Privacy-preserving data trading allows data owners to sell data to consumers through a data trading web platform, the data market, without disclosing sensitive information in raw data. It enables legitimate data transmission and aggregation, facilitating large-scale data-driven model training. However, existing differential privacy-based approaches struggle to inject precisely calibrated noise in a trustworthy manner without revealing raw data to a third party, thus making them fail in achieving strong fairness and controllable privacy simultaneously, especially when facing malicious external adversaries or a corrupted data market.

In IoT-enabled electricity markets, trading is often conducted in a forward-style manner, where parties agree on prices and quantities in advance and settle upon future delivery. However, deploying such forward-style exchanges across chains is incompatible with execution-restricted blockchains and typically incurs significant cross-chain gas overhead. Moreover, existing low-overhead cross-chain mechanisms, particularly HTLC-based schemes, inherently rely on pairwise locking and thus cannot efficiently support one-to-many settlement. We propose an inter-chain forward-style exchange framework based on a dual-track validation architecture. The framework integrates a double-spend fraud-proof mechanism to ensure correctness and a proof-of-acceptance (PoAc) mechanism to reduce cross-chain overhead for successful settlements. We further introduce a novel k-directional hash lock enabling one-to-many settlement, allowing a single buy order to be split across multiple sellers. Our analysis shows that the framework resists griefing attacks, prevents adversarial losses, and preserves cross-chain atomicity. Experiments demonstrate support for execution-restricted blockchains such as Bitcoin, scalability to 862,000 sellers per order, and a 78.25% reduction in settlement cost compared to light-client approaches.

The rapid development of the automotive industry and the Internet of Vehicles (IoV) has led to an exponential growth of distributed vehicular data, driving the need for secure and efficient collaborative machine learning solutions. However, existing distributed collaborative machine learning (DCML) approaches, such as federated learning and split learning, face significant challenges in IoV scenarios, including limited training efficiency, centralized aggregation vulnerabilities, and constrained privacy and model protection. To address these issues, we propose a blockchain-based split federated learning (BSFL) scheme for IoV applications. BSFL non-trivially combines federated learning and split learning to enable vehicles with low computational power to participate in parallel training, improving both model accuracy and training efficiency. By utilizing blockchain as a decentralized infrastructure, BSFL eliminates the risks of single points of failure and ensures model consistency through Byzantine fault-tolerant consensus. Furthermore, we design a noise addition mechanism based on differential privacy to safeguard client data privacy and model security. Formal security analysis and extensive experiments demonstrate that BSFL achieves enhanced privacy, security, and training performance. Comparing to related DCML schemes, BSFL reduces computational overhead by up to 88.84% and client training time by up to 29.49% while maintaining comparable accuracy. When training on ResNet-50 based on CIFAR10, BSFL achieved an accuracy of 93.15%. And the verification process for each model’s training results on the blockchain requires 1.49 ms.

Dynamic Proactive Secret Sharing (DPSS) is essential for distributed systems, enabling long-term key escrow, BFT protocol reconfiguration, and confidential state machine replication. Yet existing asynchronous schemes, while crucial for realistic settings, suffer from high communication overhead and poor practicality, limiting real-world deployment. We propose PlainDrop, a concise and efficient DPSS protocol designed specifically for asynchronous networks. PlainDrop achieves optimized communication complexity ofO(n2) via commitment–share decoupling combined with homomorphic threshold encryption techniques. PlainDrop also eliminates the need for expensive distributed key generation and complex bivariate polynomial structures by introducing a lightweight silent setup framework and employing direct share processing based on univariate polynomials. We formally prove that PlainDrop provides secrecy, integrity, and termination in asynchronous networks against a mobile adversary corrupting up to one third of the parties. We implement PlainDrop and evaluate it on Amazon EC2 with up to 100 nodes. Our experimental results demonstrate average reductions of 37% and 67% in completion time, and 61% and 89% in communication volume, compared to DyCAPS and LongLive, respectively.

Blockchain-based information storage and retrieval systems face significant challenges in achieving efficiency, privacy, and auditability when operating across heterogeneous blockchain platforms. Existing solutions often struggle to balance these requirements, particularly in cross-chain environments involving both public and consortium blockchains. This paper proposes a novel framework that leverages cross-chain technology to address these limitations. The framework integrates multi-party threshold cross-chain consensus to optimize verification efficiency and reduce the computational burden on trusted nodes. To ensure privacy-preserving information querying and retrieval, advanced cryptographic techniques are employed. Additionally, a dedicated auditor set within the consortium blockchain is introduced to detect malicious behavior and enforce regulatory compliance. Comparative evaluations demonstrate that the proposed framework outperforms existing methods in terms of privacy protection, efficiency, and auditability. Experimental results on Hyperledger Fabric demonstrate significant improvements in throughput, achieving at least 20 Transactions Per Second (TPS), along with latency below 3.5 seconds and 300MB memory utilization under standard PC configurations. These findings validate the framework's practical viability for secure and efficient cross-chain information retrieval while maintaining superior performance compared to existing solutions.

Data has become a critical driver of innovation in artificial intelligence and the evolution of 6G technologies. The explosive growth of data volume accelerates the convergence of cloud and edge computing, while simultaneously posing heightened challenges to data security and privacy. The emerging cloud-edge-device collaborative paradigm enables dynamic and large-scale data circulation across heterogeneous entities, exposing systems to complex threats such as malicious edge nodes and eavesdropping over untrusted communication channels. In response to these issues, we propose EdgeGuard, a secure and decentralized framework for cloud-edge-device data circulation. EdgeGuard is specifically designed for highly dynamic environments and ensures robust data confidentiality, integrity, traceability, and resilience against both malicious external attackers and compromised edge servers. To underpin its cryptographic foundation, we develop two core primitives. Specifically, we introduce an Aggregatable Publicly Verifiable Secret Sharing (APVSS) scheme that enables efficient sharing of field elements while supporting aggregation and public verifiability. Furthermore, we construct AggDKG, a distributed key generation (DKG) protocol. AggDKG achieves public verifiability and bias resistance with an expected total communication cost of${\mathcal {O}}(\kappa n^{3})$effectively overcoming the scalability limitations inherent in traditional complaint-based protocols. Collectively, these components form a comprehensive framework that strengthens secure and efficient data circulation in cloud-edge-device systems. Experimental data show that AggDKG delivers clear performance gains: across all tested scales, its total running time is only about 8%–65% of that of the DKG of Gurkan et al., and at$n=256$, it reduces per-node runtime by approximately 27% compared with the DKG of Gennaro et al. These results highlight EdgeGuard's superior scalability, lower latency, and stronger Byzantine resilience for secure large-scale deployments.

Transaction propagation delay limits the block interval and is one of the main bottlenecks in improving Bitcoin throughput. However, transaction relay in Bitcoin is entirely voluntary, which results in low bandwidth and high transaction propagation delay. Improving relay motivation by introducing incentives can effectively reduce delay, but it still faces challenges such as Sybil attacks during reward allocation, leakage of network layer privacy, and high on-chain/off-chain overhead. Therefore, this paper proposes Txtail, a practical transaction relay incentive scheme for Bitcoin, based on continuously attaching relay evidence representing the relays’ identity and contribution during transaction propagation. We employ a free pricing mechanism based on the game between relays to allocate rewards fairly. We design an order-insensitive relay evidence structure based on aggregate signatures and public key mapping, which reduces off-chain data overhead while alleviating the leakage of relay paths by obfuscating the relay order. We construct a verifiable lottery mechanism based on Merkle tree commitments to reduce the data that needs to be uploaded to the chain. Both theoretical and experimental results show that Txtail reduces the per-hop off-chain overhead and the overall on-chain overhead by 96.6% and 79.8%, respectively, compared with state-of-the-art baselines, while remaining practical for deployment.

Federated Learning (FL) enables collaborative model training across distributed devices while preserving data privacy. However, it faces critical security challenges, including centralization risks and poisoning attacks, which degrade robustness and scalability. Existing schemes struggle to simultaneously mitigate targeted and untargeted poisoning attacks, impose restrictive adversary ratio assumptions (poison ratio < 50%), and suffer from privacy-performance trade-offs. To address these limitations, we propose SharBipole, a decentralized FL scheme integrating sharding blockchain with a novel dual-metric defense mechanism, Bipole. SharBipole employs a Byzantine Fault Tolerant-enabled sharding architecture to eliminate single points of failure, reduce communication overhead, and enable parallel model aggregation. Meanwhile, the Bipole module defends against poisoning attacks using two adaptive similarity metrics to filter malicious updates dynamically. Reinforcement learning optimizes threshold adjustments, while noise-aware adaptive clipping balances privacy and model utility. Further, we give convergence analysis to prove the theoretical soundness and scalability of SharBipole. Lastly, extensive experimental evaluations demonstrate that SharBipole supports poison ratios exceeding 50% and improves throughput and latency. The model replacement attack with 60% adversaries is entirely ineffective against SharBipole, and the label-flipping attack achieves an attack success rate of only 2.344%. SharBipole establishes a scalable, secure, and privacy-preserving solution for distributed learning in massive environments.

In Ethereum, DevP2P is the fundamental network-layer protocol set that supports consensus mechanisms, transaction propagation and smart contract execution. Due to the importance of DevP2P, its bugs can be exploited by the attacker to cause security problems like denial of service, leading to property loss on Ethereum. However, existing blockchain testing approaches focus on the bug detection of consensus and application layers, causing many serious DevP2P bugs to be missed. In fact, detecting DevP2P bugs has some key challenges, including how to generate effective inputs and how to detect complex bugs. This paper designs D2PFuzz, the first network-layer differential fuzzing approach of bug detection for Ethereum. It consists of two key techniques: (1) aquery-based fuzzing strategythat dynamically generates valid DevP2P messages according to network, chain and node state changes; and (2) amulti-node differential checking methodthat identifies important differences of DevP2P response messages from multiple nodes in the same blockchain to detect semantic bugs. We have evaluated D2PFuzz on five open-source and popular Ethereum node implementations, including Geth, Erigon, Reth, Besu and Nethermind. D2PFuzz in total finds 15 unique bugs, 12 of which are previously unknown. Compared to two state-of-the-art blockchain testing approaches including LOKI and Hive, D2PFuzz improves testing coverage by 3.7x and 21.6x, respectively, and finds 13 bugs missed by these approaches.

As blockchain technology advances, an increasing number of applications require interactions between smart contracts across multiple blockchains. However, existing cross-chain solutions exhibit limited scalability due to heterogeneous blockchain environments and diverse application requirements. A fundamental challenge lies in the absence of a unified resource definition for cross-chain processes, impeding moderate resource allocation and effective conflict resolution. Specifically, when extended to general cross-chain transactions involving invocations among multiple contracts, these methods lack the capability to correctly handle state transitions for all related contracts. This paper proposes AtomXross, a novel cross-chain scheme that supports arbitrary combinations of smart contracts during the cross-chain process. We build a scalable cross-chain architecture based on a relay chain and a cluster of cross-chain nodes to provide better scalability. We propose a unified definition for cross-chain resources within the system and implement an adaptive resource management mechanism on the relay chain, enabling it to record the invocation relationships of contract functions. When a cross-chain transaction involves multiple contract calls, AtomXross can index the calls and generate the corresponding call tree. To address the challenges posed by potential mutual invocations between smart contracts, we design an atomic transaction protocol based on buckle-lock, an ordered two-tier pessimistic locking mechanism. AtomXross ensures that cross-chain transactions do not conflict with each other while remaining compatible with non-cross-chain calls that may occur at any time. Furthermore, we propose a universal programming template for on-chain smart contracts, which enables ordinary smart contracts to acquire cross-chain capabilities. We implement AtomXross based on Hyperledger Fabric and FiscoBCOS. In comparison to WeCross, AtomXross lowers the gas cost on system initialization and incurs only a 14% increase in transaction latency while supporting inter-contract calls.

