Abstract Smart home platforms predominantly adopt the broker-mediated publish/subscribe model (e.g., MQTT) for seamless device-app coordination. However, this architecture introduces a fundamental privacy-functionality conflict: the broker requires plaintext metadata (topic strings) for message routing, which inadvertently exposes fine-grained user behavioral patterns to semi-trusted service providers. Furthermore, existing systems lack rigorous cryptographic enforcement for app permissions, leaving the ecosystem vulnerable to over-privileged or malicious apps. While conventional Attribute-Based Encryption (ABE) provides fine-grained read-side access control, it cannot enforce writer-bound policies and remains computationally prohibitive for resource-constrained IoT nodes. In this paper, we propose SHERLOC, a practical and privacy-preserving framework that reconciles secure message routing with fine-grained privilege control. SHERLOC introduces two core primitives: (1) Secret Queue Telemetry Transport (SQTT), which leverages a novel trapdoor-based matching mechanism to support multi-level wildcard routing while ensuring topic indistinguishability and resistance against inside keyword-guessing attacks (IKGA); and (2) Outsourced Inner-Product Access Control Encryption (OS-IPACE), an attribute-hiding scheme that enforces dual no-read and no-write security for apps by offloading intensive pairing operations to a local hub without compromising data secrecy. We provide formal security proofs reducing SHERLOC’s privacy guarantees to the SXDH assumption. Experimental results from a full-scale prototype, comprising ESP32-based devices and Android apps, demonstrate that SHERLOC incurs millisecond-level latency and maintains compatibility with legacy MQTT brokers without altering protocol semantics, making it a robust and deployable solution for modern smart home environments.

Abstract Threshold signatures are essential for fault-tolerant applications among groups of users, such as in blockchain transactions. SM2 is a digital signature standard in China and ISO, yet its threshold variant is less developed compared to international alternatives such as ECDSA. Specifically, modern threshold signatures offer identifiable abort (ID-abort) and non-interactive online signing, but these features make threshold-SM2 costly, limiting its real-world application. In this paper, we introduce a fast threshold-SM2 with ID-abort and non-interactive online signing. We design a technology for ID-abort by checking hard-to-verify pseudononces based on their mappings in a group. By putting the message-independent computations to a presigning phase, we achieve a non-interactive online signing. We prove that our threshold-SM2 is secure in the dishonest majority model and implement it using Golang. Theoretical analysis and experimental results demonstrate that our threshold-SM2 provides rich functionalities with good performance, significantly reducing computational and communication costs compared to the state-of-the-art threshold-SM2 by Liang and Chen (FCS’ 24).