Abstract Amid the rapid evolution of cloud computing, safeguarding data privacy has become a core priority for both academic and industrial communities. To protect user data from unauthorized access, vast volumes of sensitive information are encrypted before being transmitted to and stored on cloud platforms. Nevertheless, encryption inherently limits the platform’s ability to manipulate encrypted data, like direct search or matching on ciphertexts. Traditional Public Key Encryption with Equality Test (PKEET) schemes address this issue by enabling ciphertext equivalence verification without decryption, but they lack support for multi-ciphertext scenarios and fine-grained security. We propose a novel quantum-resistant Public Key Encryption with Multi-ciphertexts Equality Test (PKE-MET) scheme, the first to be constructed based on the Learning with Rounding (LWR) problem in lattice-based cryptography. We prove that the scheme achieves Chosen Ciphertext Attack (CCA2) security under the standard model, addressing the limitation of the existing Learning With Error (LWE)-based PKE-MET scheme which only reaches Chosen-Plaintext Attack (CPA) security. Compared with LWE-based solution, our scheme eliminates the need for complex discrete Gaussian sampling and adopts a smaller modulus. Theoretical analysis demonstrates that our proposed scheme exhibits good ciphertext scalability. Compared with the LWE-based solution, it requires only approximately 1/3 of the ciphertext storage. This reduces storage and communication resource consumption, thus lightening the operational load on cloud servers.

The Internet of Vehicles (IoV) cloud platform enables multi-dimensional sharing of vehicle data, enhancing both its value and the quality of vehicle services. To ensure dynamic authorized access control and safeguard user privacy in the IoV cloud platform, an attribute-based encryption (ABE) scheme is employed. However, existing state-of-the-art schemes still struggle to simultaneously address the following challenges: 1) the limitation of single-application scenarios due to the difficulty of achieving cross-primitive ciphertext transformation; 2) the risk of user privacy leakage caused by the inability to fully hide access policies; 3) the potential for malicious accusations against the delegator due to a lack of verifiability. To tackle these issues, we propose PPVTAC, a Privacy-Preserving, Verifiable, and Transformable Access Control scheme for cloud-assisted IoV. Specifically, we leverage a hybrid proxy re-encryption technique to transform ABE ciphertext into identity-based encryption (IBE) ciphertext, making it more suitable for collaborative scenarios. A cuckoo filter is introduced to achieve fully hidden policies, thereby protecting user privacy. Additionally, we incorporate non-interactive zero-knowledge proofs (NIZKPs) to ensure verifiability, guaranteeing the correctness of transformed ciphertexts while preventing malicious accusations against the delegator. A further advantage of our scheme is its support for unbounded attribute spaces, eliminating the need for system reboot when adding new attributes. In addition, our scheme requires only a constant number of pairing operations during the decryption and re-encryption phases, regardless of the number of attributes. We formalize a security model and rigorously prove that our scheme achieves adaptive security. Our scheme achieves simultaneously for the first time cross-primitive ciphertext transformation, fully hidden policy, and verifiability while ensuring adaptive security. We implement our scheme in real-world environments and compare it with existing state-of-the-art schemes. Our approach offers a more comprehensive feature set without significant performance trade-offs, making it highly suitable for cloud-assisted IoV scenarios.

Abstract The paper introduces TinyThunder, an asynchronous Byzantine fault tolerance (BFT) protocol designed to minimize communication overhead during inter-node message transmission. Regardless of the original transaction sizes, TinyThunder optimizes the acknowledgment overhead for a transaction to a constant size (e.g. 8 bytes). This optimization is based on a key observation in BFT systems: each transaction is redundantly stored by at least one honest node. Instead of transmitting the original transaction, TinyThunder only needs to send a specific feature value to confirm a transaction, leading to the development of our new compact reliable broadcast protocol. Additionally, we introduce a novel block compensation protocol that ensures the consistency of recovering these feature values and enables TinyThunder to achieve the desirable property of strong validity. The implementation and evaluation of TinyThunder in large-scale wide-area network environments demonstrate its superiority over the well-known HoneyBadgerBFT, with higher throughput (increased by 122%) and lower latency (reduced by 54%). Notably, TinyThunder also exhibits significant bandwidth savings for larger individual transaction sizes. For transactions of 250B in size, TinyThunder reduces bandwidth consumption by 56% compared to HoneyBadgerBFT.

