where the adversary has no knowledge of model architectures except for a small amount of training data. We perform empirical experiments on three representative and widely studied TTS models, indicating that backdoors can be injected into TTS models within a few fine-tuning steps. Additionally, we conduct experiments to explore the impact of different types of triggers, as well as the intermediate outputs of models, which provide insights for potential defenses against backdoor attacks.

Recently, several technology companies have released online inference services for clients based on Transformer-based large language models, which show excellent performance in various tasks. However, in these services, the inputs usually involve clients’ sensitive information. To address this problem, many works have proposed secure inference on language models such as GPT. For language models, complex mathematical functions like Gaussian Error Linear Unit (GELU) are used extensively and dominate the main cost of secure inference. In this work, we systematically study the existing secure GELU protocols and classify previous methods into two categories: polynomial-based protocols and lookup table (LUT)-based protocols. We point out several important characteristics and tradeoffs for these two classes of secure GELU protocols. Based on these observations and analysis, we propose a new secure GELU protocol, called Simple. The main technique that Simple uses involves a LUT of small size to retrieve approximate polynomials for fitting residual error functions caused by a crude approximation for GELU, which achieves state-of-the-art (SOTA) overhead and accuracy performance. We conduct extensive experiments and benchmark the previous 6 secure GELU protocols. The experimental comparison shows that our Simple protocol achieves 1.1 ∼ 8784.3× computation and 1.4 ∼ 188.8× communication improvements while reducing 1.2∼80.2× errors.

Federated Learning (FL) has gained prominence for collaborative training across multiple devices without data sharing. However, traditional FL overlooks two crucial aspects: collaborative fairness and privacy protection. Typically, all participants receive the same models, regardless of their contribution, and plaintext transmission of model gradients risks privacy. Existing fairness-enhancing approaches often increase privacy risks, while security-focused methods suffer from efficiency limitations, failing to provide a comprehensive solution against multiple threats simultaneously. To address these challenges, we propose QPFFL, a novel fair and secure FL framework. Firstly, we propose Privacy-Preserving Reputation Mechanism (PPRM) that assigns global models to users based on their performance during training, promoting fairness of FL. We employ Functional Encryption (FE) to enable efficient and quantum-resistant aggregation, securing user model parameters. Furthermore, a reputation threshold helps identify malicious behaviors. Theoretical analysis and experiments demonstrate QPFFL’s effectiveness in thwarting various attacks without compromising privacy and efficiency, thereby providing a comprehensive solution for secure and fair FL.

Image scaling is one of the most common operations in image processing. For instance, it is often conducted before image transferring to preserve resources, image classifiers also require images to be input at a specified size. However, potential threats may come out with the image scaling operation. A recent work called image-scaling attack can change the semantic information of the input image when it is scaled to a specific size. For example, a manipulated image of a sheep may become an image of a wolf when it scales to a specific size. Many works have already demonstrated the effectiveness of this attack and the security risks it poses. However, existing image-scaling attacks only focus on single target with single specific size, and are not applicable to multi-target image-scaling attack. In this paper, we present a multi-target image-scaling attack (MTISA). MTISA can be trained with a single image performs diverse and semantically distinct outputs to fool both human vision and image classifiers. Specifically, to fool human vision, we employ SinGAN to generate semantically different but background-similar samples to serve as the attack target samples. To mislead image classifiers, we employ adversarial attacks to construct adversarial examples to serve as the attack target samples. Finally, we evaluate MTISA on chest X-rays dataset and ImageNet dataset, respectively. The experimental results demonstrate that MTISA achieves high attack success rate against both human vision and image classifiers.

In recent times, federated learning (FL) aggregation techniques based on functional encryption (FE) have garnered increased attention. The growing interest stems from the distinct advantages of FE compared to traditional aggregation methods. Especially in terms of computational efficiency, communication costs and functionality, FE markedly surpasses its counterparts. However, privacy-preserving federated learning (PPFL) schemes utilizing FE still grapple with significant privacy and security challenges. For instance, current implementations fail to safe-guard aggregated intermediate outcomes and remain susceptible to quantum attacks, among other concerns. To address these problems, we first propose PIM-MCFE, a new FE scheme based on Learning with Errors (LWE) assumption, which can hide the intermediate aggregated results and is computationally efficient. We extend the scheme to the aggregation task of PPFL and propose an optimization technique, plaintext packaging to accelerate the training process. We provide the security analysis of the proposed PPFL scheme through theoretical analysis and demonstrate its efficiency and practicality through extensive experiments. The results show the encryption efficiency of our scheme improves by 20× and 50× compared to HybridAlpha and CryptoFE, and the decryption operation achieves a 3-orders-of-maanitude efficiency improvement.

Smart cameras have gained immense popularity in commercial markets for their safety and security capabilities. Yet, the prevalent design of these intelligent camera systems often compels users to cede control of their data to poten-tially untrusted service providers, such as cloud services. This relinquishment can lead to unauthorized data access by these intermediaries, posing significant security and privacy risks. The conventional solutions have been to employ privacy-enhancing technologies to bypass these intermediaries, but at the cost of increased overhead for video streaming and sharing. In our study, we introduce SecSCS, a user-centric, blockchain-based secure camera system that incorporates essential features like video streaming, sharing, deletion, and permission restoration. SecSCS integrates a blockchain-enabled user login protocol with a secure device pairing mechanism that combines visual authorization with blockchain to flexibly manage the device ownership. We utilize blockchain to provide integrity protection for the video clips stored remotely, ensuring the video data remains tamper-proof. Furthermore, we present a video frame compression and a fast video encryption method aimed at boosting the efficiency of smart camera systems. Our evaluations show that, in comparison to the leading decentralized scheme, CaCTUs, SecSCS improves the computational and communication overhead for live streaming by a factor of 12.58 and 11.29, respectively, at a frame rate of 24 fps and a resolution of 720p.

In cloud-based data marketplaces, the cardinal objective lies in facilitating interactions between data shoppers and sellers. This engagement allows shoppers to augment their internal datasets with external data, consequently leading to significant enhancements in their machine learning models. Nonetheless, given the potential diversity of data values, it becomes critical for consumers to assess the value of data before cementing any transactions. Recently, Song et al. introduced Primal (publish in ACSAC), the pioneering cloud-assisted privacy-preserving data evaluation (PPDE) strategy. This strategy relies on variants of functional encryption (FE) as the underlying framework, conferring notable performance advantages over alternative cryptographic primitives such as secure multi-party computation and homomorphic encryption. However, in this paper, we regretfully highlight that Primal is susceptible to inadvertent misuse of FE, and leaves much-desired room for performance amelioration. To combat this, we introduce a novel cryptographic primitive known as labeled function-hiding inner-product encrypted. This new primitive serves as a remedy and forms the foundation for designing the concrete framework for PPDE. Furthermore, experiments conducted on real datasets demonstrate that our framework significantly reduces the overall computation cost of the current state-of-the-art secure PPDE scheme by roughly 10× and the communication cost for the data seller by about 2×.

Data privacy and resistance against poisoning attack (Byzantine-robustness) are two critical concerns of federated learning (FL). Addressing the two issues simultaneously is challenging, since the privacy-preserving mechanism tends to make the data be indistinguishable, whereas Byzantine-robustness methods require access for the data to make a comprehensive analysis. To solve this problem, in this article, we propose a novel defender for privacy-ensured Byzantine-robust FL on a compressive domain. Unlike existing works that mainly using computation-intensive techniques, our method leverages compressive sensing (CS) as a lightweight encryption to protect the data privacy, while maintaining the possibility of Byzantine-robustness analysis on the encrypted (compressive) model update (i.e., gradient). Our key insight is that the cosine similarity can be approximately measured on the compressive measurements of any two normalized vectors, thus makes it be feasible to identify the malicious gradients on the CS compressive domain. We theoretically prove the correctness of our method. Notably, due to the dimensionality reduction of CS, the computation and communication overhead of our system can be significantly reduced. This makes our scheme be fit for applying in the applications with resource-constrained devices, such as Internet of Things (IoT). Experimental results demonstrate the effectiveness and efficiency of our method.

Federated learning (FL) has been widely applied in Internet of Things (IoT). However, two security problems hinder the proliferation of FL in practical IoT, i.e., privacy leakage and poisoning attacks. To address these problems, various approaches have been proposed from different perspectives. Nevertheless, there remain two critical challenges: 1) how to establish a unified framework for protecting privacy and defending against poisoning attacks and 2) how to implement such methods in the flexible computing architecture of fog computing. In this article, we propose CROSSBEAM, a comprehensive scheme that provides both defense against poisoning attacks and privacy protection for FL in fog computing. Specifically, we construct frameworks to defend against poisoning attacks under both independent and identically distributed (IID) and non-IID settings. Meanwhile, we establish an actively secure framework to protect users’ privacy, building a bridge between privacy protection and poisoning defense. Our CROSSBEAM allows multiple fog nodes and users to collaboratively achieve the FL training. Besides, it can effectively alleviate the negative impact caused by poisoning attacks, meanwhile, users’ data confidentiality can still be guaranteed, even if multiple active fog nodes collude with each other to infer users’ privacy. Additionally, our scheme is of robustness to participants (fog nodes and users) being off-line during the training process. Moreover, benefited from the superiorities of our hierarchical mechanism and secure framework, our scheme can perform with high efficiency. We present rigorous security proof and extensive performance analysis for our CROSSBEAM.

In mobile edge computing (MEC) systems, data is frequently transmitted between MEC servers and users holding mobile devices for supporting related services. However, critical threats towards data confidentiality and authenticity are raised: adversaries always attempt to extract data content from the transmission and impersonate others to spread malicious data for profits. Furthermore, users have to store the (secret and public) keys used for data transmission locally. Consequently, only devices maintaining the keys can be utilized to access the services provided by MEC servers, and “portability” cannot be achieved. In this paper, we propose a portable authenticated data transmission scheme (dubbed Biplane) via blockchain for MEC systems. Biplane is based on two techniques. One is a blockchain-based authenticated hybrid encryption mechanism, which guarantees data authenticity and confidentiality without requiring a third party (e.g., a Certificate Authority) to assist the MEC servers in certifying users’ public keys. The other one is a blockchain-based portable key management mechanism, which enables the user to transmit data without maintaining any parameter in her/his local devices. We formally prove that Biplane achieves confidential and authenticated data transmission in the universally composable (UC) framework. We also conduct a comprehensive evaluation to demonstrate that Biplane is efficient.

As a promising service, Machine Learning as a Service (MLaaS) provides personalized inference functions for clients through paid APIs. Nevertheless, it is vulnerable to model extraction attacks, in which an attacker can extract a functionally-equivalent model by repeatedly querying the APIs with crafted samples. While numerous works have been proposed to defend against model extraction attacks, existing efforts are accompanied by limitations and low comprehensiveness. In this article, we propose AMAO, a comprehensive defense framework against model extraction attacks. Specifically, AMAO consists of four interlinked successive phases: adversarial training is first exploited to weaken the effectiveness of model extraction attacks. Then, malicious query detection is used to detect malicious queries and mark malicious users. After that, we develop a label-flipping poisoning attack to instruct the adaptive query responses to malicious users. Besides, the image pHash algorithm is employed to ensure the indistinguishability of the query responses. Finally, the perturbed results are served as a backdoor to verify the ownership of any suspicious model. Extensive experiments demonstrate that AMAO outperforms existing defenses in defending against model extraction attacks and is also robust against the adaptive adversary who is aware of the defense.

Class incremental learning from a pre-trained DNN model is gaining lots of popularity. Unfortunately, the pre-trained model also introduces a new attack vector, which enables an adversary to inject a backdoor into it and further compromise the downstream models learned from it. Prior works proposed backdoor attacks against the pre-trained models in the transfer learning scenario. However, they become less effective when the adversary does not have the knowledge of the downstream tasks or new data, which is more practical and considered in this paper. To this end, we design the first latent backdoor attacks against incremental learning. We propose two novel techniques, which can effectively and stealthily embed a backdoor into the pre-trained model. Such backdoor can only be activated when the pre-trained model is extended to a downstream model with incremental learning. It has a very high attack success rate, and is able to bypass existing backdoor detection approaches. Extensive experiments confirm the effectiveness of our attacks over different datasets and incremental learning methods, as well as strong robustness against state-of-the-art backdoor defense mechanisms includingNeural Cleanse,Fine-PruningandSTRIP.

Nowadays, location-based services (LBS) are becoming increasingly important and popular. However, many LBSs are probable to collect the location information of users, which leads to the leakage of location privacy. To address this problem, dummy-based schemes have been proposed by researchers. Nevertheless, most of them only consider semantic information instead of points of interest (POIs), so the virtual trajectories may be detected by advanced data mining techniques. Besides, some of them are offline or non-local, which are not suitable for online LBS scenarios. In this paper, we design AnotherMe, an online and local location privacy-preserving system based on virtual trajectory generation, and develop the system on Android and iOS platforms. The AnotherMe system has two main functions. One is to generate virtual users located in different cities by imitating the real user's moving pattern and mapping the real user's POIs, and the other is to generate virtual trajectories that are indistinguishable from real trajectories with the help of Amap API. Therefore, the AnotherMe system can preserve continuous location privacy, and even advanced data mining techniques are difficult to distinguish between the real trajectory and the corresponding virtual trajectory. Due to low response time and battery consumption, the AnotherMe system is practical for location privacy protection. Furthermore, experimental results show that the virtual trajectories generated by our solution are more indistinguishable from real trajectories than similar solutions, and the average recognition rate of virtual trajectories is 53.8%, which is close to random guessing (50%).

Federated Learning (FL) ensures collaborative learning among multiple clients while maintaining data locally. However, the traditional synchronous FL solutions have lower accuracy and require more communication time in scenarios where most devices drop out during learning. Therefore, we propose anAsynchronousFederatedLearning (AsyFL) scheme using time-weighted and stale model aggregation, which effectively solves the problem of poor model performance due to the heterogeneity of devices. Then, we integrate Symmetric Homomorphic Encryption (SHE) into AsyFL to proposeAsynchronousPrivacy-PreservingFederatedLearning (Asy-PPFL), which protects the privacy of clients and achieves lightweight computing. Privacy analysis shows that Asy-PPFL is indistinguishable under Known Plaintext Attack (KPA) and convergence analysis proves the effectiveness of our schemes. A large number of experiments show that AsyFL and Asy-PPFL can achieve the highest accuracy of 58.40% and 58.26% on Cifar-10 dataset when most clients (i.e., 80%) are offline or delayed, respectively.

The cloud-assisted mobile electronic health (e-health) system facilitates e-health data sharing between healthcare providers and patients, but also raises the security and privacy concerns of e-health data. Although Ciphertext-Policy Attribute-Based Encryption (CP-ABE) has been a promising technique to achieve fine-grained access control over encrypted e-health data, it still incurs high encryption and decryption burdens on mobile users such as smartphones and sensors. In addition, malicious cloud servers may conduct incorrect operations due to various interest incentives (e.g., leaking sensitive information to illegal users, saving computation and storage costs). To solve the above issues, in this paper we first propose an Outsourced CP-ABE (OABE) with verifiable encryption scheme by splitting secret keys corresponding to an attribute set and using the short signature, which not only reduces the encryption and decryption complexities of mobile users but also guarantees that cloud servers correctly perform encryption operations. Then, we extend OABE to construct outsourced CP-ABE with verifiable decryption (OABE+) by utilizing the verifiable tag mechanism, which guarantees that cloud servers correctly conduct the ciphertext transformation. Formal security analysis proves that our schemes are selectively secure against unauthorized accesses and malicious operations. Extensive experiments using various real-world datasets demonstrate that our schemes are efficient and feasible in real applications.

Decentralized multi-client functional encryption for inner product (DMCFE-IP) enables efficient joint functional computation of private inputs in a secure manner without a trusted third party, which has found successful applications, including distributed statistical analysis and machine learning. However, existing DMCFE-IP schemes suffer several drawbacks, such as lack of support for client dropout, requiring cross-client communication for key generation, and poor efficiency and scalability. To address these issues, we propose an efficient and scalable DMCFE-IP, which supports client dropout and non-interactive decentralized partial decryption key generation. Our scheme mainly exploits appropriate underlying cryptographic primitives, including multi-client functional encryption, digital signature, key agreement, secret sharing, and symmetric encryption, with careful integration to achieve the aforementioned two functionalities. We then extend this scheme to enable privacy-preserving federated learning (PPFL) for the cross-silo scenrio. We provide formal security proof for our scheme and evaluate our DMCFE-IP-based PPFL on several real-world datasets. Compared with the state-of-the-art methods, our approach achieves a speedup of 6.12$\sim 43.36\times$in running time.

In this paper, we presentVerifyML, the first secure inference framework to check the fairness degree of a given Machine learning (ML) model.VerifyMLis generic and is immune to any obstruction by the malicious model holder during the verification process. We rely on secure two-party computation (2 PC) technology to implementVerifyML, and carefully customize a series of optimization methods to boost its performance for both linear and nonlinear layer execution. Specifically, (1)VerifyMLallows the vast majority of overhead to be performed offline, thus meeting the low latency requirements for online inference. (2) To speed up offline preparation, we first design novel homomorphic parallel computing techniques to accelerate the authenticated Beaver's triple (including matrix- vector and convolution triples) generation procedure. It achieves up to$1.7\times$computation speedup and gains at least$10.7\times$less communication overhead compared to state-of-the-art work. (3) We also present a new cryptographic protocol to evaluate the activation functions of non-linear layers, which is$4\times$–$42\times$faster and has$\gt 48\times$less communication than the existing 2 PC protocol against malicious parties. In fact,VerifyMLeven beats the state-of-the-art semi-honest ML secure inference system! We provide a formal theoretical analysis forVerifyMLsecurity and demonstrate its performance superiority on mainstream ML models including ResNet-18 and LeNet.

In this paper, we study the problem of secure ML inference against a malicious client and a semi-trusted server such that the client only learns the inference output while the server learns nothing. This problem is first formulated by Lehmkuhlet al.with a solution (MUSE, Usenix Security'21), whose performance is then substantially improved by Chandranet al.'s work (SIMC, USENIX Security'22). However, there still exists a nontrivial gap in these efforts towards practicality, giving the challenges of overhead reduction and secure inference acceleration in an all-round way. Based on this, we propose SIMC 2.0, which complies with the underlying structure of SIMC, but significantly optimizes both the linear and non-linear layers of the model. Specifically, (1) we design a new coding method for parallel homomorphic computation between matrices and vectors. (2) We reduce the size of the garbled circuit (GC) (used to calculate non-linear activation functions,e.g., ReLU) in SIMC by about two thirds. Compared with SIMC, our experiments show that SIMC 2.0 achieves a significant speedup by up to$17.4\times$for linear layer computation, and at least$1.3\times$reduction of both the computation and communication overhead in the implementation of non-linear layers under different data dimensions. Meanwhile, SIMC 2.0 demonstrates an encouraging runtime boost by$2.3\sim 4.3\times$over SIMC on different state-of-the-art ML models.

This work studies secure inference on Binary Neural Networks (BNNs), which have binary weights and activations as a desirable feature. Although previous works have developed secure methodologies for BNNs, they still have performance limitations and significant gaps in efficiency when applied in practice. We present SecBNN, an efficient secure two-party inference framework on BNNs. SecBNN exploits appropriate underlying primitives and contributes efficient protocols for the non-linear and linear layers of BNNs. Specifically, for non-linear layers, we introduce a secure sign protocol with an innovative adder logic and customized evaluation algorithms. For linear layers, we propose a new binary matrix multiplication protocol, where a divide-and-conquer strategy is provided to recursively break down the matrix multiplication problem into multiple sub-problems. Building on top of these efficient ingredients, we implement and evaluate SecBNN over two real-world datasets and various model architectures under LAN and WAN. Experimental results show that SecBNN substantially improves the communication and computation performance of existing secure BNN inference works by up to$29 \times $and$14 \times $, respectively.

