Decentralized identity (DID) is a key infrastructure for Web3, granting users sovereign control over their private identity data. While existing DID systems like FADID-TT (WWW'25) realize anonymity and traceability within a single domain, the Web3 ecosystem is a multiverse of independent domains like DeFi, GameFi, and DAO. This multi-domain reality presents critical issues for current DID solutions. First, most existing solutions are built on the monolithic committee architecture, facing severe scalability bottlenecks as the committee size grows. Second, most existing solutions cannot offer strong cross-domain anonymity, where frequent cross-domain interaction inevitably exposes the user's privacy. Third, existing methods for tracing the identities of malicious users are inefficient.

With the continuous development of the Industrial Internet of Things (IIoT) and cloud computing, an increasing number of firms store industrial data in the cloud. However, data outsourcing raises owners’ concerns about the confidentiality of their data, prompting them to encrypt data before uploading. When all files are encrypted, it becomes tough to locate specific ones. Searchable encryption enables users to retrieve needed data from encrypted datasets. Most existing keyword-searchable encryption schemes are designed for single-user scenarios; yet in practice, multiple users often access the same data, making single-user schemes unsuitable for multi-user environments. Additionally, sharing data on untrusted devices may lead to single key leakage. This paper presents a new searchable encryption scheme that supports multi-user search. By integrating blockchain, it addresses the problem of single key leakage. The scheme is proven to be impervious to keyword-guessing attacks and achieves trapdoor unlinkability, further enhancing data confidentiality. Performance evaluations compared with existing schemes demonstrate the proposed scheme’s efficiency and feasibility in IIoT deployments.

In fog-based smart grids, smart meters collect users’ electricity data in real time and transmit it to fog node (FN) for aggregation. Then FN sends the aggregated data to control center for in-depth analysis. Throughout this process, data privacy preservation must be implemented, for which privacy-preserving data aggregation (PPDA) serves as a viable solution. However, most existing PPDA schemes do not support multidimensional data aggregation and fault-tolerance(i.e. scheme can still achieve data aggregation even when some devices malfunction), and these schemes are vulnerable to collusion attacks and have high computational and communicational overheads. To address these issues, this paper proposes a certificateless privacy-preserving multidimensional data aggregation scheme with fault-tolerance. The scheme first employs Chinese Remainder Theorem to integrate multidimensional data into a single data, followed by data obfuscation using the updated blind factors, and subsequently encrypts the data via the Paillier homomorphic encryption. Security analysis indicates that the scheme achieves data confidentiality and authenticity while resisting collusion attacks. Performance comparisons indicate its advantages in both communicational and computational overheads.

Location-based recommendation services (LBRS) offer great convenience to our daily lives, but ensuring that user privacy remains intact against the honest-but-curious service provider has become a key concern for the LBRS community. Current mainstream approaches to privacy protection in LBRS typically involve introducing a third party or trading off service accuracy. Considering the reality of limited mobile resources of LBRS users, current privacy-centric LBRS solutions tend to incur significant computation and communication costs. To address these shortcomings, we propose an efficient privacy-preserving scheme for LBRS that simultaneously achieves users' query content privacy, identity privacy, and the LBRS provider's data privacy. Specifically, we utilize linkable ring signcryption (LRSC) to achieve the anonymity of users' identities, confidentiality of the query content, and linkability of a user's multiple actions within a valid service period. The integration of an anonymous payment protocol into the LRSC scheme allows users to make anonymous payments and receive encrypted query results from the LBRS provider, guaranteeing privacy and security throughout the entire process. Under the random oracle model (ROM), our scheme is proven to be secure. Furthermore, it significantly outperforms prior works in efficiency, making it suitable for LBRS.

