Recent progress in adversarial attacks on 3D point clouds, particularly in achieving spatial imperceptibility and high attack performance, presents significant challenges for defenders. Current defensive approaches remain cumbersome, often requiring invasive model modifications, expensive training procedures or auxiliary data access. To address these threats, in this paper, we propose a plug-and-play and non-invasive defense mechanism in the spectral domain, grounded in a theoretical and empirical analysis of the relationship between imperceptible perturbations and high-frequency spectral components. Building upon these insights, we introduce a novel purification framework, termed PWAVEP, which begins by computing a spectral graph wavelet domain saliency score and local sparsity score for each point. Guided by these values, PWAVEP adopts a hierarchical strategy, it eliminates the most salient points, which are identified as hardly recoverable adversarial outliers. Simultaneously, it applies a spectral filtering process to a broader set of moderately salient points. This process leverages a graph wavelet transform to attenuate high-frequency coefficients associated with the targeted points, thereby effectively suppressing adversarial noise. Extensive evaluations demonstrate that the proposed PWAVEP achieves superior accuracy and robustness compared to existing approaches, advancing the state-of-the-art in 3D point cloud purification. Code and datasets are available at https://github.com/a772316182/pwavep

Outsourcing logistic regression classification services to the cloud is highly beneficial for streaming data. However, it raises critical privacy concerns for the input data and the training models. Current solutions for encrypted logistic regression classification fall short in the processing of encrypted streaming data. In this paper, we propose a privacy-preserving logistic regression model (PrivESD), which allows computation over encrypted streaming data. First, we propose a lightweight framework, which creates a collaborative workload between the cloud and the edge thereby reducing the computation complexity of the cloud and the number of communications between the data owners and the cloud. Second, we develop a tailored building block library with strong data confidentiality that supports comparison operations. This library has then been used to construct logistic regression. Finally, we devise a processing scheme that uses stochastic gradient descent with momentum to train the model to prevent the problem of local optimal convergence with streaming data. We have conducted extensive performance analysis demonstrating that the proposed protocols such as our secure compare protocol outperforms existing schemes such as Bost [44] and Guo [45], and that the encryption and decryption operations of PrivESD are similar to that of Paillier [42] with$2^{30}$keys.

Cloud computing has become a dominant paradigm for outsourcing computationally intensive tasks. However, the lack of transparency in remote execution poses significant challenges to integrity and trust. Verifiable computation (VC) mitigates these issues by enabling clients to efficiently verify outsourced results. Existing VC schemes often incur high verification costs, scale poorly, and exhibit low computational efficiency. We propose the Parallel and Verifiable Polynomial Computation (PVPC) scheme, designed for secure, privacy-preserving, and scalable polynomial evaluation in heterogeneous cloud-edge environments. PVPC reformulates polynomial evaluation as matrix-vector operations combined with random sparse blinding, enabling parallel execution across multiple sub-servers while preserving input privacy. It achieves sublinear complexity in the polynomial degree through row-wise factorization and enables aggregated batch verification via bilinear pairings, thereby reducing per-task verification overhead. We present formal correctness and security proofs under the Computational Diffie-Hellman assumption, and evaluate PVPC against state-of-the-art VC protocols. Experimental results show that PVPC substantially outperforms existing schemes in computation, verification, and recovery phases-particularly for high-degree polynomials-while maintaining practical communication costs. These features make PVPC well-suited for large-scale, latency-sensitive, and distributed verifiable computing applications.

With the rapid advancement of Internet of Things (IoT) technology, the security and utilization of data outsourced to the cloud is a prerequisite for IoT application in actual production. Attribute-based keyword search (ABKS) has emerged as a powerful primitive for fine-grained search over encrypted data for IoT. While recent advanced ABKS schemes support more abundant functions and query structures, they do not consider multi-owner setting. Moreover, these schemes typically rely on a single trusted attribute authority for user certificate verification and private key distribution. This centralization creates a single point of failure and raises security concerns, such as key escrow. Furthermore, the existence of malicious entities necessitates verification mechanisms. However, most existing approaches introduce unvetted third-party validators, leading to reliability issues and privacy risks. Nevertheless, in numerous schemes, malicious entities persist in operational status, thereby compromising systemic security. To address these challenges, we propose ABKS with user-generated keys (ABKS-UGK), which decentralizes key generation to individual data users, fundamentally resolving the key escrow vulnerabilities in traditional schemes. It not only leverages blockchain’s immutability for secure result verification, but also incorporates a revocation mechanism against malicious entities. Extensive experimental evaluations demonstrate its efficiency and reliability, making it suitable for secure, verifiable data sharing in real world.