In recent years, there is an explosive growth in multimodal learning. Image captioning, a classical multimodal task, has demonstrated promising applications and attracted extensive research attention. However, recent studies have shown that image caption models are vulnerable to some security threats such as backdoor attacks. Existing backdoor attacks against image captioning typically pair a trigger either with a predefined sentence or a single word as the targeted output, yet they are unrelated to the image content, making them easily noticeable as anomalies by humans. In this paper, we present a novel method to craft targeted backdoor attacks against image caption models, which are designed to be stealthier than prior attacks. Specifically, our method first learns a special trigger by leveraging universal perturbation techniques for object detection, then places the learned trigger in the center of some specific source object and modifies the corresponding object name in the output caption to a predefined target name. During the prediction phase, the caption produced by the backdoored model for input images with the trigger can accurately convey the semantic information of the rest of the whole image, while incorrectly recognizing the source object as the predefined target. Extensive experiments demonstrate that our approach can achieve a high attack success rate while having a negligible impact on model clean performance. In addition, we show our method is stealthy in that the produced backdoor samples are indistinguishable from clean samples in both image and text domains, which can successfully bypass existing backdoor defenses, highlighting the need for better defensive mechanisms against such stealthy backdoor attacks.

Timed data delivery is a critical service for time-sensitive applications that allows a sender to deliver data to a recipient, but only be accessible at a specific future time. This service is typically accomplished by employing a set of mailmen to complete the delivery mission. While this approach is commonly used, it is vulnerable to attacks from realistic adversaries, such as a greedy sender (who accesses the delivery service without paying the service charge) and malicious mailmen (who release the data prematurely without being detected). Although some research works have been done to address these adversaries, most of them fail to achieve fairness. In this paper, we formally define the fairness requirement for mailmen-assisted timed data delivery and propose a practical scheme, dubbed DataUber, to achieve fairness. DataUber ensures that honest mailmen receive the service charge, lazy mailmen do not receive the service charge, and malicious mailmen are punished. Specifically, DataUber consists of two key techniques: 1) a new cryptographic primitive, i.e., Oblivious and Verifiable Threshold Secret Sharing (OVTSS), enabling a dealer to distribute a secret among multiple participants in a threshold and verifiable way without knowing any one of the shares; and 2) a smart-contract-based complaint mechanism, allowing anyone to become a reporter to complain about a mailman’s misbehavior to a smart contract and receive a reward. Furthermore, we formally prove the security of DataUber and demonstrate its practicality through a prototype implementation.

To address the challenges posed by data silos and heterogeneity in distributed machine learning, privacy-preserving asynchronous Federated Learning (FL) has been extensively explored in academic and industrial fields. However, existing privacy-preserving asynchronous FL schemes still suffer from the problem of low model accuracy caused by inconsistency between delayed model updates and current model updates, and even cannot adapt well to Non-Independent and Identically Distributed (Non-IID) settings. To address these issues, we propose a Privacy-preserving Asynchronous Federated Learning based on the alternating direction multiplier method (PAFed), which is able to achieve high-accuracy models in Non-IID settings. Specifically, we utilize vector projection techniques to correct the inconsistency between delayed model updates and current model updates, thereby reducing the impact of delayed model updates on the aggregation of current model updates. Additionally, we employ an optimization method based on alternating direction multipliers to adapt the Non-IID settings to further enhance the global model accuracy. Finally, through extensive experiments, we demonstrate that our scheme improves the model accuracy by up to 12.53% when compared with current state-of-the-art solution FedADMM.

Federated learning not only realizes collaborative training of models, but also effectively maintains user privacy. However, with the widespread application of privacy-preserving federated learning, poisoning attacks threaten the model utility. Existing defense schemes suffer from a series of problems, including low accuracy, low robustness and reliance on strong assumptions, which limit the practicability of federated learning. To solve these problems, we propose a Robustness-enhanced privacy-preserving Federated learning with scaled dot-product attention (RFed) under dual-server model. Specifically, we design a highly robust defense mechanism that uses a dual-server model instead of traditional single-server model to significantly improve model accuracy and completely eliminate the reliance on strong assumptions. Formal security analysis proves that our scheme achieves convergence and provides privacy protection, and extensive experiments demonstrate that our scheme reduces high computational overhead while guaranteeing privacy preservation and model accuracy, and ensures that the failure rate of poisoning attacks is higher than 96%.

Unmanned aerial vehicles (UAVs) have emerged as pivotal roles within internet of vehicles (IoV), serving as mobile base stations. However, while expanding coverage and improving mobility, the deployment of UAVs also poses a threat to the integrity and privacy of sensitive data due to open wireless communication channels in IoV. Therefore, preventing unauthorized access and data tampering is critically important between UAVs and vehicles. For the authenticity and legitimacy of the UAV certificate, existing authentication approaches may lead to significant challenges in key management overhead or dependence on a trusted third party. In this paper, a blockchain-based authentication scheme for UAV-assisted IoV system (BASUV) is proposed. This solution enables dependable UAV registration and authentication services, and permits the dynamic addition and removal. Specifically, blockchain is introduced to achieve the decentralized management and distributed trust of the UAV certificate ledger. Furthermore, to prevent information tampering and identity deception, we design CMPES, a novel combined scheme based on multiple public key generators (PKGs) for encryption and signature. Identical key pair in encryption and signature can reduce key generation and management overhead. The security and experimental analysis demonstrates the effectiveness and efficiency of the proposed scheme.

This work investigates fine-grained data distribution in real-world federated learning (FL) applications, wherein training samples are distributed across multiple regions, and different clients within each region possess distinct features of local training samples. Furthermore, the datasets and models in these regions often exhibit heterogeneity, characterized by varying label distributions and model architectures, posing challenges to the model construction process. In this article, we propose a vertical federated learning (VFL) framework, named HeteroVFL, to address the data distribution complexities and overcome the hurdles posed by heterogeneous regions. Besides, we enhance the privacy of HeteroVFL by adopting differential privacy, a privacy-preserving technology by injecting measured noise into data based on a stochastic framework. We compare our HeteroVFL with existing solutions on three real-world datasets in simulations. The results demonstrate that HeteroVFL can achieve over 96% accuracy on MNIST, surpassing the accuracy of 90% in the state-of-the-art VFL benchmarks.

Electronic health (e-health) systems may outsource data such as patient e-health records to mobile cloud servers for efficiency gains (e.g., minimizing local storage and computation costs). However, such a move may result in privacy implications in the presence of semi-honest cloud servers. Searchable Encryption (SE) can potentially facilitate privacy-preserving searches based on keywords for encrypted data stored in the mobile cloud, but most existing SE solutions do not support temporal access control (i.e., a mechanism that grants access permissions to users for specified time ranges). Hence, in this paper we design a time-controllable keyword search scheme by using an attribute-based comparable access control. This allows users to match indexes encrypted at specified time intervals. Then, we improve the basic framework to support efficient user revocation using secret sharing. We then formally prove the security of our proposed frameworks against chosen-keyword attack and key collusion attack, as well as achieving keyword secrecy. We also evaluate the performance of our proposed approach using a real-world dataset to demonstrate their practical utility.

The mobile Internet of Vehicles (IoVs) has great potential for intelligent transportation, and creates spatial data query demands to realize the value of data. Outsourcing spatial data to a cloud server eliminates the need for local computation and storage, but it leads to data security and privacy threats caused by untrusted third-parties. Existing privacy-preserving spatial range query solutions based on Homomorphic Encryption (HE) have been developed to increase security. However, in the single server model, the private key is held by the query user, which incurs high computation and communication burdens on query users due to multiple rounds of interactions. Moreover, exposing data access patterns to semi-honest servers is highly vulnerable to frequency and statistical attacks. To solve these issues, in this paper we propose a secure spatial location query within arbitrary geometric range while protecting access pattern. Specifically, we apply Paillier algorithm and polynomial fitting technique to achieve secure arbitrary geometric range query, design secure and efficient search protocol to hide data access patterns and alleviate query users from high computation and communication burdens under dual-server model. Formal security analysis shows that our scheme is secure under semi-honest model, and extensive experiments demonstrate that our work can reduce users' communication costs by more than 90% compared to previous schemes under single server model, which is practice in real-world scenarios.

The two-factor authentication ($2$FA) has drawn increasingly attention as the mobile devices become more prevalent. For example, the user's possession of the enrolled phone could be used by the$2$FA system as the second proof to protect his/her online accounts. Existing$2$FA solutions mainly require some form of user-device interaction, which may severely affect user experience and creates extra burdens to users. In this work, we propose a secure$2$FA system utilizing the proximity of a user's enrolled phone and the login device as the second proof without requiring the user's interactions. The basic idea of our$2$FA system is to derive location signatures based on acoustic beep signals emitted alternately by both devices and sensing the echoes with microphones, and compare the extracted signatures for proximity detection. Moreover, to further enhance the security of our system, we also design a device authentication scheme which derives the acoustic fingerprint between the login device and enrolled phone to verify the identity of two devices. Given the received beep signal, our system designs a period selection scheme to identify two sound segments accurately: the chirp period is the sound segment propagating directly from the speaker to the microphone whereas the echo period is the sound segment reflected back by surrounding objects. To achieve an accurate proximity detection, we develop a new energy loss compensation extraction scheme by utilizing the extracted chirp periods to estimate the intrinsic differences of energy loss between microphones of the enrolled phone and the login device. Our proximity detection component then conducts the similarity comparison between the identified two echo periods after the energy loss compensation to effectively determine whether the enrolled phone and the login device are in proximity for$2$FA. Moreover, to provide higher security, our device fingerprint-assisted proximity detection further utilizes the overall energy loss between the login device and enrolled phone as their hardware fingerprint to authenticate the identity of two devices. Our experimental results show that our system is accurate in providing$2$FA and robust to both man-in-the-middle (MiM) and co-located attacks across different scenarios and device models.

The indoor location awareness has drawn increasing attention as the mobile apps are used extensively in our daily lives. Existing indoor localization solutions either require a pre-installed infrastructure or can only achieve room-level accuracy, which could not provide a function-location service for mobile devices. In this work, we propose a new active sensing system that enables smartphones to identify some pre-defined indoor locations robustly without requiring any additional sensors or pre-installed infrastructure. The main idea behind our system is to utilize the acoustic signatures, which are derived from the mobile device by emitting a beep signal and selecting its echoes created by dominant reflectors, as the robust fingerprint for location identification. Given the microphone samplings, our system designs a correlation based technique to accurately detect the beginning points of echoes from the received beep signal. To achieve a robust location identification, we develop a new echo selection scheme to select echoes created by dominant reflectors by exploiting the relationships between propagation delays of different orders of echoes. To deal with the variable number of selected echoes, our location identification component then derives histograms from selected echoes and uses the one-against-all SVM classifiers to determine the current location. Our experimental results show that our proposed system is accurate and robust for location identification under various real-world scenarios.

The two-factor authentication (2FA) has become pervasive as the mobile devices become prevalent. Existing 2FA solutions usually require some form of user involvement, which could severely affect user experience and bring extra burdens to users. In this work, we propose a secure 2FA that utilizes the individual acoustic fingerprint of the speaker/microphone on enrolled device as the second proof. The main idea behind our system is to use both magnitude and phase fingerprints derived from the frequency response of the enrolled device by emitting acoustic beep signals alternately from both enrolled and login devices and receiving their direct arrivals for 2FA. Given the input microphone samplings, our system designs an arrival time detection scheme to accurately identify the beginning point of the beep signal from the received signal. To achieve a robust authentication, we develop a new distance mitigation scheme to eliminate the impact of transmission distances from the sound propagation model for extracting stable fingerprint in both magnitude and phase domain. Our device authentication component then calculates a weighted correlation value between the device profile and fingerprints extracted from run-time measurements to conduct the device authentication for 2FA. Moreover, to thwart the possible co-located attacks, our proximity detection component further makes the enrolled phone to generate an active random vibration signal by its built-in motor, and then matches the signal received by the microphone of login device with the signal received by the accelerometer of enrolled phone to verify the proximity of two devices. Our experimental results show that our proposed system is accurate and robust to various attacks across different scenarios and device models.

The indoor location awareness has drawn increasing attention for smart speakers as they become essential to provide function-location services. Existing indoor localization solutions either require add-on equipment or could only achieve room-level accuracy, which could not provide a function-location service for smart speakers. In this work, we propose a location identification system utilizing 3-D acoustic images, which are derived from the smart speaker by emitting a beep signal and sensing echoes created by objects in the surrounding environment with its microphone array, as the proof to identify some pre-defined indoor locations. Given the recorded acoustic samplings captured by the microphone array, our image construction component constructs a virtual imaging hemisphere and steers the array towards each grid of the hemisphere to generate a 3-D acoustic image of the surrounding environment. Moreover, we design a transfer-learning based model to derive effective features from the constructed images, and propose a data augmentation scheme for generating synthesized training images. To achieve a more accurate location identification, we further design a distance estimation scheme to identify the distances between the smart speaker and some major surrounding objects by utilizing the constructed 3-D acoustic image, and then adopt such distance information for location identification. Our experimental results show that our proposed system is accurate and robust for location identification under various real world scenarios.

With the rapid growth of data size, a large number of data providers outsource their private data to cloud servers to reduce the high storage and computation burdens, but it also leads to security issues such as privacy leakage. Therefore, many privacy-preserving range query schemes have been proposed. However, most of existing secure range query schemes suffer from low query efficiency and expensive computation and update overheads. To address these issues, we propose a novel Fast Range Query (FRQ) scheme for large-scale encrypted Key-Value (KV) data. First, we introduce REMIX, a space-efficient KV index data structure based on Log-Structured Merge-trees (LSM-trees), which maintains a global sorted view of KV pairs across multiple table files for efficient range queries. Besides, we exploit the write-efficiency compression strategy of LSM-trees to ensure efficient dynamic data updates. Finally, we use Czech Havas Majewski (CHM) to protect the index structure, which reduces the computation overhead and ensures the retrieval accuracy. Formal security analysis proves that our scheme can achieve an acceptable level of security. Extensive experiments demonstrate that our scheme improves the query efficiency by nearly$8\times$and update efficiency by$7\times$compared to state-of-the-art solutions over million-level datasets.

Recently, outsourcing machine learning inference services to the cloud has become increasingly popular. The inference process, however, remains an open question onhow to effectively protect the model owner's proprietary model, the user's sensitive data, and prediction results. In this work, we propose an efficient and comprehensive privacy-preserving framework for outsourcing Gradient Boosting Decision Tree (GBDT) inference utilizing pseudorandom function and additively homomorphic encryption. Specifically, we first design a transformation method for GBDT to protect the node and structure privacy of the owner's model. On top of the protected model, we further propose customized comparison and random trees permutation protocols, which substantially boost the computation and reduce the communication cost of the outsourcing inference, while preventing the user from inferring privacy associated with GBDT. Besides, we provide rigorous security analysis, and extensive experiments on 7 real-world datasets and various models demonstrating that our scheme achieves up to 36 times less runtime and 69 times less communication compared to the state-of-the-arts.

Backdoor attacks against neural networks have been intensively investigated, where the adversary compromises the integrity of the victim model, causing it to make wrong predictions for inference samples containing a specific trigger. To make the trigger more imperceptible and human-unnoticeable, a variety of stealthy backdoor attacks have been proposed, some works employ imperceptible perturbations as the backdoor triggers, which restrict the pixel differences of the triggered image and clean image. Some works use special image styles (e.g., reflection, Instagram filter) as the backdoor triggers. However, these attacks sacrifice the robustness, and can be easily defeated by common preprocessing-based defenses. This paper presents a novel color backdoor attack, which can exhibit robustness and stealthiness at the same time. The key insight of our attack is to apply a uniform color space shift for all pixels as the trigger. This global feature is robust to image transformation operations and the triggered samples maintain natural-looking. To find the optimal trigger, we first define naturalness restrictions through the metrics of PSNR, SSIM and LPIPS. Then we employ the Particle Swarm Optimization (PSO) algorithm to searchfor the optimal trigger that can achieve high attack effectiveness and robustness while satisfying the restrictions. Extensive experiments demonstrate the superiority of PSO and the robustness of color backdoor against different main-stream backdoor defenses.

Outsourcing inference enables users to outsource neural network inference tasks to a service provider (e.g., a remote server). This paradigm has brought enormous convenience and effectively solved the resource-limited issues of users, especially for mobile devices. However, it still suffers from two challenges: (1) The user's input data and inference results contain a large amount of private information, which should not be disclosed. (2) The server in this setting may be malicious and hence violate the inference procedure. For example, the server may use a low-quality model to reduce costs or return wrong inference results. While several privacy-preserving inference works have been proposed, they cannot solve the above two problems at the same time. In this work, we propose PPVI, a secure and verifiable outsourcing inference scheme against malicious service providers. PPVI designs a hybrid check technique for inference integrity verification and employs leveled homomorphic encryption to protect users' privacy. These ingredients together make it possible to protect users' privacy and verify the inference correctness in outsourcing inference simultaneously. Extensive experiment results demonstrate our scheme has an excellent performance in terms of verification accuracy and communication and computational overhead.

Density-Based Spatial Clustering of Applications with Noise (DBSCAN) is a commonly used density-based clustering algorithm, and the study of its privacy-preserving methods is of practical importance. However, prior works either leak important intermediate results or suffer from intolerable overhead, which makes it difficult to deploy in real-world scenarios. To address this problem, we propose Private-DBSCAN, a practical secure two-party framework for DBSCAN. Specifically, (i) we design an efficient secure comparison protocol for the calculation of the adjacency matrix, which reduces the online communication to only one round and (ii) we employ a secret-shared shuffle protocol to anonymize the data records, which can hide the position relation of elements while avoiding redundant computations. These ingredients allow Private-DBSCAN to achieve practical efficiency and rigorous security at the same time. We implement our protocol and conduct extensive experiments on five datasets, which show that it achieves a$90\sim 340\times$speedup on LAN and$13\sim 73\times$speedup on WAN compared to the state-of-the-art work.

In the context of collaborative data analysis or machine learning tasks (such as biomedical image segmentation for tumor region definition) involving multiple parties, secure feature selection protocols enable the parties to jointly select the most informative features while preserving their privacy from being exposed to others. However, current secure feature selection methods have several limitations: (1) they leak intermediate results during feature selection raises serious privacy concerns; (2)they cannot cover various scenarios comprehensively. To this end, we present a secure feature selection framework based on mutual information, which improves the privacy-preserving data preprocessing work. Specifically, the division protocol performs low-complexity interactive computations, reducing the time cost to$578^{th}$of the original; besides, our logarithm protocol converts shared values through Beaver's triple, and increases the efficiency by up to 118 times. We conduct extensive experimental evaluations on diverse real-world datasets, and the results demonstrate that our framework achieves up to 28.5% accuracy improve-ment, thus effectively enhancing the privacy protection work of machine learning data preprocessing.

Recently, there has been increasing interest in extending deep learning approaches to graph data. Graph representation learning has become an important way to fully utilize the information contained in graph data. Graph Neural Networks (GNNs) have demonstrated significant efficacy in various fields. Previous studies have shown that traditional machine learning models may lead to disclosure of private data, but the privacy risks of GNNs have not received enough attention. In this paper, we propose two attack methods based on the ground-truth label. Our attack approach covers two mainstream attack patterns, including training attack models based on neural networks and setting thresholds. To improve the effectiveness of attacks, we consider incorporating label information of the samples. Since the samples' distributions of different classes are different, the possibility of privacy leakage cannot be treated equally. In neural network-based attacks, we concatenate the label information into the input vector of the attack model. In threshold-based attacks, we set separate thresholds for each label category. We systematically evaluate the performance of membership inference attacks against graph-level classification. Our evaluation on three GNN structures and four benchmark datasets shows that GNNs for graph classification are more vulnerable to the improved attacks. On the DD dataset, our attack achieved an accuracy of 79%. Furthermore, we proposed two defense mechanisms to mitigate the privacy leakage caused by membership inference attacks.

