Internet Autonomous System (AS) level topology includes AS topology structure and AS business relationships, describes the essence of Internet inter-domain routing, and is the basis for Internet operation and management research. Although the latest topology inference methods have made significant progress, those relying solely on local information struggle to eliminate inference errors caused by observation bias and data noise due to their lack of a global perspective. In contrast, we not only leverage local AS link features but also re-examine the hierarchical structure of Internet AS-level topology, proposing a novel inference method called topoKG. TopoKG introduces a knowledge graph to represent the relationships between different elements on a global scale and the business routing strategies of ASes at various tiers, which effectively reduces inference errors resulting from observation bias and data noise by incorporating a global perspective. First, we construct an Internet AS-level topology knowledge graph to represent relevant data, enabling us to better leverage the global perspective and uncover the complex relationships among multiple elements. Next, we employ knowledge graph meta paths to measure the similarity of AS business routing strategies and introduce this global perspective constraint to infer the AS business relationships and hierarchical structure iteratively. Additionally, we embed the entire knowledge graph upon completing the iteration and conduct knowledge inference to derive AS business relationships. This approach captures global features and more intricate relational patterns within the knowledge graph, further enhancing the accuracy of AS-level topology inference. Compared to the state-of-the-art methods, our approach achieves more accurate AS-level topology inference, reducing the average inference error across various AS link types by up to 1.2 to 4.4 times.

Intelligent in-vehicle networks are increasingly exposed to complex security threats. Traditional supervised deep learning methods depend heavily on extensive labeled datasets, resulting in significant manual labeling costs, while centralized training methods incur substantial communication overhead due to the transfer of raw data. To address the dual challenges of limited labeled data and communication efficiency in in-vehicle networks, this paper proposes a Federated Semi-Supervised Learning-based Intrusion Detection System (FSL-IDS). FSL-IDS integrates a Convolutional Autoencoder (CAE) with the Federated Averaging (FedAvg) algorithm to enable a distributed and efficient intrusion detection solution. In this framework, vehicle CAN traffic data are first converted into grayscale images. The CAE is utilized for unsupervised feature extraction from unlabeled data at each local client, capturing latent representations of traffic patterns. The server then aggregates model parameters from local clients using FedAvg, forming a global autoencoder model and applying INT8 weight quantization, which reduces communication overhead by 48.7%. Subsequently, a fully connected supervised neural network is constructed atop the global encoder, requiring only 20% labeled data for fine-tuning. Experiments on the Car-Hacking dataset demonstrate that FSL-IDS achieves a detection accuracy of 98.83% and an F1-score of 94.14% across various attack types. On low-performance devices and in real vehicular environments, the inference time per sample is under 10 ms and memory consumption is only 15.28 MB. This approach provides a low-label, high-accuracy, and communication-efficient distributed paradigm for intrusion detection in in-vehicle networks, effectively balancing data utilization and edge device resource constraints.

Nowadays, more individuals and corporations tend to use machine learning as a service (MLaaS) in cloud computing environment. However, when enjoying the pay-as-you-go mode and flexible capacity of cloud computing, it also increases the risk of privacy leakage for sensitive data. In this paper, we aim to efficiently implement privacy-preserving MLaaS, and focus on k-means clustering over outsourced encrypted cloud databases. Previous works mainly utilize partially homomorphic encryptions, which require a great number of interactive protocols with high computation and communication costs, making them not practical in real-world applications. To better solve this problem, we propose a new secure and efficient outsourced k-means clustering (SEOKC) scheme using fully homomorphic encryption with ciphertext packing technique, which achieves parallel computation without extra cost. The proposed scheme preserves privacy in three aspects: (1) database security, (2) privacy of clustering results and (3) hiding of data access patterns. We provide formal security analysis and evaluate the performance of the proposed scheme through extensive experiments. The experiment results show that our scheme needs much less computation cost (more than three orders of magnitude lower) than the state-of-the-art schemes, and is suitable to be applied on large databases.

Summary Because mobile terminals have limited computing and storage resources, individuals tend to outsource their data generated from mobile devices to clouds to do data operations. However, utilization of the abundant computation and storage resources of clouds may pose a threat to user's private data. In this paper, we focus on the issue of encrypted k‐nearest neighbor (kNN) classification on the cloud. In the past few years, many solutions were proposed to protect the user's privacy and data security. Unfortunately, most privacy‐preserving data mining schemes are not lightweight, which are not practical in real‐world applications. To solve this issue, we proposed a lightweight edge‐based kNN (EBkNN) classification scheme over encrypted cloud database utilizing edge computing technology. Our proposed scheme can provide several security guarantees: (i) user's data security, (ii) user's query privacy, and (iii) data access patterns. We analyzed the security of our scheme utilizing the semi‐honest security model and evaluated the performance using a synthetic dataset. The experiment results indicate that our scheme is more lightweight than the state‐of‐the‐art scheme.