With the development of air transportation, Space-Air-Ground Integrated Network (SAGIN) are playing an increasingly important role in optimizing air traffic management and enhancing flight safety for billions of passengers and trillions dollars of aviation industry. As the key technology of SAGIN, the Automatic Dependent Surveillance-Broadcast (ADS-B) system is widely used due to its simple operation, low construction cost, and high information accuracy. However, the security problems in ADS-B system, including lack of identity authentication between all communication links, crucial information transmitted in plaintext, and susceptibility to the single point of failure, have been serious obstacle to its wide application. Existing solutions fail to account for the unique characteristics of ADS-B and SAGIN, leading to inadequate security and poor performance in these specialized contexts. Aiming to solve the above issues and provide security and scalability for ADS-B system, we conduct the following research. Firstly, an enhanced identity-based broadcast signcryption (e-IBBSC) scheme is designed to keep crucial information confidential and all messages authenticated simultaneously. Secondly, we propose an efficient batch message authentication method combined with the Merkle tree and proposed e-IBBSC, significantly improving the ADS-B message utilization ratio from 1.35% to 74.10%. Thirdly, we utilize the sharding blockchain and Byzantine fault tolerance protocol to design the first sharding-based distributed management system for SAGIN that realizes fault tolerance and scalability. Finally, after a detailed security analysis and comprehensive performance evaluation, we demonstrate that our solution can achieve all proposed system goals including security, scalability, and high performance of 1s flight transaction processing latency and 62KTPS throughput.

Cross-chain auction is a promising paradigm for enabling on-chain price discovery across blockchain systems. While existing bridge solutions can functionally support cross-chain auctions, their deployment across heterogeneous blockchains remains challenging. In addition, conventional hash time-lock contracts (HTLCs) inherently predetermine the receiver, making them incompatible with the flexible recipient assignment required in auction settings. In this paper, we propose recipient-agnostic hash locks (RAHL), a new primitive that extends the HTLC framework to support dynamic recipient selection. By leveraging adaptor signatures and the UTXO model, we construct mutually exclusive pre-payments that allow multiple potential receivers to participate, while ensuring that only one is ultimately finalized. Furthermore, we embed adaptor signatures with polynomial commitments such that the secret revealed during settlement encodes recipient information, thereby enabling recipient-agnostic functionality. We formally model RAHL under a rational cross-chain communication (CCC) setting, and prove that it satisfies effectiveness and atomicity, while providing resilience against front-running and temporary censorship attacks. Experimental results demonstrate that RAHL primitive supports auctions between Bitcoin and Ethereum, reducing cross-chain settlement overhead by 33% compared to representative light-client approaches.

As the artificial intelligence, large model, Metaverse, and Web 3.0 develop rapidly, data is being traded constantly. Existing data exchange methods primarily rely on trusted third parties, which compromises fairness and decentralization. Moreover, existing methods often overlook data access control during trading and typically employ an one-to-one model, resulting in high communication and computational overhead. To address these issues, this article makes the following contributions. First, we propose a blockchain-based secure and fair data trading scheme named fair data trading (FairDT). By leveraging blockchain and smart contracts, FairDT achieves decentralized data trading with high throughput and scalability. Second, we design a fair data exchange mechanism that utilizes commitment schemes, Merkle trees, and other techniques to facilitate dispute resolution with constant on-chain cost when conflicts arise. Third, we incorporate attribute-based encryption to enable fine-grained access control in data trading, thereby reducing the computational burden on data sellers. Finally, we prove that FairDT satisfies access control, fair exchange, completeness, and termination properties. Experimental results on the Ethereum testnet demonstrate that the on-chain cost remains constant, showing that FairDT is highly efficient.

The automatic dependent surveillance broadcast (ADS-B) system is a critical surveillance technology in air traffic management (ATM), essential for enhancing aviation safety and operational efficiency. However, ADS-B broadcasts plaintext messages over open channels without authentication mechanisms, and is constrained by message length limitations and low bandwidth, making it susceptible to various attacks, including deception, tampering, and replay. To address these challenges, we propose a secure and lightweight blockchain-integrated certificateless signature scheme (ECB-CLS) tailored for ADS-B systems with packet resilience. Specifically, we introduce an efficient signature verification algorithm based on elliptic curve cryptography (ECC) that supports batch verification without the need for certificate management, complex bilinear pairing, or hash-to-point calculations, significantly reducing computational overhead. Furthermore, our scheme leverages blockchain to ensure the decentralization and traceability of massive public keys and provides provable security against Type I and Type II adversary attacks. To address packet loss in practical environments, we incorporate both standard and enhanced Reed-Solomon (RS) coding to recover lost data. Experimental evaluations demonstrate that our blockchain-integrated ECB-CLS scheme offers substantial advantages in computational efficiency and signature length compared to existing methods, while also showing that RS coding introduces low-performance overhead. This makes our solution highly suitable for resource-constrained ADS-B systems.

The AI-driven Internet of Things (AIoT) has been widely applied in the field of Internet of Vehicles (IoV) for vehicular cooperation. Federated learning (FL), due to its ability to protect users’ data privacy, reduce communication overhead, and facilitate real-time decision making, is widely applied in the augmented intelligence of things for vehicles (AIoV). However, integrating FL with AIoV poses challenges, including the absence of fine-grained access control, insufficient safeguards for FL tasks and vehicle identities, inadequate security for data transmission, and shortcomings in protecting data storage. These vulnerabilities may lead to risks such as vehicle tracking, model information theft, and data tampering. To address these challenges, we propose a privacy preservation mechanism for AIoV via cloud–edge–vehicle hierarchical sharding blockchain. First, we propose a hierarchical anonymous authentication scheme for IoV devices with stronger scalability and higher fault tolerance. Vehicles only know the attributes of each other or which shard they belong to. Second, we present a secure FL task assignment scheme for AIoV. Edge nodes utilize attribute-based encryption to deploy fine-grained FL tasks based on vehicle attributes. Only users who meet the attributes can decrypt the content, protecting FL tasks content and participant identities. Third, we present a secure data transmission scheme between AIoV devices to protect the identity and data privacy of both parties, while also achieving noninteractive key agreement. Additionally, we propose a scalable secure data sharing and storage scheme based on hierarchical sharding blockchain, aiming to reduce storage overhead and minimize trust costs.

With the rapid development of cloud computing technology, cloud services, represented by cloud storage and data retrieval, have been widely researched in Internet of Things (IoT). As a result, various data retrieval schemes have been proposed. The multikeyword Ranked Searchable Encryption Scheme (MRSE) was developed to improve the accuracy and experience of users searching data. However, MRSE has its drawbacks, such as the security risk of key leakage and limited functionality. Therefore, this article proposes a Privacy-preserving IoT Data Retrieval Scheme (PDRS) that supports lightweight fine-grained access control. We analyze the risk of key information leakage in MRSE, and perform permutation operations on encrypted indexes and trapdoors in PDRS to prevent key leakage and improve system security. Furthermore, in IoT scenarios with multiusers and multikeys, the secure user identity authentication mechanism ensures that only authorized users can acquire legitimate keys to generate search trapdoors, preventing malicious users from impersonating legitimate users and accessing private data. A novel polynomial-based access control is designed to realize attribute-based fine-grained access control, which enables resource-limited devices to limit data access to data users and achieves lightweight overhead. Finally, a formal theoretical analysis demonstrates that PDRS is secure. Simulation experiments verify that PDRS is efficient and lightweight.

With the approach of the quantum era, public key cryptography (PKC) faces risks, which also presents challenges to blockchain technologies that utilize PKC as a core component. Sharding blockchain is a promising way to realize scalability, yet current research does not consider quantum-resistant sharding blockchains as it is non-trivial to design cross-shard communication and transaction processing method without PKC. Besides, blockchain enables reliability in data transmission and unbreakable communication while current schemes suffer from high overhead and low throughput. In this paper, we propose a quantum-resistant sharding blockchain (QRShar) and a secure data transmission scheme (QRDT) to fill the above gap. Firstly, we design a secure and efficient cross-shard communication pattern utilizing hash-based message authentication code (HMAC) and erasure code to reduce the transmission load and achieve high efficiency. Secondly, we propose the a quantum-resistant sharding blockchain utilizing optimized cross-shard transaction processing method to decrease the consensus execution frequency. Thirdly, we introduce a quantum-resistant key agreement protocol through the verifiable secret sharing on cryptographic hash function and we also offer a data transmission scheme to realize efficient QRDT. Furthermore, we conduct security analysis and performance evaluations for our schemes. The results show that the QRShar throughput can reach up to 34 KTPS and the latency stays below 2 seconds. The key agreement latency is just 43ms.

Tor's original design does not have an incentive mechanism but relies on volunteers to maintain their relay nodes for free, eventually leading to the current situation of centralization and lack of relay nodes. Current incentive schemes designed for Tor generally rely on centralized roles, thus presenting a risk of destroying Tor's anonymity. This paper proposes R2E, a decentralized scheme that treats Tor relay services as cryptocurrency mining and rewards the relays with generated tokens while addressing the challenge of how to design decentralized protocols that quantify workload while ensuring fairness and anonymity. We construct the Proof-of-Relay protocol in R2E that enforces random circuit selection, limits the number of nonce attempts, and exploits one-time keys and zero-knowledge proofs to protect participants' identities. We implemented a prototype of R2E based on Ethereum and conducted the trial operation and several confirmation experiments involving$2^{20}$clients,$2^{10}$to$2^{16}$nodes, and 256 circuits for each client to demonstrate its applicability. Analysis and experimental results show that R2E can effectively ensure the anonymity of participants' identities and fairness of incentive allocation while showing good performance in overhead and scalability, making it easy to be quickly applied in practical deployments.

In recent years, Generative Adversarial Networks (GANs) have become essential tools in artificial intelligence research. Field Programmable Gate Arrays (FPGAs) offer remarkable flexibility, high performance, and energy efficiency for deploying GANs. However, the open and reprogrammable architecture of FPGAs, despite its advantages, introduces risks of unauthorized access and reverse engineering. To address this challenge, this paper presents a novel approach integrating Physical Unclonable Functions (PUFs) and logos to protect the Intellectual Property Rights (IPR) of GANs. Our method establishes a closed-loop conversion process where logos are transformed into PUF responses, generating unique identities fed into the GAN to reproduce the original logo. By embedding PUF response information into latent vectors, the generator produces images with embedded logos. Thanks to the uniqueness of PUF, a robust binding of the logo, FPGA, and GANs' IPR is implemented, allowing verification of the IPR with the assistance of a unique FPGA fingerprint, even when a publicly available logo is used. Experimental results show that embedding the logo does not change the performance of the original GANs, and the logo detection rate exceeds 90%. At the same time, the scheme can effectively resist brute force, fine-tuning and pruning attacks.

Addressing blockchain's insufficient throughput and scalability is imperative for practical viability. Off-chain approaches, such as state channels (including Hash Time Lock Contract (HTLC), virtual channels), demonstrate enhanced throughput by enabling parallel transaction processing. While virtual channels introduce execution complexity, HTLC suffers from high update delays. Moreover, existing methods face network attacks. We present Sharding-based Hybrid State Channel (SharHSC) to address these issues. First, we introduce a novel off-chain sharding architecture, which partitions proxy nodes into multiple shards. Thus, when the off-chain node count increases, adding shards enhances system throughput. Second, each shard establishes a supervisory committee to record latest channel statuses to ensure accurate fund distribution upon channel closure. Third, we combine the strengths of HTLC and virtual channels. In particular, SharHSC constructs a single virtual channel across all the nodes involved in the payment by treating the nodes between payer and payee as an intermediate entity, which utilizes HTLC for fund routing. This realizes both low latency and streamlined complexity. Finally, our work is substantiated by security analysis and experiments. As the node number varies, compared with HTLC and virtual channels, the latency is reduced by 49.32% and 31.82%, and the throughput is increased by 8.93 and 1.89 times.