Complex math functions, such as exponential and tanh, are widely applied in machine learning inference tasks like recurrent neural networks (RNNs). Even though a few works have provided secure implementations of these functions, they still suffer from serious performance bottlenecks, leaving efficiency gaps in practice. To approach this issue, we propose SecMath, an efficient 2-party cryptographic framework for complex math functions. Specifically, SecMath contributes novel communication-efficient protocols for secure exponential, sigmoid and tanh operations. These protocols utilize an advanced underlying primitive, silent oblivious transfer, and employ customized optimizations including lookup table techniques to further improve performance. Extensive evaluations show that our new constructions outperform the counterparts in SIRNN (IEEE S&P'21) by a large margin in terms of both communication and computation overhead. For example, the sigmoid operation of SecMath costs 4.15KB communication and less than 0.2 millisecond, which improves SIRNN up to 7.6× in communication and 2.4× in runtime.

Trigonometric functions are crucial non-linear operations used in scientific computation and complex machine learning models. However, existing secure computing frameworks either lack support for these operations, or suffer from undesirable performance bottleneck. In this paper, we present an efficient and precise fixed-point framework called TriFSS for securely evaluating trigonometric functions. Specifically, we first design new building blocks based on advanced Function Secret Sharing techniques, achieving reduced communication and computation overhead. Second, with these efficient components, we propose a general evaluation process for these functions, in which periodic properties are fully exploited for better performance. Moreover, we implement the TriFSS framework and conduct extensive experiments. The experimental results show that our protocols achieve at least 23x less communication overhead and 2.8x less latency than the state-of-the-art frameworks, while only resulting in 1 ULP error, which is comparable to floating-point based works.

Gradient Boosting Decision Trees (GBDTs) are popular machine learning models due to its simplicity, effectiveness, and interpretability. Recently, to alleviate serious privacy leakages in conventional centralized methods, researchers have proposed several privacy-preserving distributed GBDT solutions. However, those approaches still suffer from either insufficient privacy protection or significant runtime and communication overhead. In this paper, we propose an efficient and end-to-end privacy-preserving distributed GBDT framework, called PPD-GBDT, which uses differential privacy, polynomial approximation, and fully homomorphic encryption to achieve comprehensive privacy protection. Specifically, during the boosting phase, we design a novel model preparation method to improve the efficiency of prediction with acceptably slight accuracy/RMSE loss while preventing data owners' corruption. On the other hand, for the prediction phase, we propose a customized secure prediction method, which effectively prevents the malicious server from stealing private information. Besides, we conduct extensive experiments on six datasets and compare with three prior schemes. Evaluation results show that our privacy-preserving scheme achieves lower runtime and up to 40× less communication overhead compared to the state-of-the-arts.

Millions of contracts deployed onto Ethereum provide various services that can be invoked. For this purpose, blockchain users need to know and specify the function signature of a callee, which includes its function id and the parameter types. Function signatures are crucial in several applications, such as recognizing the services that contracts provide. In this poster, we propose a novel solution that leverages how functions are handled by Ethereum virtual machine (EVM) to automatically recover function signatures from contract bytecode, without the need of source code and function signature databases. The extensive experimental results show that our solution outperforms all existing tools, achieving an unprecedented 98.7% accuracy within 0.074 seconds. We further demonstrate the usefulness of our solution in attack detection, fuzzing and reverse engineering of contract bytecode.

The user authentication has drawn increasingly attention as the smart speaker becomes more prevalent. For example, smart speakers that can verify who is sending voice commands can mitigate various types of attacks such as replay attack or impersonation attack. Existing user authentication solutions either cannot be applicable to smart speakers directly or require certain additional user-device interaction or pre-installed infrastructure, which may severely affect the user experience and create extra burdens to users. In this work, we propose a user authentication system EchoImage utilizing acoustic images, which are derived from the smart speaker by emitting beep signals and sensing echoes from the user's body with its microphone array, as the proof for user authentication. Given the acoustic samplings of the reflected beep signal, our system designs a distance estimation component by applying a correlation based technique on the beamformed signal to estimate the distance between the user and microphone array. Our image construction component then constructs a virtual imaging plane using the estimated distance and steers the array towards each grid of the plane to generate an acoustic image of the user. Moreover, we propose a transfer learning-based method to derive efficient features from the constructed images, and employ SVM classifiers for accurate user authentication. Our extensive experiments demonstrate that our system is robust and accurate across various scenarios.

Heterogeneous federated learning (HFL) enables clients with different computation and communication capabilities to collaboratively train their own customized models via a query-response paradigm on auxiliary datasets. However, such a paradigm raises serious privacy concerns due to the leakage of highly sensitive query samples and response predictions. We put forth GuardHFL, the first-of-its-kind efficient and privacy-preserving HFL framework. GuardHFL is equipped with a novel HFL-friendly secure querying scheme built on lightweight secret sharing and symmetric-key techniques. The core of GuardHFL is two customized multiplication and comparison protocols, which substantially boost the execution efficiency. Extensive evaluations demonstrate that GuardHFL significantly outperforms the alternative instantiations based on existing state-of-the-art techniques in both runtime and communication cost.

The two-factor authentication (2FA) has become pervasive as the mobile devices become prevalent. Existing 2FA solutions usually require some form of user involvement, which could severely affect user experience and bring extra burdens to users. In this work, we propose a secure 2FA that utilizes the individual acoustic fingerprint of the speaker/microphone on enrolled device as the second proof. The main idea behind our system is to use both magnitude and phase fingerprints derived from the frequency response of the enrolled device by emitting acoustic beep signals alternately from both enrolled and login devices and receiving their direct arrivals for 2FA. Given the input microphone samplings, our system designs an arrival time detection scheme to accurately identify the beginning point of the beep signal from the received signal. To achieve a robust authentication, we develop a new distance mitigation scheme to eliminate the impact of transmission distances from the sound propagation model for extracting stable fingerprint in both magnitude and phase domain. Our device authentication component then calculates a weighted correlation value between the device profile and fingerprints extracted from run-time measurements to conduct the device authentication for 2FA. Our experimental results show that our proposed system is accurate and robust to both random impersonation and Man-in-the-middle (MiM) attack across different scenarios and device models.

Federated learning (FL) is a distributed machine learning technology that preserves data privacy. However, it has been shown to be vulnerable to gradient leakage attacks (GLA), which can reconstruct private training data from public gradients with an overwhelming probability. Nevertheless, these attacks either require modification of the FL model (analytics-based) or take a long time to converge (optimization-based) and fail in dealing with highly compressed gradients in practical FL systems. In this paper, we pioneer a generation-based GLA method called FGLA that can reconstruct batches of user data, forgoing the optimization process. Specifically, we design a feature separation technique that extracts the feature of each data in a batch and then generates user data directly. Extensive experiments on multiple image datasets demonstrate that FGLA can reconstruct user images in milliseconds with a batch size of 256 from highly compressed gradients (0.8% compression ratio or higher), thus substantially outperforming state-of-the-art methods.

In this paper, we investigate actual exchange-assisted data trading systems and point out that the increment of data content in a sensitive dataset always results in the increment of its privacy level, i.e., making the dataset more sensitive than before. As a consequence, data trading always follows an incremental privacy-driven paradigm, where (1) buyers with various requirements would purchase subsets of the data with different privacy levels, and (2) when a buyer purchases a subset of the entire dataset with a higher level of privacy, the subsets with all lower levels of privacy are required (in other words, there is a containment relationship between subsets with different levels of privacy). A notable example is attribute-value type datasets. Based on these observations, we propose a new concept of privacy-driven and fine-grained data trading, which enables sellers and buyers to trade in data in an efficient and flexible way. We propose a concrete instantiation, dubbed PDFG, which enables sellers and buyers to conduct fine-grained data trading with minimal costs in terms of computation and communication. We prove that PDFG is indistinguishable against the chosen plaintext attack (CPA) under the real-or-random (RoR) model. We also conduct a comprehensive performance evaluation to demonstrate the practicality and efficiency of PDFG.

To mitigate the ever-increasing privacy concerns of model inference, intensive efforts have been put to develop cryptograph-based private deep learning inference, that preserves the confidentiality of the submitted query and its inference result. However, privacy is not free but expensive as the secure computation over the ciphertext domain is time-consuming for both linear and non-linear layers, especially the homomorphic operations. To boost efficiency, a novel optimization is proposed for the evaluation of homomorphic convolutions, which is the most computation-intensive component throughout the entire inference processing. In specific, our approach involves the following critical designs. First, the Winograd fast convolution algorithm is applied to minimize the number of multiplications in convolutions. Second, we fuse this algorithm with the SIMD-enabled additive homomorphic encryption to expedite homomorphic convolution evaluation. Third, the sparsity of the model parameters is explored to further compress the computational cost brought by homomorphic encryption. In addition, it is non-trivial to extend the original Winograd algorithm to accommodate convolution operations, when kernels are larger than 3 × 3 and strides are greater than 1. We conquer this technical challenge and enable the applicability of the proposed optimizations for general convolution parameter configurations. In terms of performance, our scheme outperforms state-of-the-art secure inference methods, demonstrating a 2× reduction in the number of multiplications for convolution evaluation and a 30% improvement in end-to-end latency.

Deep learning has shown impressive performance in numerous applications. However, recent studies have found that deep learning models are vulnerable to adversarial attacks, where the attacker adds imperceptible perturbations into benign samples to induce misclassifications. Adversarial attacks in the digital domain focus on constructing imperceptible perturbations. However, they are always less effective in the physical world because the perturbations may be destroyed when captured by the camera. Most physical adversarial attacks require adding invisible adversarial features (e.g., a sticker or a laser) to the target object, which may be noticed by human eyes. In this work, we propose to employ image transformation to generate more natural adversarial samples in the physical world. Concretely, we propose two attack algorithms to satisfy different attack goals:Efficient-AATRemploys a greedy strategy to generate adversarial samples with fewer queries;Effective-AATRemploys an adaptive particle swarm optimization algorithm to search for the most effective adversarial samples within the given the number of queries. Extensive experiments demonstrate the superiority of our attacks compared with state-of-the-art adversarial attacks under mainstream defenses.

The population of cloud computing greatly facilitates the sharing of explosively generated image today. While benefiting from the convenient of cloud, the privacy protection mechanism that commonly applied in cloud service makes the spreading of illegal and harmful data very hard to be detected or controlled. Such a realistic threat should be seriously treated, yet is largely overlooked in the literature. To address this issue, we propose the first cloud service framework that can simultaneously provide privacy protection and content regulation for the cloud storage image. In specific, we design a secure multi-party computation (MPC) protocol to protect the data privacy via random projection. By leveraging the distance preserving properties residing in random projection, we propose a privacy-preserving principal component analysis (PCA)-based recognition approach over the random projection domain to achieve content matching while respecting the data privacy. To facilitate the efficiency, we implement our system under the compressive sensing (CS) framework. Due to the compression effect of CS, the proposed cloud service can achieve remarkable reduction on the computation and communication complexity of the content matching process. Theoretical analysis and experimental results both show that our system can achieve privacy assurance and acceptable recognition performance, while with high efficiency.

Benefiting from the powerful computing and storage capabilities of cloud services, data sharing in the cloud has been permeated across various applications including social networks, e-health and crowdsourcing transportation system. Intuitively, outsourcing data to untrusted cloud commonly raises concerns about data privacy breaches. To combat this, one approach is exploiting Broadcast Based Searchable Encryption (BBSE) for secure data sharing. Nevertheless, the latest proposed BBSE is still defective in either security or efficiency. In this article, we propose ESPD, an Efficient, Scalable and Privacy-preserving Data sharing framework over encrypted cloud dataset. Different from previous works, ESPD supports sharing target data to multiple users with distinct secret keys, and keeps a constant ciphertext length with the changes of the amount of system users. This feature significantly improves search efficiency and makes ESPD scalable in real-world scenarios. We show a formal analysis to prove the security of ESPD in terms of file privacy, keyword privacy and trapdoor privacy. Also, extensive experiments on real-world dataset are conducted to indicate the desirable performance of ESPD compared to other similar schemes.

Decentralized image classification plays a key role in various scenarios due to its attractive properties, including tolerating high network latency and less prone to single-point failures. Unfortunately, training such a decentralized image classification model is more vulnerable to data privacy leaks compared to other distributed training frameworks. Existing efforts exclusively use differential privacy as the cornerstone to alleviate the threat to data privacy. However, differential privacy is implemented at the expense of accuracy, which goes against our motivation for designing an image classification model without loss of accuracy. To address this problem, we propose D2-MHE, thefirstsecure and efficient decentralized training framework with lossless precision. Inspired by the latest developments in the homomorphic encryption technology, we design a multiparty version of Brakerski-Fan-Vercauteren (BFV), one of the most advanced cryptosystems, and use it to implement private gradient updates of users’ local models. D2-MHE can reduce the communication complexity of general Secure Multiparty Computation (MPC) tasks from quadratic to linear in the number of users, making it very suitable and scalable for large-scale decentralized learning systems. Moreover, D2-MHE provides strict semantic security protection even if the majority of users are dishonest with collusion. We conduct extensive experiments on MNIST, CIFAR-10, and ImageNet to demonstrate the superiority of D2-MHE. Experimental results show that D2-MHE achieves up to$5.5\times $reduction in computation overhead, and at least$12\times $reduction in communication overhead compared to existing schemes.

In this paper, we address the problem of privacy-preserving federated neural network training with$N$users. We presentHercules, an efficient and high-precision training framework that can tolerate collusion of up to$N-1$users.Herculesfollows the POSEIDON framework proposed by Sav et al. (NDSS’21), but makes a qualitative leap in performance with the following contributions: (i) we design a novel parallel homomorphic computation method for matrix operations, which enables fast Single Instruction and Multiple Data (SIMD) operations over ciphertexts. For the multiplication of two$h\times h$dimensional matrices, our method reduces the computation complexity from$O(h^{3})$to$O(h)$. This greatly improves the training efficiency of the neural network since the ciphertext computation is dominated by the convolution operations; (ii) we present an efficient approximation on the sign function based on the composite polynomial approximation. It is used to approximate non-polynomial functions (i.e.,ReLUandmax), with the optimal asymptotic complexity. Extensive experiments on various benchmark datasets (BCW, ESR, CREDIT, MNIST, SVHN, CIFAR-10 and CIFAR-100) show that compared with POSEIDON,Herculesobtains up to 4% increase in model accuracy, and up to$60\times$reduction in the computation and communication cost.

Privacy-preserving decision trees (DTs) in vertical federated learning are one of the most effective tools to facilitate various privacy-critical applications in reality. However, the main bottleneck of current solutions is their huge overhead, mainly due to the adoption of communication-heavy bit decomposition to realize complex non-linear operations, such as comparison and division. In this paper, we presentPriVDT, an efficient two-party framework for private vertical DT training and inference in the offline/online paradigm. Specifically, we customize several cryptographic building blocks based on an advanced primitive, Function Secret Sharing (FSS). First, we construct an optimized comparison protocol to improve the efficiency via reducing the invocation of FSS evaluations. Second, we devise an efficient and privacy-enhanced division protocol without revealing the range of divisors, which utilizes the above comparison protocol and more importantly new designed FSS-based secure range and digital decomposition protocols. Besides, we further reduce the overhead of linear operations by employing lightweight pseudorandom function-based Beaver’s triple techniques. Building on the above efficient components, we implement thePriVDTframework and evaluate it on 5 real-world datasets on both LAN and WAN. Experimental results show that the end-to-end runtime ofPriVDToutperforms the prior art by$42 \sim 510\times $on LAN and$16 \sim 70\times $on WAN. Moreover,PriVDTprovides comparable accuracy to the non-private setting.

Cloud-assisted electronic health records (EHRs) provide convenient medical services for patients by storing and analyzing medical data records in the cloud, but searching for sensitive data (e.g., identity, medical history) in the cloud conflicts with privacy protection requirements. Searchable encryption (SE) is a good cryptographic primitive for solving this conflict, which allows the user to store their encrypted data in the cloud and search them later in encrypted domain. However, the direct applications of most existing SE schemes in cloud-assisted EHRs may result in challenges, for example in terms of functionality, security and efficiency. In this paper, we propose BPVSE, a new verifiable and dynamic SE scheme for cloud-assisted EHR. BPVSE has the following advantages over existing approaches. First, leveraging blockchain and hash-proof chain, BPVSE allows the user to publicly verify the search result returned by the cloud without a trusted authority. Second, BPVSE supports dynamic datasets with forward and backward security, using our newly designed new hidden data structure. Third, BPVSE enables the user to launch parallel search with efficient encryption. We formally prove the security of the proposed BPVSE, and also conduct theoretical comparison and experimental evaluation to show its superiority of functionality, security, and efficiency.

Private neural network inference has demonstrated great importance in various privacy-critical scenarios. However, the primary challenge remaining in prior works is that the evaluation on encrypted data levies prohibitively high run-time and communication overhead. In this work, we present FastSecNet, an efficient two-party cryptographic framework for private inference in the dealer-based pre-processing setting. Specifically, (1) FastSecNet provides an efficient ReLU protocol for the evalution of non-linear layers, which is built up on a recent advanced cryptographic primitive, function secret sharing (FSS). The core of this construction are an optimized ReLU representation and a customized FSS-based ReLU protocol. (2) For linear layer evaluation, we first propose an efficient PRG-based preprocessing protocol based on the fact that one of the inputs is uniformly random in the offline phase. Then, the online phase only communicates one element and consists of lightweight secret-sharing operations in a ring. Extensive evaluations conducted on 4 real-world datasets and 9 neural network models demonstrate that during the online phase, FastSecNet achieves 14× less runtime and 18× less communication cost compared to the state-of-the-art.

With the rapid development of Location-Based Services (LBS), a large number of LBS providers outsource spatial data to cloud servers to reduce their high computational and storage burdens, but meanwhile incur some security issues such as location privacy leakage. Thus, extensive privacy-preserving LBS schemes have been proposed. However, the existing solutions using Bloom filter do not take into account the redundant bits that do not map information in Bloom filter, resulting in high computational overheads, and reveal the inclusion relationship in Bloom filter. To solve these issues, we propose an efficient Privacy-preserving Spatial Range Query (PSRQ) scheme by skillfully combining Geohash algorithm with Circular Shift and Coalesce Bloom Filter (CSC-BF) framework and Symmetric-key Hidden Vector Encryption (SHVE), which not only greatly reduces the computational cost of generating token but also speeds up the query efficiency on large-scale datasets. In addition, we design a Confused Bloom Filter (CBF) to confuse the inclusion relationship by confusing the values of 0 and 1 in the Bloom filter. Base on this, we further propose a more secure and practical enhanced scheme PSRQ+by using CBF and Geohash algorithm, which can support more query ranges and achieve adaptive security. Finally, formal security analysis proves that our schemes are secure against Indistinguishability under Chosen-Plaintext Attacks (IND-CPA) and PSRQ+achieves adaptive IND-CPA, and extensive experimental tests demonstrate that our schemes using million-level dataset improve the query efficiency by 100x compared with previous state-of-the-art solutions.

Federated Learning (FL) has been widely used in various fields such as financial risk control, e-government and smart healthcare. To protect data privacy, many privacy-preserving FL approaches have been designed and implemented in various scenarios. However, existing works incur high communication burdens on clients, and affect the training model accuracy due to non-Independently and Identically Distributed (non-IID) data samples separately owned by clients. To solve these issues, in this paper we propose a secure Model-Contrastive Federated Learning with improved Compressive Sensing (MCFL-CS) scheme, motivated by contrastive learning. We combine model-contrastive loss and cross-entropy loss to design the local network architecture of our scheme, which can alleviate the impact of data heterogeneity on model accuracy. Then we utilize improved compressive sensing and local differential privacy to reduce communication costs and prevent clients’ privacy leakage. The formal security analysis shows that our scheme satisfies (ε,δ)-differential privacy. And extensive experiments using five benchmark datasets demonstrate that our scheme improves the model accuracy by 3.45% on average of all datasets under the non-IID setting and reduces the communication costs by more than 95%, when compared with FedAvg.