As the cornerstone of telemedicine, Electronic Health Records (EHRs) not only reduce clinical costs but also enable precision diagnostics. As medical institutions increasingly outsource EHRs to Cloud Service Providers (CSPs), dual challenges have emerged as critical issues: preserving patient privacy and enhancing the search experience for medical personnel. While multi-keyword searchable encryption has gained significant attention in the medical domain as a potential solution, existing schemes have significant limitations in both practicality and security. First, the growing number of medical institutions complicates the management of key and privileges. Second, the impoverished search semantics in existing query mechanisms severely degrades the clinical user experience, creating unacceptable operational bottlenecks in medical practice. Furthermore, excessive reliance on CSPs leads to ignoring situations where the returned results are incorrect, impacting the availability and security of the telemedicine system. To address these limitations, we propose a Verifiable Multi-Semantic Keyword Search scheme (VMSKS) for EHRs in cloud-based telemedicine. To resolve the security requirements arising from the increasing medical institutions, we innovatively design a more efficient dual Securek-Nearest Neighbor technique (SKNN) for key distribution. Meanwhile, fine-grained access control is implemented using access policy trees, ensuring the controllability of data access. This approach safeguards the privacy of EHRs. To support flexible EHR search for medical personnel, the prime Hadamard product encoding technique is exploited to provide queries that support multiple search semantics simultaneously. Given the potential unreliability of CSPs, VMSKS introduces a novel verification mechanism by constructing verification proofs during encryption, ensuring the authenticity and integrity of returned results. Theoretical analysis and experimental evaluation demonstrate the security and efficiency of VMSKS, respectively.

ABSTRACT Searchable Encryption (SE) enables searching over encrypted data. Exact keyword search is supported in most SE schemes, which achieve higher search accuracy but suffer from lower completeness due to the inability to handle similar expressions. To realize fuzzy keyword search, some schemes employ Bloom Filters (BFs), but these may incur high false positive rates and risk exposing the Bloom Filter's internal values to cloud servers (CS). Besides, most existing schemes ignore the fact that CS may engage in malicious behaviors (e.g., undercounting parameters or forging results). To address these issues, we propose an efficient and verifiable ranked fuzzy multi‐keyword search scheme based on BFs. We propose a Twin Bloom Filter (TBF) to conceal insertion positions and introduce random numbers to obfuscate uninserted bits. Search results are ranked using Term Frequency‐Inverse Document Frequency (TF‐IDF) scores to improve relevance. To ensure correctness and integrity, we employ Real Homomorphic Message Authentication Codes (RealHomMAC) and a random challenge technique, respectively. Security analysis proves that our scheme remains secure under both the known‐ciphertext model and the known‐background model. Theoretical and experimental performance analysis confirms that our scheme achieves efficient and accurate keyword search.

In Cloud-Assisted IoT (CAIoT), the large amounts of data generated by devices and sensors need to be shared and stored efficiently and securely. Broadcast proxy re-encryption (BPRE) technology ensures data privacy and enables efficient sharing. A significant issue with existing BPRE schemes is that the re-encryption permissions of the cloud server are uncontrolled, potentially leading to re-encryption operations without the consent of the data owner, and increasing the risk of data leakage. Additionally, most conditional proxy re-encryption (CPRE) schemes rely on computationally intensive bilinear pairing operations, making them unsuitable for resource-constrained IoT devices. To address this, this paper proposes a new certificateless conditional broadcast proxy re-encryption scheme, where the data owner sets conversion conditions when generating the original ciphertext and re-encryption keys, ensuring that only ciphertext meeting the conditions can being converted, thus preventing the cloud platform from abusing re-encryption permissions. Security analysis shows that the proposed scheme can resist chosen ciphertext attacks and collusion attacks in the random oracle model. Performance evaluation shows that the proposed scheme avoids bilinear pairing and hash-to-point operations, reducing the computational cost for the data owner. This improves computational efficiency, making it more suitable for CAIoT scenarios.