In Web 3.0’s pursuit of a decentralized and user-autonomous network, traditional access control methods, such as central servers and weak decentralized algorithms, are insufficient regarding security, fault tolerance ability, and scalability. To solve this, we first design a decentralized multi-committee attribute-based encryption, X-ABE, to address the weak decentralization and low fault tolerance in Multi-Authority Attribute-Based Encryption (MA-ABE). X-ABE replaces MA-ABE’s fragile attribute authorities with robust attribute committees, each composed of multiple nodes. By developing dual-wrapped shares techniques, we address the increased dimensionality challenge of secret sharing while maintaining only 1 distributed key generation instance. Also, a formal security definition and proof under the partial adaptive model are given using dual system encryption. Second, X-LOCK, an X-ABE based decentralized access control utilizing consensus plus sharding, is proposed for Web 3.0, to achieve full decentralization, consistency, fault tolerance, user autonomy, and scalability. Third, X-ABE-R is proposed for attribute revocation and is demonstrated in X-LOCK-R with sharding blockchain as an immutable revocation ledger. Fourth, a formal definition and comparative analysis of X-ABE’s fault tolerance abilities are demonstrated, covering aspects of liveness and safety, along with the complexity analysis. Fifth, practical evaluations are conducted, demonstrating that while improving fault tolerance, the overhead remains acceptable.

Cross-chain bridges connect two heterogeneous and independent blockchains, in which router contracts interact with external modules to perform functions, e.g., locking assets. However, numerous attacks exploit external interaction vulnerabilities (EIVs) in router contracts. Detecting EIVs presents two key challenges: (1) extracting complete data dependencies, and (2) identifying access controls for off-chain entities. Existing approaches, which transform contracts into intermediate representations for analysis, often miss critical execution logic (e.g., path conditions) and data flows (e.g., data flows at the instruction parameter level). Additionally, the path explosion severely impacts analysis efficiency. In this paper, we systematically analyze real-world attacks and extract the precise features of two typical EIVs. We propose BridgeGuard, a static analysis framework for detecting EIVs. Specifically, we present a symbolic dataflow analysis approach to capture complete execution logic and fine-grained data flows. We then identify three common authentication patterns for off-chain entities and deploy a heuristic-driven pruning method to solve the path explosion. We implement an automated analysis prototype. The experimental results show that for analyzing 1,035 wild contracts with an average scale of 15,914 bytes, BridgeGuard achieves 87.4% average code coverage. For detecting two typical EIVs, BridgeGuard achieves F1-scores above 0.93.

Cryptocurrencies and permissionless blockchains allow nodes from all over the world to join, and their rapid development has created enormous blockchain networks with nodes spanning the globe. Blockchain network partitioning attacks split the network into separate node groups through disrupting communication, causing information inconsistency, and facilitating malicious behaviors like double-spending and selfish mining, threatening the blockchain security. Existing research primarily studies concrete partitioning attack methods. However, it is hard to analyze practical post-attack security and efficiency impacts on blockchains and design effective countermeasures. This paper studies practical network partitioning attacks’ impacts on existing proof-of-work-based (Bitcoin) and proof-of-stake-based (Ethereum) permissionless blockchains. We theoretically analyze and experimentally confirm the adverse effects of network partitioning on blockchain performance and security. Network partitioning will cause blockchain throughput to plummet, and cause block generation delay to increase rapidly. In our experiments on Ethereum 2.0, when the bandwidth between the partitioned networks is lower than 768 Kbps, the throughput begins to plummet precipitously until it ultimately falls to 0. What’s worse, network partitioning will significantly increase the success rate of double-spending. In our experiments on Bitcoin, when the bandwidth between the partitioned networks is less than 256 Kbps, the success rate of double-spending reaches 50%. To solve the above issues, we propose countermeasures leveraging a freezing threshold to safeguard the security of permissionless blockchains and resist double-spending attacks. We experimentally validate that the countermeasures enhance the resistance of permissionless blockchains to network partitioning attacks. It reduces the probability of double-spending in partitioned networks, thereby ensuring security and reliability.

Blockchain and cryptocurrencies are developing rapidly, and the scalability issue has become a constraint on their practical application and development. Off-chain payment channel is an effective solution to the scalability problem of blockchain. Currently, various payment channel protocols have been proposed. However, privacy issues are vital in payment channels. Existing works that consider privacy issues mainly focus on payment channel networks and payment channel hubs, while there is little work on two-party and multi-party channels. In addition, many existing payment channel works that consider privacy protection fix the transaction amounts to ensure the hiding of payment relationships or rely on smart contracts, which will hinder the practical application of payment channels. In this work, we propose a two-party privacy-preserving payment channel protocol that is compatible with Bitcoin (TBPChannel), achieving value privacy and unlinkability, while supporting variable transaction amounts. On this basis, we propose a privacy-preserving multi-party payment channel protocol (MBPChannel), which removes the role of untrusted operators in previous multi-party settings and further achieves robustness. We formally model the protocols in the universal composability framework and prove the security. Finally, we implement the protocols and provide a performance evaluation. The results demonstrate the scalability and practicality of our protocols. Compared to current protocols, even though we use privacy-preserving methods, our protocols are still efficient and applicable in practice.

It is critical to achieve the following objectives in partially synchronous Byzantine Fault Tolerance (BFT) protocols: (1) two-phase commit regime, (2) standard optimistic responsiveness, and (3) linear communication complexity. These three properties significantly affect the efficiency of BFT protocols. A number of attempts, such as HotStuff and Tendermint, have been made to solve this problem, but they typically manage to achieve only a subset of these properties. In this work, we propose a two-phase BFT protocol called TockCuckoo that fully achieves the aforementioned three properties. A primary challenge intwo-phaseBFT protocols is HiddenLock: when a leader lacks visibility into the latest locked block states of honest replicas, it cannot safely proceed, potentially stalling the protocol. To address this issue, we introduce the proactive voting paradigm, which explicitly distinguishes between rejection and non-receipt states. After global stable time, an honest leader can always collect sufficient votes through proactive voting, enabling quick responses. TockCuckoo operates in continuous rounds of proactive voting, ensuring responsiveness. The proactive voting process requires only linear communication overhead, which directly results in TockCuckoo achieving linear communication complexity overall. Furthermore, we introduce TockCuckoo+, an extension of TockCuckoo. By introducing a cross-pipelined design, TockCuckoo+ enables more frequent block proposals without sacrificing the key characteristics of TockCuckoo, leading to improved throughput. Our experiments in wide-area networks demonstrate that, TockCuckoo reduces commit latency by 20% to 40% compared to HotStuff across different network sizes, and TockCuckoo+ achieves a throughput increase of 1.1× to 1.5× over HotStuff.

Random beacons are of paramount importance in distributed systems (e.g., blockchain, electronic voting, governance). The sheer scale of nodes inherent in distributed environments necessitates minimizing communication overhead per node while ensuring protocol availability, particularly under adversarial conditions. Existing solutions have managed to reduce the optimistic overhead to a minimum ofO(n2), wherenrepresents the node count of the system. In this paper, we step further by proposing and implementing RandFlash, a leaderless random beacon protocol that achieves an optimistic communication complexity ofO(nlogn). Evaluation results demonstrate that RandFlash outperforms existing constructions, RandPiper (CCS’21) and OptRand (NDSS’23), in terms of the number of random beacons generated within largescale networks comprising 64 nodes or more (e.g., in sizes of 80 and 128). Furthermore, RandFlash exhibits resilience, capable of withstanding up to one-third of the nodes acting maliciously, all without the need for strongly trusted setups (i.e., embedding a secret trapdoor by trusted third parties). We also provide formal security proofs validating all properties upheld by this lineage.

Electronic mail, as one of the most widely used identifiers, is extensively utilized for account registration and recovery, two-factor authentication, and organizational identification. Traditional email ownership authentication is typically achieved through verification codes or links sent via email, which leads to full disclosure of a user’s email address.We propose FreeAuth, an innovative and universal email ownership authentication scheme that enhances privacy by allowing users to selectively disclose email-related information. FreeAuth distinguishes itself from precedents by eschewing verification emails, thus avoiding spam marking and online behavior tracking. It establishes an authentication interaction paradigm based on widely deployed email transmission protocols, such as SMTP, IMAP, and POP3, ensuring legacy compatibility and server obliviousness. Meanwhile, it utilizes TLS Oracle schemes to protect data privacy by disclosing only the authentication outcome of the interaction, rather than revealing the full email address. FreeAuth can be integrated as an alternative to traditional email ownership authentication schemes.We present details of FreeAuth architecture and instantiations of prototype systems, along with three tailored examples of selective email address disclosures to align with various scenario requirements. The experimental analysis indicates that FreeAuth is compatible with up to 96% of existing email providers, and it is notably efficient, requiring only 2.5 seconds of online time to complete ownership authentication in our wide area network settings.

The complexity of cryptographic APIs and developers' expertise gaps often leads to their improper use, seriously threatening information security. Existing cryptographic API misuse detection tools that rely on black/white-list methods require experts to manually establish detection rules. They struggle to dynamically update rules and scale to cover numerous unofficial cryptographic libraries. Furthermore, as these tools are primarily aimed at non-Go languages, they have limited applicability and accuracy in the Go ecosystem, which is extensively used for security-centric applications. To mitigate these challenges, we present Gopher, a novel cryptographic misuse detection framework, that excels in encapsulated API and cross-library detection. In this framework, we have designed CryDict to convert rules into unified and standardized constraints, capable of deriving new usage rules and elucidating implicit knowledge during scanning. Gopher leverages CryDict to create a logical separation between rule formulation and Detector detection, enabling dynamic updating of constraints and enhancing detection capabilities. This significantly improves the Gopher 's compatibility and scalability. Utilizing Gopher, we have conducted an extensive analysis of the Go ecosystem, examining 19,313 Go projects. In our rigorous testing, Gopher demonstrated a remarkable 98.9% accuracy rate and identified 64.1% of previously undetected misuses. This scrutiny has surfaced numerous hidden security vulnerabilities, and highlighted misuse tendencies across diverse project categories.

In the context of rapidly evolving cloud service systems and blockchain ecosystems, certain lightweight edge client nodes responsible for continuous generation or transmission of streaming data often exhibit limited computational prowess. Traditional dynamic integrity audit schemes, which rely on one-time initialization frameworks and incur high client-side over-heads, are ill-suited to this scenario. To address these challenges, this paper introduces Iterative Proof of Retrievability (IPoR), an integrity verification scheme for periodic incremental data via optimistic tags generation. We propose a publicly verifiable tripartite IPoR system framework comprised of SDC, EAP and SSP, where the majority of the stream data tagging process is attributed to the SSP responsible for data storage. To ensure the verifiability of the EAP's stream data tag generation process, we introduce a fraud proof based on SMT, the latter substantially decreasing the computational load on public validators. We formally prove under the random oracle model that IPoR satisfies storage integrity and tag generation completeness. Theoretical performance analysis and experimental results demonstrate that our IPoR construction can help clients save over 90% on initial computational overhead.