The number of images produced by people everyday is rapidly increasing in recent years and their local storage space may be not big enough for storing all these images. As a result, people are currently accustomed to uploading images to cloud platforms, which raises privacy concerns. Traditional image encryption is a way to protect image privacy without preserving visual usability, so that image owners fail to conveniently browse and manage their images stored in the cloud. Hence some visual privacy protection schemes were proposed to balance image privacy and usability, while many of them are irreversible. Recently, a novel reversible technology, called Thumbnail-Preserving Encryption (TPE), has been a hot topic. However, existing TPE schemes are either inefficient, or cannot perfectly restore the original image and meanwhile achieve Nonce-Respecting (NR) security. In view of this, we propose a reversible framework for efficient and secure visual privacy protection, which tunably preserves image visual usability for image owners with the idea of data hiding. In the framework, the original image is firstly divided into several regions by our proposed region division methods and one of the regions is vacated by data hiding. Then, the vacated region is utilized to preserve the original thumbnail by pixel adjustment after image encryption. Finally, pixels in each sub block are permuted for security. According to our theoretical analysis, the above processes are completely reversible and the processed image achieves NR security. Furthermore, we conduct extensive experiments, including recognition by various application programming interfaces, user surveys, and efficiency comparison, to demonstrate that our framework is efficient and strikes a good balance between privacy and usability.

The increasingly popular usage of wearable devices provides users with the ability to continuously track their health conditions or physical activities. Such system is however vulnerable to user spoofing, in which a user distributes his/her device to other users such that the data collected from these users could be claimed to be his/her own. Thus, it is critical to identify the user for many wearable devices, allowing the sensing data to be labeled properly. In this paper, we propose a user identification system by leveraging the users whispered sound to mitigate user spoofing for wearable devices. Our system exploits the contact microphone placed into contact with the body to capture the users whispered sound for user identification. Given the captured acoustic data, our system first identifies frames which contain whispered events. Our system then calculates acoustic features from the identified whispered frames to determine whether the voice is collected when the microphone is on the body. Moreover, to make our system robust, we assign different quality weights to the whispers phonemes by considering their consistency (i.e., intra users differences) and distinctiveness (i.e., inter users differences) simultaneously. Our experiments demonstrate that our system is robust and accurate across various scenarios.

With the increasing popularity of GPS-equipped mobile devices in cloud-assisted fog computing scenarios, massive spatio-textual data is generated and outsourced to cloud servers for storage and analysis. Existing privacy-preserving range query or ranked keyword search schemes does not support a unified index, and are just applicable for the symmetric environment where all users sharing the same secret key. To solve this issue, we propose aPrivacy-preservingRankedSpatial keywordQuery in mobile cloud-assistedFog computing (PRSQ-F). Specifically, we design a novel comparable product encoding strategy that combines both spatial and textual conditions tightly to retrieve the objects in query range and with the highest textual similarity. Then, we use a new conversion protocol and attribute-based encryption to support privacy-preserving retrieval and malicious user traceability in the asymmetric environment where different query users have different keys. Furthermore, we construct an R-tree-based index to achieve faster-than-linear retrieval. Our formal security analysis shows that data security can be guaranteed. Our empirical experiments using a real-world dataset demonstrate the efficiency and feasibility of PRSQ-F.

Blockchain-based Zero Trust Cybersecurity in the Internet of Things 1 INTRODUCTIONThe Internet of Things (IoT) connects a massive number of smart devices to the Internet, in which all data, applications, devices, and users require connectivity, security, and trust.Traditional security approaches assume that all participants within the network perimeter are trustworthy.However, in IoT environment data, applications, devices, and users are gradually moving outside the traditional trusted defence perimeter and have become a source of security risks.Unlike traditional security approaches, which are initially designed for the optimum protection and only act if a process is malicious, the zero-trust security framework upholds the "verify and never trust" principle.Zero trust-based approaches assume that everything within the system is untrustworthy and needs to be verified to prevent threats.Meanwhile, the blockchain technology shows promises on cyber security and several blockchain security mechanisms have been developed, including access management, user authentication, and transaction security.Due to its prowess in enhancing cyber security, blockchain can provide zero trust security framework with highly accessible and transparent security mechanisms via a visible blockchain, in which all transactions are visible to restricted operators.Zero-trust models can be secured further by a blockchain due to its sheer immutable nature and blockchain technology is expected to recognise them, authenticate their trust, and allow them access.Blockchain-enabled zero trust security can detect suspicious online transaction, isolate connection, and restrict access to the user.This special issue received in total 37 high-quality submissions.Per journal policy, it was ensured that handling editors did not have any potential conflict of interest with authors of submitted papers.All submitted papers were reviewed by at least three independent potential referees.The papers were evaluated for their rigor and quality, and also for their relevance to the theme of our special issue.After evaluating the overall scores, seven papers were selected by the guest editors and approved by the Editor-in-Chief for inclusion in this special issue.We will now briefly introduce the accepted papers. THE PAPERSThe paper entitled "Three-tier storage framework based on TBchain and IPFS for protecting IoT security and privacy" by authors Li et al. proposed to use a three-tier blockchain to split

Tokens have become an essential part of blockchain ecosystem, so recognizing token transfer behaviors is crucial for applications depending on blockchain. Unfortunately, existing solutions cannot recognize token transfer behaviors accurately and efficiently because of their incomplete patterns and inefficient designs. This work proposes TokenAware , a novel online system for recognizing token transfer behaviors. To improve accuracy, TokenAware infers token transfer behaviors from modifications of internal bookkeeping of a token smart contract for recording the information of token holders (e.g., their addresses and shares). However, recognizing bookkeeping is challenging, because smart contract bytecode does not contain type information. TokenAware overcomes the challenge by first learning the instruction sequences for locating basic types and then deriving the instruction sequences for locating sophisticated types that are composed of basic types. To improve efficiency, TokenAware introduces four optimizations. We conduct extensive experiments to evaluate TokenAware with real blockchain data. Results show that TokenAware can automatically identify new types of bookkeeping and recognize 107,202 tokens with 98.7% precision. TokenAware with optimizations merely incurs 4% overhead, which is 1/345 of the overhead led by the counterpart with no optimization. Moreover, we develop an application based on TokenAware to demonstrate how it facilitates malicious behavior detection.

Federated learning (FL) is a new distributed learning paradigm, in which the clients cooperate to conduct the global model without exposing local private data. However, existing privacy inference attacks on FL show that adversaries can still reverse the training data from the submitted model updates. Recently, secure aggregation has been proposed and integrated into the FL framework, which effectively guarantees privacy through various cryptographic techniques, unfortunately at the cost of a large amount of communication and computation. In this paper, we propose a highly efficient secure aggregation scheme, Fast-Aggregate, which significantly reduces the communication and computation overhead while ensuring data privacy and robustness against clients' dropout. Firstly, Fast-Aggregate employs a multi-group regular graph for efficient secure aggregation to boost data parallelism. Secondly, we leverage polynomial multi-point evaluation and fast Lagrange interpolation methods to handle clients' dropout as well as reduce computational complexity. Finally, we adopt an additive mask to guarantee clients' privacy. Riding on the capabilities of Fast-Aggregate, we achieve the secure aggregation overhead of O (N log2$N$), as opposed to O (N2) in the state-of-the-art works. Besides, Fast-Aggregate improves training speed without loss of model quality and provides flexibility to deal with client corruption at the same time.

Cloud-based services for federated learning has received widespread attention for its ability to collaboratively train a model without collecting users' local data. Although there are existing methods such as homomorphic encryption and secure multi-party computation to address the privacy issues associated with the model parameter exchanging during aggregation, these methods will inevitably lead to huge communication overheads or slow down the training time. Functional encryption (FE) is considered as a new approach to address privacy-preserving federated learning probelms, but the only known FE solution has severe security issues such as leaking master private key, and is impractical. Thus, in this paper, we propose CryptoFE, a cloud-based privacy-preserving federated learning aggregation scheme based on FE. Compared with the only existing FE solution, CryptoFE is efficient in aggregation phase, especially when a high model precision is required, and provides formal privacy guarantees for users' gradients. The experiments with real-world data demonstrate the efficeint performance of our proposed scheme.

Federated learning (FL) enables multiple users to learn a global predictive model by exchanging local updates without disclosing their private datasets. To further protect local updates, several privacy-preserving schemes are proposed and applied in FL. However, a fundamental issue is that irregular users in FL holding low quality updates could decrease the convergence rate, and even worse, damage the model’s usability. While a few works recently explore unified solutions to mitigate the issues of privacy and irregular users meanwhile, the existing methods are still insufficient in terms of accuracy and efficiency. The reasons are two major limitations: inefficiency caused by complex cryptographic algorithms and poor model usability due to ineffective removing strategies for irregular users. To approach the above problems, we propose SAP-IU, a new and efficient federated learning scheme, which achieves irregular users removing and privacy protection at the same time. Specifically, we first design a novel removing algorithm for irregular users called TrustIUthat calculates the weight of each user via the cosine metric. This ensures that the global model is mainly derived from the contributions of high-quality data. We further devise a secure weighted aggregation protocol for TrustIUto protect users’ sensitive information including local updates and data quality. Besides, our scheme is robust to users dropping out during the whole training process. Moreover, extensive experiments show that SAP-IU has a better performance than prior works in terms of training accuracy and efficiency.

Privacy-preserving vertical federated learning (VFL) has been widely applied in electronic health (eHealth) systems. However, existing VFL schemes rarely consider the data pre-processing step including feature selection, which will lead to poor convergence rate and even damaging the model utility. In this paper, we propose an efficient and privacy-preserving feature selection scheme for VFL. Specifically, we first propose a general Gini-impurity based feature selection framework, which is compatible with most existing machine learning models in VFL. With the framework, we present two concrete protocols (dubbed πSS−FSand πH−FS, respectively) customized for different eHealth scenarios. πSS−FSexploits a lightweight additive secret sharing technique, such that it can be executed in comparable time as the evaluation of the plaintext scheme. πH−FSis a hybrid feature selection protocol that additionally utilizes a linear homomorphic encryption technique, to reduce the communication overhead at the cost of a moderate runtime. Moreover, extensive evaluations conducted on real-world medical datasets demonstrate that our scheme realizes up to 27% accuracy gains.

Image representation is critical for many visual tasks. Instead of representing images discretely with 2D arrays of pixels, a recent study, namely local implicit image function (LIIF), denotes images as a continuous function where pixel values are expansion by using the corresponding coordinates as inputs. Due to its continuous nature, LIIF can be adopted for arbitrary-scale image super-resolution tasks, resulting in a single effective and efficient model for various up-scaling factors. However, LIIF often suffers from structural distortions and ringing artifacts around edges, mostly because all pixels share the same model, thus ignoring the local properties of the image. In this paper, we propose a novel adaptive local image function (A-LIIF) to alleviate this problem. Specifically, our A-LIIF consists of two main components: an encoder and a expansion network. The former captures cross-scale image features, while the latter models the continuous up-scaling function by a weighted combination of multiple local implicit image functions. Accordingly, our A-LIIF can reconstruct the high-frequency textures and structures more accurately. Experiments on multiple benchmark datasets verify the effectiveness of our method. Our codes are available at https://github.com/LeeHW-THU/A-LIIF.

We initiate the study of private inference on Transformer-based models in the client-server setting, where clients have private inputs and servers hold proprietary models. Our main contribution is to provide several new secure protocols for matrix multiplication and complex non-linear functions like Softmax, GELU activations, and LayerNorm, which are critical components of Transformers. Specifically, we first propose a customized homomorphic encryption-based protocol for matrix multiplication that crucially relies on a novel compact packing technique. This design achieves $\sqrt{m} \times$ less communication ($m$ is the number of rows of the output matrix) over the most efficient work. Second, we design efficient protocols for three non-linear functions via integrating advanced underlying protocols and specialized optimizations. Compared to the state-of-the-art protocols, our recipes reduce about half of the communication and computation overhead. Furthermore, all protocols are numerically precise, which preserve the model accuracy of plaintext. These techniques together allow us to implement \Name, an efficient Transformer-based private inference framework. Experiments conducted on several real-world datasets and models demonstrate that \Name achieves $3 \sim 14\times$ less communication and $3 \sim 11\times$ less runtime compared to the prior art.

The location awareness becomes increasingly important as mobile devices such as smartphones are used extensively in our daily lives. Existing indoor localization solutions either require certain preinstalled infrastructures or add-on devices, which could not provide a location semantics identification service for smartphones to infer both type and size of a geographic location. In this work, we propose a new active sensing system that enables smartphones to identify its location semantics without requiring any additional infrastructure. The main idea behind our system is to utilize the acoustic signatures, which are derived from the smartphone by emitting a predesigned beep signal and identifying two echo sets which correspond to sidewalls and other static objects respectively, as the proof to achieve both spatial size estimation and room-type prediction simultaneously for indoor location semantics identification. Given the microphone samplings, our system designs a correlation-based scheme to identify beginning points of echoes corresponding to static reflectors accurately from the received signal. To achieve an accurate location semantics identification, we develop a new echo selection scheme to discriminate echoes created by sidewalls and other static reflectors by utilizing the geometrical relationships between the delays of echoes. To deal with the varying number of identified echoes, our location semantics prediction scheme then derives histograms from echo sets and adopt a deep-learning-based classifier to determine the current location semantics. Our experimental results show that our proposed system is accurate and robust for location semantics identification under various real-world scenarios.

Federated learning (FL) has emerged as a powerful technology widely applied in Internet of Things (IoT). Recently, researchers have shown an increased interest in privacy-preserving FL withunreliable users. The goal of such works is to achieve private training under ciphertext mode while ensuring that the FL model is mainly derived from the contributions of users with high-quality data. However, the existing work is still in its infancy, and the main challenge faced by many researchers is how to achieve their schemes for meeting the demands of high accuracy and efficiency. To combat that, we propose an efficient privacy-preserving FL (EPPFL) scheme withunreliable users. Specifically, we design a novel scheme to mitigate the negative impact ofunreliable users, where the targeted model is guaranteed to be updated with high-quality data. Through iteratively executing our “Excluding Irrelevant Components” and “Weighted Aggregation,” the FL model converges rapidly while taking limited communication and computation overhead. As a result, not only the model accuracy can be optimized, but also the training efficiency can be improved. Meanwhile, we conduct a secure framework based on the threshold Paillier cryptosystem, which can rigorously protect all user-related private information during the training process. Furthermore, the extensive experiments demonstrate our EPPFL with high-level performance in terms of accuracy and efficiency.

Internet of Things (IoT) devices and systems are becoming increasingly commonplace, and as such systems scale up, so do the computational and storage requirements. Hence, one recent trend is to outsource data from IoT devices to remote systems. To facilitate both ciphertext retrieval and data confidentiality in the outsourced data, a number of searchable encryption (SE) approaches have been proposed in the literature. However, due to limited keyword space, a number of SE schemes are vulnerable to keyword guessing attacks (KGAs). In addition, existing SE approaches generally do not consider the hierarchical structure in which users at different levels require varying access privileges. Furthermore, existing SE schemes seldom provide time-controlled access control. Therefore, in this article, we propose a time-controlled hierarchical multikeyword search by using a double-server architecture to mitigate KGA. In our approach, we also build a public key tree to support different access permissions for hierarchical users. Formal security analysis shows that our scheme is secure, and extensive experiments demonstrate that our scheme is practical.

Generally, power utilities can utilize smart-meter data to extract load patterns through load-profiling technologies, such as$K$-means clustering. To improve the efficiency of load profiling, both$K$-means clustering and smart-meter data can be outsourced to powerful clouds. However, clouds are not completely trustworthy: private meter data may be used for commercial interests;$K$-means clustering may also be performed with fewer iterations to save computational costs, which violates the integrity of outsourced clustering. In this article, therefore, a secure$K$-means-clustering scheme is proposed, called privacy-preserving and integrity-preserving clustering (PIPC), which aims to protect the privacy and integrity of load profiling. To this end, two techniques are designed: 1) encrypted distance measurement, in which a public comparison matrix is constructed by securely embedding a secret key matrix and 2) integrity assurance, in which a specific Stackelberg game is designed to create economic incentives. The former, as the core of$K$-means clustering, can protect the privacy of meter data. The latter ensures that clouds can obtain the maximum utility only when clouds execute$K$-means clustering in an honest manner, thereby preserving the integrity of outsourced computing. Experimental results demonstrate that PIPC reaches high clustering accuracy and computational efficiency for load profiling while retaining smart-meter data privacy and outsourced-clustering integrity.

Searchable Encryption (SE) is a popular cryptographic primitive for building ciphertexts retrieval systems with far-reaching applications. However, existing SE schemes generally do not support threshold access control (i.e., data users must collaboratively issue search and decryption operations over encrypted cloud data) in a group-oriented cloud data sharing setting, which is increasingly receiving much attention in the research community. Thus, in this article, we first propose a Threshold Multi-keyword Search (TMS) scheme for cloud-based group data sharing (referred to as basic TMS scheme) by utilizing Shamir’s secret sharing technique, to achieve threshold multi-keyword search, threshold decryption, and short record ciphertext size. Then, we extend this basic TMS to realize threshold result verification and threshold traceability (referred to as enhanced TMS). Furthermore, the enhanced TMS is extended to support public result verification and dynamic operations with the public verifier and improved hash tables, respectively. Our formal security analysis proves that both basic TMS and enhanced TMS are semi-adaptively secure and can resist Chosen-Keyword Attack (CKA). Our theoretical evaluation and empirical experiments demonstrate the potential utility of both schemes.

Searchable encryption (SE) allows cloud tenants to retrieve encrypted data while preserving data confidentiality securely. Many SE solutions have been designed to improve efficiency and security, but most of them are still susceptible to insider Keyword-Guessing Attacks (KGA), which implies that the internal attackers can guess the candidate keywords successfully in an off-line manner. Also in existing SE solutions, a semi-honest-but-curious cloud server may deliver incorrect search results by performing only a fraction of retrieval operations honestly (e.g., to save storage space). To address these two challenging issues, we first construct the basic Verifiable SE Framework (VSEF), which can withstand the inside KGA and achieve verifiable searchability. Based on the basic VSEF, we then present the enhanced VSEF to support multi-keyword search, multi-key encryption and dynamic updates (e.g., data modification, data insertion, and data deletion) at the same time, which highlights the importance of practicability and scalability of SE in real-world application scenarios. We conduct extensive experiments using the Enron email dataset to demonstrate that the enhanced VSEF achieves high efficiency while resisting to the inside KGA and supporting the verifiability of search results.

With the increasing traffic volume, enterprises choose to outsource their middlebox services, such as deep packet inspection, to the cloud to acquire rich computational and communication resources. However, since the traffic is redirected to the public cloud, information leakages, such as packet payload and inspection rules, arouse privacy concerns of both middlebox owner and packet senders. To address the concerns, we propose an efficient verifiable deep packet inspection (EV-DPI) scheme with strong privacy guarantees. Specifically, a two-layer architecture is designed and deployed over two non-collusion cloud servers. The first layer fast filters out most of legitimate packets and the second layer supports exact rule matching. During the inspection, the privacy of packet payload and the confidentiality of inspection rules are well preserved. To improve the efficiency, only fast symmetric crypto-systems, such as hash functions, are used. Moreover, the proposed scheme allows the network administrator to verify the execution results, which offers a strong control of outsourced services. To validate the performance of the proposed EV-DPI scheme, we conduct extensive experiments on the Amazon Cloud. Large-scale dataset (millions of packets) is tested to obtain the key performance metrics. The experimental results demonstrate that EV-DPI not only preserves the packet privacy, but also achieves high packet inspection efficiency.