Abstract With the rise of cloud storage and the looming threat of quantum computing, traditional encryption methods are encountering significant challenges that hinder data manipulation without decryption. To counter quantum attacks while maintaining data manipulation capabilities, new architectures such as quantum-resistant public key encryption with equality test (PKEET) must be developed. Our study presents the initial PKEET that leverages the Learning with Rounding (LWR) problem, which provides security within standard model. We also introduce its variants, public key encryption with delegated equality test (PKE-DET) and PKEET supporting flexible authorization (PKEET-FA). Our proposals could achieve fine-grained delegation at the ciphertext-specified level compared to previous PKE-DET schemes. For example, our PKE-DET supports a delegated tester function while ensuring security against quantum computing threats. Our PKEET-FA could accord users even more controls over what ciphertexts they want to compare. Our schemes’ security is founded on the LWR problem which avoids the need for discrete Gaussian sampling, unlike the Learning with Errors (LWE) problem. This distinction renders our methods both simpler and more efficient compared to those based on LWE. Moreover, our schemes enjoy smaller-sized ciphertexts.

As de facto standards of in-vehicle network communications among various ECUs (Electronic Control Units), CAN (Controller Area Network) protocols invented by Bosch rely on the privately defined unique identifiers CAN ID in CAN messages that do not convey any destination address. However, sticking to error-handling mechanisms in CAN protocols, an ECU with an amount of transmission errors would enter bus-off state (i.e., go offline thereupon) and shall be recovered according to some prescribed bus-off recovery mode (BOM). All this sensitive CAN knowledge concealed inside an ECU by OEMs (Original Equipment Manufacturers) shall not be revealed; however, it could have extensive practical applications, both for adversarial behavior (e.g., target ECU attacks) and for security enhancement mechanisms (e.g., intrusion detection system designs). The article presents FirmCAN, the first automatic analysis framework to dope out sensitive CAN knowledge (CAN IDs and bus-off recovery mode, in particular) compiled in automotive ECU firmwares. FirmCAN first identifies base address (using accurate absolute function entry addresses) and then performs CAN module API positioning and sensitive configuration information resolution. We buckle down to automotive ECUs that resort to fixed-address mailboxes as CAN module transmission buffers (e.g., Renesas SuperH/RA series) and present concrete algorithms for each analysis phase. Our experimental evaluations first investigate firmwares extracted from real automotive ECUs. We then develop our own applications using RA6M4 development boards, which not only produce required firmwares to evaluate FirmCAN but also create ground truth through hardware debugging. All evaluations demonstrate that FirmCAN can accurately garner above-mentioned sensitive CAN knowledge. FirmCAN can be trivially generalized to engage in extended frames and CAN modules with similar transmission logic, e.g., TI (Texas Instruments), ST (ST Microelectronics), and so on.

The paper proposes SMuLe, a secure mutual learning protocol for two-party deep model training, to support low demand for interaction complexity and communication overhead. The strategy is that two parties exchange their blind predictions securely on each other's dataset and the underlying models can thereby benefit from not only the true label of the data but the prediction of the other party, as being different from federated learning and prior art that counts on secure multi-party computation. After this protocol, each participant occupies a well trained plaintext model privately. The contributions include the following: (i) the communication cost of SMuLe is lower than state-of-the-art two-party training protocols; (ii) our solution is flexible with different secure inference schemes; (iii) SMuLe can resist malicious attacks through poisoning samples. The experiments show that on CifarlO, SMuLe can obtain desirable accuracy even in a small convnet and the communication cost in each epoch is less than 75 MB as expected.