Web3 is a revolutionary Internet paradigm that focusing decentralization, user empowerment, and intelligence. One of its key technologies is decentralized identity (DID), which has gained significant attention recently. However, existing DID solutions are not scalable enough to be compatible with the large-scale identity node applications required by Web3 across various fields. To overcome this challenge, we propose the first multi-layer Web3 DID architecture utilizing sharding blockchain, which provides management, scalability, and compatibility. This architecture leverages leader shards and the main chain to establish trust, while regular shards manage DID-related transactions. Specific system processes and query optimizations are also given. Besides, formal security analysis and comprehensive simulation evaluations have demonstrated that the architecture can achieve all proposed security and performance goals, including low latency of down to 2 seconds and high throughput of up to 90KTPS.

The space-air-ground integrated network (SAGIN) has a stringent demand on the efficiency of authentication protocols deployed in the devices that have been launched into the air and space. In this paper, we define the concept of the security model of conditional physical unclonable function (CPUF) that guarantees the security of the protocol while allowing the use of PUFs that can be modeled. We then propose a CPUF-based authentication and key agreement (AKA) scheme, named CPAKA, that addresses the challenges of device key leakage and inefficient authentication in resource-asymmetric environments. The CPAKA scheme embeds PUFs in weak nodes and deploys prediction models corresponding to the PUFs in strong nodes, eliminating the need to store challenge-response pairs or perform complex calculations. We formally prove the protocol's security under the decisional uniqueness assumption of CPUF and the universal composability framework, and we analyze its secrecy and authentication properties using the Tamarin prover. We also implement an Arbiter PUF on the ZYNQ-7020 FPGA, verify its accuracy through experiments, and show that CPAKA is secure, efficient, and suitable for SAGIN. Our CPAKA scheme greatly reduces computing and storage costs while improving authentication efficiency compared to traditional schemes.

The cloud-edge-end architecture is suitable for many essential scenarios, such as 5 G, the Internet of Things (IoT), and mobile edge computing. Under this architecture, cross-domain and cross-layer data sharing is commonly in need. Considering cross-domain data sharing under the zero-trust model, where each entity does not trust the others, existing solutions have certain problems regarding security, fairness, scalability, and efficiency. Aiming at solving these issues, we conduct the following research. First, a new plaintext checkable encryption scheme is constructed, which can be used on lightweight IoT devices to verify the ciphertext validity sent by a data owner. Second, we propose a new multi-domain cloud-edge-end architecture based on sharding blockchains and design a cross-domain data sharing scheme under the partial trust model to achieve security, scalability, and high performance. Third, a cross-domain data sharing scheme under the zero trust model is further designed, which can ensure the fairness of both parties in data sharing. Fourth, we give a formal security definition and analysis of cross-domain data sharing. Fifth, we conduct a detailed theoretical analysis of the protocol and give an in-depth functional test and performance test, including the throughput and latency of data sharing policy registration and execution.

Due to the promising scalability property, sharding technology has gained widespread attention. It improves the transaction throughput of blockchain systems but also introduces cross-shard transactions. Current two-phase commit (2PC) protocols process different cross-shard transactions sequentially, resulting in significant system overhead and low throughput. Besides, current sharding blockchains rely on Byzantine fault tolerance (BFT) as a black box, lacking specific designs to efficiently handle cross-shard proposals. Moreover, cross-shard communication complexity is high, and transaction processing parallelism is low. In this paper, we first propose P-2PC, a general framework to process cross-shard transactions of different phases in a pipelined way, suitable for most sharding blockchains. Further, we design Cherubim with improved quadruple 2PC, 4P-2PC. By combining P-2PC with an intra-shard pipelined BFT, 4P-2PC achieves both intra-shard and cross-shard pipelined processing. Combined with a newly designed batch processing method, each shard processes 4 transaction batches simultaneously through 1 round of calculation and communication, compared to 4 rounds in previous work. In particular, Cherubim seamlessly integrates a multi-signature algorithm supporting further aggregation, reducing communication complexity. Furthermore, we evaluate our work through theoretical analysis and implementation, proving that Cherubim has a communication complexity linear to the node number. We also propose horizontal and vertical consensus parallelism degrees to evaluate the parallelism ability. Compared to the state-of-the-art solutions, the evaluation demonstrates that Cherubim achieves a transaction throughput improvement of at least 2.28×.

Consensus protocols play a crucial role in determining the security and performance of blockchain systems, with committee-based consensus protocols being particularly important, especially in sharding consensus protocols. Anonymous election of committee nodes can mitigate DDoS attacks and bribery attempts. This approach can also be applied to sharding systems to mitigate the risk associated with a single vulnerable shard. However, current node secret selection schemes still present remaining issues. Single secret leader election schemes struggle to elect multiple leaders with equal anonymity, and existing secret committee election schemes lack adequate measures for tracking malicious nodes. To address these issues, we propose accountable secret committee election schemes that not only regulate the number of nodes but also maintain anonymity during the phases of leader proposal and verifier voting. Furthermore, our schemes enable the tracing of malicious nodes in a threshold way. In addition, we introduce two efficient threshold traceable membership proof schemes for both ad hoc and interactive scenarios. Unlike traceable ring signatures, our scheme can trace malicious nodes even after a single malicious behavior. Subsequently, we apply the accountable secret committee election scheme to sharding blockchains and devise a fully accountable anonymous consensus protocol. The experiment demonstrates that this protocol can elevate the difficulty of corrupting a single shard to the level of compromising the entire system, thereby significantly enhancing the security of the sharding system.

Secret leader election in consensus could protect leaders from Denial of Service (DoS) or bribery attacks, enhancing the blockchain system security. Single Secret Leader Election (SSLE), proposed by Boneh et al., supports electing a single random leader from a group of nodes while the leader’s identity remains secret until he reveals himself. Subsequent research endeavors have introduced distinct approaches to realize SSLE, yet most of these solutions consume relatively high communication complexity. In this paper, we propose an extended SSLE scheme, Secret Multiple Leaders Election (SMLE), based on linkable membership proof. A general SMLE scheme supports the one-time election of multiple consecutive secret leaders while reducing the average communication cost of a single leader election to constant complexity. In particular, SMLE is proven to satisfy a newly proposed consistent unpredictability property for each leader. Specifically, two concrete SMLE constructions are constructed. The first construction is designed for non-interactive scenarios where pre-configured system nodes are not required. The second one is designed for interactive scenarios where nodes operate within a committee. Furthermore, we extend SMLE to Secret Committee Election (SCE) and realize the anonymous node allocation in sharding blockchains utilizing SCE, thereby significantly enhancing the security of the sharding system. Finally, the experimental results indicate that our constructions exhibit minimal communication and computational overhead. When integrated into sharding systems, our protocol could increase an adversary’s attack difficulty, with the enhancement proportion approximately equal to the shard number.

The device fingerprinting technique extracts fingerprints based on the hardware characteristics of the device to identify the device. The primary goal of device fingerprinting is to accurately and uniquely identify a device, which requires the generated device fingerprints to have good stability to achieve long-term tracking of the target device. However, the fingerprints generated by some existing fingerprinting technologies are not stable enough or change frequently, making it impossible to track the target device for a long time. In this paper, we present FPHammer, a novel DRAM-based fingerprinting technique. The device fingerprint generated by our technique has high stability and can be used to track the device for a long time. We leverage the Rowhammer technique to repeatedly and quickly access a row in DRAM to get bit flips in its adjacent row. We then construct a physical fingerprint of the device based on the locations of the collected bit flips. The evaluation results of the uniqueness and reliability of the physical fingerprint show that it can be used to distinguish devices with the same hardware and software configuration. The experimental results on device identification demonstrate that the physical fingerprints engendered by our innovative technique are inherently linked to the entirety of the device rather than just the DRAM module. Even if the device modifies software-level parameters such as MAC address and IP address or even reinstalls the operating system, we can accurately identify the target device. This demonstrates that FPHammer can generate stable fingerprints that are not affected by software layer parameters.

The communication efficiency optimization, censorship resilience, and generation of shared randomness are inseparable from the threshold cryptography in the existing Byzantine Fault Tolerant (BFT) consensus. The membership in consensus in a blockchain scenario supports dynamic changes, which effectively prevents the corruption of consensus participants. Especially in cross-chain protocols, the dynamic access to different blockchains will inevitably bring about the demand for member dynamic. Most existing threshold cryptography schemes rely on redefined key shares, leading to a static set of secret sharing participants. In this paper, we propose a general approach to coupling blockchain consensus and dynamic secret sharing. The committee performs consensus confirmation of both dynamic secret sharing and transaction proposals. Our scheme facilitates threshold cryptography membership dynamic, thus underlying support for membership dynamic of threshold cryptography-based BFT consensus schemes. We instantiate a dynamic HotStuff consensus to demonstrate the effectiveness of the scheme. After the correctness and security proof, our scheme achieves the secrecy and integrity of the threshold key shares while ensuring consensus liveness and safety. Experimental results prove that our scheme obtains dynamic membership with negligible overhead.

With the continuous advancement of edge intelligence, edge servers undertake more and more intelligent computing tasks. Nowadays, there are a large number of IoT devices in the network in idle state. For instance, the mining process for consensus of miners in blockchain such as Bitcoin causes a waste of computing resources and energy. A natural question arises: can we couple the idle computing resources of network devices to continuously and credibly share the burden of edge intelligent computing tasks in a secure manner? The answer of this paper is yes. We propose a blockchain-based IoT resource monitoring and scheduling framework that supports resource management and trusted edge computing. We analyze the security threats in all phases of distributed edge computing, and utilize the trusted computing and public verifiability features of blockchain to ensure reliability and fairness in the trusted measurement of device computing power, the decomposition of intelligent computing tasks, the matching of task and computing power, and the verification of computing result. Finally, we implement a simulation on the edge network by performing distributed machine learning task for weather prediction, and the simulation results demonstrate the availability of our scheme.

Cloud computing has become an increasingly popular option for users to store and share data. Encryption prior to outsourcing data to the cloud is the best way to protect data security and privacy; however, it hinders sharing of the data that was encrypted. In addition, users in many real-world organizations (e.g., enterprises) have multiple level structures and a higher-level user should have the privilege to decide which data can be shared with a lower-level user. Most solutions in the literature suffer from inefficiency or inflexibility in tackling this problem. In this article, we propose a fine-grained hierarchical data sharing (FHDS) scheme in clouds. With FHDS, the data owner can encrypt data with his public key, and then selectively share encrypted data with users in a hierarchy; if necessary, the users can disseminate the owner's data to their subordinates in the lower levels by generating access keys. In particular, the higher-level users could puncture the keys with some tags such that the part of the owner's data which is labeled by the punctured tags will not be accessible to the lower-level users. The proposed scheme is provable secure under our security model and performance analyses show the efficiency of the scheme.

Sharding technology is crucial to achieve decentralization, scalability, and security simultaneously. However, existing sharding blockchain schemes suffer from high cross-shard transaction processing latency, low parallelism, incomplete cross-shard views of shard members, centralized reconfiguration, high overhead of randomness generation, and lack of formalized protocol design and security proofs. This paper proposes a flexible sharding (FS) blockchain protocol. First, a cross-shard Byzantine fault tolerance (CSBFT) protocol is designed to cut down confirmation delays when processing cross-shard transactions. Second, we utilize multiple parallel CSBFT where each node acts not only as a leader but also as multiple ordinary members to break through the performance bottleneck caused by a leader’s bandwidth and computing power, improving the system parallelism. Third, a cross-shard transaction censorship attack is proposed, and a cross-shard view-change mechanism is designed to defend against it. Fourth, a secure and truly decentralized shard reconfiguration method combining proof-of-work, proof-of-possession, and intra-shard BFT is designed. Fifth, we utilize a formal protocol design method and give strict security proof for each protocol. Finally, we evaluate FS from both theoretical and practical perspectives. FS is proven to have lower communication and computation complexity and achieve considerable performance.