Middlebox is an intermediary network equipment which can be outsourced to remote cloud servers for low-cost and customizable network services, such as load balancer and intrusion detection. A fundamental function of the middlebox is packet inspection, where both the packet header and payload are extracted and analyzed based on inspection rules. However, as the packet may contain sensitive individual or organizational information, it may raise severe privacy concerns without proper countermeasures. In this article, we propose a secure and versatile packet inspection scheme for outsourced middlebox. The proposed scheme builds upon two non-collusion cloud servers, where the first server conducts the inspection task over the ciphertext domain and the second reveal the inspection results. By doing so, the proposed scheme achieves versatile inspection functionalities: range-query-based header inspection and token-based payload inspection, while preserving the privacy of packet header, payload, and inspection rules. Moreover, we identify and address two challenging issues in the state-of-the-art literatures. First, we tailor the design of mis-operation resistant searchable homomorphic encryption (MR-SHE) and somewhat homomorphic encryption in the two-server model, to resistoffline dictionary attack on payload headers. Second, we propose a key management mechanism with compelled access for the middlebox, to achievefine-grained probable cause privacy. We also conduct extensive experiments and compare the results with existing schemes to demonstrate the feasibility of the proposed scheme.

Cloud-assisted Internet of Things (IoT) is increasingly prevalent used in various fields, such as the healthcare system. While in such a scenario, sensitive data (e.g., personal electronic medical records) can be easily revealed, which incurs potential security challenges. Thus, Symmetric Searchable Encryption (SSE) has been extensively studied due to its capability of supporting efficient search on encrypted data. However, most SSE schemes require the data owner to share the complete key with query users and take malicious cloud servers out of consideration. Seeking to address these limitations, in this article we propose a Verifiable Privacy-preserving data Search scheme with Limited key-disclosure (VPSL) for cloud-assisted Internet of Things. VPSL first designs a trapdoor generation protocol for obtaining a trapdoor with disclosing limited key information and without revealing plaintext query points to others. Then, VPSL provides an efficient result verification and search processing by employing the Merkle hash tree structure and k-means clustering technique, respectively. VPSL is secure against the level-2 attack. Finally, an enhanced VPSL (called VPSL+) resisting the level-3 attack is constructed by introducing the random splitting technique. Empirical experiments demonstrate the accuracy and efficiency of VPSL or VPSL+ using real-world datasets.

DNA similarity search has been widely applied in human genomic studies including DNA marking, genomic sequencing and genetic disease prediction. Meanwhile, with the explosive growth of data, users are increasingly inclining to store DNA data on the cloud for saving local cost. However, the high sensitivity of DNA data has forced the government to strictly control its acquisition and utilization. One potential solution is to encrypt DNA data before outsourcing them to the cloud. Nevertheless, private DNA similarity query has been an active research issue, state-of-the-art results are still defective in security, functionality, and efficiency. In this article, we propose EFSS, an efficient and fine-grained similarity search scheme over encrypted DNA data. In specific, first, we design an approximation algorithm to efficiently calculate the edit distances between two sequences. Second, we put forward a novel Boolean search strategy to achieve complicated logic queries such as mixed “AND” and “NO” operations on genes. Third, data access control is also supported in our EFSS through a variant of polynomial based design. Moreover, the K-means clustering algorithm is exploited to further improve the efficiency of execution. In the end, security analysis and extensive experiments demonstrate the high performance of EFSS compared with existing schemes.

Federated deep learning has been widely used in various fields. To protect data privacy, many privacy-preservingapproaches have been designed and implemented in various scenarios. However, existing works rarely consider a fundamental issue that the data shared by certain users (calledirregular users) may be of low quality. Obviously, in a federated training process, data shared by manyirregular usersmay impair the training accuracy, or worse, lead to the uselessness of the final model. In this article, we propose PPFDL, a Privacy-Preserving Federated Deep Learning framework withirregular users. In specific, we design a novel solution to reduce the negative impact ofirregular userson the training accuracy, which guarantees that the training results are mainly calculated from the contribution of high-quality data. Meanwhile, we exploit Yao's garbled circuits and additively homomorphic cryptosystems to ensure the confidentiality of all user-related information. Moreover, PPFDL is also robust to users dropping out during the whole implementation. This means that each user can be offline at any subprocess of training, as long as the remaining online users can still complete the training task. Extensive experiments demonstrate the superior performance of PPFDL in terms of training accuracy, computation, and communication overheads.

Federated learning enables clients to train a machine learning model jointly without sharing their local data. However, due to the centrality of federated learning framework and the untrustworthiness of clients, traditional federated learning solutions are vulnerable to poisoning attacks from malicious clients and servers. In this paper, we aim to mitigate the impact of the central server and malicious clients by designing a Privacy-preserving Byzantine-robust Federated Learning (PBFL) scheme based on blockchain. Specifically, we use cosine similarity to judge the malicious gradients uploaded by malicious clients. Then, we adopt fully homomorphic encryption to provide secure aggregation. Finally, we use blockchain system to facilitate transparent processes and implementation of regulations. Our formal analysis proves that our scheme achieves convergence and provides privacy protection. Our extensive experiments on different datasets demonstrate that our scheme is robust and efficient. Even if the root dataset is small, our scheme can achieve the same efficiency as FedSGD.

The effectiveness of state-of-the-art deep learning (DL) models has empowered the development of industrial Internet of things (IIoT). Recently, considering resource-constrained and privacy-required IIoT devices, collaborative inference has been proposed, which splits DL models and deploys them in IIoT devices and an edge server separately. However, in this article, we argue that there are still severe privacy vulnerabilities in collaborative inference systems. And we devise the first membership inference attack (MIA) against collaborative inference, to infer whether a particular data sample is used for training the model of IIoT systems. Existing MIAs either assume full access to the systems’ APIs or availability of the target model's parameters, which is not applicable in realistic IIoT environments. In contrast to prior works, we proposetransfer-inheritshadow learning and thus relax these key assumptions. We evaluate our attack on different datasets and various settings, and the results show it has high effectiveness.

With the advent of cloud computing, it has become more and more popular to outsource various services to the cloud for releasing the burden of local data storage and maintenance. However, it may cause serious privacy problems because the cloud may be untrusted. In this article, we study the privacy-preserving reverse nearest neighbor (PPRNN) query over encrypted spatial data. First, we introduce the concept of reference-locked order-preserving encryption (RL-OPE) with its construction and security proof, which reveals less information than traditional order-preserving encryption (OPE). Then, we present a novel PPRNN scheme in static setting based on structured encryption (SE) and the proposed RL-OPE, called sPPRNN. After that, we design a generic method that extends a PPRNN scheme in static setting to the counterpart in dynamic setting, called dPPRNN. Furthermore, we present a thorough privacy analysis of our proposal. Finally, we demonstrate its efficiency and effectiveness for practical deployment through extensive experiments.

Millions of smart contracts have been deployed onto Ethereum for providing various services, whose functions can be invoked. For this purpose, the caller needs to know thefunction signatureof a callee, which includes its function id and parameter types. Such signatures arecriticalto many applications focusing on smart contracts, e.g., reverse engineering, fuzzing, attack detection, and profiling. Unfortunately, it is challenging to recover the function signatures from contract bytecode, since neither debug information nor type information is present in the bytecode. To address this issue, prior approaches rely on source code, or a collection of known signatures from incomplete databases or incomplete heuristic rules, which, however, are far from adequate and cannot cope with the rapid growth of new contracts. In this paper, we propose a novel solution that leverages how functions are handled by Ethereum virtual machine (EVM) to automatically recover function signatures. In particular, we exploit how smart contracts determine the functions to be invoked to locate and extract function ids, and propose a new approach namedtype-awaresymbolic execution (TASE) that utilizes the semantics of EVM operations on parameters to identify the number and the types of parameters. Moreover, we developSigRec, a new tool for recovering function signatures from contract bytecode without the need of source code and function signature databases. The extensive experimental results show thatSigRecoutperforms all existing tools, achieving an unprecedented 98.7 percent accuracy within 0.074 seconds. We further demonstrate that the recovered function signatures are useful in attack detection, fuzzing and reverse engineering of EVM bytecode.

Federated learning (FL) has demonstrated tremendous success in various mission-critical large-scale scenarios. However, such promising distributed learning paradigm is still vulnerable to privacy inference and byzantine attacks. The former aims to infer the privacy of target participants involved in training, while the latter focuses on destroying the integrity of the constructed model. To mitigate the above two issues, a few works recently explored unified solutions by utilizing generic secure computation techniques and common byzantine-robust aggregation rules, but there are two major limitations: 1) they suffer from impracticality due to efficiency bottlenecks, and 2) they are still vulnerable to various types of attacks because of model incomprehensiveness.

Lack of transparency in deep learning models makes them vulnerable to backdoor attack, which can cause severe security consequences. For a backdoored model, the specific inputs can trigger misclassification rules while it performs normal behaviors on clean data. Existing backdoor attacks usually generate poisoned data by adding an obvious trigger to the original data and mislabeling them, which suffers from poor invisibility and hence can be easily detected. In this paper, we propose Stand-in Backdoor, a more stealthy and powerful backdoor attack, which can completely hide the trigger while maintaining correct labels of poisoned data. Specifically, we design a novel optimization strategy to transform triggers into imperceptible perturbation in the feature space. Furthermore, utilizing the transferability of feature perturbation, we fine-tune the victim model with well-constructed poisoned data that are correctly labeled. Extensive experiments conducted on various image classification tasks demonstrate that our attack outperforms the state-of-the-art work in terms of backdoor stealth and attack performance, without sacrificing the model's utility.

Federated learning (FL), as a promising distributed learning paradigm, has put many efforts into distributed intrusion detection systems (IDS), for defending against various malicious attacks, such as SQL injection and DDoS attacks. Compared with traditional IDS based on centralized deep learning (DL), FL-based solutions require not to share users' raw data while yielding better detection performance. However, state-of-the-art FL-based methods still suffer from two key limitations: 1) insufficient detection performance on non-independent and identically distributed (non-IID) data, and 2) high communication and computational overheads due to the utilization of large-scale neural network models. In this paper, we propose a lightweight collaborative intrusion detection framework, called CoLGBM, the first of its kind in the regime of decentralized IDS, where decision tree and light gradient boosting machine (LGBM) are combined for constructing the detection scheme. The main insight is that through combining user-trained decision trees (each user's decision tree is derived from its own data with unique distribution), our framework can perform effectively on non-IID data while working efficiently for handling enormous samples. Compared with the current FL-based methods, our CoLGBM achieves higher accuracy and lower overhead on both IID and non-IID data. Extensive experiment results demonstrate our scheme with high-level performance.

The rapid development of machine learning technology has prompted the applications of Automatic Speech Recognition(ASR). However, studies have shown that the state-of-the-art ASR technologies are still vulnerable to various attacks, which undermines the stability of ASR destructively. In general, most of the existing attack techniques for the ASR model are based on white box scenarios, where the adversary uses adversarial samples to generate a substituted model corresponding to the target model. On the contrary, there are fewer attack schemes in the black-box scenario. Moreover, no scheme considers the problem of how to construct the architecture of the substituted models. In this paper, we point out that constructing a good substituted model architecture is crucial to the effectiveness of the attack, as it helps to generate a more sophisticated set of adversarial examples. We evaluate the performance of different substituted models by comprehensive experiments, and find that ensemble substituted models can achieve the optimal attack effect. The experiment shows that our approach performs attack over 80% success rate (2% improvement compared to the latest work) meanwhile maintaining the authenticity of the original sample well.

Exercise intensity monitoring of physical activities has drawn increasingly attention as the awareness of the exercise intensity is of great importance for a person to achieve optimal training outcomes. For example, over-training could lead to excessive fatigue and loss of motivation for exercise. Traditional exercise intensity monitoring systems utilize GPS data to track the user’s intensity of cardio activities through his/her position and speed. Such systems however become invalid for indoor exercises on stationary fitness equipments such as the treadmill or exercise bike. Recent work in using body-worn sensors to track the user’s heart rate for exercise intensity monitoring usually involves additional wearable sensors which are only available on some particular fitness equipments, and thus are hard to be used in all occasions. This work presents an exercise intensity monitoring system which is capable of detecting a person’s exercise intensity via smartphones. Our system exploits the off-the-shelf smartphone and its headphone to capture the user’s breathing sound. Given the captured acoustic data, our system performs data pre-processing to remove the environmental noise and identify the non-silent acoustic frames based on the signal energy. Our system then conducts breathing event detection for non-silent frames, and further calibrates the detection results by utilizing the high correlation between breathing cycles to improve the detection accuracy. Moreover, our system can estimate the person’s exercise intensity based on features extracted from the frames which contain breathing sound. Our experiments involving 9 subjects over four-month time period demonstrate that our proposed exercise intensity monitoring system is robust and accurate in both indoor and outdoor environments.

The two-factor authentication (2FA) has drawn increasingly attention as the mobile devices become more prevalent. For example, the user's possession of the enrolled phone could be used by the 2FA system as the second proof to protect his/her online accounts. Existing 2FA solutions mainly require some form of user-device interaction, which may severely affect user experience and creates extra burdens to users. In this work, we propose Proximity-Echo, a secure 2FA system utilizing the proximity of a user's enrolled phone and the login device as the second proof without requiring the user's interactions or pre-constructed device fingerprints. The basic idea of Proximity-Echo is to derive location signatures based on acoustic beep signals emitted alternately by both devices and sensing the echoes with microphones, and compare the extracted signatures for proximity detection. Given the received beep signal, our system designs a period selection scheme to identify two sound segments accurately: the chirp period is the sound segment propagating directly from the speaker to the microphone whereas the echo period is the sound segment reflected back by surrounding objects. To achieve an accurate proximity detection, we develop a new energy loss compensation extraction scheme by utilizing the extracted chirp periods to estimate the intrinsic differences of energy loss between microphones of the enrolled phone and the login device. Our proximity detection component then conducts the similarity comparison between the identified two echo periods after the energy loss compensation to effectively determine whether the enrolled phone and the login device are in proximity for 2FA. Our experimental results show that our Proximity-Echo is accurate in providing 2FA and robust to both man-in-the-middle (MiM) and co-located attacks across different scenarios and device models.

Cloud storage enables users to outsource data to storage servers and retrieve target data efficiently. Some of the outsourced data are very sensitive and should be prevented for any leakage. Generally, if users conventionally encrypt the data, searching is impeded. Public-key encryption with keyword search (PEKS) resolves this tension. Whereas, it is vulnerable to keyword guessing attacks (KGA), since keywords are low-entropy. In this paper, we present a secure PEKS scheme called SEPSE against KGA, where users encrypt keywords with the aid of dedicated key servers via a threshold and oblivious way. SEPSE supports key renewal to periodically replace an existing key with a new one on each key server to thwart the key compromise. Furthermore, SEPSE can efficiently resist online KGA, where each keyword request made by a user is integrated into a transaction on a public blockchain (e.g., Ethereum), which allows key servers to learn the number of keyword requests made by the user without requiring a synchronization between them for per-user rate limiting. Security analysis and performance evaluation demonstrate that SEPSE provides a stronger security guarantee compared with existing schemes, at the expense of acceptable computational costs.

Wireless body area networks (WBANs) rely on powerful cloud storage services to manage massive medical data. As precise medical diagnosis analysis is heavily based on these medical data, any altered medical data may cause severe consequences, the integrity of outsourced medical data has become the most concerning security issue. Up to date, most existing public auditing mechanisms have been proposed to check the data integrity, but they could not achieve conditional identity privacy, any patient would not like others to know his/her real identity corresponding to certain serious disease, and some malicious patients should be revoked timely due to misbehaviors. Additionally, they are vulnerable to malicious auditors, by colluding with the cloud server to cheat patients. In this paper, we propose a conditional identity privacy-preserving public auditing (CIPPPA) mechanism for cloud-based WBANs. CIPPPA is the first public auditing mechanism achieving conditional identity privacy of patients in WBANs, the real identity of a patient is unknown to anyone in cloud-based WBANs other than the private key generator (PKG). We attempt to integrate Ethereum blockchain into CIPPPA, which gives assistance to patients for validating malicious auditing behaviors. Formal security analysis and performance evaluation demonstrate that CIPPPA is practical for cloud-based WBANs.

Ciphertext-Policy Attribute-Based Keyword Search (CP-ABKS) schemes support both fine-grained access control and keyword-based ciphertext retrieval, which make these schemes attractive for resource-constrained users (i.e., mobile or wearable devices, sensor nodes, etc.) to store, share and search encrypted data in the public cloud. However, ciphertext length and decryption overhead in the existing CP-ABKS schemes grow with the complexity of access policies or the number of data users' attributes. Moreover, such schemes generally do not consider the practical multi-owner setting (e.g., each file needs to be signed by multiple data owners before being uploaded to the cloud server) or prevent malicious cloud servers from returning incorrect search results. To overcome these limitations, in this paper we first design an optimized Verifiable Fine-grained Keyword Search scheme in the static Multi-owner setting (termed as basic VFKSM), which achieves short ciphertext length, fast ciphertext transformation, accelerated search process, and authentic search result verification. Then, we extend the basic VFKSM to support multi-keyword search and multi-owner update (also called as extended VFKSM). Finally, we prove that the basic (or extended) VFKSM resists the Chosen-Keyword Attack (CKA) and external Keyword-Guessing Attack (KGA). We also evaluate the performance of these schemes using various public datasets.

Searchable Encryption (SE) is an important technique to guarantee data security and usability in the cloud at the same time. Leveraging Ciphertext-Policy Attribute-Based Encryption (CP-ABE), the Ciphertext-Policy Attribute-Based Keyword Search (CP-ABKS) scheme can achieve keyword-based retrieval and fine-grained access control simultaneously. However, the single attribute authority in existing CP-ABKS schemes is tasked with costly user certificate verification and secret key distribution. In addition, this results in a single-point performance bottleneck in distributed cloud systems. Thus, in this paper, we present a secure Multi-authority CP-ABKS (MABKS) system to address such limitations and minimize the computation and storage burden on resource-limited devices in cloud systems. In addition, the MABKS system is extended to support malicious attribute authority tracing and attribute update. Our rigorous security analysis shows that the MABKS system is selectively secure in both selective-matrix and selective-attribute models. Our experimental results using real-world datasets demonstrate the efficiency and utility of the MABKS system in practical applications.

Ciphertext-Policy Attribute-Based Keyword Search (CP-ABKS) facilitates search queries and supports fine-grained access control over encrypted data in the cloud. However, prior CP-ABKS schemes were designed to support unshared multi-owner setting, and cannot be directly applied in the shared multi-owner setting (where each record is accredited by a fixed number of data owners), without incurring high computational and storage costs. In addition, due to privacy concerns on access policies, most existing schemes are vulnerable to off-line keyword-guessing attacks if the keyword space is of polynomial size. Furthermore, it is difficult to identify malicious users who leak the secret keys when more than one data user has the same subset of attributes. In this paper, we present a privacy-preserving CP-ABKS system with hidden access policy in Shared Multi-owner setting (basic ABKS-SM system), and demonstrate how it is improved to support malicious user tracing (modified ABKS-SM system). We then prove that the proposed ABKS-SM systems achieve selective security and resist off-line keyword-guessing attack in the generic bilinear group model. We also evaluate their performance using real-world datasets.

Federated learning (FL), as a distributed machine learning setting, has received considerable attention in recent years. To alleviate privacy concerns, FL essentially promises that multiple parties jointly train the model by exchanging gradients rather than raw data. However, intrinsic privacy issue still exists in FL, e.g., user’s training samples could be revealed by solely inferring gradients. Moreover, the emerging poisoning attack also poses a crucial security threat to FL. In particular, due to the distributed nature of FL, malicious users may submit crafted gradients during the training process to undermine the integrity and availability of the model. Furthermore, there exists a contradiction in simultaneously addressing two issues, that is, privacy-preserving FL solutions are dedicated to ensuring gradients indistinguishability, whereas the defenses against poisoning attacks tend to remove outliers based on their similarity. To solve such a dilemma, in this paper, we aim to build a bridge between the two issues. Specifically, we present a privacy-enhanced FL (PEFL) framework that adopts homomorphic encryption as the underlying technology and provides the server with a channel to punish poisoners via the effective gradient data extraction of the logarithmic function. To the best of our knowledge, the PEFL is the first effort to efficiently detect the poisoning behaviors in FL under ciphertext. Detailed theoretical analyses illustrate the security and convergence properties of the scheme. Moreover, the experiments conducted on real-world datasets show that the PEFL can effectively defend against label-flipping and backdoor attacks, two representative poisoning attacks in FL.