With the rapid development of positioning technology and mobile devices, location-based services (LBS) have witnessed extensive adoption. However, privacy leakage issues have become increasingly severe. Existing solutions often focus solely on protecting users’ location privacy while neglecting query privacy requirements, and further exhibit suboptimal retrieval efficiency when handling large-scale datasets. To comprehensively preserve user and server privacy while enhancing data retrieval efficiency, this paper proposes an efficient and privacy-preserving range retrieval scheme for location-based services (EPRL). The scheme proposes a Geohash-based query range generation algorithm, enabling users to generate query ranges according to their privacy requirements dynamically. To protect the user’s location privacy and query privacy, EPRL employs a ring signature policy. Furthermore, we innovatively design a Geohash-Trie Tree structure to store server data resources, effectively improving retrieval efficiency. Theoretical analysis and extensive experiments indicate that compared with other state-of-the-art LBS retrieval schemes, EPRL exhibits broader applicability, lower computational costs, and higher efficiency. When the number of ring signature users reaches 1,000, the total computational overhead of the scheme is approximately 5 seconds, merely one-fifth of that required by similar schemes.

With the rapid development of cloud computing technology, cloud services, represented by cloud storage and data retrieval, have been widely researched in Internet of Things (IoT). As a result, various data retrieval schemes have been proposed. The multikeyword Ranked Searchable Encryption Scheme (MRSE) was developed to improve the accuracy and experience of users searching data. However, MRSE has its drawbacks, such as the security risk of key leakage and limited functionality. Therefore, this article proposes a Privacy-preserving IoT Data Retrieval Scheme (PDRS) that supports lightweight fine-grained access control. We analyze the risk of key information leakage in MRSE, and perform permutation operations on encrypted indexes and trapdoors in PDRS to prevent key leakage and improve system security. Furthermore, in IoT scenarios with multiusers and multikeys, the secure user identity authentication mechanism ensures that only authorized users can acquire legitimate keys to generate search trapdoors, preventing malicious users from impersonating legitimate users and accessing private data. A novel polynomial-based access control is designed to realize attribute-based fine-grained access control, which enables resource-limited devices to limit data access to data users and achieves lightweight overhead. Finally, a formal theoretical analysis demonstrates that PDRS is secure. Simulation experiments verify that PDRS is efficient and lightweight.

Location-Based Services are increasingly common in our lives. In order to reduce user overhead, the data owner stores the location information and text data on the cloud server, and the user completes the retrieval task with the help of the fog server. To protect the privacy of outsourced data, many secure spatial keyword retrieval schemes have been proposed. Most schemes use R-tree indexes to improve the efficiency of ciphertext retrieval, but the encrypted R-tree index is hard to update. Moreover, some indexes based on order-preserving encryption are vulnerable to frequency-revealing attacks. So how to balance efficiency and security is a problem. To solve the above problems, we propose an efficient and secure spatial keyword ciphertext retrieval scheme based on cloud-fog collaboration. First, we innovatively design the SK-tree. The Geohash algorithm and Simhash algorithm are used in SK-tree to compress information, achieving efficient retrieval. Secondly, our retrieval tree has the function of fuzzy order preservation, which can better hide the correspondence between plaintext and ciphertext compared to traditional index-based order-preserving encryption schemes. In addition, we design a cloud-fog-user interaction scheme for attribute-based encryption that can hide access control policies, which reduces the computational overhead for the user side. Finally, we prove through theoretical analysis that our scheme ensures cloud data security and query trap information privacy. We compare our scheme with others through simulation experiments to demonstrate its superiority in efficiency.

In Internet of Things(IoT), the combination of cloud computing and edge computing becomes a new computing paradigm to provide users with low-latency data services. However, for the limited resource, high dynamic, and wide distributed characteristics of IoT devices, it becomes a great challenge to realize the universal application of edge servers and the cloud-edge computing allocation. Meanwhile, most of the schemes ignore the leakage of data access pattern privacy when accessing data. Therefore, in this paper, we propose a privacy-preserving access control scheme for IoT data. Based on the cloud-edge-end framework, we design a pervasive edge computing protocol, which allows well-resourced devices to become edge servers at suitable geographic locations and users to outsource and access IoT data through the nearest edge server. It increases the flexibility of the cloud-edge collaborative system as well as the efficiency of data processing. Users do not need to interact beyond the network edge to enjoy the data services. Furthermore, a novel attribute-based encryption scheme is designed based on a modified Lightweight Secret Sharing Scheme to optimize computing task allocation and reduce the computation burden on end devices, without attribute information leakage. In addition, we also design a Transform algorithm and a Cloud-edge Interaction protocol to hide access pattern privacy efficiently. We analyze the feasibility of the scheme and demonstrate that the scheme is semantically secure and conceals access pattern privacy. Simulation experiments based on real IoT data show that the scheme is efficient and suitable for IoT scenarios.