Difficulty adjustment algorithm (DAA) is critical for PoW blockchain systems in currency issuance, transaction throughput, and blockchain security. Most DAAs concentrate on the unique goal of block-making stability from seconds to minutes. In contrast, we propose a new DAA with the goal of stabilizing orphan rates among the blocks made recently, observing that the orphan rate is more indicative since too high orphan rate indicates poor blockchain security and waste of honest hash power whereas too low orphan rate indicates poor blockchain throughout and wast of time awaiting other blocks. We notice a security defect of the recent orphan-rate DAA (NDSS 2022) in which an attacker may continually create orphan blocks and mislead miners to wrongly increase the difficulty. To fix this defect, our enhanced DAA takes into the orphan rate variation during the historical slots with smooth exponential decay affection on current difficulty adjustment. Theoretical and experimental analyses show that our DAA is effective and secure.

Cloud storage services allow data owners to outsource their potentially sensitive data (e.g., private genome data) to remote cloud servers in a ciphertext form. To enable data owners to further share the data encrypted in ciphertexts, many proxy re-encryption (PRE) schemes are proposed. However, most schemes only support single-recipient or coarse-grained re-encryption, which may limit the flexibility for data sharing. To address this issue, we propose a Policy-based Broadcast Access Authorization (PBAA) scheme by introducing the well-established identity-based broadcast encryption (IBBE) and key-policy attribute-based encryption into PRE. In our PBAA scheme, a data owner can apply IBBE to encrypt his data to a group of recipients. More importantly, the data owner can generate a delegation key with an access policy, and send this key to the cloud such that it can convert any initial ciphertext satisfying the access policy into a new ciphertext for a new group of recipients. With these features, cloud users can share their remote data in a secure and flexible way. Security analysis and performance evaluation show that the PBAA scheme is secure and efficient, respectively.

Sharding blockchains are proposed to solve the scalability problem while maintaining security and decentralization. However, there are still many issues to be solved. First, the member selection and assignment process are not strictly analyzed, which might lead to an increase in the adversary proportion. Second, current intra-shard consensus algorithms are inefficient. Besides, cross-shard transaction processing costs expensive system overhead. Moreover, there is a lack of a formal security framework. In this article, we propose a secure and scalable hybrid consensus (SSHC). First, we propose a fair sharding selection scheme to select committee members, including mining processes and member lists confirmation by a reference committee. Second, a pipelined Byzantine fault tolerance for intra-shard consensus is designed, combining the pipelined technology with threshold signatures. Third, we propose a responsive sharding transaction batch processing mechanism to handle cross-shard transactions, which reduces the number of calls to Byzantine fault tolerance algorithms. Fourth, a secure committee reconfiguration method is designed to update shard members efficiently. Furthermore, we employ a formal security framework to design and analyze a sharding blockchain. For an adversary whose computational power fraction is less than$1/3$, by reasonably setting a corruption parameter and other related parameters, SSHC is proved to achieve consistency and liveness.

Dynamic searchable symmetric encryption (DSSE) has been widely recognized as a promising technique to delegateupdateandsearchqueries over an outsourced database to an untrusted server while guaranteeing the privacy of data. Many efforts on DSSE have been devoted to obtaining a good tradeoff between security and performance. However, it appears that all existing DSSE works miss studying on what will happen if the DSSE client issues irrationalupdatequeries carelessly, such as duplicateupdatequeries anddeletequeries to remove non-existent entries (that have been considered by many popular database system in the setting of plaintext). In this scenario, we find that (1) most prior works lose their claimed correctness or security, and (2) no single approach can achieve correctness, forward and backward security, and practical performance at the same time. To address this problem, we study for the first time the notion of robustness of DSSE. Generally, we say that a DSSE scheme is robust if it can keep the same correctness and security even in the case of misoperations. Then, we introduce a new cryptographic primitive named key-updatable pseudo-random function and apply this primitive to constructing ROSE, a robust DSSE scheme with forward and backward security. Finally, we demonstrate the efficiency of ROSE and give the experimental comparisons.

It is becoming fashionable for people to access data outsourced to clouds with mobile devices. To protect data security and privacy, attribute-based encryption (ABE) has been widely used in cloud storage systems. However, one of the main efficiency drawbacks of ABE is the high computation overheads at mobile devices during user revocation and file access. To address this issue, we propose a revocable attribute-based data storage (RADS) scheme equipped with several attracting features. First, our RADS scheme achieves a fine-grained access control mechanism, by which file owners do not need to explicitly specify authorized visitors to their outsourced files. Second, our RADS scheme allows mobile users to authorize the cloud service provider (CSP) to share costly computations in file access, without exposing the file content. Third, our RADS scheme offloads the operations of access-credential update and file re-encryption during revocation process to CSP, leaving all non-revoked users undisturbed. The revocation of RADS achieves a strong data protection, i.e., revoked users can access neither newly uploaded files nor old ones. The security and efficiency of the RADS scheme are validated via both analysis and experimental results.

Outsourcing encrypted data to cloud servers that has become a prevalent trend among Internet users to date. There is a long list of advantages on data outsourcing, such as the reduction cost of local data management. How to securely operate encrypted data (remotely), however, is the top-rank concern over data owner. Lianget al.proposed a novel encrypted cloud-based data share and search system without loss of privacy. The system allows users to flexibly search and share encrypted data as well as updating keyword field. However, the search complexity of the system is of extreme inefficiency,$O(n d)$, where$d$is the total number of system files and$n$is the size of query formula. This article, for the first time, leverages the “oblivious cross search” technology in public key searchable encryption context to reduce the search complexity toonly$O(nf(w))$, where$f(w)$is the number of files embedded with the “least frequent keyword”$w$. The new scheme maintains efficient encrypted data share and keyword field update as well. This article further revisits the security models for payload security, keyword privacy and search token privacy (i.e., search pattern privacy) and meanwhile, presents security and efficiency analysis for the new scheme.

Cloud technology has brought great convenience to enterprises as well as customers. System logs record notable events and are becoming valuable resources to track and investigate system status. Detecting anomaly from logs as fast as possible can improve the quality of service significantly. Although many machine learning algorithms (e.g., SVM, Logistic Regression) have high detection accuracy, we find that they assume data are clean and might have high training time. Facing these challenges, in this paper, we propose Robust Online Evolving Anomaly Detection (ROEAD) framework which adopts Robust Feature Extractor (RFE) to remove the effects of noise and Online Evolving Anomaly Detection (OEAD) to dynamic update parameters. We propose Online Evolving SVM (OES) algorithm as the example of online anomaly detection methods. We analyze the performance of OES in theory and prove the performance difference between OES and the best hypothesis tends to zero as time goes infinity. We compare the performance of ROEAD against state-of-the-art anomaly detection algorithms using public log datasets. The results demonstrate that ROEAD is able to remove the effects of noise and OES can improve the detection accuracy by more than 40%.

With the outbreak of e-mail message leakage events, such as the Hillary Clinton’s Email Controversy, privacy and security of sensitive e-mail information have become users’ primary concern. Encrypted email seems to be a viable solution for providing security, but it will greatly limit their operations. Public encryption with keyword search (PEKS) scheme is a popular technology to incorporate security protection and favorable operability functions together, which can play an important role in searching over encrypted email in a cloud server. In this paper, we propose a practical PEKS scheme named as public-key multi-keyword searchable encryption with hidden structures (PMSEHS). It could enable e-mail receivers to do the multi-keyword and boolean search in the large encrypted email database as fast as possible, without revealing more information to the cloud server. We also give comparative experiments, which demonstrate that our scheme has a higher efficiency in multi-keyword search for encrypted emails.

In permissionless blockchains, due to the corruption attack of an adversary, nodes participating the protocol need to be updated regularly. In the process of node selection and committee reconfiguration, there may exist some problems. First, a complicated secure randomness generation protocol is in need. Besides, an adversary might obtain a mining puzzle in advance and start mining in ahead of honest nodes. Moreover, an adversary usually has an advantage of network delay. In order to solve the above problems, we conduct the following research. Firstly, we propose a PoW solution withhold attack against PoW-based member selection methods. An adversary might withhold his mining results in an epoch to obtain the mining puzzle of the next epoch in advance of honest nodes. Secondly, a secure shard reconfiguration protocol is designed, which does not rely on any complicated randomness generation protocol. Our shard reconfiguration protocol is proved rigorously to be secure, which means that in each selected committee, the honest node fraction exceeds a predefined target value. Thirdly, we implement our shard reconfiguration protocol. By carefully setting related system parameters, our protocol could be applied easily to most sharding blockchains. To our best knowledge, the shard reconfiguration protocol proposed in this paper is the first protocol that could safely implement node selection and committee reconfiguration of a sharding blockchain without using a secure randomness, which greatly reduces the communication and time overhead caused by the generation of a randomness.

Summary As the value of data has received considerable attention, data trading shows broad market prospects. The existing data trading methods, including private trades and centralized trades, have high risks regarding transaction security and data protection. To solve this problem, we propose a decentralized trading solution for open fair data trading by deploying the smart contract on the blockchain network. The data for sale are encrypted and stored on the distributed storage platform but not directly on the blockchain network. Because the trading content is the decryption key of the data, the proposed new method can alleviate the storage pressure of the blockchain by reducing the transaction cost. We conduct a security analysis which shows that our scheme achieves secure, practical, open, and fair trading. We implement our trading contract with solidity and test it on the Ethereum's test network, and extensive experiments demonstrate desirable feasibility of our proposal.

The application of cloud storage system has been deployed widely in recent years. A lot of electronic medical records (EMRs) are collected and uploaded to the cloud for scalable sharing among the authority users. It is necessary to guarantee the confidentiality of EMRs and the privacy of EMR owners. To achieve this target, we summarize a series of attack behaviors in the cloud storage system and present the security model against many types of unexpected privacy leakage. Privacy of unassailed EMRs is guaranteed in this model, and the influence of privacy leakage is controlled in a certain scope. We also propose a role-based access control scheme to achieve flexible access control on these private EMRs. One can access medical records only if his/her role satisfies the defined access policy, which implies a fine-grained access control. Theoretical and experimental analyses show the efficiency of our scheme in terms of computation and communication.

With the rapid development of cloud computing, an increasing number of individuals and organizations are sharing data in the public cloud. To protect the privacy of data stored in the cloud, a data owner usually encrypts his data in such a way that certain designated data users can decrypt the data. This raises a serious problem when the encrypted data needs to be shared to more people beyond those initially designated by the data owner. To address this problem, we introduce and formalize an identity-based encryption transformation (IBET) model by seamlessly integrating two well-established encryption mechanisms, namely identity-based encryption (IBE) and identity-based broadcast encryption (IBBE). In IBET, data users are identified and authorized for data access based on their recognizable identities, which avoids complicated certificate management in usual secure distributed systems. More importantly, IBET provides a transformation mechanism that converts an IBE ciphertext into an IBBE ciphertext so that a new group of users not specified during the IBE encryption can access the underlying data. We design a concrete IBET scheme based on bilinear groups and prove its security against powerful attacks. Thorough theoretical and experimental analyses demonstrate the high efficiency and practicability of the proposed scheme.

Anomaly detection for cloud servers is important for detecting zero-day attacks. However, it is very challenging due to the large amount of accumulated data. In this paper, a new mathematical model for modeling dynamic usage behavior and detecting anomalies is proposed. It is constructed using state summarization and a novel nested-arc hidden semi-Markov model (NAHSMM). State summarization is designed to extract usage behavior reflective states from a raw sequence. The NAHSMM is comprised of exterior and interior hidden Markov chains. The exterior controls the propagation of raw sequences of system calls and, conditional on it, the interior one controls the summarized observation process from the transition less usage behavior reflective states. An anomaly detection algorithm is derived by integrating state summarization and NAHSMM. During training the algorithm is assisted by a forensic module to tune the behavioral threshold. Experimental data is collected using IXIA Perfect Storm in conjunction with the commercial security-test hardware platform cyber range. To evaluate the reliability of the proposed model, first, its accuracy and training costs are compared with those of existing machine-learning models and then its scalability and resistance capabilities are tested. The results indicate that this model could be used as a method for detecting anomalies in cloud servers.