With the rapid expansion of the Internet of Things (IoT), the shift from cloud computing to Mobile Edge Computing (MEC) has become necessary to address the low-latency requirements of real-time applications. Verifiable computation (VC) enables resource-limited clients to outsource their computation-intensive tasks to a powerful cloud while ensuring the correctness of the computation result. However, traditional VC schemes, originally designed for cloud computing, face challenges when applied to MEC environments, such as scalability issues, robustness, and efficiency concerns. To this end, we propose a verifiable distributed computation scheme for MEC, where computation tasks are distributed between a cloud server cluster (consisting of$n$servers) and an edge server. The cloud handles most of the computation through parallel sub-tasks, while the edge server verifies intermediate results and performs minimal computation to recover the final outcome. Our scheme guarantees that the result can be recovered if at least$t$servers, out of a total of$n$servers in the cloud server cluster, perform their computations honestly. By leveraging batch verification and matrix-optimized polynomial evaluations, our scheme significantly enhances scalability, fault tolerance, and efficiency. The extensive analysis and simulations demonstrate that our proposed scheme is more feasible than existing solutions.

Verifiable delegated set intersection over outsourced private datasets (VDPSI) enables two parties to outsource their private datasets and delegate the computation of set intersection to the cloud while being able to check the correctness of the result. In this process, the cloud learns nothing about the datasets and the intersection result. However, the existing VDPSI schemes suffer from three substantial shortcomings that limit their use: i) the whole dataset consists of only one subset, ii) they are designed for the static data, and iii) they cannot support other operations. To resolve these problems, we introduce a novel primitive called tag-based VDPSI (TVDPSI), which is designed for the multi-subset case where each subset is associated with one single tag for data classification. To protect privacy, the data is encrypted before being resided to the cloud. The tag is implicitly hidden in each encrypted element. As a result, the cloud cannot learn which data belongs to the same subset beyond the intersection set. Besides, the cloud cannot calculate the intersection except under the permissions of data owners. To the best of our knowledge, TVDPSI is the first VDPSI scheme supporting dynamic update and count operations. The detailed performance evaluation and simulation show that our protocol is more practical in cloud computing.

Verifiable databases (VDB) enables the data owner to outsource a huge unencrypted database to the powerful but untrusted cloud such that any client could later retrieve the database and check whether the cloud returns valid records or not. To the best of our knowledge, there is no prior work considering privacy. Besides, they assume that the data owner and the client are fully trusted while they may be semi-honest in the real world. To address these problems, we propose a new primitive called privacy-preserving publicly verifiable database (PPVDB), which not only guarantees the integrity of the queried result but also leaks no information. At the end of this protocol, the client can check whether the cloud returns a valid result and learns the queried result but nothing else about the database. Besides, the cloud learns nothing about the database and the query, and the data owner does not know which item that the client has queried. Motivated by the comparison among some strawman solutions, we incorporate verifiable computation for the polynomial with oblivious pseudorandom function to construct a PPVDB scheme, which is the first VDB scheme providing stronger security against the malicious cloud and the semi-honest client and data owner.

Cooperative intelligent transport systems (C-ITS) are advanced applications providing various services to enable a more secure, efficient, and accessible transportation system. When requesting services in C-ITS, privacy-preserving is crucial to avoid attempts in tracking vehicles who send continuous messages containing their authentication information. In this paper, we propose a revocable privacy-preserving authentication scheme through attribute-based credentials with complete subtree method. Differing from the existing anonymous credential works in C-ITS, our scheme supports the aggregation of attributes which facilitates the construction of a constant-size credential for multi-service. Not only maintaining the privacy-preserving of identity, the aggregate credential is also able to improve the efficiency of credential presentation. For illegal vehicles, our scheme revokes and disallows them to generate valid signatures via using complete subtree method in the non-revoked epoch. Moreover, we present analyses on aspects of security and performance, respectively. The former focuses on the security goals including privacy-preserving of identity, unlinkability, unforgeability, revocability and anti-replay attacks; while the latter shows that our scheme makes more practical sense for C-ITS.