In big data scenarios, the data volume is enormous. Data computation and storage in distributed manner with more efficient algorithms is promising. However, most current ciphertext search schemes are designed for the centralized cloud computing platforms and they are inefficient and inapplicable in big data scenarios. A proxy server based system is a cloud computing extension. This new pattern moves some of the data storage and computation burden from end users to the edge servers and it greatly decrease the resource costs of data users. In this paper, we propose a searchable encryption scheme assisted by cloud computing and proxy servers for big data, which can accomplish Lightweight Fine-grained access control and Efficient multi-keyword top-k ciphertext Search synchronously (LFES). To cope with all types of data, we design an innovative fine-grained access control mechanism based on attribute-based encryption and key distribution protocol. Thus, the scheme only allows users with licensed attributes to access data efficiently. Then, a public key searchable encryption scheme is proposed based on privacy Protection Set Intersection (PSI) and the proxy server model. Our scheme greatly reduces the computation burden on end-users and improves retrieval efficiency. Meanwhile, to prevent tampering with stored ciphertexts, a practical data integrity audit mechanism is also designed. Security analysis illustrates that the LFES can resist Chosen Keyword Attack (CKA) and Keyword Guessing Attack (KGA). Finally, the simulation shows that the LFES is efficient and feasible in practice.

Due to the high cost of training DNN models, how to protect the intellectual property of DNN models, especially when the models are deployed to users’ devices, is becoming an important topic. One practical solution is to use Trusted Execution Environments (TEEs) and researchers have proposed various model obfuscation solutions to make full use of the high-security guarantee of TEEs and the high performance of collocated GPUs. In this paper, we first identify a common vulnerability, namely the fragility of randomness, that is shared by existing TEE-based model obfuscation solutions. This vulnerability benefits model-stealing attacks and allows the adversary to recover about 97% of the secret model. To improve the security of TEE-shielded DNN models, we further propose a new model obfuscation approach GroupCover, which uses sufficient randomization and mutual covering obfuscation to protect model weights. Experimental results demonstrate that GroupCover can achieve a comparable security level as the upper-bound (black-box protection), which is remarkably over 3x compared with existing solutions. Besides, GroupCover introduces 19% overhead and negligible accuracy loss compared to model unprotected scheme.

Abstract Federated learning enables training healthcare diagnostic models across multiple decentralized devices containing local private health data samples, without transferring data to a central server, providing privacy‐preserving services for healthcare professionals. However, for a model of a specific field, some medical data from non‐target participants may be included in model training, compromising model accuracy. Moreover, diagnostic queries for healthcare models stored in cloud servers may result in the leakage of the privacy of healthcare participants and the parameters of models. Furthermore, the records of model searching and usage could be tracked causing privacy disclosure risk. To address these issues, we propose a blockchain‐based privacy‐preserving searchable attribute‐based encryption scheme for the diagnostic model federated learning in the Internet of Medical Things (BSAEM‐FL). We first adopt fine‐grained model trainer participation policies for federated learning, using the attribute‐based encryption (ABE) mechanism, to realize model accuracy and local data privacy. Then, We employ searchable encryption technology for model training and usage to protect the security of models stored in the cloud server. Blockchain is utilized to implement distributed healthcare models' keyword‐based search and model users' attribute‐based authentication. Lastly, we transfer most of the computational overhead of user terminals in model searching and decryption to edge nodes, achieving lightweight computation of IoMT terminals. The security analysis proves the security of the proposed healthcare scheme. The performance evaluation indicates our scheme is of better feasibility, efficiency, and decentralization.