The connected vehicular ad hoc network (VANET) and cloud computing technology allows entities in VANET to enjoy the advantageous storage and computing services offered by some cloud service provider. However, the advantages do not come free, since their combination brings many new security and privacy requirements for VANET applications. In this paper, we investigate the cloud-based road condition monitoring (RCoM) scenario, where the authority needs to monitor real-time road conditions with the help of a cloud server so that it could make sound responses to emergency cases timely. When some bad road condition is detected, e.g., some geologic hazard or accident happens, vehicles on site are able to report such information to a cloud server engaged by the authority. We focus on addressing three key issues in RCoM. First, the vehicles have to be authorized by some roadside unit before generating a road condition report in the domain and uploading it to the cloud server. Second, to guarantee the privacy against the cloud server, the road condition information should be reported in ciphertext format, which requires that the cloud server should be able to distinguish the reported data from different vehicles in ciphertext format for the same place without compromising their confidentiality. Third, the cloud server and authority should be able to validate the report source, i.e., to check whether the road conditions are reported by legitimate vehicles. To address these issues, we present an efficient RCoM scheme, analyze its efficiency theoretically, and demonstrate the practicality through experiments.

Data center has become an important facility for hosting various applications. For data center networks, deadline missing rate and average flow completion time are two main metrics for the performance of applications. In this paper, we find deadline-aware methods can only reduce the percentage of flows missing deadline, while flowsize-aware and information-cumulative methods can only optimize the average flow completion time. However, traffic in data center is the mixture of various flows and focusing on the single goal is not enough. We advocate to incorporate deadline and flow duration time into flow rate control. Then we design DA&FD (Deadline-Aware and Flow Duration) based rate control mechanism and analyze its performance in theory. At last, we evaluate DA&FD under different topologies, real world traffic and load scenarios, both by simulation and in real testbed. Our results show that DA&FD performs close to D2TCP and about 15%, 25%, 30%, 35% better than Ameon, L2DCT, Karuna, DCTCP on deadline missing rate. For average FCT, the performance of DA&FD is similar to L2DCT and compared with Ameon, D2TCP, Karuna, DCTCP, DA&FD can reduce average FCT by 10%, 15%, 20%, 25%.

Traditional network resource management mechanisms are mainly flow or packet based. Recently, coflow has been proposed as a new abstraction to capture the communication patterns in a rich set of data parallel applications in data centers. Coflows effectively model the application-level semantics of network resource usage, so high-level optimization goals, such as reducing the transfer latency of applications, can be better achieved by taking coflows as the basic elements in network resource allocation or scheduling. Although efficient coflow scheduling methods have been studied, in this paper, we advocate to schedule weighted coflows as a further step in this direction, where weights are used to express the importances or priorities of different coflows or their corresponding applications. We propose the Weighted Coflow Completion Time (WCCT) minimization problem and a (2-2/n+1)-approximate optimal offline algorithm, where n is the concurrent number of coflows. We then design an information-agnostic online algorithm named IAOA to dynamically schedule coflows according to their weights and the instantaneous network condition. We also design and implement a coflow scheduling system named FlyTransfer, which can use the online algorithm as its scheduling method. We test the performance of FlyTransfer by trace-driven simulations as well as real deployment in openstack. Our evaluation results show that, compared to the latest information-agnostic coflow scheduling algorithms, FlyTransfer can reduce more than 40 percent of the WCCT, and more than 30 percent of the completion time for coflows with above-the-average level of importance. It even outperforms the most efficient clairvoyant coflow scheduling method by reducing around 30 percent WCCT, and 25- 30 percent of the completion time for coflows with above-the-average importance, respectively.

Smart mobile devices are playing a more and more important role in our daily life. Cancelable biometrics is a promising mechanism to provide authentication to mobile devices and protect biometric templates by applying a noninvertible transformation to raw biometric data. However, the negative effect of nonlinear distortion will usually degrade the matching performance significantly, which is a nontrivial factor when designing a cancelable template. Moreover, the attacks via record multiplicity (ARM) present a threat to the existing cancelable biometrics, which is still a challenging open issue. To address these problems, in this paper, we propose a new cancelable fingerprint template which can not only mitigate the negative effect of nonlinear distortion by combining multiple feature sets, but also defeat the ARM attack through a proposed feature decorrelation algorithm. Our work is a new contribution to the design of cancelable biometrics with a concrete method against the ARM attack. Experimental results on public databases and security analysis show the validity of the proposed cancelable template.

Electronic Health Record (EHR) systems bring an abundance of convenience for telediagnosis, medical data sharing and management. A main obstacle for wide adoption of EHR systems is due to the privacy concerns of patients. In this work, we propose a role-based access control (RBAC) scheme for EHR systems to secure private EHRs. In our RBAC, there are two main types of roles, namely independent patients and hierarchically organized medical staffs. A patient is identified by his/her identity, and a medical staff is recognized by his/her role in the medical institute. A user can comprehend an EHR only if he/she satisfies the access policy associated with this EHR, which implies a fine-grained access control. A public auditor is employed to verify whether the EHR is correctly encapsulated with the specified access policy, which provides an a priori approach to find fraudulent EHRs and reduce potential medical disputes. Moreover, our RBAC enforces a forward revocation mechanism. A revoked user cannot access the future EHRs even if his/her previous role satisfies the access policy. These security properties are formally proven under well-established assumptions. Theoretical and experimental analyses show the efficiency of our RBAC in terms of communication and computation.

Cross-client data deduplication has been widely used to eliminate redundant storage overhead in cloud storage system. Recently, Abadi et al. introduced the primitive of MLE2 with nice security properties for secure and efficient data deduplication. However, besides the computationally expensive noninteractive zero-knowledge proofs, their fully randomized scheme (R-MLE2) requires the inefficient equality-testing algorithm to identify all duplicate ciphertexts. Thus, an interesting challenging problem is how to reduce the overhead of R-MLE2 and propose an efficient construction for R-MLE2. In this paper, we introduce a new primitive called μR-MLE2, which gives a partial positive answer for this challenging problem. We propose two schemes: static scheme and dynamic scheme, where the latter one allows tree adjustment by increasing some computation cost. Our main trick is to use the interactive protocol based on static or dynamic decision trees. The advantage gained from it is, by interacting with clients, the server will reduce the time complexity of deduplication equality test from linear time to efficient logarithmic time over the whole data items in the database. The security analysis and the performance evaluation show that our schemes are Path-PRV-CDA2 secure and achieve several orders of magnitude higher performance for data equality test than R-MLE2 scheme when the number of data items is relatively large.

Cloud storage system provides facilitative file storage and sharing services for distributed clients. To address integrity, controllable outsourcing, and origin auditing concerns on outsourced files, we propose an identity-based data outsourcing (IBDO) scheme equipped with desirable features advantageous over existing proposals in securing outsourced data. First, our IBDO scheme allows a user to authorize dedicated proxies to upload data to the cloud storage server on her behalf, e.g., a company may authorize some employees to upload files to the company's cloud account in a controlled way. The proxies are identified and authorized with their recognizable identities, which eliminates complicated certificate management in usual secure distributed computing systems. Second, our IBDO scheme facilitates comprehensive auditing, i.e., our scheme not only permits regular integrity auditing as in existing schemes for securing outsourced data, but also allows to audit the information on data origin, type, and consistence of outsourced files. Security analysis and experimental evaluation indicate that our IBDO scheme provides strong security with desirable efficiency.

Provable data possession (PDP) allows a user to outsource data with a guarantee that the integrity can be efficiently verified. Existing publicly verifiable PDP schemes require the user to perform expensive computations, such as modular exponentiations for processing data before outsourcing to the storage server, which is not desirable for weak users with limited computation resources. In this paper, we introduce and formalize an online/offline PDP (OOPDP) model, which divides the data processing procedure into offline and online phases. In OOPDP, most of the expensive computations for processing data are performed in the offline phase, and the online phase requires only lightweight computations like modular multiplications. We present a general OOPDP transformation framework which is applicable to PDP-related schemes with metadata aggregatability and public metadata expansibility. Following the framework, we present two efficient OOPDP instantiations. Technically, we present aggregatable vector Chemeleon hash functions which map a vector of values to a group element and play a central role in the OOPDP transformation. Theoretical and experimental analyses confirm that our technique is practical to speed-up PDP schemes.

Existing secure and privacy-preserving vehicular communication protocols in vehicular ad hoc networks face the challenges of being fast and not depending on ideal tamper-proof devices (TPDs) embedded in vehicles. To address these challenges, we propose a vehicular authentication protocol referred to as distributedaggregate privacy-preserving authentication. The proposed protocol is based on our new multiple trusted authority one-time identity-based aggregate signature technique. With this technique a vehicle can verify many messages simultaneously and their signatures can be compressed into a single one that greatly reduces the storage space needed by a vehicle or a data collector (e.g., the traffic management authority). Instead of ideal TPDs, our protocol only requires realistic TPDs and hence is more practical.

Electronic Health Record (EHR) system facilitates us a lot for health record management. Privacy risk of patients' records is the dominating obstacle in the widely deployed EHRs. Role-based access control (RBAC) schemes offer an access control on EHRs according to one's role. Only the medical staff with roles satisfying the specified access policies can read EHRs. In existing schemes, attackers can link patients' identities to their doctors. Therefore, the classification of patients' diseases are leaked without actually knowing patients' EHRs. To address this problem, we present an anonymous RBAC scheme. Not only it achieves flexible access control, but also realizes privacy-preserving for individuals. Moreover, our scheme maintains the property of constant size for the encapsulated EHRs. The proposed security models with semantic security and anonymity can be proven under decisional bilinear group assumptions. Besides, we provide an approach for EHR owners to search out their targeted EHR in the anonymous system. For better user experience, we apply "online/offline" approach to speed up data processing in our scheme. Experimental results show that the time consumption for key generation and EHR encapsulation can be done in milliseconds.

Apple claims that iPhone 6, which is equipped with iOS 8.0 and later version, is secure enough to prevent a user's private data from law enforcement or malicious intruders. In pre-iOS 8.0 operating systems, a user's data were only encrypted by hardware-based keys, which can be obtained by Apple. But in iOS 8.0 and later version, the private data on the iPhone are protected by a secret key that is protected by the user's passcode, which the Apple does not hold. In this paper, supported by real-life experiments, we demonstrate that several vulnerabilities of iPhone 6 with iOS 8, which are brought by ordinary user operations, can lead to the leakage of the private data. Then we conduct vulnerability analysis and give the reasons that cause these vulnerabilities from a technical perspective. Meanwhile, experiments of forging attack aiming at iPhone 6 Touch ID are conducted.

Summary It is challenging to secure group communications among large‐scale networks due to their network scale. We observe that in many large‐scale networks, the scale of actual group communication is nevertheless predicable and not very large. For instance, although the entire social network (e.g., Facebook) may have billions of users, the members in a concrete group are usually about tens to hundreds. We manage to secure group communication in such scenarios with efficient group management protocols. Technically, we achieve this goal by using a novel dual‐ring approach in which two rings of nodes are established, one active and one dummy. When some nodes leave, the remaining nodes can replace these nodes with dummy nodes, minimizing the required communications and computations after the protocol is set up and thus providing significant advantage over existing group key management protocols. Formal security arguments show that our protocols are secure under standard computational assumptions. Thorough analysis confirms that our protocols are efficient in computation and communication. Copyright © 2015 John Wiley & Sons, Ltd.

