Blockchain, as an emerging technology, is constantly evolving due to its remarkable advantages but is also subject to its unalterability, which leads to the misuse of blockchain storage and causes adverse effects. Hence, the redactable blockchain was proposed, which can alleviate the above issues in a controlled manner. However, a situation exists in which the modifiers specified by customized identities or attributes in the existing schemes may be malicious, which can easily lead to malicious modification events. Evaluating, filtering, and limiting malicious modifiers in advance may be a feasible solution to the situation. Hence, we propose an efficient dynamic trust-based redactable blockchain supporting update and traceability, which offers full-process security with pre-modification pre-evaluation, modification privilege restrictions, and post-modification traceability. Firstly, we consider the user’s various behaviors and multiple factors and customize a dynamic trust evaluation model for redactable blockchain to comprehensively evaluate the reliability of the user. Then, we combine the user’s trust worthiness, dynamic proactive secret sharing($\mathcal {DPSS}$), chameleon hash($\mathcal {CH}$), and digital signature ($\mathcal {DS}$) to design a dynamic trust-based chameleon hash supporting update and traceability, called$\mathcal {DTCH}$, to realize full-process security, and prove its security. Thirdly, we construct the$\mathcal {DTCH}$-based redactable blockchain supporting update and traceability, demonstrate its security and further apply it to consortium blockchain. Finally, we evaluate the performance of the constructed model and scheme, and the evaluation results illuminate that they are not only effective but also possess better performance.

Abstract With the rapid development of big data technology and applications, sharing and supervision of massive data have become the demand of industry development. As an emerging technology, blockchain, with excellent characteristics, can promote the prosperity and development of the data‐sharing industry. However, the existing blockchain may lead to some privacy and security issues due to its transparency and lack of supervision. Hence, a secure data sharing model with supervision and privacy protection, named DBSDS, was proposed, which supports illegal content supervision and users revocation, and possesses flexible and fine‐grained access control on data sharing. Firstly, it introduces a dual‐blockchain architecture, one blockchain is used to ensure the integrity and traceability of private data and another is utilized to supervise illegal users so that they can no longer upload and share private data. Secondly, a key tracing tree was built and correspondingly different key generation strategies for different users were designed, which endows regulators with supervision capabilities. Finally, combined ABPER‐KS algorithm, both privacy protection and fine‐grained access control on private data can be accomplished. Furthermore, security analysis and performance comparison manifest that DBSDS is safe and owns better performance, and scheme implementation and experimental analysis indicate the practicality of DBSDS.

With the popularity of social networks, a great variety of new social applications have been generated for impromptu group formation and communications. Among those applications, the subgraph matching has become a hot research area in social networks. Due to the huge cost of managing and computing graph data, it may have to outsource the computations to the cloud server. However, the most critical problem is that the cloud server leaks the graph information during the processing of the graph data, and the external attackers modify the graph information during the transmission on the public channel. Thus, confidentiality and authentication have been critical attributes in the subgraph matching query service. In this article, we present an efficient and privacy-preserving subgraph matching scheme with authentication in social networks. Using the proposed scheme, the cloud can accomplish the subgraph matching query process without obtaining any sensitive information about the users. Additionally, we achieve data integrity verification and user authentication. Each receiver can verify if the received messages come from the legal sender and have not been tampered. The detailed security and efficiency analysis show that the proposed scheme not only satisfies security requirements but also achieves high-efficiency in local users, and it is suitable for many practical applications.

Due to wealthy structure and semantic information expressed by a graph, the graph is frequently employed in numerous social applications to show social relationships. Among those important applications, the private graph intersection operation plays an important part in social networks. Because of the high cost of managing graph data and the computational difficulty of graph intersection operation, delegating the computations to the cloud server (CS) is an attractive alternative. However, when the CS is untrusted or compromised by some adversaries, the results that the CS returns can not be guaranteed to be correct. In such cases, it may have serious consequences for the application functionality. In this article, we present an efficient and privacy-preserving verifiable graph intersection scheme with cryptographic accumulators in social networks. Using the proposed scheme, we construct the framework to provide secure verifiable graph intersection operation in an untrusted cloud, and the requester can verify the correctness of the graph intersection result that the CS returns. Additionally, the data owners' graph data privacy and user authentication are well protected. The detailed correctness proof and performance analysis show that the proposed scheme is secure and feasible. Thus, our scheme is appropriate for many practical applications.