We revisit the problem of Electronic Control Unit (ECU) identification from signal characteristics in the physical layer of in-vehicle Controller Area Network (CAN). Ringing is oscillation of a signal in signal processing and prior work has already noticed the ringing force in identifying ECUs via differ-ential CAN signaling. However, they either count on advanced do-main transformations or turn out to be fragile once CAN topology alters (e.g., the length of the stub lines, the number of connected ECUs, etc). The paper further dissects the connection between the ringing intensity and signal characteristics, based on which we can procure robust ECU identification scheme (and IDS, intrusion detection system) independent of CAN topology without any mathematical transformations. We first look into the factors enlarging signal ringing, and then abstract the characterization of ringing intensity where rising edges (from recessive to dominant states) and falling edges (from dominant to recessive states) make distinct contributions to ECU identification. The rising edges (along with dominant states) suffice to fingerprint the ECUs, whereas the falling edges pitch in shaky performance (correlated strongly to CAN topology). The unique contribution of the former can thereby be isolated to construct robust mechanisms for ECU identification and IDS. Robustness and accuracy of the resulting approach are validated on not only prototype implementations (with diverse portfolio in 3/6/9/13 ECUs and 1/2/3-meter stub lines) but real vehicles. Concrete comparisons among prior work and ours are also conducted and substantiate our argumentation and mechanisms.

The paper goes into Bitcoin PoW (Proof-of-Work) consensus, especially the variances of inter-block time and of mining reward which may turn out to be the origin of Bitcoin's fundamental weakness (e.g., unexpected centralization and double-spend attack). We procure a contribution-and-gain solution - LVRT, a collaborative PoW consensus with low variances of mining reward and of inter-block time, to intensify mining transparency and incentivize collaborative effort. More precisely, LVRT looses the solutions of cryptographic puzzles by introducing tweakable factor to difficulty target and exploits all qualified computing powers (rather than throws them all away except the first one that wins the puzzle, as handled in Bitcoin) to generate the block (all qualified miners would thereby be rewarded). Low variance of inter-block time also stems from our strategy in packing the block that$k$(a pre-defined system parameter to characterize collaborative effort) smallest out of all qualified hash values are determined and the corresponding average is bounded by difficulty target as well. We define particular block structure to fit our requirements. LVRT is supported by theoretical analysis on the relationship between collaborative effort and the variances of inter-block time and mining reward. Experiments further demonstrate LVRT's resistance against selfish-mining and double-spend attacks. For a double-spend attacker with 40% mining power, it will succeed in Bitcoin with a probability ≥ 35%, in contrast, his probability is less than 1% in LVRT (for$k\geq 50$).

The paper presents WSG-InV, a novel weighted state graph (WSG) model for lightweight IDS on in-vehicle network. By capitalizing on historical in-vehicle data of timestamps, message identifiers, and data field, WSG-InV constructs offline a weighted state graph G=(V, E) where distinct message identifiers constitute the set V of vertices and the edges in E define the time-varying state transitions of the CAN frames. The iconic constituents of given in-vehicle data are condensed into a collection of ordered triples (the vectorized weight) that are further assigned to the edges in E. In the mean time, several kinds of intrusion data are evoked and the random forest model is deployed to conduct intrusion classification. WSG-InV then segments the online data stream into a slice of sliding windows and extracts a weighted state subgraph S for each of them. Bv consulting G as a benchmarking as well as optimizing a particular 3-variable programming, WSG-InV assesses the subgraph S and thereby recognizes the corresponding traffic as normal or anomaly. Besides, WSG-InV can distinguish which type of attack the anomaly gears toward. Experimental results demonstrate almost optimal performance.