Summary Vehicular ad hoc networks (VANETs) continually produce large scale of data shared among vehicles nearby to improve driving experience and safety. The vehicular communications contain a large amount of private information. It is well known that group key management is a fundamental cryptographic primitive for providing secure group communication. Although many proposals with regard to group key management have been introduced, they cannot well support secure subgroup and intergroup communications in VANETs. In this paper, we exploit the specific features of vehicular communications and propose two group key distribution schemes providing efficient solutions to these two problems. Our schemes do not require interaction between users. Storage and computation analyses show that compared with existing schemes, our proposals are more efficient and versatile. Based on these basic schemes, we present extensions for multipartite groups, by which the efficiency is greatly improved in this scenario. We also provide the extensions for two‐level multipartite groups, which enable fine‐grained real‐world applications. The experimental results confirm that our group key distribution schemes are practical in security, computation, and communication. Copyright © 2015 John Wiley & Sons, Ltd.

Abstract Mobile e‐Health Network (MHN) is an emerging cloud‐aided networking application across the entire range of functions involved in e‐Health systems. It is important to establish secure channels between users because the data transmitted in MHNs are private, for example, personal electronic healthcare records. It is of great significance to employ key management mechanism and encrypt the data before transmitting in MHNs. However, secure key management is challenging in MHNs because of its highly dynamic and large‐scale nature. In this paper, we first model MHNs and formalize a hierarchical network architecture mirroring the administrative hierarchy and dynamic autonomy in MHNs in the real world. We next present a virtual MHN architecture with only three levels yet suitable to realistic MHNs with arbitrary hierarchical levels. By exploiting the virtual architecture, we propose an efficient authenticated key exchange framework to secure MHNs. We realize a scalable authenticated key exchange scheme with a dedicated variant of a recent hierarchical identity‐based signature and the well‐known Diffie–Hellman key exchange protocol. Theoretical analyses and experimental results show that scalable authenticated key exchange is secure and scalable and hence is practical to secure MHNs. Copyright © 2015 John Wiley & Sons, Ltd.

Abstract Signcryption is a public key cryptosystem that achieves the functions of digital signature and public key encryption simultaneously. It significantly reduces the cost of traditional signature‐then‐encryption approach. Although a large body of signcryption schemes have been proposed, few works have been done on attribute‐based signcryption (ABSC), which simultaneously achieves the functionalities of attribute‐based encryption and attribute‐based signature, two important cryptographic primitives proposed to enforce fine‐grained access control and user authentication in cloud computing applications. In this paper, we present a threshold ABSC scheme. The scheme is proven secure under the well‐established Decisional Bilinear Diffie–Hellman and the standard Computational Diffie–Hellman assumptions in the standard model. Compared with the state of the ABSC art, our scheme has comparable efficiency without relying on any random oracle. Furthermore, we construct an authenticated key agreement protocol based on this threshold attribute‐based signcryption from the point of improving the security of cloud computing. Copyright © 2016 John Wiley & Sons, Ltd.

Dynamic Proof of Storage (PoS) is a useful cryptographic primitive that enables a user to check the integrity of outsourced files and to efficiently update the files in a cloud server. Although researchers have proposed many dynamic PoS schemes in singleuser environments, the problem in multi-user environments has not been investigated sufficiently. A practical multi-user cloud storage system needs the secure client-side cross-user deduplication technique, which allows a user to skip the uploading process and obtain the ownership of the files immediately, when other owners of the same files have uploaded them to the cloud server. To the best of our knowledge, none of the existing dynamic PoSs can support this technique. In this paper, we introduce the concept of deduplicatable dynamic proof of storage and propose an efficient construction called DeyPoS, to achieve dynamic PoS and secure cross-user deduplication, simultaneously. Considering the challenges of structure diversity and private tag generation, we exploit a novel tool called Homomorphic Authenticated Tree (HAT). We prove the security of our construction, and the theoretical analysis and experimental results show that our construction is efficient in practice.

Broadcast encryption (BE) schemes allow a sender to securely broadcast to any subset of members but require a trusted party to distribute decryption keys. Group key agreement (GKA) protocols enable a group of members to negotiate a common encryption key via open networks so that only the group members can decrypt the ciphertexts encrypted under the shared encryption key, but a sender cannot exclude any particular member from decrypting the ciphertexts. In this paper, we bridge these two notions with a hybrid primitive referred to as contributory broadcast encryption (ConBE). In this new primitive, a group of members negotiate a common public encryption key while each member holds a decryption key. A sender seeing the public group encryption key can limit the decryption to a subset of members of his choice. Following this model, we propose a ConBE scheme with short ciphertexts. The scheme is proven to be fully collusion-resistant under the decision n-Bilinear Diffie-Hellman Exponentiation (BDHE) assumption in the standard model. Of independent interest, we present a new BE scheme that is aggregatable. The aggregatability property is shown to be useful to construct advanced protocols.

Recently, a number of extended Proxy Re-Encryptions (PRE), e.g. Conditional (CPRE), identity-based PRE (IPRE) and broadcast PRE (BPRE), have been proposed for flexible applications. By incorporating CPRE, IPRE and BPRE, this paper proposes a versatile primitive referred to as conditional identity-based broadcast PRE (CIBPRE) and formalizes its semantic security. CIBPRE allows a sender to encrypt a message to multiple receivers by specifying these receivers' identities, and the sender can delegate a re-encryption key to a proxy so that he can convert the initial ciphertext into a new one to a new set of intended receivers. Moreover, the re-encryption key can be associated with a condition such that only the matching ciphertexts can be re-encrypted, which allows the original sender to enforce access control over his remote ciphertexts in a fine-grained manner. We propose an efficient CIBPRE scheme with provable security. In the instantiated scheme, the initial ciphertext, the re-encrypted ciphertext and the re-encryption key are all in constant size, and the parameters to generate a re-encryption key are independent of the original receivers of any initial ciphertext. Finally, we show an application of our CIBPRE to secure cloud email system advantageous over existing secure email systems based on Pretty Good Privacy protocol or identity-based encryption.

Existing secure and privacy-preserving schemes for vehicular communications in vehicular ad hoc networks face some challenges, e.g., reducing the dependence on ideal tamper-proof devices, building efficient member revocation mechanisms and avoiding computation and communication bottlenecks. To cope with those challenges, we propose a highly efficient secure and privacy-preserving scheme based on identity-based aggregate signatures. Our scheme enables hierarchical aggregation and batch verification. The individual identity-based signatures generated by different vehicles can be aggregated and verified in a batch. The aggregated signatures can be re-aggregated by a message collector (e.g., traffic management authority). With our hierarchical aggregation technique, we significantly reduce the transmission/storage overhead of the vehicles and other parties. Furthermore, existing batch verification based schemes in vehicular ad hoc networks require vehicles to wait for enough messages to perform a batch verification. In contrast, we assume that vehicles will generate messages (and the corresponding signatures) in certain time spans, so that vehicles only need to wait for a very short period before they can start the batch verification procedure. Simulation shows that a vehicle can verify the received messages with very low latency and fast response.

With the increasing development of pervasive computing and wireless bandwidth communication, more mobile devices are used to access sensitive data stored in remote servers. In such applications, a practical issue emerges such as how to exploit the sufficient resource of a server so that the file owners can enforce fine-grained access control over the remotely stored files, while enable resource-limited mobile devices to easily access the protected data, especially if the storage server maintained by a third party is untrusted. This challenge mainly arises from the asymmetric capacity among the participants, i.e., the capacity limited mobile devices and the resource abundant server (and file owners equipped with fixed computers). To meet the security requirements in mobile access to sensitive data, we propose a new encryption paradigm, referred to as asymmetric cross-cryptosystem re-encryption (ACCRE) by leveraging the asymmetric capacity of the participants. In ACCRE, relatively light-weight identity-based encryption (IBE) is deployed in mobile devices, while resource-consuming but versatile identity-based broadcast encryption (IBBE) is deployed in servers and fixed computers of the file owners. The core of ACCRE is a novel ciphertext conversion mechanism that allows an authorized proxy to convert a complicated IBBE ciphertext into a simple IBE ciphertext affordable to mobile devices, without leaking any sensitive information to the proxy. Following this paradigm, we propose an efficient ACCRE scheme with its security formally reduced to the security of the underlying IBE and IBBE schemes. Thorough theoretical analyses and extensive experiments confirm that the scheme takes very small cost for mobile devices to access encrypted data and is practical to secure mobile computing applications.

We introduce and formalize the notion of group-oriented proofs of storage (GPoS). In GPoS, each file owner, after being authorized as a member by a group manager, can outsource files to a group storage account maintained by an untrusted party, for example, a cloud storage server, while anyone can efficiently verify the integrity of the remotely stored files without seeing the files. The file owner's identity privacy is preserved against the cloud server while the group manager can trace the one who outsourced any suspicious file for liability investigation. By novelly identifying and exploiting several useful properties, that is, homomorphic composability and homomorphic verifiability in some signatures, we propose a generic GPoS construction relying on the security of the underlying signature scheme and the hardness of the computational Diffie-Hellman (CDH) problem. Following the generic construction, we instantiate a concrete GPoS scheme with the well-known Boneh-Boyen short signature. By leveraging the polynomial commitment technique, the proposed GPoS proposal is optimized with constant-size bandwidth consumption in proof of storage by the cloud server. Theoretical analyses and comparisons show that our GPoS proposal is advantageous over existing PoS-like schemes in user privacy, public audibility and/or performance in a multi-user setting.

Signcryption is a public key cryptosystem that achieves the functions of digital signature and public key encryption simultaneously. It significantly reduces the cost of traditional signature-then-encryption approach. Although a large body of signcryption schemes have been proposed, few works have been done on attribute-based signcrytion (ABSC) which simultaneously achieves the functionalities of attribute-based encryption (ABE) and attribute-based signature (ABS), two important cryptographic primitives proposed to enforce fine-grained access control and user authentication in cloud computing applications. In this paper, we present a threshold attribute-based signcryption (TABSC) scheme. The scheme is proven secure under the well-established Decisional Bilinear Diffie-Hellman (DBDH) and the standard Computational Diffie-Hellman (CDH) assumptions in the standard model. Compared with the state of the ABSC art, our scheme has comparable efficiency without relying on any random oracle.

Abstract In this paper, a distributed secret share update scheme with public verifiability for ad hoc network is proposed, in which the system secret key is collaboratively generated by k nodes or more, instead of by a centralized key generation center. To prevent a passive adversary from collecting other nodes' shares to compromise the system key over a long period, each node can periodically refresh its share without changing the system key. At the same time, to resist an active adversary to forge partial share and even to solve the accusation problem, any one can publicly verify the correctness of partial shares submitted by other nodes in the share update phase. To achieve our goals, we explore the technique of verifiable encryption with additive homomorphism and that of threshold cryptography. The analysis shows that the proposed scheme is more secure and efficient than the previous schemes for ad hoc networks. Copyright © 2014 John Wiley & Sons, Ltd.

In vehicle-to-grid (V2G) networks, service providers are battery-powered vehicles, and the service consumer is the power grid. Security and privacy concerns are major obstacles for V2G networks to be extensively deployed. In 2011, Yang et al. proposed a very interesting privacy-preserving communication and precise reward architecture for V2G networks in smart grids. In this paper, we enhance Yang et al.'s framework with the formal definitions of unforgeability and restrictiveness. Then, we propose a new traceable privacy-preserving communication and precise reward scheme with available cryptographic primitives. The proposed scheme is formally proven secure with well-established assumptions in the random oracle model. Thorough theoretical and experimental analyses demonstrate that our scheme is efficient and practical for secure V2G networks in smart grids.