In the Internet of Vehicles (IoV), the data center will receive a large number of data-signature pairs sent by vehicle-mounted communication devices and needs to quickly verify the validity of the signatures. Using aggregated signatures, the validity of multiple signatures can be verified by performing only one verification calculation, which significantly improves the calculation efficiency and is very suitable for the Internet of Vehicles. Unfortunately, security proofs of most certificateless aggregate signature (CLAS) schemes are implemented in the random oracle model (ROM). It is known that schemes with provable security in ROM may be vulnerable in real situations. Therefore, there may be potential security risks when these schemes are applied to the IoVs. In this paper, the system model and security demands of a CLAS scheme for IoVs were put forward. Afterwards, a concrete scheme was constructed and the security proofs were achieved in the standard model (SM). In the end, the advantage enjoyed by new scheme was demonstrated by making a comparison on performance for several schemes.

With the rapid development of cloud computing and Internet of Things (IoT) technologies, large amounts of data collected from IoT devices are encrypted and outsourced to cloud servers for storage and sharing. However, traditional ciphertext retrieval schemes impose high computation and storage overhead on end users. Meanwhile, IoT devices with limited resources are difficult to adapt to large amounts of data computation and transmission, which leads to transmission delay and poor user experience. In this article, we propose a lightweight privacy-preserving ciphertext retrieval scheme based on edge computing (LPCR) by extending searchable encryption (SE) and ciphertext policy attribute-based encryption (CP-ABE) techniques. First, to avoid network delay and paralysis, we introduce edge servers into LPCR and design a collaboration mechanism between the user side and the edge servers. The user side only needs to accomplish lightweight computation and storage tasks, which greatly reduces their resource consumption. Second, we extend the basic ciphertext policy attribute-based keyword search (CP-ABKS) technique and design the Linear Secret Sharing Scheme (LSSS) access control algorithm with attribute values to hide access policies and attributes. In addition, to improve the retrieval accuracy, the document indexes and query trapdoors are set up by conjunctive keywords to help the cloud server locate exactly the data that the user wishes to query. Formal security analysis verifies that LPCR can achieve the security of chosen plaintext attack (CPA) and chosen keyword attack (CKA), and resist collusion attack. Simulation experiments prove that LPCR is lightweight and feasible.

In recent years, security test of network protocols based on fuzzing has been attracting more and more attentions. This is very challenging compared with the stateless software fuzzing and most early network protocol fuzzers are of low speed and poor test effect. Since the first greybox and stateful fuzzer named AFLNET was proposed, several new schemes have been designed to improve its performance from different aspects. During the research, a great challenge is how to greatly improve the fuzzing efficiency. Based on the basic analysis in SNPSFuzzer, this paper provides a more thorough analysis about the time consumption in a fuzzing iteration for 13 network protocols and then we design a High-speed Network Protocol Fuzzer named HNPFuzzer. In HNPFuzzer, the test cases and response messages between the client and server are transmitted through the shared memory, guided by a precise synchronizer, rather than the socket interfaces. This greatly shorten the period of an iteration. Moreover, we design a persistent mode attempting to fuzz the service instances in the memory more than one time based on analyzing the side effect information. This mode further improves the speed of fuzzing. Experiment results illustrate that our scheme can improve the fuzzing throughput by about 39.66 times in average and triggers a large number of crashes including 2 new vulnerabilities which cannot discovered by existing fuzzers. Note that, the existing network protocol fuzzing schemes proposed in different directions do not compete with each other and on the contrary, they can collaborate with each other to improve the overall fuzzing effect and efficiency. Consequently, more existing tools can be integrated into our framework to get better network protocol fuzzing effect.

With the rapid development of cloud computing, massive amounts of data are uploaded to cloud servers for storage. For privacy protection, sensitive data should be encrypted before outsourcing, and ciphertext retrieval technologies based on similarity come into being. In cloud computing with massive data, the efficiency and accuracy of retrieval are crucial. However, most of the current similarity retrieval schemes do not perform well in these two aspects. Therefore, we propose SESR scheme, a secure and efficient similarity retrieval scheme based on homomorphic encryption. Firstly, we use Hamming distance to calculate the similarity between the feature vector of the data and query vector from the data user. Secondly, the homomorphic encryption algorithm is used to encrypt data to protect data privacy. Furthermore, we creatively design a BK-KD tree structure that hierarchically implements similarity search and fine-grained access control, thereby speeding up the retrieval efficiency. In addition, we design a two-cloud-server cooperative retrieval model and a message authentication scheme, which ensure access pattern privacy security and the integrity of the transmitted data simultaneously. We also propose an improved SESR scheme. In this scheme, we use Simhash algorithm to generate feature vectors and query vectors, which reduces storage overhead. Finally, the security of SESR is formally proved and the simulation results show the efficiency and accuracy of the retrieval scheme.

