Cloud computing has become an essential paradigm for facilitating large-scale and privacy-preserving encrypted image retrieval in Internet of Things (IoT) environments. However, existing encrypted image retrieval schemes face challenges in balancing retrieval efficiency and data security, which hinders their practical adoption. On one hand, retrieval-efficient schemes based on secure k-Nearest Neighbor (kNN) are prone to known-plaintext attacks; on the other hand, highly secure schemes based on homomorphic encryption often suffer from excessive computational and storage overhead. Furthermore, supporting multi-user environments and enforcing fine-grained access control over query users are critical challenges in IoT-based retrieval systems. To tackle these issues, we propose a Secure and Controllable similarity Retrieval scheme in Multi-user settings (SCRM), which achieves a practical trade-off between efficiency and security while enabling multi-user management. First, we design an efficient and privacy-preserving similarity computation method that is resilient against known-plaintext attacks. Second, we introduce a key conversion protocol that enables similarity retrieval in multi-user settings without requiring key sharing. Third, we integrate attribute-based encryption to enforce fine-grained access control and trace query users who may leak decryption keys. A correctness analysis confirms that SCRM ensures accurate similarity retrieval while supporting access control. Furthermore, a formal security analysis demonstrates that SCRM effectively protects data privacy against known-plaintext attacks. Finally, extensive experiments on real-world image dataset validate the efficiency and effectiveness of SCRM.

Privacy-preserving similarity retrieval for ciphertext images has broad applications in Internet of Things (IoT) areas, including smart healthcare, face recognition, and social networking. However, most existing privacy-preserving schemes suffer from inefficient retrieval and limited security guarantees due to the use of unreasonable encryption methods. In addition, those supporting fine-grained access control often lack scalability or are computationally inefficient. To address these challenges, we propose an efficient similarity retrieval scheme for ciphertext images that ensures both privacy preservation and fine-grained access control. First, we construct an encrypted index tree using clustering to improve retrieval efficiency while preserving high recall. Second, we achieve security against chosen-plaintext attacks (CPA) and result verification by employing symmetric homomorphic encryption and Merkle hash tree. Third, we realize access control for each image, enabling simultaneous access verification and similarity retrieval via a single inner product operation. Our theoretical and experimental analysis shows that the proposed scheme is CPA-secure and achieves up to 100× faster query processing than existing CPA-secure schemes, with the ability to retrieve 2000 ciphertext images within 0.5 seconds for 128-dimensional feature vectors.

As the Internet of Things (IoT) continues to grow, the urgency to bolster IoT device security escalates, particularly in evaluating the security of lightweight ciphers. Since the inception of Keccak (also known as SHA-3), embedding a permutation within a certain operational mode has become a pivotal approach in designing lightweight cryptography. This led to numerous permutation-based lightweight ciphers tailored for IoT applications. Among them, Xoodyak and Gaston are typical examples and even incorporate Keccak’s nonlinear operation$\chi $within their round functions. This article focuses on assessing the security of Keccak-like lightweight hash functions against preimage attacks. We introduce a generic preimage attack framework from an algebraic perspective and propose a new linearization method that leverages the algebraic properties of$\chi $in the permutation. Additionally, in order to find good guessing strategies, we develop automatic tools based on bit-level mixed-integer linear programming on Xoodyak and Gaston. As a result, the complexity of finding a preimage for 2-round Xoodyak-XOF with a 128-bit digest is$2^{94.66}$while that for 3-round Xoodyak-XOF can be reduced from$2^{125.06}$to$2^{123.91}$and memory consumption from$2^{97}$to a negligible level. This marks the most efficient preimage attack against a 3-round Xoodyak-XOF to date. Furthermore, we present the first preimage attacks on 1-/2-round Gaston with complexities of$2^{90.56}$and$2^{122.15}$, respectively.

Image search is a hot topic, which has played a significant role in various Internet of Things (IoT) applications, such as disease diagnosis, face recognition, and fingerprint recognition. Meanwhile, the proliferation of images has led image owners to outsource images to the cloud for reducing local storage and computation burdens. Therefore, image search without compromising privacy over cloud has received considerable attention and extensively explored in the literature. Many Bloom filter (BF)-based schemes have been put forth in past years, however, most of them suffer from high storage overhead, low false positive rate, and even expose the values in BF. To solve these challenges, in this article, we first design a merged and repeated indistinguishable BF (MRIBF) index structure, which can reduce the storage overhead and achieve adaptive security with a low false positive rate. Then, with the MRIBF, we propose a secure and efficient BF-based image search (BFIS) scheme to achieve a faster-than-linear and more accurate search. Detailed theoretical analysis shows that our scheme is really accurate and secure. Extensive experiments demonstrate that our scheme is indeed efficient and feasible.