Existing semantically secure public-key searchable encryption schemes take search time linear with the total number of the ciphertexts. This makes retrieval from large-scale databases prohibitive. To alleviate this problem, this paper proposes searchable public-key ciphertexts with hidden structures (SPCHS) for keyword search as fast as possible without sacrificing semantic security of the encrypted keywords. In SPCHS, all keyword-searchable ciphertexts are structured by hidden relations, and with the search trapdoor corresponding to a keyword, the minimum information of the relations is disclosed to a search algorithm as the guidance to find all matching ciphertexts efficiently. We construct an SPCHS scheme from scratch in which the ciphertexts have a hidden star-like structure. We prove our scheme to be semantically secure in the random oracle (RO) model. The search complexity of our scheme is dependent on the actual number of the ciphertexts containing the queried keyword, rather than the number of all ciphertexts. Finally, we present a generic SPCHS construction from anonymous identity-based encryption and collision-free full-identity malleable identity-based key encapsulation mechanism (IBKEM) with anonymity. We illustrate two collision-free full-identity malleable IBKEM instances, which are semantically secure and anonymous, respectively, in the RO and standard models. The latter instance enables us to construct an SPCHS scheme with semantic security in the standard model.

Modern collaborative and group-oriented applications typically involve communications over open networks. Given the openness of today's networks, communications among group members must be secure and, at the same time, efficient. Group key agreement (GKA) is widely employed for secure group communications in modern collaborative and group-oriented applications. This paper studies the problem of GKA in identity-based cryptosystems with an emphasis on round-efficient, sender-unrestricted, member-dynamic, and provably secure key escrow freeness. The problem is resolved by proposing a one-round dynamic asymmetric GKA protocol which allows a group of members to dynamically establish a public group encryption key, while each member has a different secret decryption key in an identity-based cryptosystem. Knowing the group encryption key, any entity can encrypt to the group members so that only the members can decrypt. We construct this protocol with a strongly unforgeable stateful identity-based batch multisignature scheme. The proposed protocol is shown to be secure under the k -bilinear Diffie-Hellman exponent assumption.

Most existing proposals for access control over outsourced data mainly aim at guaranteeing that the data are only accessible to authorized requestors who have the access credentials. This paper proposes TRLAC, an a posteriori approach for tracing and revoking leaked credentials, to complement existing a priori solutions. The tracing procedure of TRLAC can trace, in a black-box manner, at least one traitor who illegally distributed a credential, without any help from the cloud service provider. Once the dishonest users have been found, a revocation mechanism can be called to deprive them of access rights. We formally prove the security of TRLAC, and empirically shows that the introduction of the tracing feature incurs little costs to outsourcing.

Checking remote data possession is of crucial importance in public cloud storage. It enables the users to check whether their outsourced data have been kept intact without downloading the original data. The existing remote data possession checking (RDPC) protocols have been designed in the PKI (public key infrastructure) setting. The cloud server has to validate the users’ certificates before storing the data uploaded by the users in order to prevent spam. This incurs considerable costs since numerous users may frequently upload data to the cloud server. This study addresses this problem with a new model of identity‐based RDPC (ID‐RDPC) protocols. The authors present the first ID‐RDPC protocol proven to be secure assuming the hardness of the standard computational Diffie‐Hellman problem. In addition to the structural advantage of elimination of certificate management and verification, the authors ID‐RDPC protocol also outperforms the existing RDPC protocols in the PKI setting in terms of computation and communication.

The primitive of proxy signatures allows the original signer to delegate proxy signers to sign on messages on behalf of the original signer. It has found numerous applications in distributed computing scenarios where delegation of signing rights is common. Certificate less public key cryptography eliminates the complicated certificates in traditional public key cryptosystems without suffering from the key escrow problem in identity-based public key cryptography. In this paper, we reveal the relationship between the two important primitives of proxy signatures and certificate less signatures and present a generic conversion from the latter to the former. Following the generic transformation, we propose an efficient proxy signature scheme with a recent certificate less signature scheme.

ABSTRACT A fair exchange protocol allows two entities to exchange digital signatures over open networks in a fair way, so that either each entity obtains the other's signature or neither entity does. Fair exchange protocol plays an important role in electronic commerce in the case of exchanging digital contracts. In this paper, we propose a fair exchange protocol based on identity‐based verifiably encrypted signatures. Our protocol involves an offline trusted third party which is only required when one entity attempts to cheat or crashes. The underlining identity‐based verifiably encrypted signature scheme is proven secure under the computational Diffie–Hellman assumption and is the first identity‐based verifiably encrypted signature scheme provably secure against existential unforgeable under adaptive chosen message and identity attacks in the standard model. Copyright © 2012 John Wiley & Sons, Ltd.

Public-key encryption with keyword search (PEKS) is a versatile tool. It allows a third party knowing the search trapdoor of a keyword to search encrypted documents containing that keyword without decrypting the documents or knowing the keyword. However, it is shown that the keyword will be compromised by a malicious third party under a keyword guess attack (KGA) if the keyword space is in a polynomial size. We address this problem with a keyword privacy enhanced variant of PEKS referred to as public-key encryption with fuzzy keyword search (PEFKS). In PEFKS, each keyword corresponds to an exact keyword search trapdoor and a fuzzy keyword search trapdoor. Two or more keywords share the same fuzzy keyword trapdoor. To search encrypted documents containing a specific keyword, only the fuzzy keyword search trapdoor is provided to the third party, i.e., the searcher. Thus, in PEFKS, a malicious searcher can no longer learn the exact keyword to be searched even if the keyword space is small. We propose a universal transformation which converts any anonymous identity-based encryption (IBE) scheme into a secure PEFKS scheme. Following the generic construction, we instantiate the first PEFKS scheme proven to be secure under KGA in the case that the keyword space is in a polynomial size.

The problem of efficiently and securely broadcasting to a remote cooperative group occurs in many newly emerging networks. A major challenge in devising such systems is to overcome the obstacles of the potentially limited communication from the group to the sender, the unavailability of a fully trusted key generation center, and the dynamics of the sender. The existing key management paradigms cannot deal with these challenges effectively. In this paper, we circumvent these obstacles and close this gap by proposing a novel key management paradigm. The new paradigm is a hybrid of traditional broadcast encryption and group key agreement. In such a system, each member maintains a single public/secret key pair. Upon seeing the public keys of the members, a remote sender can securely broadcast to any intended subgroup chosen in an ad hoc way. Following this model, we instantiate a scheme that is proven secure in the standard model. Even if all the nonintended members collude, they cannot extract any useful information from the transmitted messages. After the public group encryption key is extracted, both the computation overhead and the communication cost are independent of the group size. Furthermore, our scheme facilitates simple yet efficient member deletion/addition and flexible rekeying strategies. Its strong security against collusion, its constant overhead, and its implementation friendliness without relying on a fully trusted authority render our protocol a very promising solution to many applications.

Numerous applications in ad hoc networks, peer-to-peer networks, and on-the-fly data sharing call for confidential broadcast without relying on a dealer. To cater for such applications, we propose a new primitive referred to as ad hoc broadcast encryption (AHBE), in which each user possesses a public key and, upon seeing the public keys of the users, a sender can securely broadcast to any subset of them, so that only the intended users can decrypt. We implement a concrete AHBE scheme proven secure under the decision Bilinear Diffie-Hellman Exponentiation (BDHE) assumption. The resulting scheme has sub-linear complexity, comparable to up-to-date broadcast systems which have also sub-linear complexity but require a fully trusted dealer.

Certificateless cryptography eliminates the key escrow problem in identity-based cryptography. Hierarchical cryptography exploits a practical security model to mirror the organizational hierarchy in the real world. In this paper, to incorporate the advantages of both types of cryptosystems, we instantiate hierarchical certificate less cryptography by formalizing the notion of hierarchical certificate less signatures. Furthermore, we propose an HCLS scheme which, under the hardness of the computational Diffie-Hellman (CDH) problem, is proven to be existentially unforgeable against adaptive chosen-message attacks in the random oracle model. As to efficiency, our scheme has constant complexity, regardless of the depth of the hierarchy. Hence, the proposal is secure and scalable for practical applications.

A recent primitive known as asymmetric group key agreement allows a group of users to negotiate a common encryption key which is accessible to any entities while each user holds her respective secret decryption key. This concept not only enables confidential communications among group users but also permits any outsider to send encrypted messages to the group. The existing instantiation is only secure against passive adversaries. In this paper, we first propose an authenticated asymmetric group key agreement protocol which captures the practical security properties against active attacks. Based on our protocol, we then propose a broadcast encryption system without relying on a trusted dealer to distribute the secret keys to the users. Our system has also short ciphertexts. Furthermore, the proposal is equipped with the perfect forward security property.

Vehicular ad hoc networks (VANETs) are designed to improve traffic safety and efficiency. To this end, the traffic communication must be authenticated to guarantee trustworthiness for guiding drivers and establishing liability in case of traffic accident investigation. Cryptographic authentication techniques have been extensively exploited to secure VANETs. Applying cryptographic authentication techniques such as digital signatures raises challenges to efficiently store signatures on messages growing with time. To alleviate the conflict between traffic liability investigation and limited storage capacity in vehicles, this paper proposes to aggregate signatures in VANETs. Our proposal can preserve privacy for honest vehicles and trace misbehaving ones, and provides a practical balance between security and privacy in VANETs. With our proposal, cryptographic witnesses of safety-related traffic messages can be significantly compressed so that they can be stored for a long period for liability investigation. Our proposal allows a large number of traffic messages to be verified as if they were a single one, which speeds up the response of vehicles to traffic reports.

In Eurocrypt 2003, Gentry introduced the notion of certificate-based encryption. The merit of certificate-based encryption lies in the following features: (1) providing more efficient public-key infrastructure (PKI) that requires less infrastructure, (2) solving the certificate revocation problem, and (3) eliminating third-party queries in the traditional PKI. Additionally, it also offers the solution to the inherent key escrow problem in the identity-based cryptography. The contributions of this paper are threefold. Firstly, we introduce a new attack called the “Key Replacement Attack” into the certificate-based signature system and refine the security model of certificate-based signature. Secondly, we show that the certificate-based signature scheme presented by Kang, Park and Hahn in CT-RSA 2004 is insecure against key replacement attacks. Thirdly, we present two new certificate-based signature schemes secure against key replacement attacks. Our first scheme is existentially unforgeable against adaptive chosen message attacks under the computational Diffie–Hellman assumption in the random oracle model. Compared with the certificate-based signature scheme in CT-RSA 2004, our first scheme enjoys shorter signature length and less operation cost. Our second scheme is inspired by Waters signature and is the first construction of certificate-based signature secure against key replacement attacks in the standard model.

Key agreement is one of the fundamental cryptographic primitives in public key cryptography. It plays an important role for securing systems in practice. In this paper, we present the first certificateless one-way authenticated two-party key agreement protocol. The security of the proposed protocol is analyzed based on the intractability of the standard discrete logarithm (DL) and bilinear Diffie-Hellman (BDH) problems. For efficiency, our protocol enjoys low complexity in both communication and computation.

Recently, Seung-Hyun et al proposed a nominative proxy signature scheme for mobile communication. However, we show that the scheme hasn't nonrepudiation, note that a malicious original signer can forge the proxy signer to sign on any message. Finally, we also present a modification of the scheme to repair the security flaw.

Publicly verifiable sealed electronic auctions are proposed. The schemes enjoy the following advantages. They require no special trusted parties. After bid opening phase, only the winning price is revealed and the relation of other bidding amounts keep unknown. The winning price is publicly verifiable. Our scheme supports the first-price auction, Vickrey auction and (M+l)st-price auction. Finally, the first-price auction is very efficient and the generic (M+l)st-price auction is applicable when a high standard of security is required.