With the rapid development of cloud computing technology and Internet of Things (IoT), enterprises and organizations tend to outsource local data to cloud servers and use searchable encryption (SE) technology to access and search encrypted data. However, the existing symmetric SE (SSE) schemes pay less attention to multiuser environments and users’ interest, which cause poor experience to users. In this article, we propose a multiuser personalized ciphertext search scheme (MPCS) by extending deep learning technology and SSE technology, which can achieve personalized retrieval and multiuser retrieval at the same time. MPCS achieves secure transmission of document keys and fine-grained access control by combining matrix decomposition and ciphertext policy attribute-based encryption (CP-ABE) technology, which assigns different private keys to each authorized user in the system and allows setting different access rights for different users. Second, we build an interest model for different users and design a user query update algorithm based on the attention mechanism to provide personalized ranking results, which improves the retrieval experience of users. In addition, the computation overhead of MPCS is lightweight, the size of ciphertext and key will not increase linearly with the number of attribute values, and MPCS supports lightweight document updates, which greatly reduces the computation overhead of the system. Formal security analysis verifies the security of MPCS, and simulation experiments on real data sets show that MPCS is feasible and efficient in practice.

With the continuous development of sensor technology, more and more users hope to monitor and collect information in a certain area safely and efficiently by deploying heterogeneous wireless sensor networks (HWSNs). However, nodes in HWSNs have limited capabilities, which leads to many security challenges. Existing data transmission schemes in HWSNs take measures to resist these security threats, which aggravate the node computation overhead and increase the network energy consumption. This paper proposes a Lightweight and Secure Data Transmission (LSDT) scheme against malicious nodes in heterogeneous wireless sensor networks. Firstly, considering node capabilities limitations in HWSNs, we design a lightweight secret sharing scheme based on XOR operation, which maps data to multiple shares and makes it convenient to transmit shares separately to the sink node via multiple paths. While guaranteeing data security, this scheme can greatly reduce the computation overhead of nodes compared with traditional secret sharing schemes. Further, during the delivery of shares, the network may be attacked by malicious nodes, causing the interruption of message transmission. Therefore, we design a malicious node detection and feedback mechanism, which can quickly respond to malicious node attacks and update the reputation degree of malicious nodes. Finally, we propose a routing selection scheme based on reference path which comprehensively considers the energy and reputation degree of heterogeneous nodes. It makes message transmission bypass malicious nodes while achieving network energy load balance, significantly extending the network lifetime. The security analysis proves that our scheme guarantees the security of data transmission. Theoretical analysis and experiments show that our scheme has significant advantages over the existing HWSNs data transmission schemes in terms of network lifetime extension and malicious node resistance.

The Internet of Medical Things (IoMT) is an important application of the Internet of Things in health care. In IoMT, efficiency and user privacy are crucial for cloud storage and retrieval of healthcare data documents. Existing schemes, however, often suffer from inefficient retrieval and increased risk of privacy disclosure when dealing with massive data. We propose here a new Efficient Encrypted Parallel Ranking (EEPR) search system, block-based and privacy-preserved, for encrypted cloud healthcare data. We design a parallel binary search tree structure in block and propose a parallel retrieval algorithm adaptable to such a structure. A quantitative analysis through the information retention index shows that our scheme demonstrates better search performance. In addition, feature vectors generated from our scheme are difficult to be reversely analyzed due to unexplainability, enhancing privacy protection for patients and researchers. A formal security analysis shows that our EEPR scheme is resistable to known background attack, and yields a lower time complexity and significantly improves search efficiency as well as accuracy over existing schemes.