With the increasingly powerful and extensive deployment of edge devices, edge/fog computing enables customers to manage and analyze data locally, and extends computing power and data analysis applications to network edges. Meanwhile, as the next generation of the power grid, the smart grid can achieve the goal of efficiency, economy, security, reliability, use safety and environmental friendliness for the power grid. However, privacy and secure issues in fog-based smart grid communications are challenging. Without proper protection, customers’ privacy will be readily violated. This article presents a smart and practical Privacy-preserving Data Aggregation (PDA) scheme with smart pricing and packing method for fog-based smart grids, which achieves diversified tariffs, multifunctional statistics and efficiency. Especially, we first propose a smart PDA scheme with Smart Pricing (PDA-SP). With PDA-SP, the Control Center (CC) can compute more complex and higher-order aggregation statistics to provide various services, provide diversiform pricing strategies and choose a double-winning strategy. Subsequently, we put forward a practical PDA scheme with Packing Method (PDA-PM), which is able to reduce the size of encrypted data and improve performance in performing various secure computations. Moreover, we extend our original packing method and present a more useful packing method, which can handle general vectors with large entries. The security analysis shows that our proposed scheme is secure against many threats. The performance evaluation reveals that the computation and communication overheads of our proposed scheme are effectively reduced by employing the Somewhat Homomorphic Encryption (SHE), and our packing method can further significantly reduce these overheads.

The papers in this special section focus on softwarized networking for next generation industrial cyber-physical systems (CPSs). With the emergence of embedded and ubiquitous cyberphysical applications, the rationale of blending the physical and the virtual worlds has become ever promising. These papers examine several topics that are recently concerned in the community, including the software defined architectures and implementations, advanced machine learning and data analytics solutions, blockchain-based network services and applications, network function allocation, dependable and trustable solutions, energy efficient networks and services, and other enabling technologies for integrating softwarized networks into CPSs.

Password-based single-sign-on authentication has been widely applied in mobile environments. It enables an identity server to issue authentication tokens to mobile users holding correct passwords. With an authentication token, one can request mobile services from related service providers without multiple registrations. However, if an adversary compromises the identity server, he can retrieve users' passwords by performing dictionary guessing attacks (DGA) and can overissue authentication tokens to break the security. In this paper, we propose a password-based threshold single-sign-on authentication scheme dubbed PROTECT that thwarts adversaries who can compromise identity server(s), where multiple identity servers are introduced to authenticate mobile users and issue authentication tokens in a threshold way. PROTECT supports key renewal that periodically updates the secret on each identity server to resist perpetual leakage of the secret. Furthermore, PROTECT is secure against off-line DGA: a credential used to authenticate a user is computed from the password and a server-side key. PROTECT is also resistant to online DGA and password testing attacks in an efficient way. We conduct a comprehensive performance evaluation of PROTECT, which demonstrates the high efficiency on the user side in terms of computation and communication and proves that it can be easily deployed on mobile devices.

Outsourced inference service has enormously promoted the popularity of deep learning, and helped users to customize a range of personalized applications. However, it also entails a variety of security and privacy issues brought by untrusted service providers. Particularly, a malicious adversary may violate user privacy during the inference process, or worse, return incorrect results to the client through compromising the integrity of the outsourced model. To address these problems, we propose SecureDL to protect the model’s integrity and user’s privacy in Deep Neural Networks (DNNs) inference process. In SecureDL, we first transform complicated non-linear activation functions of DNNs to low-degree polynomials. Then, we give a novel method to generate sensitive-samples, which can verify the integrity of a model’s parameters outsourced to the server with high accuracy. Finally, We exploit Leveled Homomorphic Encryption (LHE) to achieve the privacy-preserving inference. We shown that our sensitive-samples are indeed very sensitive to model changes, such that even a small change in parameters can be reflected in the model outputs. Based on the experiments conducted on real data and different types of attacks, we demonstrate the superior performance of SecureDL in terms of detection accuracy, inference accuracy, computation, and communication overheads.

Truth Discovery (TD) is to infer truthful information by estimating the reliability of users in crowdsensing systems. To protect data privacy, many Privacy-Preserving Truth Discovery (PPTD) approaches have been proposed. However, all existing PPTD solutions do not consider a fundamental issue of trust. That is, if the data aggregator (e.g., the cloud server) is not trustworthy, how can an entity be convinced that the data aggregator has correctly performed the PPTD? A "lazy" cloud server may partially follow the deployed protocols to save its computing and communication resources, or worse, maliciously forge the results for some shady deals. In this paper, we propose V-PATD, the first Verifiable and Privacy-Aware Truth Discovery protocol in crowdsensing systems. In V-PATD, a publicly verifiable approach is designed enabling any entity to verify the correctness of aggregated results returned from the server. Since most of the computation burdens are carried by the cloud server, our verification approach is efficient and scalable. Moreover, users' data is perturbed with the principles of local differential privacy. Security analysis shows that the proposed perturbation mechanism guarantees a high aggregation accuracy even if large noises are added. Compared to existing solutions, extensive experiments conducted on real crowdsensing systems demonstrate the superior performance of V-PATD in terms of accuracy, computation and communication overheads.

With the wild applications of machine learning (ML) technology, automatic speech recognition (ASR) has made great progress in recent years. Despite its great potential, there are various evasion attacks of ML-based ASR, which could affect the security of applications built upon ASR. Up to now, most studies focus on white-box attacks in ASR, and there is almost no attention paid to black-box attacks where attackers can only query the target model to get output labels rather than probability vectors in audio domain. In this paper, we propose an evasion attack against ASR in the above-mentioned situation, which is more feasible in realistic scenarios. Specifically, we first train a substitute model by using data augmentation, which ensures that we have enough samples to train with a small number of times to query the target model. Then, based on the substitute model, we apply Differential Evolution (DE) algorithm to craft adversarial examples and implement black-box attack against ASR models from the Speech Commands dataset. Extensive experiments are conducted, and the results illustrate that our approach achieves untargeted attacks with over 70% success rate while still maintaining the authenticity of the original data well.

The widespread use of edge devices in E-Health such as smartphones and wearables means richer electronic health records (EHR) are becoming available. Training deep learning models on these data can effectively improve the quality of healthcare services. Recently, federated learning (FL) has received extensive attention in E-Health because it can train a model by only sharing gradients without disclosing the original EHR of owners. In this case, however, the adversary can still violate EHR owners' privacy based on shared gradients. To mitigate privacy threat, several privacy-preserving FL protocols have been proposed by utilizing different cryptography techniques. Unfortunately, existing privacy-preserving FL schemes do not take into account irrelevant updates, which are useless for the convergence of the global model. This may reduce the predictive accuracy and worse may lead to the uselessness of the final model. In this paper, we propose PFL-IU, an efficient and privacy-preserving FL framework that is compatible with irrelevant updates. Specifically, we first design a communication-efficient secure aggregation protocol by using a non-interactive key generation algorithm. Then we present a sign method to mitigate the negative impact incurred by irrelevant updates, which will accelerate model convergence and improve predictive accuracy. Moreover, PFL-IU is robust to EHR owners' dropout during the whole training phase. Extensive experiments using the real-world dataset demonstrate that PFL-IU can achieve better performance in terms of accuracy, convergence and efficiency.

Electronic health records (EHR), generated in healthcare, contain extensive digital information, such as diagnoses, medications and complications. Recently, many studies have focused on constructing deep learning (DL) models with EHR data to improve the quality of healthcare services. However, in traditional centralized training, the collection of EHR causes serious privacy issues due to vulnerable transmission channels and untrusted DL service providers. An alternative that can mitigate the above privacy threat is federated learning (FL). It enables multiple healthcare institutions to learn a global predictive model by exchanging locally calculated updates without disclosing the private dataset. Unfortunately, the latest studies have shown that the local updates still expose sensitive information about the original training data. While several privacy-preserving FL protocols have been proposed, few prior works focused on energy consumption issues. Specifically, local training requires extensive computational resources, which is prohibitively expensive for resource-limited institutions. To overcome the above problems, we propose PRCL, a Privacy-aware and Resource-saving Collaborative Learning protocol. To reduce the local computational overhead, we design a novel model splitting method that partitions the neural network into three parts and outsources the computationally large middle part to cloud servers. By using the lightweight data perturbation and packed partially homomorphic encryption, PRCL protects the privacy of the original data and labels, as well as the parameters of the model. Moreover, we analyze the security of the proposed protocol, and demonstrate the superior performance of PRCL in terms of accuracy and efficiency.

Load profiling is to cluster power consumption data to generate load patterns showing typical behaviors of consumers, and thus it has enormous potential applications in smart grid. However, short-interval readings would generate massive smart meter data. Although cloud computing provides an excellent choice to analyze such big data, it also brings significant privacy concerns since the cloud is not fully trustworthy. In this paper, based on a modified vector homomorphic encryption (VHE), we propose a privacy-preserving and outsourced k-means clustering scheme (PPOk M) for secure load profiling over encrypted meter data. In particular, we design a similarity-measuring method that effectively and non-interactively performs encrypted distance metrics. Besides, we present an integrity verification technique to detect the sloppy cloud server, which intends to stop iterations early to save computational cost. In addition, extensive experiments and analysis show that PPOk M achieves high accuracy and performance while preserving convergence and privacy.

Cloud-based deep learning (DL) solutions have been widely used in applications ranging from image recognition to speech recognition. Meanwhile, as commercial software and services, such solutions have raised the need for intellectual property rights protection of the underlying DL models. Watermarking is the mainstream of existing solutions to address this concern, by primarily embedding pre-defined secrets in a model's training process. However, existing efforts almost exclusively focus on detecting whether a target model is pirated, without considering traitor tracing. In this paper, we present SecureMark_DL, which enables a model owner to embed a unique fingerprint for every customer within parameters of a DL model, extract and verify the fingerprint from a pirated model, and hence trace the rogue customer who illegally distributed his model for profits. We demonstrate that SecureMark_DL is robust against various attacks including fingerprints collusion and network transformation (e.g., model compression and model fine-tuning). Extensive experiments conducted on MNIST and CIFAR10 datasets, as well as various types of deep neural network show the superiority of SecureMark_DL in terms of training accuracy and robustness against various types of attacks.

Machine learning has demonstrated promising application prospects in the field of vehicular technology during the past decade, for instance, it effectively propelled the development of autonomous vehicles and intelligent transportation systems. However, machine learning is still vulnerable to numerous malicious attacks. Amongst them, poisoning attack is one of the most severe security threats to the training process of machine learning, where the attacker injects some poisoned samples to the training dataset to make the learned model unavailable. As the crucial part of poisoning attack is generating poisoned samples, most proposals for poisoning attack have employed traditional gradient-based optimization algorithms to optimize the poisoned samples. Nevertheless, conventional gradient-based optimization algorithms are liable to get trapped in local optimums or saddle points and have a slow rate of convergence. As a result, these problems may lead to a reduction of the poisoned samples' effect. To address these issues, we propose two improved gradient-based poisoning attack algorithms. Specifically, in order to accelerate the convergence speed, we propose the first poisoning attack algorithm by employing momentum algorithm. Also, we propose the second poisoning attack algorithm by utilizing adam algorithm, which can get rid of some local optimums and has a faster convergence speed simultaneously. After that, support vector machines (SVM), linear regression and logistics regression are chosen as exemplary algorithms to conduct our attack algorithms and the effectiveness and computational overhead of the two attack algorithms are evaluated. Finally, we propose a countermeasure algorithm, which can detect suspicious samples using mahalanobis distance.

Fog-cloud computing promises many new vertical service areas beyond simple data communication, storing, and processing. Among them, distributed deep learning (DDL) across fog-cloud computing environment is one of the most popular applications due to its high efficiency and scalability. Compared with the centralized deep learning, DDL can provide better privacy protection with training only on sharing parameters. Nevertheless, when DDL meets fog-cloud computing, it still faces two major security challenges: 1) how to protect users' privacy from being leaked to other internal participants in the training process and 2) how to guarantee users' identities from being forged by external adversaries. To combat them, several approaches have been proposed via various technologies. Nevertheless, those approaches suffer from drawbacks in terms of security, efficiency, and functionality, and cannot guarantee the legitimacy of participants' identities during training. In this article, we propose a secure and privacy-preserving DDL (SPDDL) for fog-cloud computing. Compared with the state-of-the-art works, our proposal achieves a better tradeoff between security, efficiency, and functionality. In addition, our SPDDL can guarantee the unforgeability of users' identities against external adversaries. Extensive experimental results indicate the practical feasibility and high efficiency of our SPDDL.

As a promising data-driven technology, deep learning has been widely employed in a variety of Internet-of-Things (IoT) applications. Examples include automated navigation, telemedicine, and smart home. To protect the data privacy of deep-learning-based IoT applications, a few privacy-preserving approaches have also been exploited, designed, and implemented in various scenarios. However, state-of-the-art works are still defective in accuracy, efficiency, and functionality. In this article, we propose the privacy-aware and asynchronous deep-learning-assisted IoT applications (PADL), a privacy-aware and asynchronous deep learning framework that enables multiple data collecting sites to collaboratively train deep neural networks (DNNs), while keeping the confidentiality of private data to each other. Specifically, we first design a layerwise importance propagation (LIP) algorithm to quantify the importance of the model's weights held by each site. Then, we present the customized perturbation mechanism, a precise combination of the LIP algorithm and differential privacy mechanism, which helps to make optimal tradeoffs between the availability and privacy of local models. Furthermore, to fully use the computing resources of all sites, for the first time, we propose an advanced asynchronous optimization (AAO) protocol to perform global updates without waiting. Theoretical analysis shows that the PADL is robust to extreme collusion even with only one reliable site while supporting lock-free optimization. Finally, extensive experiments conducted on real-world data sets using TensorFlow library show that the PADL outperforms the existing systems in terms of efficiency and prediction accuracy.

The k-nearest neighbors (kNN) classification has been widely used for defective product identification and anomaly detection in the Industrial Internet of Things (IIoT). In this article, we propose a secure and efficient distributed kNN classification algorithm (SEED-kNN) to prevent information and control flow exposure while supporting large-scale data classification on distributed servers. Specifically, we first design a secure and efficient vector homomorphic encryption (VHE) scheme by constructing a key-switching matrix and a noise matrix for data encryption. Based on the designed VHE, SEEDkNN is proposed to efficiently achieve the confidentiality of data flow, kNN query, and class label, while enabling homomorphic operations on the encrypted data. Moreover, by leveraging the Map/Reduce architecture, SEED-kNN enables the kNN classification over the large-scale encrypted data on distributed servers for industrial control systems. Finally, we demonstrate that SEEDkNN achieves semantic security and high classification accuracy, and is applicable in IIoT due to its high efficiency.

In medical cloud computing, a patient can remotely outsource her medical data to the cloud server. In this case, only authorized doctors are allowed to access the data since the medical data is highly sensitive. Before outsourcing, the data is commonly encrypted, where the corresponding secret key is sent to authorized doctors. However, performing searches on encrypted medical data is difficult without decryption. In this paper, we propose two Secure and Efficient Dynamic Searchable Symmetric Encryption (SEDSSE) schemes over medical cloud data. First, we utilize the secure k-Nearest Neighbor (kNN) and Attribute-Based Encryption (ABE) techniques to construct a dynamic searchable symmetric encryption scheme, which can achieve forward privacy and backward privacy simultaneously. These tow security properties are vital and very challenging in the area of dynamic searchable symmetric encryption. Then, we propose an enhanced scheme to solve the key sharing problem which widely exists in the kNN based searchable encryption scheme. Compared with existing proposals, our schemes are better in terms of storage, search and updating complexity. Extensive experiments demonstrate the efficiency of our schemes on storage overhead, index building, trapdoor generating and query.

As an emerging training model with neural networks, federated learning has received widespread attention due to its ability to update parameters without collecting users' raw data. However, since adversaries can track and derive participants' privacy from the shared gradients, federated learning is still exposed to various security and privacy threats. In this paper, we consider two major issues in the training process over deep neural networks (DNNs): 1) how to protect user's privacy (i.e., local gradients) in the training process and 2) how to verify the integrity (or correctness) of the aggregated results returned from the server. To solve the above problems, several approaches focusing on secure or privacy-preserving federated learning have been proposed and applied in diverse scenarios. However, it is still an open problem enabling clients to verify whether the cloud server is operating correctly, while guaranteeing user's privacy in the training process. In this paper, we propose VerifyNet, the first privacy-preserving and verifiable federated learning framework. In specific, we first propose a double-masking protocol to guarantee the confidentiality of users' local gradients during the federated learning. Then, the cloud server is required to provide the Proof about the correctness of its aggregated results to each user. We claim that it is impossible that an adversary can deceive users by forging Proof, unless it can solve the NP-hard problem adopted in our model. In addition, VerifyNet is also supportive of users dropping out during the training process. The extensive experiments conducted on real-world data also demonstrate the practical performance of our proposed scheme.

By leveraging deep learning-based technologies, industrial artificial intelligence (IAI) has been applied to solve various industrial challenging problems in Industry 4.0. However, for privacy reasons, traditional centralized training may be unsuitable for sensitive data-driven industrial scenarios, such as healthcare and autopilot. Recently, federated learning has received widespread attention, since it enables participants to collaboratively learn a shared model without revealing their local data. However, studies have shown that, by exploiting the shared parameters adversaries can still compromise industrial applications such as auto-driving navigation systems, medical data in wearable devices, and industrial robots' decision making. In this article, to solve this problem, we propose an efficient and privacy-enhanced federated learning (PEFL) scheme for IAI. Compared with existing solutions, PEFL is noninteractive, and can prevent private data from being leaked even if multiple entities collude with each other. Moreover, extensive experiments with real-world data demonstrate the superiority of PEFL in terms of accuracy and efficiency.

We propose Chronos+, an accurate blockchain-based time-stamping scheme for outsourced data, where both the storage and time-stamping services are provided by cloud service providers. Specifically, Chronos+integrates a file into a transaction on a blockchain once the file is created, which guarantees the file's latest creation time to be the time when the block containing the transaction is appended to the blockchain. A sufficient number of consecutive blocks that are latest confirmed on the blockchain is embedded into the file at the creation time. These blocks serve as a time-dependent random seed to prove the earliest creation time, due to blockchains' chain quality property. Chronos+makes the file's timestamp corresponding to a time interval formed by the earliest and latest creation times which are derived from the heights of the corresponding blocks. Due to blockchains' chain growth property, such a height-derived timestamp can ensure that the time intervals' range is within a few minutes so as to guarantee the accuracy. We also point out potential threats towards outsourced time-sensitive files and present security analyses to prove that Chronos+is secure against these threats. Comprehensive performance evaluations demonstrate the efficiency and practicality of Chronos+.

Using searchable encryption (SE), users' data can be outsourced to an untrusted server while ensuring privacy of both the queries and the data. Meanwhile, to efficiently support data updating, dynamic SE (DSE) has also been proposed and applied to a variety of scenarios. However, recent work shows that even with little information leakage on updated keywords, most of existing DSE schemes are also vulnerable to adaptative attacks breaking the privacy of the queries. To address this problem, several privacy-preserving DSE have been exploited to mitigate the two major privacy issues in the data update process: i.e., Forward privacy and Backward privacy. Nevertheless, it is still an open problem to support clients multi-keyword-based searching over dynamic cloud data. In reality, as a promising query requirement, it is assurance that the cost of all participants can be fundamentally reduced by implementing multi-keyword-based querying. To combat that, in this paper, we design the first multi-keyword based search proposals ensuring forward and backward privacy over dynamic cloud data. Specifically, we utilize Symmetric Hidden Vector Encryption (SHVE) as the underlying structure to build multi-keyword search protocol. Then, Bloom filter integrating with pseudo-random function will be further adopted to enhance query efficiency. The security analysis proves the high security of our model, and extensive experiments conducted on real-world data also demonstrate the practical performance of our proposed scheme.