Modern vehicles are generally equipped with dozens of (or even hundreds of) electronic and intelligent devices and bloom into more involved information hub in enabling V2X networking. Protecting this increasingly complex vehicle ecosystem can be an arduous task, especially as the proliferation of data across distinct connected devices makes them more vulnerable than ever before. Intrusion detection systems (IDSs) have been found extremely rewarding in monitoring in-vehicle network traffic and detecting potential intrusions. The paper presents WLOF-InV, a novel unsupervised method based on local density for IDS on in-vehicle network. Given historical in-vehicle data of message identifiers, WLOF-InV first segments the traffic into a slice of (e.g., m) sliding windows. For each sliding window, WLOF-InV exerts information gain to select features for dimensionality reduction and squeezes out n features which are then bundled together to form a row vector and eventually gets an m*n matrix. WLOF-InV then adaptively determines the hyper parameters for local outlier factor (LOF) model (optimizing the scores for ranking the training data and the cutoff position for anomalies). In online detection, WLOF-InV determines the features by the information gain and invokes abnormal score weighting mode (which weights the LOF value of each dimension data by entropy method) to obtain the complete LOF score (of the overall traffic), and thereby grabs the anomaly traffic by resorting to the adjusted model. WLOF-InV is validated on the real data of three attack types (DoS, fuzzy, and impersonation). Experimental results demonstrate that WLOF-InV contrives next to optimal performance.

It has been widely adopted to minimize the maintenance cost by predicting potential vulnerabilities before code audits in academia and industry. Most previous research dedicated to file/component level vulnerability prediction models is coarse- grained and may suffer from cost-prohibitive and impractical security testing activities. In this paper, we focus on a cost- aware vulnerability prediction model and present a just-in-time change-level code review tool called VulDigger to dig suspicious ones from a sea of code changes. Our contributions benefit from the case study of Mozilla Firefox by constructing a large-scale vulnerability-contributing changes (VCCs) dataset in a semi-automatic fashion. We then further manifest a classification tool with a mixture of established and new metrics derived from both software defect prediction and vulnerability prediction. Consequently, the precision of such tool is extremely promising (i.e., 92%) for an effort-aware software team. We also examine the return on investment by training a regression model to locate most skeptical changes with fewer lines to inspect. Our findings suggest that such model is capable of pinpointing 31% of all VCCs with only 20% of the effort it would take to audit all changes (i.e., 55% better than random predictor). Our outputs can assist as an early step of continuous security inspections as it provides immediate feedback once developers submit changes to their code base.

Several factors (e.g., balancedness, good correlation immunity) are considered as important properties of Boolean functions for using in cryptographic primitives. A Boolean function is perfect algebraic immune if it is with perfect immunity against algebraic and fast algebraic attacks. There is an increasing interest in construction of Boolean function that is perfect algebraic immune combined with other characteristics, like resiliency. A resilient function is a balanced correlation-immune function. This paper uses bivariate representation of Boolean function and theory of finite field to construct a generalized and new class of Boolean functions on even variables by extending the Carlet-Feng functions. We show that the functions generated by this construction support cryptographic properties of 1-resiliency and (sub)optimal algebraic immunity and further propose the sufficient condition of achieving optimal algebraic immunity. Compared experimentally with Carlet-Feng functions and the functions constructed by the method of first-order concatenation existing in the literature on even (from 6 to 16) variables, these functions have better immunity against fast algebraic attacks. Implementation results also show that they are almost perfect algebraic immune functions.

Outsourcing computation with verifiability is a merging notion in cloud computing, which enables lightweight clients to outsource costly computation tasks to the cloud and efficiently check the correctness of the result in the end. This advanced notion is more important in marine mobile computing since the oceangoing vessels are usually constrained with less storage and computation resources. In such a scenario, vessels always firstly outsource data set and perform a function computing over them or at first outsource computing functions and input data set into them. However, vessels may choose which delegation computation type to outsource, which generally depends on the actual circumstances. Hence, we propose a scalable verifiable outsourcing computation protocol ( SV-OC ) in marine cloud computing at first and extract a single-mode version of it ( SM-SV-OC ), where both protocols allow anyone who holds verification tokens to efficiently verify the computed result returned from cloud. In this way, the introduced “scalable” property lets vessels adjust the protocol to cope with different delegation situations in practice. We additionally prove both SV-OC and SM-SV-OC achieving selective soundness in the random oracle model and evaluate their performance in the end.