With the rapid development of 5G/6G, most Internet of Things (IoT) devices will embrace wireless connection in the near future. A public concern is how to securely organize, store and retrieve data generated from IoT devices. Many cloud-based IoT data storage schemes have been proposed recently. However, for an untrusted or vulnerable cloud server, the stored IoT data can be easily accessed, modified and even destroyed given that the IoT data are stored in total centralization. Moreover, the servers in a cloud are generally homogeneous and thus vulnerable to attacks. For improvements, we design a novel framework for secure and efficient IoT data storage based on secret sharing and a collaborative blockchain. First, an ultra-lightweight secret sharing algorithm is designed to map original messages generated by IoT devices to a set of shorter message shares. Second, all the shares of IoT messages are separately delivered to different clouds for storage. To guarantee the security of shares, the delivery is notarized on a proposed blockchain. Specifically, both hash values of the shares and their information of location are embedded in blocks which are then chained to form a blockchain. Third, we create a balanced index structure about the shares for each cloud storage node based on the information in the blockchain, and we also propose a depth-first data search algorithm to improve IoT data retrieval efficiency. Theoretical analysis and simulation results illustrate that our scheme can store and retrieve the IoT data securely and efficiently.

As traditional computing and cloud computing integrate, the Internet of Things (IoT) has evolved into a layered and cloud-network-edge-end architecture. However, most searchable encryption models still use triples, in which hierarchical structures are neglected, and insecure intermediate nodes are exposed to external environment. Meanwhile, mainstream schemes adopting accurate retrieval are incompatible with IoT end users' features of differentiation. To address these issues, we innovatively design an efficient and credible search model with an accurate multikeyword fuzzy ciphertext retrieval scheme in the context of IoT. First, based on network coding and key sharing, data are grouped, encoded, and transmitted in parallel to the receiver node through middle-layer nodes, with high efficiency and reliability. Second, to realize fuzzy retrieval of IoT, edit distance is selected as the standard of difference between keywords, and then document index vector and query vector are created based on locality sensitive hashing (LSH) and Bloom Filter. Furthermore, to improve the traditional scheme, query keywords are split into multiple single-word forms, inner products between each trapdoor of single word and encryption index vector are calculated, respectively, for the sum of each inner product and thus top $\mathrm{top}$ - k $k$ sorting search. Ultimately, feasibility, safety, and efficiency of our improved scheme are verified by security analysis, while simulation results support that our scheme has better accuracy and efficiency.

With the development of 5G, it is unsurprising that most of the smart devices in the Internet of Things (IoT) will be wirelessly connected with each other in the near future. This kind of lightweight, scalable and green network architecture will be well-received. In a wide variety of IoT application scenarios, sensor nodes deployed in a local space, such as a multistory building, automatically form a distributed 3D wireless IoT and it can be employed to collect and analyze environmental information. Source-location privacy protection is of great importance in these networks and however, most existing schemes focus on only planar distributed networks which are not suitable for the 3D networks. In this paper, we consider a novel trace-back attack for 3D wireless IoT and then design a source-location privacy protection scheme, named DMR-3D, to defend this kind of novel attacks. In DMR-3D, the source node first selects a set of virtual locations to indirectly choose a set of agent nodes based on the cold start sphere structure and the ellipsoid communication pipeline. Then, a sophisticated mechanism is designed based on both the connected graph and Multiple Delaunay Triangulation (MDT) structure of the network to deliver packets from the source node to the destination node via these agent nodes in a relay manner. Analysis and simulation results illustrate that the proposed scheme can effectively protect source-location privacy with a moderate increment of path stretch, time delay and data transmission amount.