Privacy protection and open sharing are the core of data governance in the AI‐driven era. A common data‐sharing management platform is indispensable in the existing data‐sharing solutions, and users upload their data to the cloud server for storage and dissemination. However, from the moment users upload the data to the server, they will lose absolute ownership of their data, and security and privacy will become a critical issue. Although data encryption and access control are considered up‐and‐coming technologies in protecting personal data security on the cloud server, they alleviate this problem to a certain extent. However, it still depends too much on a third‐party organization’s credibility, the Cloud Service Provider (CSP). In this paper, we combined blockchain, ciphertext‐policy attribute‐based encryption (CP‐ABE), and InterPlanetary File System (IPFS) to address this problem to propose a blockchain‐based security sharing scheme for personal data named BSSPD. In this user‐centric scheme, the data owner encrypts the sharing data and stores it on IPFS, which maximizes the scheme’s decentralization. The address and the decryption key of the shared data will be encrypted with CP‐ABE according to the specific access policy, and the data owner uses blockchain to publish his data‐related information and distribute keys for data users. Only the data user whose attributes meet the access policy can download and decrypt the data. The data owner has fine‐grained access control over his data, and BSSPD supports an attribute‐level revocation of a specific data user without affecting others. To further protect the data user’s privacy, the ciphertext keyword search is used when retrieving data. We analyzed the security of the BBSPD and simulated our scheme on the EOS blockchain, which proved that our scheme is feasible. Meanwhile, we provided a thorough analysis of the storage and computing overhead, which proved that BSSPD has a good performance.

Attribute-based encryption has been a promising encryption technology to secure personal health records (PHRs) sharing in cloud computing. PHRs consist of the patient data often collected from various sources including hospitals and general practice centres. Different patients' access policies have a common access sub-policy. In this paper, we propose a novel attribute-based encryption scheme for fine-grained and flexible access control to PHRs data in cloud computing. The scheme generates shared information by the common access sub-policy, which is based on different patients' access policies. Then, the scheme combines the encryption of PHRs from different patients. Therefore, both time consumption of encryption and decryption can be reduced. Medical staff require varying levels of access to PHRs. The proposed scheme can also support multi-privilege access control so that medical staff can access the required level of information while maximizing patient privacy. Through implementation and simulation, we demonstrate that the proposed scheme is efficient in terms of time. Moreover, we prove the security of the proposed scheme based on security of the ciphertext-policy attribute-based encryption scheme.

This paper presents a novel access control scheme for personal health record(PHR) data in cloud computing. The scheme utilizes attribute-based encryption(ABE), hash function and symmetric encryption to realize a fine-grained, multi- privilege access control to PHR. The patients can share their PHR with medical staff from various departments with different privileges securely. The experimental results show the efficiency of our scheme in terms of running-time, communication cost and storage overhead.

Exploit attacks have been one of the major threats to computer network systems, the damage of which has been extensively studied and numerous countermeasures have been proposed to defend against them. In this work, we propose a multiobjective optimization framework to facilitate evaluation of network security under exploit attacks. Our approach explores a promising avenue of integrating attack graph methodology to evaluate network security. In particular, we innovatively utilize attack graph based security metrics to model exploit attacks and dynamically measure security risk under these attacks. Then a multiobjective problem is formulated to maximize network exploitability and security impact under feasible exploit compositions. Furthermore, an artificial immune algorithm is employed to solve the formulated problem. We conduct a series of simulation experiments on hypothetical network models to testify the performance of proposed mechanism. Simulation results show that our approach can innovatively solve the security evaluation problem under multiple decision variables with feasibility and effectiveness.