In Collaborative Intelligent Transportation System (C-ITS), vehicles send collaborative awareness messages (CAMs) carrying information such as speed, position, and identity, to interact with other vehicles, and thus, obtain transportation services. However, CAMs are broadcasted in plaintext over the unsafe network, which causes the leakage of vehicle's sensitive information when maliciously intercepted. At present, there is less scheme for encryption and anonymous authentication CAMs that is suitable for the actual scenario. In this paper, we propose a revocable zone encryption scheme with anonymous authentication. When vehicles enter the zone, the zone manager first completes the anonymous authentication according to the vehicle-generated join request containing a self-delegated certificate. Then, vehicles encrypt CAMs with the session key by symmetric encryption and wrap the session key with the zone key for secure communication. Besides, we use the complete subtree method to satisfy the revocation of the vehicle and zone key management respectively. Finally, simulation experiments and analysis show that our scheme provides stronger privacy-preserving compared with proposals that only support anonymous authentication. Differing from the similar scheme that tries to encrypt CAMs, our scheme not only satisfies more security requirements but also our key management is more feasible.

With the development and innovation of new techniques for 5G, 5G networks can provide extremely large capacity, robust integrity, high bandwidth, and low latency for multimedia image sharing and storage. However, it will surely exacerbate the privacy problems intrinsic to image transformation. Due to the high security and reliability requirements for storing and sharing sensitive images in the 5G network environment, verifiable steganography-based secret image sharing (SIS) is attracting increasing attention. The verifiable capability is necessary to ensure the correct image reconstruction. From the literature, efficient cheating verification, lossless reconstruction, low reconstruct complexity, and high-quality stego images without pixel expansion are summarized as the primary goals of proposing an effective steganography-based SIS scheme. Compared with the traditional underlying techniques for SIS, cellular automata (CA) and matrix projection have more strengths as well as some weaknesses. In this paper, we perform a complimentary of these two techniques to propose a verifiable secret image sharing scheme, where CA is used to enhance the security of the secret image, and matrix projection is used to generate shadows with a smaller size. From the steganography perspective, instead of the traditional least significant bits replacement method, matrix encoding is used in this paper to improve the embedding efficiency and stego image quality. Therefore, we can simultaneously achieve the above goals and achieve proactive and dynamic features based on matrix projection. Such features can make the proposed SIS scheme more applicable to flexible 5G networks. Finally, the security analysis illustrates that our scheme can effectively resist the collusion attack and detect the shadow tampering over the persistent adversary. The analyses for performance and comparative demonstrate that our scheme is a better performer among the recent schemes with the perspective of functionality, visual quality, embedding ratio, and computational efficiency. Therefore, our scheme further strengthens security for the images in 5G networks.

The industrial control and automation systems have played an increasingly important role in critical manufacturing processes. In such systems, many Internet of Things devices continuously collect large number of streaming data for real-time processing. Verifiable data streaming (VDS) addresses such authenticity issue for streaming data, but most VDS schemes are not efficient and lightweight, do not support range querying, and cannot be used in practice. To improve the efficiency and achieve a verifiable range query in data streaming, we present here a new primitive, namely, a chameleon authentication tree with prefixes (PCAT), which is extended from the PBTree and chameleon authentication tree. Our scheme is not only lightweight but also supports dynamic expansion and verifiable range query in data streaming, making it more suitable for resource-constrained devices. We separate the PCAT's algorithms into the following phases: initialization, data appending, query, and verification. Our analyses prove that the PCAT satisfies all the security requirements of VDS. Moreover, an efficiency analysis and performance evaluation demonstrate that our scheme not only supports lightweight data streaming authentication but also has high efficiency, which means that the PCAT is easier to apply in the industrial control and automation systems.

Most of security issues in deep learning are based on human-imperceptible adversarial perturbation, which can fool image recognition models of deep learning and bring a serious security threats to many practical applications. However, how to construct a universal adversarial perturbation for images is still an open question. In this paper, we make fully use of a residual network to get a universal perturbation, and then utilize a loss network to perform the similarity measure of images to carry out the adversarial attack. Experiment results on the CIFAR-10 dataset show that our scheme can get an 89% attack success rate.

