OS Kernel fuzzers such as Syzkaller often struggle to generate syscall sequences that respect intrinsic Syscall Dependency Relations (SDRs), resulting in seeds that either violate kernel constraints or fail to reach deep execution paths. We propose leveraging an N-gram model to learn SDRs from both kernel execution history and ongoing fuzzing results. This enables the fuzzer to capture dependencies in similar kernel versions while adapting to target-specific behaviors, thereby improving the validity of generated seeds. Additionally, we introduce a bidirectional Random Walk strategy to enhance the diversity of generated seeds. We implement this approach in a prototype, Psyzkaller, on top of Syzkaller. Experiments show that, trained with the large-scale DongTing dataset and continuously updated with ongoing fuzzing results, Psyzkaller improves Syzkaller's code coverage by 4.6%-7.0%, triggers 110.4%-187.2% more crashes, and discovers eight previously unknown kernel vulnerabilities. Furthermore, Psyzkaller outperforms state-of-the-art fuzzers such as ACTOR and SyzDescribe in both coverage and crashes.

Secure data forwarding involves converting decrypted ciphertext, initially readable by one user, into a format that can be deciphered by another user. Proxy re-encryption is a commonly employed technique for secure data forwarding. However, this technique faces two inherent limitations. Firstly, only the data owner possesses the ability to control which data users can decrypt the ciphertext, resulting in receivers receiving irrelevant or uninterested information. Secondly, when data is forwarded through multiple nodes, it becomes vulnerable to various attacks such as impersonation and forgery. A solution called bilateral access control addresses these issues by letting the sender and receiver specify access control policies that the other party should comply with and ensure message confidentiality and authenticity. Nevertheless, to the best of our knowledge, there is currently no existing bilateral access control scheme capable of achieving secure data forwarding. In response to this issue, we propose a privacy-preserving proxy bilateral access control scheme, which simultaneously achieves all the above functionalities. Subsequently, we prove the message confidentiality and authenticity under the standard assumptions in the random oracle model. Finally, extensive theoretical analysis and performance evaluation demonstrate that the scheme provides unique features and comparable performance.

Fully homomorphic encryption (FHE) is a powerful technique that allows unlimited computations on encrypted data without decryption. However, FHE will incur huge computation and storage costs, making it difficult to be applied in real environments. To improve the efficiency of FHE, some optimized schemes have been proposed based on the trusted execution environment (TEE), which offer a lighter and lower overhead solution for FHE optimizations to a certain extent. However, they heavily rely on the confidentiality of the TEE, and their performance is still limited. To solve the above problems, we propose an efficient TEE-assistance CKKS scheme without bootstrapping, named TCKKS, which has the characteristics of security, efficiency, low memory, and scalability. First, to weaken the trust assumption of TEE, we consider TEE to be honest-but-curious, meaning the enclave's algorithm provider will execute the algorithm honestly but might monitor the data in the enclave. Based on this assumption, we design a lightweight secure multiplication protocol (SMP) and a secure rotation protocol (SRP) for TCKKS to efficiently achieve ciphertext multiplication and rotation operations. Then, to further improve the performance of TCKKS, we optimize the arithmetic operations and encryption/decryption operations based on the characteristics of our protocols. Moreover, we prove the security of SMP and SRP under the simulation-based real/ideal worlds model and further demonstrate the security of TCKKS based on the RLWE problem. In addition, extensive experiments indicate that TCKKS has a better performance than mainstream libraries, such as RNS-HEAAN, PALISADE and SEAL.

Secure neural network inference is the privacy-preserving inference method that protects the model parameters and user’s private input. Previous works have constructed two-party, three-party and four-party secure inference schemes. However, these schemes allow only one corrupted party. Also, the interaction protocol between different parties is customized based on the number of participants. If the number of participants increases or decreases, the protocol needs to be redesigned. Another problem is that current protocols for non-linear functions still have large computation overhead. In this work, we present TFMD, a general and fast secure neural network inference framework with semi-honest security. TFMD is built based on threshold fully homomorphic encryption (FHE), and is suitable for the outsourced computation scenario. Concretely, TFMD designs general secure computation protocols for non-linear functions. Our protocols support arbitrarynparticipants, and allow at mostn– 1 corrupted parties. Further, TFMD constructs a novel secure neural network inference framework. TFMD employs FHE with computation-friendly coefficient encoding to quickly calculate linear functions, and employs our proposed protocol to calculate ReLU. Experiments illustrate that TFMD is both efficient and scalable. Even in the three-party setting, the online phase of our inference is 2.1× faster than CrypTFlow (S&P’20).

Impossible differential cryptanalysis and impossible polytopic cryptanalysis are among the most effective techniques for evaluating the security of block ciphers. However, previous automatic search methods for their distinguishers—dimpossible differentials and impossible polytopic transitions—neither account for the influence of the key schedule in single-key settings nor are applicable to block ciphers featuring large S-boxes, variable rotations, or key-dependent permutations. Furthermore, existing approaches fail to search for clusters of impossible differentials when all details of a block cipher are considered. In contrast to previous methods that focus solely on the propagation of differences or s-difference, we redefine impossible differentials and impossible (s+ 1)-polytopic transitions based on state propagation. This redefinition enables us to overcome the limitations inherent in earlier methodologies. Theoretically, we demonstrate that traditional definitions of impossible differentials and impossible (s+ 1)-polytopic transitions correspond to subsets of our redefined concepts, which offer broader analytical perspectives. Technically, we reformulate the automatic search model and develop an SAT-based tool to efficiently evaluate our redefined impossible differentials and impossible (s+ 1)-polytopic transitions. Building upon this foundational search method, we construct a comprehensive framework for detecting clusters of impossible differentials and impossible (s+1)-polytopic transitions. This framework not only fully incorporates the details and differential properties of block ciphers but is also applicable to those employing large S-boxes while considering the full linear layer. As a result, we derive new impossible differentials for GIFT64, PRINTcipher48/96, MISTY1, RC5-32/64/128 and SPECK, as well as new clusters of impossible differentials for SPECK, DES and ARIA. In assessing resistance against impossible differentials, we apply our method to evaluate the security of GIFT64, PRINTcipher48/96, MISTY1, SPECK, SIMON, and DES while accounting for all details of the block ciphers. Moreover, we propose acceleration strategies and apply them to evaluate the security of MISTY1 and AES-128. Notably, we prove that no 5-round impossible differentials with one active input byte and one active output byte exist for AES-128, even when considering the dependencies among three consecutive round keys. Finally, in exploring new impossible (s+1)-polytopic transition, we apply our approach to PRINTcipher48, GIFT64, RC5-32/64 and SIMON32-64, successfully yielding the corresponding distinguishers for the first time.

The impossible boomerang attack is a powerful cryptanalytic technique, but existing key recovery methods face several limitations that restrict its applicability. Specifically, the key pre-guessing is coarse-grained, S-box details are ignored in the differential propagation, the complexity estimation and the key guessing order determination remain rudimentary. To overcome these issues, we introduce three key improvement measures. First, we propose a flexible partial key and difference pre-guessing technique based on directed graphs, enabling selective identification of required keys and differences for generating partial pairs and quartets. Second, we propose a pre-sieving technique to early eliminate invalid quartets by exploiting cipher-specific details. Third, we introduce an automatic key-guessing strategy based on the same directed graphs to efficiently determine valid guessing orders. We integrate these techniques to develop a unified key recovery framework for impossible boomerang attacks, accompanied by a formal and precise characterization of the overall complexity. This is the first framework to support flexible key and difference pre-guessing while incorporating block cipher details during key recovery for impossible boomerang attacks. Crucially, it enables the automatic generation of detailed recovery steps, a capability missing in prior work. As applications, under the four related-key/tweakey setting, we apply the framework to ARADI, a low-latency cipher proposed by the National Security Agency (NSA), and SKINNYe v2, a threshold-implementation-friendly cipher proposed at EUROCRYPT 2020. For ARADI, we achieve the first full-round attack with 2130data, 2253.78time, and 2235.75memory complexity. For SKINNYe v2, we present the first 34-round impossible boomerang attack with 266data, 2253.75time, and 2239.75memory complexity. These results demonstrate the framework’s significance and its substantial improvement in advancing the impossible boomerang attack.