The emerging cloud-based Internet of Things (IoT) paradigm enables IoT devices to directly upload their collected data to the remote cloud and allows data owners (DOs) to conveniently manage those data through cloud APIs, which has greatly reduced infrastructure investment and data management cost in many IoT applications. Considering that the outsourced data are out of the physical control of DOs and the cloud server (CS) cannot always be fully trusted, how to securely delete the unneeded sensitive data stored in cloud to prevent potential data leakage issues is a big challenge. Most of the existing solutions only support coarse-grained deletion and rely on the participation of the CS, so their flexibility and practicability are seriously restricted. In this article, based on an enhanced policy-based puncturable encryption (P-PUN-ENC) primitive, we propose a secure and fine-grained self-controlled outsourced data deletion scheme in cloud-based IoT. The main contribution of our scheme is that it enables DOs to precisely and permanently delete their outsourced IoT-driven data in a policy-based way without relying on the CS. To achieve this, we subtly utilize the logical relationship between the puncture policy and access policy, and design a policy transform method to convert the puncture process based on the puncture policies into the update process of access policies. Then, we utilize a key delegation technique in attribute-based encryption (ABE) to complete the corresponding key update operations. Additionally, to address the issue of growing key storage and decryption cost in P-PUN-ENC, we propose the outsourced policy-based puncturable encryption (OP-PUN-ENC) primitive by combining the key and decryption outsource technique with P-PUN-ENC. Comprehensive comparisons show that our proposed scheme can better meet the data deletion requirements in cloud-based IoT, and formal security proof and extensive simulation results demonstrate the reliability and efficiency of the proposed scheme.

Numerous crowdsourcing applications have emerged in our daily lives, which enable customers to outsource their complicated tasks to a crowd of workers. However, the information of task tags and worker profiles is explicitly obtained by the crowdsourcing server to recommend tasks effectively, which violates the privacy of both customers and workers. Moreover, the worker's ability to do the task should also be verified in a privacy-preserving way. To address these issues, we propose a privacy-preserving interest-ability based task allocation scheme in crowdsourcing, which protects both task and worker privacy and enables the crowdsourcing server to allocate tasks in a fine-grained way. Specifically, by utilizing attribute-based encryption (ABE) and proxy re-encryption based searchable encryption (PRE-SE) on the task content and task tags respectively, customers are able to enforce fine-grained ability requirements on their tasks, and workers can specify flexible interests to choose their desired tasks. Additionally, ElGamal signature enables workers to prove their abilities to the crowdsourcing server without revealing the task content. Numerical analysis and experiment results demonstrate that our proposed scheme is efficient in terms of computation and storage overhead and is practical to be implemented in crowdsourcing.

In this paper, we revisit the problem of finding the longest systematic-length k for a linear minimum storage regenerating (MSR) code with optimal repair of only systematic part, for a given per-node storage capacity l and an arbitrary number of parity nodes r. We study the problem by following a geometric analysis of linear subspaces and operators. First, a simple quadratic bound is given, which implies that k = r + 2 is the largest number of systematic nodes in the scalar scenario. Second, an r-based-log bound is derived, which is superior to the upper bound on log-base 2 in the prior work. Finally, an explicit upper bound depending on the value of r2/l is introduced, which further extends the corresponding result in the literature.

Data owners have benefited significantly from cloud computing for managing the numerous data produced by massive devices in various Internet of Things (IoT) applications, such as smart home and electronic healthcare. On the other hand, fine- grained access control on outsourced data is a big concern for data owners, after they lose physical control over their data. Key-policy attribute- based encryption (KP-ABE), which provides data confidentiality and fine-grained data access control simultaneously, can be naturally introduced in this cloud-based IoT paradigm. However, the primitive KP-ABE cannot achieve efficient data access control with flexible user revocation. In this paper, we propose an efficient and fine-grained data access control scheme based on the proxy re-encryption and key blinding techniques for cloud-based IoT. With the scheme, the decryption capability of misbehaving users can be efficiently revoked to prevent data disclosure. In addition, most of the costly update operations over ciphertexts and keys due to user revocation, are delegated to the cloud. Extensive experiment results demonstrate that our scheme is more efficient than existing solutions in terms of computation and communication overheads.