With the development of cloud computing, more and more data owners are motivated to outsource their documents to the cloud and share them with the authorized data users securely and flexibly. To protect data privacy, the documents are generally encrypted before being outsourced to the cloud and hence their searchability decreases. Though many privacy-preserving document search schemes have been proposed, they cannot reach a proper balance among functionality, flexibility, security and efficiency. In this paper, a new encrypted document retrieval system is designed and a proxy server is integrated into the system to alleviate data owner's workload and improve the whole system's security level. In this process, we consider a more practical and stronger threat model in which the cloud server can collude with a small number of data users. To support multiple document search patterns, we construct two AVL trees for the filenames and authors, and a Hierarchical Retrieval Features tree (HRF tree) for the document vectors. A depth-first search algorithm is designed for the HRF tree and the Enhanced Asymmetric Scalar-Product-Preserving Encryption (Enhanced ASPE) algorithm is utilized to encrypt the HRF tree. All the three index trees are linked with each other to efficiently support the search requests with multiple parameters. Theoretical analysis and simulation results illustrate the security and efficiency of the proposed framework.

An adversary can deploy parasitic sensor nodes into wireless sensor networks to collect radio traffic distributions and trace back messages to their source nodes. Then, he can locate the monitored targets around the source nodes with a high probability. In this paper, a Source-location privacy Protection scheme based on Anonymity Cloud (SPAC) is proposed. We first design a light-weight (t, n)-threshold message sharing scheme and map the original message to a set of message shares which are shorter in length and can be processed and delivered with minimal energy consumption. Based on the shares, the source node constructs an anonymity cloud with an irregular shape around itself to protect its location privacy. Specifically, an anonymity cloud is a set of active nodes with similar radio actions and they are statistically indistinguishable from each other. The size of the cloud is controlled by the preset number of hops that the shares can walk in the cloud. At the border of the cloud, the fake source nodes independently send the shares to the sink node through proper routing algorithms. At last, the original message can be recovered by the sink node once at least t shares are received. The simulation results demonstrate that the SPAC can strongly protect the source-location privacy in an efficient manner. Moreover, the message sharing mechanism of SPAC increases the confidentiality of network data and it also brings high tolerance for the failures of sensor nodes to the data transmission process.

Smart factory is a typical application scene of Internet of Things and wireless terminal devices naturally compose a three-dimensional (3-D) industrial wireless network. A primary requirement in the network is delivering packets from source node to destination node. Most geographic routing algorithms are designed for planar networks and they do not suit 3-D networks. In this paper, we extend a greedy perimeter stateless routing algorithm (GPSR) into three dimensions named GPSR-3D. In GPSR-3D, each node decides next hop of a packet by cooperating with only local neighbors and hence this algorithm is totally distributed. GPSR-3D comprises two packet forwarding patterns named greedy forwarding pattern (GFP) and surface forwarding pattern (SFP). In GFP, a node always sends the packet to a neighbor closest to destination and when it fails, SFP is employed for recovery. In SFP, we first divide the whole network space into a set of subspaces based on a novel 3-D geometric structure. Then, a parallel polyhedron traverse algorithm is proposed to recover local minima. A flowchart of GPSR-3D is given to clearly present the process of delivering a packet based on GFP and SFP. Simulation results show that GPSR-3D is of great reliability, energy efficiency and storage efficiency. Specifically, data transmission amount in GPSR-3D is about 67% and 71% to that of multihop Delaunay triangulation (MDT) and GDSTR-3D on average. Moreover, GPSR-3D performs much better than MDT and GDSTR-3D in terms of average storage cost and the average storage space in GPSR-3D is about 48% and 26% to that of MDT and GDSTR-3D, respectively.

Secure document storage and retrieval is one of the hottest research directions in cloud computing. Though many searchable encryption schemes have been proposed, few of them support efficient retrieval over the documents which are encrypted based on their attributes. In this paper, a hierarchical attribute-based encryption scheme is first designed for a document collection. A set of documents can be encrypted together if they share an integrated access structure. Compared with the ciphertext-policy attribute-based encryption schemes, both the ciphertext storage space and time costs of encryption/decryption are saved. Then, an index structure named attribute-based retrieval features (ARF) tree is constructed for the document collection based on the TF-IDF model and the documents' attributes. A depth-first search algorithm for the ARF tree is designed to improve the search efficiency which can be further improved by parallel computing. Except for the document collections, our scheme can be also applied to other datasets by modifying the ARF tree slightly. A thorough analysis and a series of experiments are performed to illustrate the security and efficiency of the proposed scheme.