Secure two-party neural network (2PC-NN) inference is a privacy-preserving inference method that protects the client's input and the server's model parameters. While addressing privacy concerns, it also incurs considerable over-heads. In this work, we propose Octopus, a faster and more communication-efficient 2PC-NN system than prior works. Octopus designs an optimized encoding method for fast homomorphic convolution, and further constructs homomorphic encryption-based convolutional computation protocol. Compared with the original coefficient encoding proposed by Cheetah, our method significantly reduces the resulting ciphertexts through packing output channels, thereby saving the communication cost and end-to-end execution time. Moreover, Octopus proposes an encoding-motivated fine tuning technique for convolutional neural networks, which fully utilizes the feature of coefficient encoding to adaptively adjust the neural network structure to maximize performance with negligible accuracy loss. We apply Octopus to the widely used model ResNet on CIFAR-10 and ImageNet dataset. Experiments illustrate that Octopus has obvious improvement compared with the state-of-the-art approaches, achieving a speedup of up to 2.75×, and reduces communication overhead by up to 7.19× for convolutions. As for secure inference, compared with Cheetah (resp., CrypTFlow2), Octopus demonstrates 1.41× (resp., 13.20×) lower communication cost and 1.25× (resp., 7.03×) faster execution time under a WAN setting.

Abstract Artificial intelligence (AI) is revolutionizing both industries and reshaping the global economy. However, the rapid advancement of AI technologies brings significant security and privacy challenges. Recent incidents highlight vulnerabilities in AI systems, such as data leakage and malicious code injection, leading to severe financial losses and privacy breaches. Although existing studies have discussed specific security threats, they often lack detailed granularity and cover a limited scope. In this survey, we fill this gap by systematically categorizing and analyzing the threats and countermeasures in AI systems, which span both the training and inference stages, encompass centralized and distributed settings, and address both conventional and foundation AI models. By reviewing existing literature, we aim to provide AI researchers and practitioners with a thorough understanding of system vulnerabilities and current countermeasures. We hope to inspire further research into robust solutions, ultimately contributing to the development of resilient AI technologies.

Verifiable data streaming (VDS) is proposed to authenticate a sequence of ordered data, such that the misbehavior on the data returned by cloud server can be effectively detected. VDS also allows to efficiently replace the outsourced data by another value. However, the old authentication information can make the expired data pass the verification. To prevent this attack, VDS schemes must provide a revocation approach to revoke the old authentication information. The current approach employs the tree-like authentication structure or cryptographic accumulator, which will influence the efficiency of the VDS scheme. In this work, we find an approach to construct the low-storage VDS scheme supporting efficient revocation. Towards this end, we fully exploit the property of chameleon hash function with ephemeral trapdoor to propose a signature, which is the crucial step to construct the VDS scheme. In our VDS scheme, the size of the authentication information can be reduced to be less than the scale of the data streaming (i.e., low storage). Furthermore, the client is able to revoke the old authentication information in an efficient manner, where she only needs to release a message (i.e., efficient revocation). The performance evaluation shows that the proposed VDS scheme is efficient and practical.

With the widespread use of machine learning (ML), privacy concerns during neural network inference are attracting growing attention. Secure two-party neural network (2PC-NN) inference is the privacy-preserving inference method, which allows client to obtain the inference result without disclosing client’s input to the server. The server’s model parameters are also confidential to the client. However, current 2PC-NN inference schemes still have large overhead, especially for non-linear functions. In this paper, we present Swift, a fast secure 2PC-NN inference scheme based on fully homomorphic encryption (FHE) and secret sharing (SS). FHE protects the input and model parameters in linear functions, while SS is integrated to protect the non-linear functions. Concretely, Swift integrates FHE and SS to design secure and efficient non-linear protocols used for ReLU and max pooling. To further optimize performance, Swift employs FHE with computation-friendly coefficient encoding for fast execution of linear functions, and SIMD encoding for non-linear functions. Swift constructs efficient encoding conversion protocol between the coefficient-encoded ciphertext and the SIMD-encoded ciphertext. Finally, Swift achieves secure neural network inference framework for MNIST dataset. Compared with Cheetah (USENIX 2022), the execution time of ReLU, max pooling, secure inference under a WAN setting improves$7.4\times $,$13.3\times $,$1.9\times $, respectively.

Vertical federated learning for boosting trees has gained significant attention due to its ability to enable participants to collaboratively train high-quality models while preserving data privacy. However, existing privacy-preserving vertical boosting tree schemes suffer from high computation and communication costs or potential security vulnerabilities. Recently, SGBoost, a federated outsourced training and inference scheme, was proposed to address these challenges. However, its performance and security still require significant improvements. Therefore, we propose SGBoost+, an efficient and privacy-preserving vertical boosting tree framework for federated outsourced training and inference. Building upon the strengths of SGBoost, we introduce an RLWE-based lossless and secure internal node construction and an efficient oblivious inference algorithm to finish the model training and inference, significantly enhancing both security and efficiency. To reduce communication cost, we design a ciphertext compression algorithm for model training, which drastically minimizes data transmission costs. Additionally, we analyze the security of a symmetric encryption scheme, specify the required security conditions and parameters, and optimize our model inference based on its improved and secure version. Detailed security analysis confirms that SGBoost+offers strong privacy guarantees. Extensive experiments demonstrate that SGBoost+achieves efficient model training and inference with significantly lower computation and communication costs compared to state-of-the-art schemes.

Data streaming is an ordered sequence of data continuously generated over time, whose dynamic scale is hard to be predicated in advance. Since the traditional integrity verification primitives are not qualified to check the integrity of the retrieved data and the outsourced database in streaming setting, some specific schemes were proposed by adopting the tree- like authentication structure or the combination of signature and accumulator. However, these schemes are not optimal for the owner. The main concerns can be generalized as how to reduce the size of the authentication information to be less than the scale of the data streaming, and enable the resource-constrained owner to check the data integrity without using challenge. To address the problems, we intend to find a new approach to design the scheme by exploiting the novel technique called decentralized vector commitment (DVC). Towards this goal, we first propose a key exposure-freeness chameleon vector commitment scheme, and then present the efficient DVC technique based on our key exposure-freeness chameleon vector commitment scheme. The scheme is finally constructed by leveraging the efficient DVC technique. Besides the integrity verification, our scheme is also sufficient to efficiently distribute the data to a user who is protected from receiving the stale data. To optimize the performance in concurrently retrieving multiple data, we introduce the batch query that reduces large amounts of communication and computation overheads. The security analysis and performance evaluation show that our solutions are secure and efficient.

Most existing membership inference attacks (MIAs) utilize metrics (e.g., loss) calculated on the model's final state, while recent advanced attacks leverage metrics computed at various stages, including both intermediate and final stages, throughout the model training. Nevertheless, these attacks often process multiple intermediate states of the metric independently, ignoring their time-dependent patterns. Consequently, they struggle to effectively distinguish between members and non-members who exhibit similar metric values, particularly resulting in a high false-positive rate.

As a core arithmetic operation and security guarantee of Fully Homomorphic Encryption (FHE), Number Theoretic Transform (NTT) of a large degree is the primary source of computational and time overhead. In this paper, we propose a scalable and conflict-free memory mapping algorithm that breaks the memory bound and releases a large amount of on-chip resources. A flexible and no-stall hardware/software pipeline architecture is designed to boost the throughput of NTT/INTT of N = 216 to over 48,543 operations per second with area efficiency, which 4× and 10× speed up the FPGA-based (HPCA'23) and GPU-based (HPCA'23) schemes.

Logistic regression is a widely used and efficient machine learning algorithm for data analysis. However, data is often distributed among different participants, and building high-quality models often involves data interaction, which might easily lead to sensitive information leakage. While some schemes have been proposed to address the data security issue through privacy-preserving technologies such as multi-party computation, homomorphic encryption, and trusted execution environment (TEE), they still suffer from some limitations in terms of security, efficiency, and model integrity and are not suitable for the secure outsourcing training. Therefore, in this paper, we propose an efficient and lossless integrity-preserving training for high-dimensional logistic regression over vertically partitioned data. First, we utilize a block strategy to encrypt the data in batches and outsource them to a cloud with TEE to achieve the non-interactive training. Considering TEE’s limited memory, we employ random sampling technology to achieve mini-batch training within TEE, which ensures the data security. We find that the cloud might launch the active attacks to drop the model accuracy, such as lazy attack and replacement attack. To prevent the attacks, we introduce an integrity protection mechanism to verify data integrity and reduce verification frequency using a mixed-probability checking method, including fixed and random probability checking. Detailed analysis has confirmed that our scheme is secure and integrity-preserving. Extensive experiments have demonstrated that our scheme can achieve lossless, non-interactive, and efficient model training.