In cloud computing, computationally weak users are always willing to outsource costly computations to a cloud, and at the same time they need to check the correctness of the result provided by the cloud. Such activities motivate the occurrence of verifiable computation (VC). Recently, Parno, Raykova and Vaikuntanathan showed any VC protocol can be constructed from an attribute-based encryption (ABE) scheme for a same class of functions. In this paper, we propose two practical and efficient semi-adaptively secure key-policy attribute-based encryption (KP-ABE) schemes with constant-size ciphertexts. The semi-adaptive security requires that the adversary designates the challenge attribute set after it receives public parameters but before it issues any secret key query, which is stronger than selective security guarantee. Our first construction deals with small universe while the second one supports large universe. Both constructions employ the technique underlying the prime-order instantiation of nested dual system groups, which are based on the $d$-linear assumption including SXDH and DLIN assumptions. In order to evaluate the performance, we implement our ABE schemes using $\textsf{Python}$ language in Charm. Compared with previous KP-ABE schemes with constant-size ciphertexts, our constructions achieve shorter ciphertext and secret key sizes, and require low computation costs, especially under the SXDH assumption.

Rainbow is an effective multivariate digital signature scheme proposed by Ding and Schmidt. However, a lot of attacks against it have been proposed. To resist all these attacks, designer should be very careful with its choice of parameters. In this study, the authors will propose a new approach to build a secure variant of Rainbow. According to our security analysis, it could resist all the existing attacks against Rainbow and save some memory in the meantime.

Abstract Dual receiver encryption (DRE), a notion of public key encryption (PKE) introduced at CCS'04, allows two independent receivers to decrypt a ciphertext into a same plaintext. This crypto primitive is quite useful in designing denial of service attack‐resilient protocols. To our knowledge, prior DRE constructions are considered in the traditional PKE settings, which may face the difficulty of certificate management. This paper aiming at solving this dilemma of DRE in the traditional PKE settings, and gives an identity‐based variant version of DRE: identity‐based dual receiver encryption (ID‐DRE) that combines the notion of DRE and identity‐based encryption (IBE). Based on Waters' IBE (Crypto'05), two ID‐DRE schemes are constructed in the standard model and by partitioning methodology, provable security of our ID‐DRE schemes are obtained under the decisional bilinear Diffie‐Hellman. Furthermore, we achieve a tighter reduction by adopting a random walk ‐like methodology of analysis on the lower bound of simulators' artificial abort, which also results in better security tightness for Waters IBE. This improved result for Waters' IBE, where n is the bitlength of messages and q is the number of adversarial key queries, is consistent with Hofheinz and Kiltz's result (Crypto'08). Copyright © 2017 John Wiley & Sons, Ltd.

We revisit the problem of basing signcryption SC tag key encapsulation mechanism KEM on standard assumptions and standard model and present direct constructions of SC-KEM/tag-KEM, which satisfy confidentiality and unforgeability with respect to adversarially chosen keys where the adversary is given more advantageous attack environment than existing models in the literature;are based on the standard decisional bilinear Diffie-Hellman and computational Diffie-Hellman assumptions without random oracle;do not use strongly unforgeable signature schemes as building blocks; andprovide comparable performance to existing SC-KEM/tag-KEM schemes.