The increasing awareness in privacy has partly contributed to the renewed interest in privacy-preserving encrypted image retrieval, and designing for outsourced images stored on cloud servers, etc. However, there are some limitations in these existing schemes such as low retrieval accuracy, low retrieval efficiency, and less efficient result verification in the dynamic setting. Therefore, in this paper we present a novel Dynamic Verifiable Retrieval over Encrypted Images (DVREI) scheme. First, a pre-trained Convolutional Neural Network (CNN) model is utilized to extract image features to improve retrieval accuracy. Then, an encrypted index based on the K-means clustering algorithm is designed to improve retrieval efficiency. Finally, a dynamic verification tree based on the chameleon hash is used to verify the correctness of the retrieval results and support dynamic updates. We theoretically and experimentally evaluate the security and performance of DVREI to demonstrate its practicability.

With the emergence of intelligent terminals, the Content-Based Image Retrieval (CBIR) technique has attracted much attention from many areas (i.e., cloud computing, social networking services, etc.). Although existing privacy-preserving CBIR schemes can guarantee image privacy while supporting image retrieval, these schemes still have inherent defects (i.e., low search accuracy, low search efficiency, key leakage, etc.). To address these challenging issues, in this article we provide a similarity Search for Encrypted Images in secure cloud computing (called SEI). First, the feature descriptors extracted by the Convolutional Neural Network (CNN) model are used to improve search accuracy. Next, an encrypted hierarchical index tree by using$K$-means clustering based on Affinity Propagation (AP) clustering is devised, which can improve search efficiency. Then, a limited key-leakage k-Nearest Neighbor (kNN) algorithm is proposed to protect key from being completely leaked to untrusted image users. Finally, SEI is extended to further prevent image users’ search information from being exposed to the cloud server. Our formal security analysis proves that SEI can protect image privacy as well as key privacy. Our empirical experiments using a real-world dataset illustrate the higher search accuracy and efficiency of SEI.

With the advent of cloud computing, explosively increasing images are gradually outsourced to the cloud server for costs saving and feasibility. For security and privacy concerns, images (e.g., medical diagnosis, personal photos) should be encrypted before being outsourced. However, traditional encrypted image retrieval techniques still suffer from costly access control and low search accuracy. To solve these challenging issues, in this article, we first propose a Controllable encrypted cloud image Search scheme in Multi-user settings (namely CSM) by using the polynomial-based access strategy and proxy re-encryption technique. CSM achieves efficient access control and avoids heavy communication overhead caused by key transmission. Then, we improve the basic CSM to achieve malicious search user Tracing (namely TCSM) by utilizing the watermark technique, which can further prevent search users from illegally redistributing retrieved images to unauthorized search users. Our formal security analysis proves that our CSM (or TCSM) can guarantee the privacy of images, indexes, and search queries. Our empirical experiments using real-world datasets demonstrate the efficiency and high accuracy of our CSM (or TCSM) in practice.

With the development of outsourcing services, users with limited resources tend to store encrypted images on remote servers and search them anytime and anywhere. However, existing encrypted image search schemes are proposed for cloud computing scenarios, and have some defects, such as excessive bandwidth resource consumption or network delay, which are not suitable for Internet of Things (IoT) devices in edge computing environment. Therefore, we propose a secure and verifiable multikey image search (SVMIS) scheme in cloud-assisted edge computing. First, the pretrained convolutional neural network model is employed to extract image feature vectors to improve search accuracy. Then, a key distribution protocol is designed to convert the encrypted indexes of different owners, and a transformation key list is constructed to support the multikey setting in edge computing. Next, the learning with errors based secure k-nearest neighbor algorithm is used to encrypt feature vectors to improve security. Finally, the Merkle hash tree is utilized to check the correctness of search results returned by edge servers. Theoretical analysis and extensive experiments using a real-world dataset evaluate the security and effectiveness of SVMIS.