XGBoost, a widely-used machine learning algorithm, has been applied across various fields. To develop a high-quality model, federated learning is employed, allowing participants to keep their data localized while sharing gradients for global model training. However, recent studies have shown that gradients can leak sensitive information, and even when protected, they might still be vulnerable to certain attacks. While several privacy-preserving and verifiable schemes have been proposed to address this issue, they still face limitations in terms of computational and communication costs in certain scenarios. To solve the problem, we propose a privacy-preserving and verifiable XGBoost training scheme for horizontal federated learning. First, we propose a masking with one-time padding protocol (MOTP) to securely aggregate gradients, supporting both online and offline modes for generating random masks. Both approaches reduce the communication costs and improve the training efficiency. Next, we present a linear aggregation verification protocol (LAVP) to ensure the gradient integrity, which avoids complex computations, thereby improving verification efficiency. Building on MOTP and LAVP, we propose a privacy-preserving and verifiable internal node construction algorithm to train a XGBoost model for horizontal data. Detailed security analysis and extensive experiments demonstrate that our scheme can achieve the privacy-preserving, verifiable, lossless, and efficient XGBoost training for horizontally partitioned data.

Abstract As the global data strategy deepens and data elements accelerate integrating and flowing more rapidly, the demand for data security and privacy protection has become increasingly prominent. Confidential computing emerges as a crucial security technology to solve security and privacy problem, and it is also a hot subject of in contemporary security technologies. Leveraging collaborative security in both hardware and software, it builds a trusted execution environment to ensure confidentiality and integrity protection for data in use. This paper provides a comprehensive overview of the development process of confidential computing, summarizing its current research status and issues, which focuses on the security requirements for data security and privacy protection. Furthermore, it deeply analyses the common technical features of confidential computing, and proposes a trusted confidential computing architecture based on collaborative hardware and software trust. Then, it elaborates on the research status and issues of confidential computing from four aspects: hardware security, architecture and key technologies, applications, and standards and evaluation. Finally, this paper provides a synthesis and outlook for the future development of confidential computing. In summary, confidential computing is currently in a rapidly developing stage and will play an important role in cyber security in the future.

The emergence of cloud computing enables various healthcare institutions to outsource pre-diagnostic models and provide timely and convenient services for patients. However, healthcare institutions and patients have serious concerns about potential privacy leakage as cloud servers cannot be fully trusted. In this paper, a privacy-preserving cloud-assisted medical pre-diagnosis scheme, named NAIAD, is proposed, where patients can securely query the outsourced model and obtain their pre-diagnostic results. Specifically, the pre-diagnostic model is constructed on$k$-Nearest Neighbor ($k$NN), and Mahalanobis Distance (MD) is chosen as the similarity metric to achieve high accuracy. Accordingly, a secure MD-based comparison method (SMDC) is designed based on a matrix encryption technique. The method is a basic module of NAIAD that enables cloud servers to compare encrypted medical records and achieve privacy-preserving$k$NN-based pre-diagnosis with linear complexity. To further improve the computational efficiency, medical records are first clustered and encrypted to construct a hierarchical index tree, then patients can query the tree to speed up the query process. Detailed security analysis indicates NAIAD can resist closeness-same-pattern chosen-plaintext attack, and extensive experiments on real-world and synthetic databases demonstrate NAIAD has high query efficiency and pre-diagnosis accuracy.

With the rapid advancements in machine learning and the widespread adoption of Model-as-a-Service (MaaS) platforms, there has been significant attention on convolutional neural network (CNN) inference services. However, traditional inference services over plaintext data and models are susceptible to the risks of data and model leakage. Although several privacy-preserving CNN inference schemes utilizing trusted execution environment (TEE) and cryptography have been proposed, their security models and performance still have limitations in some scenarios. Aiming at the above challenges, we present an oblivious neural network prediction scheme with semi-honest TEE, namely ToNN, which ensures the security of users’ inputs, outputs, and the model itself. Specifically, based on the limited memory of the TEE, we design secure protocols to perform CNN calculations securely and efficiently, which are friendly to support the single instruction multiple data technique. Additionally, we propose a look-up-table method to optimize the convolution and pooling layers calculations. A detailed security analysis under the simulation-based real/ideal worlds model shows that ToNN can achieve the desired security. Extensive simulation results further demonstrate that ToNN can improve the performance of linear calculations by$\textbf {4.86}\times $and non-linear calculation by$\textbf {37.68}\times $, and can be implemented effectively with low computation and communication costs.

How to evaluate the security of Substitution-Permutation Network (SPN) block ciphers against impossible differential (ID) cryptanalysis is a valuable problem. In this paper, a series of methods for bounding the length of IDs of SPN block ciphers are proposed. Firstly, we propose the definitions of minimal representative set and partition table. Therefore, an improved partition-first implementation strategy for bounding the length of IDs is given. Secondly, we introduce a new definition of ladder and propose the ladder-first implementation strategy for bounding the length of IDs. In order to be able to apply ladder-first implementation strategy in practice, the methods for determining ladders and integrating a ladder into searching models are given. Thirdly, a heuristic algorithm called dynamic-ladder-partition implementation strategy is proposed. According to our experimental results, dynamic-ladder-partition implementation strategy is more suitable for SPN ciphers whose number of elements in partition tables is little. Fourthly, rotation-equivalence ID sets of ciphers are explored to reduce the number of models that need to be considered. As applications, we show that 9-round PRESENT, 5-round AES, 6-round Rijndael-160, 7-round Rijndael-192, 7-round Rijndael-224 and 7-round Rijndael-256 do not have any ID under the sole assumption that the round keys are uniformly random. What’s more, we obtain that 8-round GIFT-64, 12-round GIFT-128 and 14-round SKINNY-128 do not have any ID under the assumptions that GIFT and SKINNY are Markov ciphers and the round keys are uniformly random. Our methods fill crucial gaps on bounding the length of IDs with the differential properties of S-boxes considered. They enhance our confidence in the security and are valuable, especially for designers.

Mobile social networks (MSNs) offer convenient and ubiquitous services to expand social circles, share information, etc. These services require strict security measures to prevent the spread of deceptive content, misleading information, and malicious behavior. Achieving bilateral access control, message confidentiality and authenticity, and identity privacy can establish a positive network environment. Identity-based matchmaking encryption (IB-ME) with all the above features is a promising cryptographic primitive for MSNs. However, IB-ME can only specify one receiver. To share data with multiple users, the sender needs to encrypt the same message many times, resulting in higher frequencies of communication. Moreover, in multi-receiver scenarios, revocation of decryption permission may be necessary due to the possibility of malicious behavior, organization changes, or discontinuing subscription services. To our knowledge, no cryptographic primitives have been developed that satisfy these requirements. To address these challenges, we introduce the concept of revocable multi-receiver IB-ME and formalize its syntax and security definitions. We propose a revocable multi-receiver IB-ME scheme that provides privacy and authenticity in the random oracle model. Our evaluation demonstrates that it is efficient, and the sizes of system parameters and secret keys are independent of the number of receivers and revoked receivers.

Over the past decade, genomic data has grown exponentially and is widely used in promising medical and health-related applications, which opens up new opportunities for the field of medicine. Similar patients query (SPQ), which can help physicians formulate an optimal therapy, is one of such popular applications. Despite its popularity, since human genomes are usually highly sensitive, a series of policies have been launched by the government to strictly control its acquisitions and utilization. Thus, how to prevent privacy disclosure becomes of great importance to the flourish of SPQ services. In this article, aiming at the above challenge, we first design a novel genetic BK-tree (GBK-tree) for a genomic database. Then, combined with a random sorting mechanism and some existing encryption techniques, we propose an efficient and privacy-preserving similar patients query scheme over encrypted cloud data, named CASPER. With CASPER, a medical institution can securely outsource its private genomic database to a cloud server, and physicians can request SPQ services from the cloud server while keeping her/his query secret. Detailed security analysis shows that CASPER can preserve privacy in the presence of different threats. Furthermore, extensive performance evaluations demonstrate the high accuracy and efficiency of our proposed scheme.