A typical but trivial layout of alphanumeric buttons in the touchscreen setting is to arrange the 10 digits and 26 letters in a natural order. This arrangement does not take into account the frequencies of letters and digits when the users touch the buttons to key in their passwords or messages. We examine large scale datasets of over 141 million passwords collected from several leading websites for social networking, Internet forums, gaming, dating, and various other online service providers in China, and find that the distribution of letters in passwords is quite close to that in Chinese language. Based on the letter/digit frequencies, we further propose an alphanumeric button layout scheme with the following advantages: the buttons are clicked as uniformly as possible, so that the lifetime of the touchscreen can be prolonged and finger oil residues may scatter more evenly over the button area of the screen; and in the meantime, the movements of users' fingers are improved to enhance good user experience when inputting messages. The idea behind the layout is potentially applicable to diversified races.

Graphical password methods rely on human experience and hand selection (not well-quantified metric) to evaluate the appropriateness and the confusion of the challenge images. In this paper we propose to use for authentication Chinese characters, for which the entropy can be up to 9.65 (much larger than other languages). We first show an algorithmic framework to authenticate a user and then present an empirical analysis conducted at a university. The advantages of the framework include the following: the storage overhead is low; no personal experience or hand selection is involved; there is no predefined dictionary of likely choices; and it can be easily referenced by personal-style cues. Our study shows that the number of participants that prefer our framework is much close to that in favor of graphical passwords, with an interesting outcome that the two groups of participants present significantly distinct backgrounds. Our framework and graphical passwords can be used as candidate authentication methods for users with different backgrounds. We also measure user choices of patterns and find that there is a slight preference of the 3$\times$3 grid to the circle patterns. While the proposed framework prescribes the challenge characters, the users have the option to define challenge characters of their own.

ABSTRACT In password‐based or two‐factor (password and smart card) authentications, password changing is one of common techniques used to improve the security of the systems protected by the password. However, the password‐changing operations in existing password authentications either depend on the login phase or violate the common practice that an old password should not be valid for subsequent login after being updated. On the other hand, password mistyping is very common in reality, which may be random or be skewed by the adversary via technical means or social engineering manipulation [i.e., a kind of denial‐of‐service (DoS) attack]. In human‐centric authentication mechanisms, password changing and DoS resilience are not marginal issues. The paper addresses the requirements of robust password changing in authentication and presents , a password authentication scheme with robust password changing, DoS resilience, and card‐compromise security. Thus, the proposal can be viewed as a suitable candidate instantiation for authentication services of human‐centric security, by embedding in the computer and software systems. also achieves other appealing features, such as self‐healing ability and strong privacy protection, which may be useful for human‐centric applications. Copyright © 2013 John Wiley & Sons, Ltd.

A (worst-case) 2-source extractor is a deterministic algorithm that transforms pairwise independent weak random sources into almost uniform random strings. Despite non-constructive proofs that such objects exist with almost optimal parameters, it has been a longstanding open problem to construct `explicit' (aka efficient) functions for sources of `small' constant entropy rate. In particular, best known constructions either require entropy rate of at least 0.4999 (due to Bourgain), or one source must remain with constant entropy rate above half (due to Raz). Motivated by cryptographic applications, we observe that if one source is a leaky source (or it contains a few deterministically extractable entropy), then we will be able to efficiently extract almost all entropy from both sources with nearly optimal entropy loss. Further, our extractor (for leaky sources) does not suffer from the half entropy rate barrier, and it works for all linear (and even sub-linear) entropy sources. The extractor is constructed using the technique of alternating extraction by Dziembowski and Pietrzak (FOCS 2007). Finally, we show that the extractor is almost a worse-case extractor (for the same parameters) in the sense that it only fails for a negligible fraction of sources.

Progressive Edge-Growth(PEG) Algorithm is a good candidate to generate Tanner Graphs with a large girth by establishing edges or connections between symbol and check nodes in an edge-by-edge manner. In this paper, we propose an extended PEG algorithm for constructing Low-Density Parity-Check (LDPC) codes with very high rate when given a lower bound of girth. Simulation results show the bit error rates of constructed LDPC codes with very high rate or large girth.