Abstract Vector commitment (VC) schemes allow committing to an ordered sequence of ${q}$ values ${(m_1,\cdots ,m_q)}$ in such a way that one can later open the commitment at specific positions. However, the existing VC schemes suffer from two substantial shortcomings that limit their use: (i) the commitments cannot be opened except at some specific positions, and (ii) their security only captures position-binding but offers no privacy: the client may learn additional information about the committed sequence through the proofs and the commitments. To resolve these problems, we first extend VC to a more expressive primitive called VC with sum binding (VCS), in which the commitment can also be opened to the sum of all elements in the committed sequence. VCS additionally satisfies the security of sum binding, which guarantees that the commitment cannot be opened to different sums. To enhance its privacy, we extend VCS to zero-knowledge VCS (ZKVCS), in which commitments and proofs constructed during the protocol execution leak nothing about the committed sequence. We formalize this new property by a standard real/ideal experiment. Meanwhile, the detailed performance analyses and simulations show that our proposed schemes are more practical. Finally, we introduce a novel notion of (zero-knowledge) verifiable database supporting sum and show how to construct it from our (ZK)VCS scheme.

With development of online social networks, many criminal suspects use social network to communicate with each other. In order to obtain valuable criminal clues, considerable research works have been done to analyze criminal suspects' social data. However, most of them did not pay much attention on privacy-preserving problems, which may leak some sensitive data in the analysis process. To solve this problem, we propose a novel analysis approach of criminal suspects by exploiting social data and crime data that are collected by social network and police information systems. We enable the social cloud server and public security cloud server to exchange social information of criminal suspects and user's public information in a privacy-preserving way. Specifically, we propose a privacy-preserving data retrieving method based on oblivious transfer to guarantee that only the authorized entities can perform queries on suspects' social data, while the social cloud server cannot infer anything during the query. Moreover, several building blocks, such as encrypted data comparing, secure classification and regression tree (CART) model are also proposed. Based on these building blocks, we designed a privacy-preserving criminal suspects sensing scheme. Finally, we demonstrate a performance evaluation which shows that our scheme can enhance analysis of criminal suspects without privacy leakage, while with low overhead.

Along with the fast development of wireless technologies, smart devices have become an integral part of our daily life. Authentication is one of the most common and effective methods for these smart devices to prevent unauthorized access. Moreover, smart devices tend to have limited computing power, and they may possess sensitive data. In this paper, we investigate performing graph operations in a privacy-preserving manner, which can be used for anonymous authentication for smart devices. We propose two protocols that allow two parties to jointly compute the intersection and union of their private graphs. Our protocols utilize homomorphic encryption to prevent information leakage during the process, and we provide security proofs of the protocols in the semihonest setting. At last, we implement and evaluate the efficiency of our protocols through experiments on real-world graph data.

In 2015, Wang proposed the first identity-based provable data possession scheme named ID-DPDP (IEEE Transactions on Services Computing, vol. 8, no. 2, pp. 328-340, Mar./Apr. 2015) to verify outsourced data publicly without the implementation of PKI. Unfortunately, in this letter, we demonstrate that this scheme is insecure in the sense that cloud servers can generate valid proofs without possessing the original data blocks. We also show another security issue in this scheme which leads to some data blocks can never be verified unless all the data blocks are challenged. Meanwhile, we provide solutions to these problems while preserving the security features of the original scheme.

Key management is very crucial in a secure multicast system. The key storage of the group controller and group members, the communication cost and computation cost caused by joining/leaving members, are the determining factors for the performance of the key management system. A scheme is high-performed, if it has the optimal rekeying cost and the lower storage requirements. In order to get the high efficiency and security, a novel scheme (TOFT) based on threshold-based one-way function tree is proposed in this paper. The quad-tree and the threshold-key-mechanism are used in the scheme, which improves the performance of the key management system. We present the design principle, the realization protocols including keys generation and distribution, dynamic membership management. The TOFT scheme is compared with other protocols from the following four aspects: computation cost, communication cost, storage requirements, and security. Finally, we conclude that our scheme is more efficient than others.