Verifiable database with update (VDB) enables the client to store a large dataset in the outsourced database, and then efficiently query and update the data with a new value. It is attractive for the merits of checking the validity of the queried data and detecting the malicious actions of tampering with the outsourced database concurrently. However, the database in the context of VDB is merely suitable to store a fixed-size dataset. Hence, VDB is inapplicable to the unbounded-size database that provides the capability to store and manage the arbitrary-size datasets in the incremental manners. To circumvent the weaknesses, we research on the verifiable unbounded-size database with update (VUSDB). The VUSDB is sufficient for multiple clients to store their own arbitrary-size datasets in the database that has already contained some datasets. In order to design a VUSDB scheme, we first put forward a primitive called authenticated matrix commitment and give a scheme. This primitive is qualified to commit to a collection of ordered data represented in the form of matrix, and assure the ownership of the opened data. Then we utilize the authenticated matrix commitment scheme to construct a VUSDB scheme. The performance evaluation shows that the proposed schemes are efficient and practical.

To ensure the security of cryptographic algorithm implementations, several cryptographic key protection schemes have been proposed to prevent various memory disclosure attacks. Among them, the register-based solutions do not rely on special hardware features and offer better applicability. However, due to the size limitation of register resources, the performance of register-based solutions is much worse than conventional cryptosystem implementations without security enhancements. This paper presents RegKey, an efficient register-based implementation of ECC (elliptic curve cryptography) signature algorithms. Different from other schemes that protect the whole cryptographic operations, RegKey only uses CPU registers to execute simple but critical operations, significantly reducing the usage of register resources and performance overheads. To achieve this goal, RegKey splits the ECC signing into two parts, (1) complex elliptic curve group operations on non-sensitive data in main memory as normal implementations, and (2) simple prime field operations on sensitive data inside CPU registers. RegKey guarantees the plaintext private key and random number used for signing only appear in registers to effectively resist one-shot memory disclosure attacks such as cold-boot attacks and warm-boot attacks, which are usually launched by physically accessing the victim machine to acquire partial or even entire memory data but only once. Compared with existing cryptographic key protection schemes, the performance of RegKey is greatly improved. Regkey is applicable to different platforms because it does not rely on special CPU hardware features. Since RegKey focuses on one-shot memory disclosure instead of persistent software-based attacks, it works as a choice suitable for embedded devices or offline machines where physical attacks are the main threat.

With the rapid advancement in medical imaging techniques, Content-Based (medical) Image Retrieval (CBIR), which can assist in disease diagnosis, has gained much attention in both academia and industry. However, due to patients’ sensitive information involved in medical images, privacy-preserving CBIR is a challenge worth exploiting. Though several privacy-preserving CBIR schemes have been put forth, they can only resist known-background attack (KBA), and do not suffice for protecting the image privacy in outsourced settings. In this article, aiming at the above challenge, we first design a novel Privacy-preserving Mahalanobis Distance Comparison (PMDC) method to improve the accuracy of medical images retrieval. Then, combined with the Mahalanobis distance based Fuzzy C-Means (FCM-M) algorithm, a scheme named TAMMIE is proposed to achieve accurate and privacy-preserving medical image retrieval over encrypted data. With TAMMIE, an image owner can securely outsource the images and indexes to a cloud server, and query users can request retrieval services from the cloud server while keeping their queries private. Detailed security analysis shows that our proposed schemes are secure under the attack stronger than KBA. Furthermore, thorough empirical experiments conducted on two real-world and one synthetic datasets also demonstrate the efficiency of TAMMIE.

With AI-derived knowledge graph (KG), medical centers can recommend appropriate treatment options to physicians as references based on their patients' personal healthcare information (PHI). However, the treatment recommendation services may also cause serious privacy concerns. In this paper, we propose an efficient and privacy-preserving personalized treatment recommendation scheme with the aid of a third-party server. Specifically, a medical center denotes the KG of each disease by a directed graph with conditional edges and vertices that describe the treatment options and costs in different states. To prevent privacy leakage while reducing computational and management cost, the graphs are encrypted and then delegated to an honest-but-curious server. With the assistance of the server, physicians can set proper illness states and cost requirements according to patients' PHI, and correspondingly generate personalized ciphertexts to retrieve appropriate treatment options. The key component of the proposed scheme is a novel designed secure and flexible path comparison protocol, by tailoring a symmetric homomorphic encryption algorithm and combining it with a secure hash function. The protocol can enable the server to compare the uploaded ciphertexts with encrypted graphs in a secure and efficient way. Comprehensive security analysis indicates that the proposed scheme can meet desirable privacy requirements, and extensive experimental results demonstrate its practicality.

By adding noise to real data locally and providing quantitative privacy protection that can be rigorously mathematically proven, Local differential privacy is the suitable technology for the private collection of two dimensional location data. Most current solutions discretize the location information into grids, and then apply LDP-based frequency oracle to obtain distribution information of all users for spatial range query. However, the discretization step of gridding will result in a more or less loss of accuracy, while eliminating the inherent correlation between adjacent grids. Thus leading to a large overall error. Drawing on the idea of continuous perturbation on finite intervals, we propose a two-dimensional continuous density estimation method, called LTD-EM. It takes advantage of numerical nature of the map domain and uses the near-neighbor perturbation and EM algorithm. We also optimize the algorithm considering the irregular shape of the geography map. The experimental results show that the accuracy of the spatial range query provided by LTD-EM is significantly better than that of existing solutions.

Fuzzing has been widely adopted as an effective techniques to detect vulnerabilities in softwares. However, existing fuzzers suffer from the problems of generating excessive test inputs that either cannot pass input validation or are ineffective in exploring unvisited regions in the program under test (PUT). To tackle these problems, we propose a greybox fuzzer called MuFuzzer based on AFL, which incorporates two heuristics that optimize seed selection and automatically extract input formatting information from the PUT to increase the chance of generating valid test inputs, respectively. In particular, the first heuristic collects the branch coverage and execution information during a fuzz session, and utilizes such information to guide fuzzing tools in selecting seeds that are fast to execute, small in size, and more importantly, more likely to explore new behaviors of the PUT for subsequent fuzzing activities. The second heuristic automatically identifies string comparison operations that the PUT uses for input validation, and establishes a dictionary with string constants from these operations to help fuzzers generate test inputs that have higher chances to pass input validation. We have evaluated the performance of MuFuzzer, in terms of code coverage and bug detection, using a set of realistic programs and the LAVA-M test bench. Experiment results demonstrate that MuFuzzer is able to achieve higher code coverage and better or comparative bug detection performance than state-of-the-art fuzzers.

Trusted execution environment (TEE) is a promising technique to protect user programs and data on public cloud environments. To support unmodified applications running, many TEE runtime systems have been proposed. However, a major drawback of the existing schemes is the lack of interface protection. This problem may lead to many security problems, such as memory information leakage and malicious codes attacks. To tackle this problem, we propose SeRoT, a new secure runtime system on trusted execution environments. Our secure runtime system first provides some core functions to the enclave programs. Then we protect the host interface at two levels, binary interface level and application interface level. In these two levels, we prevent the adversary interfacing with malicious messages. Furthermore, we implement SeRoT on a RISC-V based platform and show our scheme is average about 10% faster than Keystone on two popular and representative benchmarks.

Due to the low latency and high speed of 5G networks, the Internet of Vehicles (IoV) under the 5G network has been rapidly developed and has broad application prospects. The Third Generation Partnership Project (3GPP) committee has taken remote diagnosis as one of the development cores of IoV. However, how to ensure the security of remote diagnosis and maintenance services is also a key point to ensure vehicle safety, which is directly related to the safety of vehicle passengers. In this paper, we propose a secure and efficient authentication scheme based on extended chebyshev chaotic maps for remote diagnosis and maintenance in IoVs. In the proposed scheme, to provide strong security, anyone, such as the vehicle owner or the employee of the Vehicle Service Centre (VSC), must enter the valid biometrics and password in order to enjoy or provide remote diagnosis and maintenance services, and the vehicle and the VSC should authenticate each other to ensure that they are legitimate. The security analysis and performance evaluation results show that the proposed scheme can provide robust security with ideal efficiency.