As a promising training model with Neural Network, distributed deep learning has been widely applied in various scenarios, where clients and the cloud server work together only by sharing local gradients and global parameters. However, research has shown that the adversary can still reconstruct the users' private information even if little information is leaked. To address this problem, several approaches of privacy-preserving distributed training have been exploited with existing mature technologies, such as Differential Privacy, Secure Multi-party Computation and Homomorphic Encryption. However, state of-the-art results are still defective in security, functionality and efficiency. In this paper, we propose an Efficient Privacy Preserving Scheme (EPPS) for distributed deep learning. We claim that our solution achieves the best performance tradeoff between security, efficiency and functionality. Specifically, we adopt the threshold Paillier encryption as the underlying structure to construct our secure training model. Hence, the confidentiality of honest users' of local gradients can be guaranteed, even the cloud server colluding with multiple users. In addition, since users are often accidentally offline due to either network environment or equipment damage, our EPPS can also support users exiting at any phases of the entire work process. Further more, we conducted extensive experiments on real-world data to demonstrate the preferable performance of our proposed scheme.

Deep learning has been applied in many areas, such as computer vision, natural language processing and emotion analysis. Differing from the traditional deep learning that collects users' data centrally, federated deep learning requires participants to train the networks on private datasets and share the training results, and hence has more gratifying efficiency and stronger security. However, it still presents some privacy issues since adversaries can deduce users' privacy from local outputs, such as gradients. While the problem of private federated deep learning has been an active research issue, the latest research findings are still inadequate in terms of security, accuracy and efficiency. In this paper, we propose an efficient and privacy-preserving federated deep learning protocol based on stochastic gradient descent method by integrating the additively homomorphic encryption with differential privacy. Specifically, users add noises to each local gradients before encrypting them to obtain the optical performance and security. Moreover, our scheme is secure to honest-but-curious server setting even if the cloud server colludes with multiple users. Besides, our scheme supports federated learning for large-scale users scenarios and extensive experiments demonstrate our scheme has high efficiency and high accuracy compared with non-private model.

Recent years have witnessed tremendous academic efforts and industry growth in machine learning. The security of machine learning has become increasingly prominent. Poisoning attack is one of the most relevant security threats to machine learning which focuses on polluting the training data that machine learning needs during the training process. Specifically, the attacker blends crafted poisoning samples into training data in order to make the learned model beneficial to him. To the best of our knowledge, existing researches about poisoning attack focused on either integrity attack or availability attack, which did not unify these two attacks together. Aside from that, from the attacker's perspective, attacker's strategy is not flexible enough. Finally, existing proposals only concentrated on increasing the test error of the learned model but ignored the importance of the concealment of attack. To overcome these issues, we firstly present a thorough adversarial model for poisoning attack in which attacker's strategy is defined from two aspects, i.e., the effect of attack and the concealment of attack. Then we unify integrity attack and availability attack together in similar formulations. Furthermore, in order to enhance flexibility, a tradeoff parameter is inserted into attacker's objective function which means the attacker can balance the attraction of effect against the requirement of concealment. Finally, as examples, extensive experiments are conducted on linear regression and logistic regression to demonstrate the effectiveness of attack.

With the increasing network traffic volume in the big data era, enterprises have paid significant attentions on outsourcing middlebox services to the public cloud. While offering appealing benefits, including network resource scalability and management cost reduction, it also raises severe privacy and security issues, such as the exposure of packet payload and middlebox rules. Since the traffic is redirected to cloud server, the exposure of packet payload and middlebox rule becomes inevitable. Simply encrypting the traffic can mitigate this problem at the cost of sacrificing data utility, which poses great challenges on deep packet inspection. In this paper, an efficient and secure Deep Packet Inspection (DPI) scheme is proposed based on non-collusion two cloud servers to enable data utility, while protecting the packet payload and middlebox rules. We leverage encrypted Matryoshka filter and T-set to process DPI. Since both the middlebox rule and packet payload are encrypted, cloud server cannot breach the confidentiality of them. We also build a secure hash chain to prevent the leakage of token order information. Extensive experiments demonstrate that proposed scheme performances better in terms of packet processing, rule preparation and rule matching.

It is common to certify when a file was created in digital investigations, e.g., determining first inventors for patentable ideas in intellectual property systems to resolve disputes. Secure time-stamping schemes can be derived from blockchain-based storage to protect files from backdating/forward-dating, where a file is integrated into a transaction on a blockchain and the timestamp of the corresponding block reflects the latest time the file was created. Nevertheless, blocks' timestamps in blockchains suffer from time errors, which causes the inaccuracy of files' timestamps. In this paper, we propose an accurate blockchain-based time-stamping scheme called Chronos. In Chronos, when a file is created, the file and a sufficient number of successive blocks that are latest confirmed on blockchain are integrated into a transaction. Due to chain quality, it is computationally infeasible to pre-compute these blocks. The time when the last block was chained to the blockchain serves as the earliest creation time of the file. The time when the block including the transaction was chained indicates the latest creation time of the file. Therefore, Chronos makes the file's creation time corresponding to this time interval. Based on chain growth, Chronos derives the time when these two blocks were chained from their heights on the blockchain, which ensures the accuracy of the file's timestamp. The security and performance of Chronos are demonstrated by a comprehensive evaluation.

Cloud-assisted Internet of Things (IoT) is increasingly prevalent in our society, for example in home and office environment; hence, it is also known as cloud-assisted Internet of Everything (IoE). While in such a setup, data can be easily shared and disseminated (e.g., between a device, such as Amazon Echo and the cloud, such as Amazon AWS), there are potential security considerations that need to be addressed. Thus, a number of security solutions have been proposed. For example, searchable encryption (SE) has been extensively studied due to its capability to facilitate searching of encrypted data. However, threat models in most existing SE solutions rarely consider the malicious data owner and semi-trusted cloud server at the same time, particularly in dynamic applications. In a real-world deployment, disputes between above two parties may arise as either party will accuse the other of some misbehavior. Furthermore, efficient full-update operations (e.g., data modification, data insertion, and data deletion) are not typically supported in the cloud-assisted IoE deployment. Therefore, in this paper, we present a fair and dynamic data sharing framework (FairDynDSF) in the multiowner setting. Using FairDynDSF, one can check the correctness of search results, achieve fair arbitration, multikeyword search, and dynamic update. We also prove that FairDynDSF is secure against inside keyword guessing attack and demonstrate its efficiency by evaluating its performance using various datasets.

Ciphertext-policy attribute-based keyword search (CP-ABKS) schemes facilitate the fine-grained keyword search over encrypted data, such as those sensed/collected from Industrial Internet of Things (IIoT) devices and stored in the cloud. However, existing CP-ABKS schemes generally have significant computation and storage requirements, which are beyond those of resource-constrained IIoT devices. Therefore, in this paper, we design a secure online/offline data sharing framework (DSF), which supports online/offline encryption and outsourced decryption. Using the healthcare setting as a case study, we demonstrate how DSF can be deployed in the cloud-assisted Healthcare IIoT (HealthIIoT) system. We not only prove that the DSF is selectively secure in the chosen access structure security model but also demonstrate its efficiency and feasibility in practical scenarios using experiments.

Sleep monitoring has drawn increasing attention as sleep quality is important to maintain a person's well-being. For instance, serious health problems, such as cardiovascular disease, fatigue, or depression, are usually associated with inadequate and irregular sleep. Traditional sleep monitoring systems involve wearable sensors with professional installation, and thus are usually limited to clinical usage. Recent work for sleep monitoring can detect several sleep events, such as coughing and snoring, using smartphone sensors. However, such coarse-grained sleep monitoring is unable to detect the breathing rate which is an important health indicator. In this paper, we present a fine-grained sleep monitoring system to detect the breathing rate and sleep events simultaneously by leveraging smartphones. Our system exploits the readily available smartphone earphone placed close to the user to reliably capture the human breathing sound. Given the captured acoustic sound, noise reduction is performed to remove the environmental noise and the breathing rate is then identified based on the signal envelope detection. Our system can further detect some sleep events, including snoring, coughing, turning over, and getting up, based on the features extracted from the acoustic sound. Moreover, we develop a body movement-assisted sleep event detection method to provide higher detection accuracy by further exploiting the user's body movement patterns captured by the accelerometer embedded on smartphones. Our extensive experiments involving nine subjects over six months confirm the effectiveness of our proposed system on breathing rate monitoring and sleep events detection under various environments. By combining breathing rate and sleep events, our system can provide noninvasive and continuous fine-grained sleep monitoring for healthcare related applications, such as sleep apnea monitoring, as evidenced by our experimental study.

As the heart of next-generation air transportation systems, the automatic dependent surveillance-broadcast (ADS-B) is becoming a substitute for the radar, because it can enhance flight safety by requiring aircraft to regularly broadcast their precise geographic positions. Despite its promise, the lack of security mechanisms, e.g., not providing data encryption and message authentication, is a significant barrier to realistically deploy this new technology. While many methods have been proposed for ADS-B security, they can deal with either privacy or integrity unilaterally, and also need to change current ADS-B standards. In this paper, we present a new cryptographic solution to ADS-B security by first carefully exploiting some cryptographic primitives, and then adapting them to the air traffic-monitoring scenario. In contrast to previous approaches, our proposed solution is not only of high compatibility with existing protocols of ADS-B, but also lightweight for congested data links and resource-constraint avionics. Furthermore, it can also tolerate package loss and disorder that frequently occur in ADS-B wireless broadcast networks, making the proposed solution easy-to-deploy and practical. Security analysis shows that our proposal simultaneously achieves the confidentiality and authenticity of ADS-B messages. In addition, performance evaluation also demonstrates the efficiency of communication and computation for the proposal by using flight data of OpenSky-a sensor network that covers Central Europe aiming at gathering ADS-B flight data. Finally, the deployment in a real airport environment also proves the effectiveness of our solution.

As a basic query function, range query has been exploited in many scenarios such as SQL retrieves, location-based services, and computational geometry. Meanwhile, with explosive growth of data volume, users are increasingly inclining to store data on the cloud for saving local storage and computational cost. However, a long-standing problem is that the user's data may be completely revealed to the cloud server because it has full data access right. To cope with this problem, a frequently-used method is to encrypt raw data before outsourcing them, but the availability and operability of data will be reduced significantly. In this paper, we propose an efficient and geometric range query scheme (EGRQ) supporting searching and data access control over encrypted spatial data. We employ secure KNN computation, polynomial fitting technique, and order-preserving encryption to achieve secure, efficient, and accurate geometric range query over cloud data. Then, we propose a novel spatial data access control strategy to refine user's rights in our EGRQ. To improve the efficiency, R-tree is adopted to reduce the searching space and matching times in whole search process. Finally, we theoretically prove the security of our proposed scheme in terms of confidentiality of spatial data, privacy protection of index and trapdoor, and the unlinkability of trapdoors. In addition, extensive experiments demonstrate the high efficiency of our proposed model compared with existing schemes.

Equipped with the emerging cloud computing, clients prefer to outsource the increasing number of Industrial Internet of things (IIoT) data to cloud to reduce the high storage and computation burden. However, existing searchable encryption (SE) schemes just apply to IIoT records containing textual keyword fields rather than both digital and textual keyword ones. Besides, the key management issue still impedes the practicality and availability of SE schemes due to high key storage overhead. To this end, we present an outsourced Hybrid Keyword-Field Search over encrypted data with efficient Keys Management (HKFS-KM) scheme by utilizing the relevance score function and keyed hash tree. Formal security analysis proves that the HKFS-KM scheme can achieve keyword privacy and trapdoor unlinkability in both known ciphertexts attack model and known background attack model. Experimental results using real-world dataset show its efficiency and practicality in practice.

Fog computing, as an extension of cloud computing, outsources the encrypted sensitive data to multiple fog nodes on the edge of Internet of Things (IoT) to decrease latency and network congestion. However, the existing ciphertext retrieval schemes rarely focus on the fog computing environment and most of them still impose high computational and storage overhead on resource-limited end users. In this paper, we first present a Lightweight Fine-Grained ciphertexts Search (LFGS) system in fog computing by extending Ciphertext-Policy Attribute-Based Encryption (CP-ABE) and Searchable Encryption (SE) technologies, which can achieve fine-grained access control and keyword search simultaneously. The LFGS can shift partial computational and storage overhead from end users to chosen fog nodes. Furthermore, the basic LFGS system is improved to support conjunctive keyword search and attribute update to avoid returning irrelevant search results and illegal accesses. The formal security analysis shows that the LFGS system can resist Chosen-Keyword Attack (CKA) and Chosen-Plaintext Attack (CPA), and the simulation using a real-world dataset demonstrates that the LFGS system is efficient and feasible in practice.

We design a Practical and Privacy-Aware Truth Discovery (PPATD) approach in mobile crowd sensing systems, which supports users to go offline at any time while still achieving practical efficiency under working process. More notably, our PPATD is the first solution under single server setting to resolve the problem that users must be online at all times during the truth discovery. Moreover, we design a double-masking with one-time pads protocol to further ensure the strong security of users' privacy even if there is a collusion between the cloud server and multiple users.

Traditional centralized PKIs are vulnerable due to the single point of failure. A feasible solution is to build a decentralized PKI without certificate authority (CA). Web of Trust is the first step toward realizing a decentralized PKI, but it still has some limitations such as missing incentive and leaking user's privacy. Blockchain's numerous desirable properties, such as cryptographical security, decentralized nature and unalterable transaction record, make it a suitable tool to implement a decentralized PKI. However, the latest research findings about blockchain-based PKI are still incompatible with the thin-clients which have limited storage ability to download the entire blockchain. To combat that, we firstly present a Privacy-preserving Thin-client Scheme (PTS) utilizing the idea of k-anonymity, which enables thin-clients to run normally as full node users and protect user's privacy simultaneously. After that, in order to reduce cost, we further propose an Efficient Privacy preserving Thin-client Scheme (EPTS) employing the method of PIR (private information retrieval). Then security analysis and functional comparison are performed to demonstrate the high security and comprehensive functionality of EPTS compared with existing schemes. Finally, extensive experiments are undertaken to confirm that EPTS can reduce computational cost and communication cost impressively.

Cellular vehicle-to-everything (C-V2X) in 5G enables device-to-device (D2D) group communications to support a variety of proximity-based services. While D2D group communication can improve mobile network spectrum efficiency and user experience by offloading local traffic and extending the coverage of cellular base stations, it has also raised new privacy challenges on balancing UE anonymity and message linkability. In this paper, we first identify the limitations of current standardization and literature on addressing this issue. Then, we design a Service-oriented Authentication Framework (SAF) that supports secure service delegation and anonymous message authentication. Specifically, a UE-controlled linking method is introduced to support adaptive linkability for different V2X use cases. Security analysis demonstrates the SAF is secure under cryptographic assumptions. Moreover, we conduct extensive simulations based on Vissim and NS3 to show that the SAF is more efficient compared with the state-or-art literature and is feasible for 3GPP standardized V2X group communications.

Range search of spatial data, has been applied in many scenarios such as geometric queries, location-based services, and computational geometry, etc. Due to the increasing amount of spatial data, which are usually outsourced to the cloud for saving storage and computational overhead. However, a common privacy issue is that the cloud server may steal user's sensitive information utilizing its powerful computing advantages. A feasible way of managing this bottleneck is to encrypt spatial data before outsourcing it. Nevertheless, the availability of data will be significantly reduced because of the query difficulty over the encrypted cloud data. In this paper, we propose an Efficient Range Search scheme (EFRS) which can achieve fine- grained query over encrypted spatial data. We original contributions are threefold. First, polynomial fitting technique and orderpreserving encryption are introduced to realize the efficient and fine- grained range query over encrypted cloud data. Then, in order to improve the search efficiency, we exploit the Rtree to significantly decreased the search space. Finally, we theoretically proved the security of our proposed scheme in terms of confidentially of spatial data, privacy protection of index and trapdoor, and the unlinkability of trapdoor. Besides, extensive experiments demonstrate the high efficiency of our proposed model compared with existing schemes.

Thek-nearest neighbor (kNN) classification has been widely adopted in data mining applications. In the age of big data,kNN classification process has to be outsourced to the cloud. However, as data may contain sensitive information, outsourcing data services directly to public clouds inevitably raises privacy concerns. To ensure the privacy of data, it is a well- known method to encrypt them prior to uploading to the cloud, which also brings great challenges to effectivekNN classification. Homomorphic encryption (HE) allows operations on encrypted data, which provides a viable solution tokNN classification over encrypted data. However, existing works using HE to enable securekNN classification all encrypt data attribute-wise that are limited by classification efficiency. In this paper, we designed an efficient and securekNN classification protocol over encrypted data using vector HE, namely ESkNNC, which could encrypt data record-wise. Security analysis shows that ESkNNC achieves function secrecy, besides confidentiality of data, confidentiality of query record, and hiding data access patterns. Compared withkNN classification techniques over plaintexts, ESkNNC achieves the same 98% accuracy with the precision of 2 digits. Furthermore, we propose a batching method of test data that significantly saves communication cost up to 90%.

Vehicle-to-Everything (V2X) assisted proximity marketing is one of the most promising V2X services due to its huge potential, and has attracted a lot of research efforts recently. In proximity marketing, roadside merchants rely on third-party ad networks to target their advertisements to nearby vehicles or pedestrians with related interests, and pay ad networks according to some pricing mechanisms, such as cost per-view. It is therefore important for merchants to learn ad conversion rate (how much of their revenue can be attributed to proximity marketing) such that merchants can adjust their advertising strategy. For ad conversion, two-party private set intersection (PSI) technique has been widely adopted, where ad networks and merchants can jointly compute ad conversion rate without leaking sensitive customer information. However, state-of-art literature on PSI either assumes the involved two parties honestly follow the protocol or only tolerates limited adversarial behaviors. In this paper, we first design a novel and efficient PSI scheme that is secure in the presence of malicious adversaries, where two parties can arbitrarily deviate from the scheme. By integrating an efficient input certification mechanism into the designed PSI scheme, we propose a privacy-preserving ad conversion protocol for V2X-assisted proximity marketing, that can achieve input privacy, unlinkability, unforgeability, and output verifiability. Security analysis demonstrates that the proposed ad conversion protocol is secure under cryptographic assumptions. Finally, we show that the proposed ad conversion protocol outperforms the state-of-art approaches when considering both security strength and computation complexity.

In recent years, the rapid development of Internet of Things (IoT) and big data shows the huge demand of outsourcing computing in cloud computing to assist some clients with low ability devices to fulfill massive data processing. In the mean time, considering the uncertainty of the Internet devices, we should persist security and high-efficiency. Uploaded data and returned results should be protected from attack of adversary, which guarantees the security, while efficiency requires low overhead of clients to finish the whole calculation procedure. In this paper, we main focus on the public verifiable outsourcing scheme on matrix multiplication, which can be applied in many IoT scenes, such as path planning and aggregation operation in Internet of Vehicles and smart grids, respectively. Specially, this paper presents schemes for two different functions of matrix multiplication, which strengthens the applicability. Moreover, security analysis and performance evaluation in this paper properly present the superiority of this paper.