With the advent of big data era, clients who lack computational and storage resources tend to outsource data mining tasks to cloud service providers in order to improve efficiency and reduce costs. It is also increasingly common for clients to perform collaborative mining to maximize profits. However, due to the rise of privacy leakage issues, the data contributed by clients should be encrypted using their own keys. This paper focuses on privacy-preserving k -means clustering over the joint datasets encrypted under multiple keys. Unfortunately, existing outsourcing k -means protocols are impractical because not only are they restricted to a single key setting, but also they are inefficient and nonscalable for distributed cloud computing. To address these issues, we propose a set of privacy-preserving building blocks and outsourced k -means clustering protocol under Spark framework. Theoretical analysis shows that our scheme protects the confidentiality of the joint database and mining results, as well as access patterns under the standard semihonest model with relatively small computational overhead. Experimental evaluations on real datasets also demonstrate its efficiency improvements compared with existing approaches.

In this paper, we revisit the problem of characterizing the secrecy capacity of minimum storage regenerating (MSR) codes under the passive (l1, l2)-eavesdropper model, where the eavesdropper has access to data stored on l1nodes and the repair data for an additional l2nodes. We study it from the informationtheoretic perspective. First, some general properties of MSR codes as well as a simple and generally applicable upper bound on secrecy capacity are given. Second, a new concept of stable MSR codes is introduced, where the stable property is shown to be closely linked with secrecy capacity. Finally, a comprehensive and explicit result on secrecy capacity in the linear MSR scenario is present, which generalizes all related works in the literature and also predicts certain results for some unexplored linear MSR codes.

Cloud computing is a promising computing paradigm which has drawn extensive attention. Serious concerns over the reliability and confidentiality of the outsourced data are arising. Traditional encryption methods can, guarantee data confidentiality, however, it also limits the cloud's functionality as few operations are supported over encrypted data. In this study, the authors construct an enhanced cloud that not only provides secure and robust data storage, but also supports the functionality that the cipher data can be forwarded without being retrieved back. Specifically, they design an all‐or‐nothing‐transform‐based encryption and a variant of ElGamal‐based proxy re‐encryption algorithms, blending them with Reed–Solomon code, the authors’ scheme is quite more efficient compared with previous studies because it only needs to update partial data blocks instead of the whole file for data forwarding. Besides, the authors’ scheme also satisfies another practical property that the original data owner can no longer decrypt or forward the re‐encrypted data to others after a complete forwarding instance, which is termed to be ‘original inaccessibility’ in this study. Analysis shows that the authors’ scheme is secure and satisfactory. Finally, the authors theoretically and experimentally evaluate its performance and the results indicate that their scheme is efficient during file dispersal, forward and retrieval.

Here, we revisit the problem of exploring the secrecy capacity of minimum storage cooperative regenerating (MSCR) codes under the (l2 l2)-eavesdropper model, where the eavesdropper can observe the data stored on l1nodes and the repair downloads of an additional l2nodes. Compared to minimum storage regenerating (MSR) codes which support only single node repairs, MSCR codes allow efficient simultaneous repairs of multiple failed nodes, referred to as a repair group. However, the repair data sent from a helper node to another failed node may vary with different repair groups or the sets of helper nodes, which would inevitably leak more data information to the eavesdropper and even render the storage system unable to maintain any data secrecy. In this paper, we introduce and study a special category of MSCR codes, termed “stable” MSCR codes, where the repair data from any one helper node to any one failed node is required to be independent of the repair group or the set of helper nodes. Our main contributions include: 1) Demonstrating that two existing MSCR codes inherently are not stable and thus have poor secrecy capacity; 2) Converting one existing MSCR code to a stable one, which offers better secrecy capacity when compared to the original one; and 3) Employing information theoretic analysis to characterize the secrecy capacity of stable MSCR codes in certain situations.

Cloud computing has been envisioned as the next generation architecture of the IT enterprise, but there exist many security problems. A significant problem encountered in the context of cloud storage is whether there exists some potential vulnerabilities towards cloud storage system after introducing third parties. Public verification enables a third party auditor (TPA), on behalf of users who lack the resources and expertise, to verify the integrity of the stored data. Many existing auditing schemes always assume TPA is reliable and independent. This work studies the problem what if certain TPAs are semi‐trusted or even potentially malicious in some situations. Actually, the authors consider the task of allowing such a TPA to involve in the audit scheme. They propose a feedback‐based audit scheme via which users are relaxed from interacting with cloud service provider (CSP) and can check the integrity of stored data by themselves instead of TPA yet. Specifically, TPA generates the feedback through processing the proof from CSP and returns it to user which is yet unforgeable to TPA and checked exclusively by user. Through detailed security and performance analysis, the author's scheme is shown to be more secure and lightweight.