Space information network (SIN), which has the characteristics of large capacity, high reliability, and wide coverage, can be effectively applied to the Internet of Things (IoT) business. However, SIN is vulnerable to various attacks due to its highly exposed links, and the power and processing capacity of satellites and IoT devices (IoTDs) are usually limited. Meanwhile, massive IoTDs connecting to SIN in an instant incur a severe signaling congestion and there is no authentication protocol proposed for massive IoTDs in SIN. In this article, we first propose a novel semi-aggregated signature mechanism and session key agreement mechanism. Then, based on the above two mechanisms, we propose a novel access authentication scheme named lattice-based access authentication (LAA) which contains two types of lattice-based authentication protocols: 1) LAA for massive IoTDs and 2) LAA for a single IoTD. The security analysis by employing the formal provable security analysis, the automation verification tool named Scyther, the Burrows-Abadi-Needham-logic, and the informal security analysis demonstrate that our proposed protocols successfully achieve these security properties, including mutual authentication, conditional anonymity, unlinkability, data confidentiality, data integrity, unforgeability, undeniability, key establishment, perfect forward/backward secrecy (PFS/PBS), and resistance against protocol attacks and quantum attacks. We further evaluate the performance of our proposed protocols with regard to signaling overhead, transmission overhead, computational overhead, and authentication delay, which shows that our proposed protocols can provide high efficiency.

Software attacks like worm, botnet, and DDoS are the increasingly serious problems in IoT, which had caused large-scale cyber attack and even breakdown of important information infrastructure. Software measurement and attestation are general methods to detect software integrity and their executing states in IoT. However, they cannot resist TOCTOU attack due to their static features and seldom verify correctness of control flow integrity. In this paper, we propose a novel and practical scheme for software trusted execution based on lightweight trust. Our scheme RIPTE combines dynamic measurement and control flow integrity with PUF device binding key. Through encrypting return address of program function by PUF key, RIPTE can protect software integrity at runtime on IoT device, enabling to prevent the code reuse attacks. The results of our prototype’s experiment show that it only increases a small size TCB and has a tiny overhead in IoT devices under the constraint on function calling. In sum, RIPTE is secure and efficient in IoT device protection at runtime.

The Industrial Internet of Things (IIoT), as a special form of Internet of Things (IoT), has great potential in realizing intelligent transformation and industrial resource utilization. However, there are security and privacy concerns about industrial data, which is shared on an open channel via sensor devices. To address these issues, many searchable encryption schemes have been presented to provide both data privacy-protection and data searchability. However, due to the use of expensive pairing operations, most previous schemes were inefficient. Recently, a certificateless searchable public-key encryption (CLSPE) scheme was designed by Lu et al. to remove the pairing operation. Unfortunately, we find that Lu et al.’s scheme is vulnerable to user impersonation attacks. To enhance the security, a new pairing-free dual-server CLSPE (DS-CLSPE) scheme for cloud-based IIoT deployment is designed in this paper. In addition, we provide security and efficiency analysis for DS-CLSPE. The analysis results show that DS-CLSPE can resist chosen keyword attacks (CKA) and has better efficiency than other related schemes.

Secure enclaves provide a practical solution to secure computation, and current approaches to secure enclaves are implemented by extending hardware security mechanisms to the CPU architecture. Therefore, it is hard for a platform to offer secure computation if its CPU architecture is not equipped with any secure enclave features. Unfortunately, ARM CPUs, dominating mobile devices and having increasing momentum in cloud markets, do not provide any security mechanisms achieving the security equivalent to modern secure enclave architectures. In this paper, we propose SecTEE, a software-based secure enclave architecture which is based on the CPU's isolation mechanism and does not require specialized security hardware of the CPU architecture such as memory encryption engines. SecTEE achieves a high level of security even compared with hardware-based secure enclave architectures: resistance to privileged host software attacks, lightweight physical attacks, and memory access based side-channel attacks. Besides, SecTEE provides rich trusted computing primitives for enclaves: integrity measurement, remote attestation, data sealing, secrets provisioning, and life cycle management. We implement a SecTEE prototype based on the ARM TrustZone technology, but our approach can be applied to other CPU architectures with isolation mechanisms. The evaluation results show that most overhead comes from the software encryption and the runtime overhead imposed by trusted computing primitives is acceptable.

The Trusted Platform Module (TPM) is a system component that provides a hardware‐based approach to establish trust in a platform. The latest TPM2.0 specification was accepted as the ISO standard in 2015. It offers functionality for key management by storing keys into the TPM's protected storage. The access to the TPM‐resident key object is protected by the session‐based authorisation mechanism. This mechanism is keyed to the object's authorisation value known as authValue and the session‐bound secret value known as sessionKey. The new authValue introduced into the TPM is protected by the session‐based encryption mechanism, which is also keyed on the sessionKey. In the authors’ study, they conduct a formal analysis of the TPM2.0 HMAC (hash message authentication code) authorisation mechanism used in the key management. They first use the stateful applied calculus to formalise the session‐based HMAC authorisation and encryption mechanisms in a model of TPM2.0 API commands. They propose a threat model to formalise the secrecy and authentication properties. Then they discuss several attacking scenarios in practice where the sessionKey could be disclosed. They also instantiate their threat model according to specific attacking scenarios. By using the SAPIC tool and the tamarin prover, they automatically give out the analysis results of their models.

Android system applies a permission-based security model to restrict unauthorized apps from accessing system services, however, this security model cannot constrain authorized apps from sending excessive service requests to exhaust the limited system resource allocated for each system service. As references from native code to a Java object, JNI Global References (JGR) are prone to memory leaks, since they are not automatically garbage collected. Moreover, JGR exhaustion may lead to process abort or even Android system reboot when the victim process could not afford the JGR requests triggered by malicious apps through inter-process communication. In this paper, we perform a systematic study on JGR exhaustion (JGRE) attacks against all system services in Android. Our experimental results show that among the 104 system services in Android 6.0.1, 32 system services have 54 vulnerabilities. Particularly, 22 system services can be successfully attacked without any permission support. After reporting those vulnerabilities to Android security team and getting confirmed, we study the existing ad hoc countermeasures in Android against JGRE attacks. Surprisingly, among the 10 system services that have been protected, 8 system services are still vulnerable to JGRE attacks. Finally, we develop an effective defense mechanism to defeat all identified JGRE attacks by adopting Android's low memory killer (LMK) mechanism.

Heap overflow is one of the most widely exploited vulnerabilities, with a large number of heap overflow instances reported every year. It is important to decide whether a crash caused by heap overflow can be turned into an exploit. Efficient and effective assessment of exploitability of crashes facilitates to identify severe vulnerabilities and thus prioritize resources. In this paper, we propose the first metrics to assess heap overflow crashes based on both the attack aspect and the feasibility aspect. We further present HCSIFTER, a novel solution to automatically assess the exploitability of heap overflow instances under our metrics. Given a heap-based crash, HCSIFTER accurately detects heap overflows through dynamic execution without any source code or debugging information. Then it uses several novel methods to extract program execution information needed to quantify the severity of the heap overflow using our metrics. We have implemented a prototype HCSIFTER and applied it to assess nine programs with heap overflow vulnerabilities. HCSIFTER successfully reports that five heap overflow vulnerabilities are highly exploitable and two overflow vulnerabilities are unlikely exploitable. It also gave quantitatively assessments for other two programs. On average, it only takes about two minutes to assess one heap overflow crash. The evaluation result demonstrates both effectiveness and efficiency of HC Sifter.

Nowadays, the popular Android is so closely involved in people's daily lives that people rely on Android to perform critical operations and trust Android with sensitive information. It is of great importance to guarantee the usability and security of Android which, however, is such a huge system that a potential threat may arise from any part of it. In this paper, we focus on the Free Floating window (FF window) which is a category of windows that can appear freely above any other applications. It can share the screen space with other FF windows, dialogs, and activities. An FF window is flexible in both its appearance and behaviour features. We analyse the behaviour features of FF windows, including the priority in display layer and the capability of processing user-generated events. Three types of attacks via FF windows with delicate design in their appearance and behaviour features are demonstrated, i.e., DoS attack against Android system, GUI hijacking by targeting overlap, and input inference using FF windows as a side channel. To address the threat caused by FF windows, we design a priority framework for FF windows, which protects a sensitive activity/FF window declared by developers from being attacked by any malicious FF windows. A complementary solution is proposed to mitigate the confusion attack from malicious activities. Finally, we provide Android with suggestions on how to manage FF windows.