In this paper, we analyze the inherent characteristic of electronic medical records (EMRs) from actual electronic health (eHealth) systems, where we found that first, multiple patients would generate large amounts of duplicate EMRs and second, cross-patient duplicate EMRs would be generated numerously only in the case that the patients consult doctors in the same department. We then propose the first efficient and secure encrypted EMRs deduplication scheme for cloud-assisted eHealth systems (HealthDep). With the integration of our analysis results, HealthDep allows the cloud server to efficiently perform the EMRs deduplication, and enables the cloud server to reduce storage costs by more than 65% while ensuring the confidentiality of EMRs. Security analysis shows that HealthDep provides a stronger security guarantee than Marforio et al.'s scheme (NDSS 2014) and Bellare et al.'s scheme (USENIX Security 2013). Algorithm implementation and performance analysis demonstrate the feasibility and high efficiency of HealthDep.

In cloud computing, outsourcing computation , as an economically promising paradigm, enables clients with limited computing resources to delegate intensive tasks to the powerful cloud server. Nevertheless, outsourcing the involved data without encryption to public brings a high risk of revealing the confidential information of the client, and no matter the returned results from server are valid or not. Due to the low trustiness of the server, it is crucial to guarantee both the security and efficiency in delegation. Motivated by those challenges, a rapidly-growing body of research mostly focuses on how to delegate mostly utilizing a feasible mechanism-verifiable computation, where the server returns results along with corresponding verification proofs. In this paper, we propose an efficient and privacyprotected delegation scheme for matrix multiplication (EPPDMM) of amortized model. EPP-DMM can realize efficient public verification together with sensitive protected data. Security analysis proves the reliability and security of our scheme, while performance evaluation presents the efficiency compared with other schemes.

In big data era, data are usually stored in databases for easy access and utilization, which are now woven into every aspect of our lives. However, traditional relational databases cannot address users' demands for quick data access and calculating, since they cannot process data in a distributed way. To tackle this problem, non-relational databases such as MongoDB have emerged up and been applied in various Scenarios. Nevertheless, it should be noted that most MongoDB products fail to consider user's data privacy. In this paper, we propose a practical encrypted MongoDB (i.e., CryptMDB). Specifically, we utilize an additive homomorphic asymmetric cryptosystem to encrypt user's data and achieve strong privacy protection. Security analysis indicates that the CryptMDB can achieve confidentiality of user's data and prevent adversaries from illegally gaining access to the database. Furthermore, extensive experiments demonstrate that the CryptMDB achieves better efficiency than existing relational database in terms of data access and calculating.

With the rapid development of smart grid, smart meters are deployed at energy consumers' premises to collect real-time usage data. Although such a communication model can help the control center of the energy producer to improve the efficiency and reliability of electricity delivery, it also leads to some security issues. For example, this real-time data involves the customers' privacy. Attackers may violate the privacy for house breaking, or they may tamper with the transmitted data for their own benefits. For this purpose, many data aggregation schemes are proposed for privacy preservation. However, rare of them cares about both the data aggregation and fine- grained access control to improve the data utility. In this paper, we proposes a data aggregation scheme based on attribute decision tree. Security analysis illustrates that our scheme can achieve the data integrity, data privacy preservation and fine- grained data access control. Experiment results show that our scheme are more efficient than existing schemes.

Internet of Things (IoT) and big data are two of the most-talked-about technology topics in recent years, and they are clearly intimately connected, i.e., billions of Internet-connected “things” will generate massive amounts of data, and open up many opportunities in our lives. It is predicted that, by 2020, there will be 50 to 100 billion devices connected to the Internet, and these devices will be capable of generating big data in need of analysis to enhanced decision making, insight discovery, and process optimization. As a result, IoT and big data have the potential to revolutionize the whole telecommunication industry.

Cloud storage services allow users to outsource their data to cloud servers to save local data storage costs. However, unlike using local storage devices, users do not physically manage the data stored on cloud servers; therefore, the data integrity of the outsourced data has become an issue. Many public verification schemes have been proposed to enable a third-party auditor to verify the data integrity for users. These schemes make an impractical assumption-the auditors have enough computation capability to bear expensive verification costs. In this paper, we propose a novel public verification scheme for the cloud storage using indistinguishability obfuscation, which requires a lightweight computation on the auditor and the delegate most computation to the cloud. We further extend our scheme to support batch verification and data dynamic operations, where multiple verification tasks from different users can be performed efficiently by the auditor and the cloud-stored data can be updated dynamically. Compared with other existing works, our scheme significantly reduces the auditor's computation overhead. Moreover, the batch verification overhead on the auditor side in our scheme is independent of the number of verification tasks. Our scheme could be practical in a scenario, where the data integrity verifications are executed frequently, and the number of verification tasks (i.e., the number of users) is numerous; even if the auditor is equipped with a low-power device, it can verify the data integrity efficiently. We prove the security of our scheme under the strongest security model proposed by Shi et al. (ACM CCS 2013). Finally, we conduct a performance analysis to demonstrate that our scheme is more efficient than other existing works in terms of the auditor's communication and computation efficiency.

With the rapid development of portable mobile devices, crowd sensing systems have been recognized as a key technology to utilize the data collected by the portable mobile devices towards scalable and flexible mobile services. However, since the information provided by devices may not be reliable, the aggregated results of the collected data may not be accurate. To tackle this challenge, various truth discovery schemes have been proposed. On the other hand, a practical issue of privacy protection is not considered in most existing truth discovery schemes. In this paper, we propose an Efficient Privacy-preserving Truth Discovery (EPTD) in Crowd Sensing Systems, which can protect the privacy of users' observed values and weights in truth discovery process. Finally, we show the performance of our scheme is better than existing models in terms of computation overhead.

With development of outsourcing computation, it is possible for clients with limited computing resources to outsource heavy computational tasks to the cloud server and thus relieve huge burden of the client. As continuous attention of delegation in recent years, requirements of security and efficiency are badly concerned undoubtedly, especially for matrix multiplication. Considering wide applications of matrix multiplication, e.g. graph processing and large date processing, in this paper, we present an identity-based publicly verifiable delegation scheme in amortized model which meets the need of security and efficiency both. Moreover, by using an secure encryption algorithm and a verification certification, the security analysis of the proposed scheme demonstrates the privacy of matrixes involved and the correctness. To demonstrate efficient properties, we compared our scheme with some existing works in terms of functionality as well as computation, storage and communication overhead.

Data-driven solutions to Electric Vehicle (EV) range estimation is attracting attention recently due to the prevalence of Internet of Things (IoT). However, there raise the Big Data problems with the increased volume and number of sensory sources of unstructured data collected from the EV equipped with In-Vehicle Networks. This means that traditional statistical analysis and Machine Learning tools are not suitable to be directly applied to analyse and interpret data. Hence, we aim to develop a Hybrid Machine Learning Model to predict the power consumption of EV trips practically considering multivariate high- dimensional data and meanwhile extract knowledge from the historical trip features for further applications. The proposed Hybrid Model is a modified Self-Organizing Maps (SOM) integrating Regression Trees (RT) to predict the power consumption of EV trips. The experimental results, including both cross-validation and mathematical accuracy measuring criteria, demonstrate that our Hybrid Model could not only provide a better power consumption estimation of EV trips but also reveal the inherent of the EV Big Data.

To preserve privacy, sensitive data in cloud computing needs to be encrypted before outsourcing, which obstacles data utilization based on plaintext search. Thus there spring up several secure schemes which enable encrypted cloud-data search. However, these single-cloud-supported search schemes would suffer from service failure, inefficient application, and privacy problem when they are applied to the multi-cloud applications. In this paper, we propose a Privacy-preserving Similarity Search scheme termed PSS. We exploit the n-grams method and counting bloom filters to define and compute the keyword-order. Based on this order, all indexing elements could be organized in a Chord-ring to support multi-cloud similarity search with high efficiency. Moreover, we extend the prefix technique to obtain strong privacy protection. Finally, a proof for the non-adaptive semantic security and the chosen-keyword attack resistance of PSS is given. Extensive experiments on real-world dataset further confirm the high efficacy and efficiency of PSS scheme.

With the growing popularity of outsourcing data and services to the cloud, performing queries on encrypted data becomes a promising technique. Searchable encryption (SE) allows encryption while still enabling search for a variety of data. However, most of the existing arts focus on rectangular range query on common database. Query on encrypted spatial database has not been well studied. Moreover, as a vital type of geometric query on spatial data, the circular range search (CRS) is widely utilized in Location-Based Services (LBSs) and computational geometry. A recently proposed CRS scheme achieved security and privacy requirements. However, it exhibits low performance in terms of encryption and search efficiency. In this paper, we propose an Efficient Privacy-preserving CRS scheme (EP-CRS) on outsourced spatial data. Specifically, our scheme achieves CRS by leveraging an R-tree based SE scheme and adding a trusted-third party (TTP) to system. Security analysis indicates that EP-CRS can preserve data and query privacy. In addition, we conduct real experiments and compare EP-CRS with the existing one to show that the proposal is more efficient in terms of data encryption, token generation and search.

Using cloud computing, individuals can store their data on remote servers and allow data access to public users through the cloud servers. As the outsourced data are likely to contain sensitive privacy information, they are typically encrypted before uploaded to the cloud. This, however, significantly limits the usability of outsourced data due to the difficulty of searching over the encrypted data. In this paper, we address this issue by developing the fine-grained multi-keyword search schemes over encrypted cloud data. Our original contributions are three-fold. First, we introduce the relevance scores and preference factors upon keywords which enable the precise keyword search and personalized user experience. Second, we develop a practical and very efficient multi-keyword search scheme. The proposed scheme can support complicated logic search the mixed “AND”, “OR” and “NO” operations of keywords. Third, we further employ the classified sub-dictionaries technique to achieve better efficiency on index building, trapdoor generating and query. Lastly, we analyze the security of the proposed schemes in terms of confidentiality of documents, privacy protection of index and trapdoor, and unlinkability of trapdoor. Through extensive experiments using the real-world dataset, we validate the performance of the proposed schemes. Both the security analysis and experimental results demonstrate that the proposed schemes can achieve the same security level comparing to the existing ones and better performance in terms of functionality, query complexity and efficiency.

With the growing popularity of cloud computing, outsourced computing has attracted much research effort recently. A computationally weak client is capable of delegating its heavy computing tasks, such as large matrix multiplications, to the cloud server. Critical requirements for such tasks include the need to guarantee the unforgeability of computing results and the preservation of the privacy of clients. On one hand, the result computed by the cloud server needs to be verified since the cloud server cannot be fully honest. On the other hand, as the data involved in computing may contain some sensitive information of the client, the data should not be identified by the cloud server. In this paper, we address these above issues by developing an Efficient and Secure Outsourcing scheme for Large Matrix Multiplication, named ESO- LMM. Security analysis demonstrates that ESO-LMM achieves the security requirements in terms of unforgeability of proof and privacy protection of outsourced data. Furthermore, performance evaluation indicates that ESO-LMM is much more efficient compared with the existing works in terms of computation, communication and storage overhead.

E-health data release, which answers the statistical queries of the Electronic Health Records (EHRs), has been widely adopted in modern health care services. However, since the EHRs contain sensitive information of the patients, the data release procedure may lead to the leakage of the privacy of patients if it is done without necessary protection measures in place. On addressing this, existing research literature introduces differential privacy to provide the necessary privacy guarantee. However, it is not suitable in sensitive e-health environments because it lacks the efficiency for data processing and updating. In this paper, we propose an efficient e-health data release scheme with consistency guarantee under differential privacy. Specifically, we improve the performance of the previous work by designing a new private partition algorithm of histogram and also proposing a heuristic hierarchical query method. We conduct real experiments and compare our scheme with the existing one to show that the proposal is more efficient in terms of data processing and updating. Moreover, we increase the accuracy of data release through consistency and give proof of privacy to show that the proposed algorithm is under ϵ-differential privacy.

In cloud computing, it is important to protect user data. Thus, data owners usually encrypt their data before outsourcing them to the cloud server for security and privacy concerns. At the same time, very often users need to find data for specific keywords of interest to them. This motivates the research on the searchable encryption technique, which allows the search user to search over the encrypted data. Many mechanisms have been proposed, and are mainly focusing on the symmetric searchable encryption (SSE) technique. However, they do not consider the search authorization problem that requires the cloud server only to return the search results to authorized users. In this paper, we propose an authorized and ranked multi-keyword search scheme (ARMS) over encrypted cloud data by leveraging the ciphertext policy attribute-based encryption (CP-ABE) and SSE techniques. Security analysis demonstrates that the proposed ARMS scheme can achieve confidentiality of documents, trapdoor unlinkability and collusion resistance. Extensive experiments show that the ARMS is more superior and efficient than existing approaches in terms of functionalities and computational overhead.

Cyber-physical-social system (CPSS) allows individuals to share personal information collected from not only cyberspace but also physical space. This has resulted in generating numerous data at a user's local storage. However, it is very expensive for users to store large data sets, and it also causes problems in data management. Therefore, it is of critical importance to outsource the data to cloud servers, which provides users an easy, cost-effective, and flexible way to manage data, whereas users lose control on their data once outsourcing their data to cloud servers, which poses challenges on integrity of outsourced data. Many schemes have been proposed to allow a third-party auditor to verify data integrity using the public keys of users. Most of these schemes bear a strong assumption: the auditors are honest and reliable, and thereby are vulnerability in the case that auditors are malicious. Moreover, in most of these schemes, an auditor needs to manage users certificates to choose the correct public keys for verification. In this paper, we propose a secure certificateless public integrity verification scheme (SCLPV). The SCLPV is the first work that simultaneously supports certificateless public verification and resistance against malicious auditors to verify the integrity of outsourced data in CPSS. A formal security proof proves the correctness and security of our scheme. In addition, an elaborate performance analysis demonstrates that the SCLPV is efficient and practical. Compared with the only existing certificateless public verification scheme (CLPV), the SCLPV provides stronger security guarantees in terms of remedying the security vulnerability of the CLPV and resistance against malicious auditors. In comparison with the best of integrity verification scheme achieving resistance against malicious auditors, the communication cost between the auditor and the cloud server of the SCLPV is independent of the size of the processed data, meanwhile, the auditor in the SCLPV does not need to manage certificates.

With the development of cloud computing, data sharing has a new effective method, i.e., outsourced to cloud platform. In this case, since the outsourced data may contain privacy, they only allow to be accessed by the authorized users. Encrypting the data before outsourcing is a commonly used approach, where the data owners only need to send the corresponding encryption key to the authorized users. However, in such approach it is difficult to use the data since the encrypted data obsoletes comprehensive search functionalities of plaintext keyword search. In this paper, we leverage the secure k-nearest neighbor to propose a secure dynamic searchable symmetric encryption scheme. Our scheme can achieve two important security features, i.e., forward privacy and backward privacy which are very challenging in Dynamic Searchable Symmetric Encryption (DSSE) area. In addition, we evaluate the performance of our proposed scheme compared with other DSSE schemes. The comparison results demonstrate the efficiency of our proposed scheme in terms of the storage, search and update complexity.

In smart grid, control center collects and aggregates users' electricity data via the smart meters. The aggregated data is also of great use for markets. To efficiently and securely distribute these data to markets, the existing schemes use Attribute-based Encryption (ABE) technique to achieve privacy preservation of sensitive data and fine-grained access control. However, the efficient attribute revocation problem has not been studied well. In this paper, leveraging the Third Party Auditor and Ciphertext-Policy ABE techniques, we propose a Multi-Authority Access Control with Efficient Attribute Revocation (MAAC-AR) scheme in smart grid. Security analysis demonstrates that MAAC-AR can achieve fine-grained access control, collusion resistance, privacy preservation and secure attribute revocation. Performance evaluation shows that MAAC-AR is more efficient compared with the existing schemes in terms of functionality as well as computation, communication and storage overhead.

With the in-depth study of smart grid, energy auction attracts a lot of attention due to its economic benefits. Many schemes have been proposed to support energy auction in smart grid. However, few of them achieve range query and ranked search. In this paper, we propose a ranked range query (RRQ) scheme, which can support both range query and ranked search. Based on the homomorphic Paillier cryptosystem, we use two super-increasing sequences to aggregate multidimensional keywords. The first one is used to aggregate one buyer's or seller's multidimensional keywords to an aggregated number. The second one is used to create a summary number by aggregating the aggregated numbers of all sellers. As a result, the comparison between the keywords of all sellers and those of one buyer can be achieved with only one calculation, and further we use the comparison result to achieve range query and ranked search. Security analysis demonstrates that RRQ can achieve confidentiality of keywords, authentication, data integrity and query privacy. Performance evaluation shows RRQ's efficiency in terms of computation and communication overhead.

Distributed energy resources DERs, which are characterized by small-scale power generation technologies to provide an enhancement of the traditional power system, have been strongly encouraged to be integrated into the smart grid, and numerous trading strategies have recently been proposed to support the energy auction in the emerging smart grid marketing. However, few of them consider the security aspects of energy trading, such as privacy preservation, bid integrity, and pre-filtering ability. In this paper, we propose an efficient searchable encryption scheme for auction SESA in emerging smart grid marketing. Specifically, SESA uses a public key encryption with keyword search technique to enable the energy sellers e.g., DERs to inquire suitable bids while preserving the privacy of the energy buyers. Additionally, to facilitate the seller to search for detailed information of the bids, we also propose an extension of SESA to support conjunctive keywords search. Security analysis demonstrates that the proposed SESA and its extension can achieve data and keyword privacy, bid integrity and trapdoor unforgeability. Simulation results also show that both SESA and its extension have less computation and communication overhead than the existing searchable encryption approaches. Copyright © 2013 John Wiley & Sons, Ltd.

Smart grid has recently emerged as the next generation of power grid due to its distinguished features, such as distributed energy control, robust to load fluctuations, and close user-grid interactions. As a vital component of smart grid, demand response can maintain supply-demand balance and reduce users' electricity bills. Furthermore, it is also critical to preserve user privacy and cyber security in smart grid. In this paper, we propose an efficient privacy-preserving demand response (EPPDR) scheme which employs a homomorphic encryption to achieve privacy-preserving demand aggregation and efficient response. In addition, an adaptive key evolution technique is further investigated to ensure the users' session keys to be forward secure. Security analysis indicates that EPPDR can achieve privacy-preservation of electricity demand, forward secrecy of users' session keys, and evolution of users' private keys. In comparison with an existing scheme which also achieves forward secrecy, EPPDR has better efficiency in terms of computation and communication overheads and can adaptively control the key evolution to balance the trade-off between the communication efficiency and security level.

With the deployment of smart meters at individual households, smart grid can collect metering data of users' power consumption. However, users' power usage patterns would also be revealed. To preserve the users' privacy, metering data is mostly encrypted by cryptographic algorithms. When data mining is needed to support decision making or ensure reliability, to find useful information from the encrypted data is very important for smart grid. Most of the traditional keyword searching schemes rarely consider both users' data privacy and requesters' query privacy. In particular, the power system data in smart grid has multidimensional attributes; thus, how to query over the encrypted multidimensional data on all dimensions is a challenging issue in smart grid. To achieve finer grained conjunctive query, this paper proposes an Efficient Conjunctive Query (ECQ) scheme. Specificly, the ECQ incorporates the idea of public key encryption and conjunctive keywords search to achieve conjunctive query without data and query privacy leakage. Security analysis demonstrates that the ECQ can achieve the security requirements, namely, data confidentiality, integrity and privacy, as well as query privacy. In addition, simulation results show that the ECQ can reduce users' computation cost and total communication cost.

Compared with traditional power grid, smart grid has several distinguished features, i.e., distributed energy, large-capacity, robust to load fluctuations, and close consumer-grid interactions. Demand response is vital for smart grid, which is expected to save energy, maintain supply-demand balance, and reduce consumers' electricity bills. Meanwhile, it is paramount important to preserve consumers privacy and cyber security in smart grid. To tackle these challenging issues, in this paper, we propose an efficient demand response (EDR) scheme which utilizes the homomorphic encryption to achieve privacy-preserving demand aggregation and efficient response. Unlike existing schemes, the proposed EDR scheme can also achieve forward secrecy in addition to security features including confidentiality, authenticity and integrity. Extensive analysis demonstrates its security, and efficiency in terms of the computation and communication overhead.