The Transport Layer Security (TLS) protocol is by far the most widely deployed protocol for securing communications and the Internet Engineering Task Force (IETF) is currently developing TLS 1.3 as the next-generation TLS protocol. The TLS standard features multiple modes of handshake protocols and supports many combinational running of successive TLS handshakes over multiple connections. Although each handshake mode is now well-understood in isolation, their composition in TLS 1.2 remains problematic, and yet it is critical to obtain practical security guarantees for TLS. In this paper, we present the first formal treatment of multiple handshakes protocols of TLS 1.3 candidates. First, we introduce a multi-level&stage security model, an adaptation of the BellareRogaway authenticated key exchange model, covering all kinds of compositional interactions between different TLS handshake modes and providing reasonably strong security guarantees. Next, we prove that candidate handshakes of TLS 1.3 draft meet our strong notion of multiple handshakes security. Our results confirm the soundness of TLS 1.3 security protection design. Such a multi-level&stage approach is convenient for analyzing the compositional design of the candidates with different session modes, as they establish dependencies of multiple sessions. We also identify the triple handshake attack of Bhargavan et al. on TLS 1.2 within our multiple handshakes security model. We show generically that the proposed fixes (RFC 7627) for TLS 1.2 offer good protection against multiple handshakes attacks.

Abstract. Under the assumption that one has a reference device iden-tical or similar to the target device, and thus be well capable of char-acterizing power leakages of the target device, Template Attacks are widely accepted to be the most powerful side-channel attacks. However, the question of whether Template Attacks are really optimal in terms of the leakage exploitation rate is still unclear. In this paper, we present a negative answer to this crucial question by introducing a normalization process into classical Template Attacks. Specifically, our contributions are two folds. On the theoretical side, we prove that Normalized Tem-plate Attacks are better in terms of the leakage exploitation rate than Template Attacks; on the practical side, we evaluate the key-recovery efficiency of Normalized Template Attacks and Template Attacks in the same attacking scenario. Evaluation results show that, compared with Template Attacks, Normalized Template Attacks are more effective. We note that, the computational price of the normalization process is of ex-tremely low, and thus it is very easy-to-implement in practice. Therefore, the normalization process should be integrated into Template Attacks as a necessary step, so that one can better understand practical threats of

Abstract There is more than one sample in a power trace, corresponding to the process of the target intermediate value, which are known as interesting points. One can exploit the power leakages at multiple samples to recover the secret key used by the crypto device, and that is the idea of multiple samples correlation power analysis (MSCPA). Considering that the leakage exploitation of MSCPA is more efficient than that of correlation power analysis (CPA), the power of MSCPA should be stronger than that of CPA. We theoretically prove and practically verify this fact. Theoretically, we show the advantage of MSCPA over CPA in terms of the correct key distinguishing level. We show that compared with CPA, MSCPA enlarges the gap between the correlation coefficient computed under the correct key and the correlation coefficients computed under wrong key guesses, which makes the correct key easier to be distinguished. Practically, we evaluate the performance of MSCPA in real scenarios. Using power traces provided by DPA Contest v2 and v4.1, we compare the key‐recovery efficiency of MSCPA with that of CPA. Experimental results show that compared with CPA, MSCPA can reach a higher key‐recovery efficiency in the same scenario. Copyright © 2016 John Wiley & Sons, Ltd.

Control Flow Integrity (CFI) is an effective technique to mitigate threats such as code-injection and code-reuse attacks in programs by protecting indirect transfers. For stripped binaries, a CFI policy has to be made conservatively due to the lack of source code level semantics. Existing binary-only CFI solutions such as BinCFI and CCFIR demonstrate the ability to protect stripped binaries, but the policies they apply are too permissive, allowing sophisticated code-reuse attacks. In this paper, we propose a new binary-only CFI protection scheme called BinCC, which applies static binary rewriting to provide finer-grained protection for x86 stripped ELF binaries. Through code duplication and static analysis, we divide the binary code into several mutually exclusive code continents. We further classify each indirect transfer within a code continent as either an Intra-Continent transfer or an Inter-Continent transfer, and apply separate, strict CFI polices to constrain these transfers. To evaluate BinCC, we introduce new metrics to estimate the average amount of legitimate targets of each kind of indirect transfer as well as the difficulty to leverage call preceded gadgets to generate ROP exploits. Compared to the state of the art binary-only CFI, BinCFI, the experimental results show that BinCC significantly reduces the legitimate transfer targets by 81.34% and increases the difficulty for adversaries to bypass CFI restriction to launch sophisticated ROP attacks. Also, BinCC achieves a reasonable performance, around 14% of the space overhead decrease and only 4% runtime overhead increase as compared to BinCFI.

The Trusted Platform Module (TPM) is a system component that provides a hardware-based approach to establish trust in a platform by providing protected storage, robust platform integrity measurement, secure platform attestation and other secure functionalities. The access to TPM commands and TPM-resident key objects are protected via an authorization mechanism. Enhanced Authorization (EA) is a new mechanism introduced by the TPM 2.0 to provide a rich authorization model for specifying flexible access control policies for TPM-resident objects.

Hummingbird‐2, designed by Engels et al ., is a lightweight cipher with built‐in MAC functionality. In this study, the authors examine the security of Hummingbird‐2 in the related‐key model. First, the authors define a new cryptographic notion of an S ‐box, called combination points, based on its differential equation, and demonstrate some properties of combination points. A potential application of the new notion is to recover some partial input of an S ‐box, and the authors show this on Hummingbird‐2 by recovering some internal state bits. Then, by carefully studying the differential distributions of the S ‐boxes, a set of key dependent S ‐boxes can be derived and be used to recover the subkey word of Hummingbird‐2. At last, by the divide and conquer strategy, all the 128 key bits can be recovered with a complexity of 2 40 , which is much lower than that (2 64 ) of the attack at FSE 2013. The attack has been fully implemented on a PC and the secret key has been recovered in a few hours. The results provide some new insights into the design of cryptographic S‐boxes.

Abstract Under the assumption that power leakages at different interesting points follow multivariate normal distribution , maximum likelihood principle (MLP) can be used as an efficient distinguisher for template attack (TA). Therefore, in key‐recovery, one uses MLP to recover the correct key. In pattern recognition, Mahalanobis distance similarity measure (MDSM) is usually used to measure the similarity of two vectors in terms of their distance. A merit of MDSM is that, when measuring the similarity of two vectors, one takes the cross correlation between different variables into consideration. In this paper, we investigate the application of MDSM as a distinguisher in TA. We will show that there exists a certain relationship between MLP‐based TA and MDSM‐based TA under the assumption that the covariance matrices of different templates are identical . However, in MDSM‐based TA, power leakages at different interesting points are not required to follow multivariate normal distribution . We perform practical experiments to evaluate the key‐recovery efficiency of MDSM‐based TA. Experimental results verify that, in the same attack scenario, the key‐recovery efficiency of MDSM‐based TA can be higher than that of MLP‐based TA. Copyright © 2014 John Wiley & Sons, Ltd.

Abstract The new released trusted platform module (TPM) specification, TPM2.0, adds cryptographic support for key exchange by providing SM2 authenticated key exchange (AKE) application programming interface (API) commands. Xu analyzed the SM2 AKE protocol and found that it was insecure in common computing environment by presenting two types of unknown key share attacks. Here, we present another design weakness of the SM2 AKE protocol, which might cause that the protocol cannot be proven secure in modern security models. We also analyze the security of SM2 AKE protocol in TPM2.0, whose running environment is very different and find that (i) it indeed gets some security improvements through the protection capability provided by the two SM2 AKE commands of TPM2.0 but (ii) it still has some weaknesses, which might lead to unknown key share and key‐compromise impersonation attacks because of the bad design of the TPM2.0 application programming interface. We solve the weaknesses of SM2 AKE protocol in TPM2.0 by slightly modifying one SM2 AKE command and finally give a formal proof of our solution in the Canetti and Krawczyk model. Our work shows that TPM2.0 could provide a proven secure SM2 AKE by slightly modifying one command. Copyright © 2014 John Wiley & Sons, Ltd.

Data encryption is an effective way to ensure the data security in the cloud. To make retrieval of such encrypted data easy for multiple users, searchable encryption in the multi-user setting is addressed. However, it introduces a new critical requirement: access control. Cipher text-Policy Attribute-Based Encryption (CP-ABE) is a promising technique to solve this issue, but it also faces several challenges, such as the inefficiency of decrypt able files search, attributes verification and decryption. In this paper, we propose a multiuser searchable encryption scheme with efficient access control for cloud storage, where the keyword index and trapdoor can be generated with the help of a proxy server. To achieve the efficient access control, we present the first solution to search the data that a user can decrypt by using the partial order relations. We also design a new method to verify each user's attributes without disclosing the relation of his identity and attributes. To reduce the decryption overhead, our scheme enables the users to delegate most CP-ABE decryption to the proxy server. Moreover, the security analysis and simulation results show that the proposed scheme is provably secure and highly efficient.

Direct Anonymous Attestation (DAA) is a signature scheme that provides a balance between user privacy and authentication in a reasonable way. The first RSA-based DAA is proposed in 2004, since then several ECC-based DAA schemes are proposed to achieve better performance. To analyze DAA schemes from a practical point of view, it is necessary to consider implementation-related issues, such as elliptic curve selection and runtime performance. We present a framework for implementing and evaluating various DAA schemes for multiple computing platforms. We implement four DAA schemes using different elliptic curves and show detailed performance evaluation for both PC and mobile device. We analyze the impact of elliptic selections on the performance of DAA schemes and propose practical techniques such as pre-computation to improve the performance of DAA schemes. We also discuss revocation of DAA and present a novel technique which significantly reduces the time of privacy-enhanced signature revocation, thus making privacy-enhanced revocation practical even for embedded mobile devices.

Location-based messaging applications (LMAs), a kind of messaging applications for mobile devices which enable users to connect with people based on their geographical locations, have recently experienced a huge popularity growth. The killer feature in LMAs that embodies the concept of geo-based instant messaging, named people nearby, allows users at any place to search and communicate with other registered users nearby. In this paper, we discuss a common weakness in LMAs that relates to the abuse of the people nearby function. In this case, rich personal data of registered LMA users can be easily obtained, bringing a chance to perform automated user profiling in LMAs. Specifically, we build an automated and scalable system to construct extended profiles (or we call life profile) of LMA users, which contain not only personal information of LMA users but also the daily activities and social ties inferred from their leaked spatio-temporal privacy. The system is highly adaptable to various applications, requiring no modification of applications or trivial work on protocol reverse engineering. We conduct the evaluation on a large scale for the first time. In our experiment, we succeed to construct life profiles for more than 280,000 users from two popular LMAs. The results of empirical analysis not only validate the existence of the privacy issue in LMAs, but also demonstrate its severity.

Similar with other outsourced services, cloud storage faces the serious issue of user data security. To keep data confidential against unauthorized cloud servers and users, Attribute-Based Encryption (ABE) for access control is widely adopted. However, ABE-based access control schemes are being criticized for their high computation overhead, such as in key generation, decryption and revocation. Considering the mobile cloud storage environment where these computation tasks are executed by mobile devices or sensors, this drawback appears more serious. In this paper, we propose an efficient and secure attribute-based access control scheme for mobile cloud storage. Specifically, we construct the first Key-Policy ABE (KP-ABE) scheme with outsourced key generation and decryption, and propose an efficient revocation method for it. Moreover, we prove the proposed scheme is immune to the collusion attack and secure in the standard model. Extensive experiment demonstrates that the efficient key generation, decryption, and revocation are achieved with the help of the cloud servers.

P2P Botnet is quite robust against various attacks once very effective against centralized network. In this paper, we concentrate on the tracking of P2P botnets, investigate botnet victims which are routable on the Internet, also known as super peers. The super peers are the backbone of the botnet to disseminate its commands and payload updates. Through tracking of three typical live P2P botnets over 6 months and analysis of their network dynamics, we outline a number of descriptive and statistical characterization of super peers, such as geo-location, peer session time and intersession time, in-degree and out-degree distribution, pattern of arrival and departure. In addition, based on the assumption that IP dynamic allocation will not cross the AS (Autonomous System) border, we give out a lower bound estimate of total infected super peers in a conservative manner. We also propose several guidelines on disrupting P2P botnets concerning its various features we have characterized which could be helpful to the security community.

The deposit security and the purchasing anonymity are two important issues when consumers do shopping on mobile platforms. However, there is currently no solution to completely address both the issues. In this paper, we propose a lightweight anonymous mobile shopping scheme based on DAA for trusted mobile platform. By fully considering the background of mobile applications, we design the scheme according to four elliptic curve based DAA (ECC-DAA) schemes. The entities of mobile device manufacturer, mobile device, central trusted party, banks and e-commerce platform compose the system architecture and seven phases are designed accordingly. Moreover, we present the architecture of trusted mobile platform based on Trust Zone and TPM emulator, which helps achieve seven security properties including the deposit security and the purchasing anonymity. The issues about sensitive data management and credential revocation are discussed. ECC-DAA schemes including CF08, BCL08, BL10 and CPS10 and three kinds of elliptic curves including MNT, BN and super singular curve are finally compared and implemented as foundation. The simulating experiment result indicates that the proposed scheme with our trusted architecture has a good computing performance for consumers using mobile devices.

Due to the cost-efficient communicating manner and attractive user experience, messenger applications have dominated every smartphone in recent years. Nowadays, Address Book Matching, a new feature that helps people keep in touch with real world contacts, has been loaded in many popular messenger applications, which unfortunately as well brings severe privacy issues to users. In this paper, we propose a novel method to abuse such feature to automatically collect user profiles. This method can be applied to any application equipped with Address Book Matching independent of mobile platforms. We also build a prototype on Android to verify the effectiveness of our method. Moreover, we integrate profiles gathered from different messenger applications and provide insights by performing a consistency and authenticity analysis on user profile fields. As our experiments show, the abuse of Address Book Matching can cause severe user privacy leakage. Finally, we provide some countermeasures for developers to avoid this issue when designing messenger applications.

There exists a specific security issue in symmetric searchable encryption that, when doing CKS(Conjunctive Keywords Search), the trapdoors and search results may reveal the relationships between the keywords being searched. For example, if the search result of keywords set A is the superset of keywords set B's, it indicates A is a subset of B by a high chance. Most existing search methods that support CKS suffer from such inclusion-relation (IR) attacks. We define measurements on IR security and propose CKS-SE, a secure CKS scheme based on bloom filter that achieves IR-secure by randomizing and integrating expressions of trapdoors. Experiments show that the average false positives are within an acceptable rate, and the performance of CKS-SE is among the best ones.

ABSTRACT Strong designated verifier signature (SDVS) makes it possible for a signer to convince a designated verifier that he or she has signed a message in such a way that the designated verifier cannot transfer the signature to any third party and no third party can even verify the validity of the signature. Recently, Kang et al. proposed an identity‐based SDVS (IBSDVS) scheme that is claimed to be unforgeable and strong. However, in this paper, we show that their scheme is actually forgeable, delegatable, and not strong. We then propose an improved efficient IBSDVS scheme with short signature size and provide formal security proofs based on the computational Diffie–Hellman assumption in the random oracle model. We also show that the performance of our scheme outperforms all the existing IBSDVS schemes known in the literature. Furthermore, we propose an extension of our scheme achieving the stronger notion of nondelegatability and provide formal security proofs. The extended scheme is also showed to achieve high efficiency and short signature size. Copyright © 2012 John Wiley & Sons, Ltd.

To keep data confidential against unauthorized cloud servers and users, cryptographic access control mechanisms must be adopted. However, user revocation is a challenging issue since it would inevitably require data re-encryption, and may need user secret key updates. Considering the complexity of fine-grained access control policy and the large number of users in cloud, this issue would become extremely difficult to resolve. In this paper, we focus on this challenging open issue and present a secure and efficient revocation scheme. We propose a modified CP-ABE algorithm to set up a fine-grained access control method, in which user revocation is achieved based on the theory of Shamir's Secret Sharing. Compared with existing schemes, our scheme introduces a minimal overhead not only to the data owner but also to cloud servers. Collusions between cloud servers and revoked users can be avoided as long as the key-update protocol is honestly executed. Meanwhile, the data owner can delegate key updates to the cloud servers without disclosing data contents, user attributes, and the access policy information. Moreover, our scheme maintains the important feature that the revocation won't affect the users whose attribute set is a superset of the revoked user's.

As a new public key primitive, attribute-based encryption (ABE) is envisioned to be a promising tool for implementing fine-grained access control. When applying ABE schemes to practical applications, revocation mechanism is very necessary for any ABE schemes involving many users. Revocation for ABE schemes is a challenge issue since each attribute is conceivably shared by multiple users. Revocation of any single user would affect others who share his attributes. In this paper, we propose a KP-ABE scheme with fine-grained attribute revocation under the direct revocation model. In our scheme, we can revoke one attribute of a user instead of all attributes issued to him and the user can complete decryption as long as the unrevoked attributes of the user satisfy the access structure. The revocation does not affect any other user's private key. Moreover, our scheme supports an important property for achieving the user accountability to prevent illegal key sharing among colluding users. We show how to construct such a KP-ABE scheme with fine-grained attribute revocation and prove its security under the q-BDHE assumption in the standard model.

Due to the tight one-to-one binding relationship between the TPM and the single platform lacks of flexibility and scalability, the Trusted Platform Module (TPM) can not be directly applied to the cloud virtualization platform, on which concurrently running several user domains (VMs). For establishing the trust in the cloud, we propose the Trusted Service Domain (TSD), as a novel root of trust for the cloud. Being an independent functional domain, the TSD is able to provide the trusted service for the multiple user domains on the cloud virtualization platform. We firstly extend the existing trusted chain to secure the TSD, and generate the independent key hierarchies for the user domains in the TSD to support the cryptography service and secure storage. Then we design the secure communication mechanism to protect the inter-domain data, and present the migration scheme for the TSD in the cloud. Finally, we detailed our implementation of the prototype system and analyze the security of the TSD. Preliminary experiment results showed that the TSD has higher efficiency than the existing schemes on the trusted commands handling and the migration, which satisfied flexible deployment and rapidly migration requirements of the cloud virtualization platform.

ABSTRACT Point‐to‐Point Protocol over Ethernet (PPPoE) is a network protocol for encapsulating PPP frames inside Ethernet frames. It is widely used by commercial Internet service providers to provide Internet surfing for customers who pay bills. In this paper, we analyze the security of PPPoE network. We find that we can easily collect information about both the peers and the PPPoE authentication servers. We can use such information to recover the peer's authentication password by silently impersonating the server, which is undetectable in the network. We impersonate the server in the peers' LAN and get their passwords by hijacking the peers' PPPoE connections and negotiating for using the Password Authentication Protocol (PAP). We further propose an efficient password recovery attack against the Challenge‐Handshake Authentication Protocol (CHAP). We first recover the length of the used password through on‐line queries, based on the weakness of MD5 input pre‐processing. Then, we crack the known‐length password off‐line, using the probabilistic context‐free grammars. We point out that PPPoE cannot be used anymore until all of the weak authentication protocols including PAP, CHAP, and Microsoft CHAP are abolished right now and replaced with more secure Extensible Authentication Protocols. Copyright © 2012 John Wiley & Sons, Ltd.

Unlike traditional image or video steganography in spatial/transform domain, motion vector (MV)-based methods target the internal dynamics of video compression and embed messages while performing motion estimation. However, we have noticed that some existing methods adopt nonoptimal selection rules and modify MVs in somewhat arbitrary manners which violate the encoding principles a lot. Aiming at these weaknesses, we design a calibration-based approach and propose MV reversion-based features for steganalysis. Experimental results demonstrate that the proposed features are very sensitive to the tendency of MV reversion during calibration and can be used to effectively detect some typical MV-based steganography even with low embedding rates.

Trusted Network Connection (TNC for short) can prevent insecure terminal from accessing protected network and thus strengthen the security of network. Existing TNC solutions face a serious problem called lying endpoint problem (LEP for short). If an attacker modifies the terminal agent software which is responsible for collecting the integrity state of an endpoint platform, Trusted Network Connection will lose its meanings. Trusted Computing Group (TCG) adds the functionality of trusted computing to prevent lying endpoint problem, but TCG's TNC relies on the traditional Static Root of Trust for Measurement (SRTM) which has too big TCB (Trusted Computing Base) and has been proved unsafe. In this paper, we design and implement an improved TNC scheme with high reliability and scalability based on trusted integrity status of terminal. While focusing on LEP problem under the context of Network Access Control (NAC), we leverage Dynamic Root of Trust for Measurement (DRTM) technology to realize desired security requirements such as smaller TCB. We also use the Logic of Secure Systems (LS2) to prove the security properties of our improved TNC system. Our experimental evaluation demonstrates that our method is feasible.

Cyclic codes with two zeros and their dual codes have been a subject of study for many years. However, their weight distributions are known only for a few cases. In this paper, the weight distributions of the duals of the cyclic codes with two zeros are settled for a few cases. The weight distributions of punctured versions of these codes are also determined for several special cases.

Massive Internet invasions implemented through the distributed platform fabricated by rapid diffusion of malwares, has become a significant issue in network security. We argue that the notion of “Collaborative Security” is an emerging trend in resisting distributed attacks originated from malware. Therefore, this paper proposes a new architecture: CloudSEC, for composing collaborative security-related services in clouds, such as correlated intrusion analysis, anti-spam, anti-DDOS, automated malware detection and containment. CloudSEC is modeled as a dynamic peer-to-peer overlay hierarchy with three types of top-down architectural components. Based on, this architecture, both data distribution and task scheduling overlays can be simultaneously implemented in a loosely coupled fashion, which can efficiently retrieve data resources from heterogeneous network security facilities, and harness distributed collection of computational resources to process data-intensive tasks. Hence, CloudSEC endues the network security infrastructure with the capability of dynamic adaptation and collaboration on an inter-organizational scale. The results of preliminary evaluation demonstrate that, CloudSEC not only delivers a sample service of distributed intrusion correlation with high scalability and robustness, but also achieves remarkable effectiveness in data sharing and task scheduling.

Proxy re-encryption is a cryptographic primitive which enables a ciphertext encrypted under a delegator's public key to be translated into a ciphertext of a delegatee by a semi-trusted proxy. Conditional proxy re-encryption (CPRE) is a variant of proxy re-encryption which allows the delegator to control the delegation of decryption rights with certain conditional value. The existing CPRE schemes left an open problem about how to construct CCA-secure CPRE schemes supporting Boolean predicates over conditions. In this paper, we propose attribute-based CPRE (AB-CPRE) in which the delegator could implement attributed-based control on the delegation of decryption rights by setting conditions in the form of access structure and attribute set. AB-CPRE is suitable for applications where fine-grained control of the decryption delegation is necessary. We formalize definitions and security notions for AB-CPRE and prove that the proposed scheme is chosen-ciphertext secure under the 3-Quotient Decision Bilinear Diffie-Hellman (3-QDBDH) assumption.

It was reported that a multivariate public key cryptosystem (MPKC) could be strengthened if its public key is generated by composition of two original public keys. In fact, two existing keys are used to constitute two quadratic rounds of the new key. But such a two-round scheme, called 2R, was claimed to have been decomposed, and even a further improved 2R, named 2R−, was shown to be similarly vulnerable. The result casts doubts on the principle of using a two-round structure to improve the security. However, this study clearly states that the decomposition attacks depend on the prerequisite that either of the rounds is quadratic. It shows that these attacks, even the conceivable extended ones, do not work in theory or in practice if the first round is of higher degree, although the threat still remains when only the degree of the second round is changed. Therefore adopting a cubic first round becomes a rule in the design of the 2-round schemes. The analysis and experiments in this study also demonstrate that the new schemes with such an indecomposable two-round public key can provide the desired security against many other known and potential attacks on MPKCs and that the key size can be practically controlled.

Niederreiter showed that there is a class of periodic sequences which possess large linear complexity and largek-error linear complexity simultaneously. This result disproved the conjecture that there exists a trade-off between the linear complexity and thek-error linear complexity of a periodic sequence by Ding By considering the orders of the divisors ofxN-1 over\BBFq, we obtain three main results which hold for much largerkthan those of Niederreiter : a) sequences with maximal linear complexity and almost maximalk-error linear complexity with general periods; b) sequences with maximal linear complexity and maximalk-error linear complexity with special periods; c) sequences with maximal linear complexity and almost maximalk-error linear complexity in the asymptotic case with composite periods. Besides, we also construct some periodic sequences with low correlation and largek-error linear complexity.

Niederreiter showed that there is a class of periodic sequences which possess large linear complexity and large k-error linear complexity simultaneously. This result disproved the conjecture that there exists a trade-off between the linear complexity and the k-error linear complexity of a periodic sequence by Ding et al.. Using the entropy function in coding theory, we obtain three main results which hold for much larger k than those of Niederreiter et al.: a) sequences with maximal linear complexity and almost maximal k-error linear complexity with general periods; b) sequences with maximal linear complexity and maximal k-error linear complexity with special periods; c) sequences with maximal linear complexity and almost maximal k-error linear complexity in the asymptotic case with composite periods.

Recovery from information attacks is difficult because DBMS is not designed to deal with malicious committed transactions. A few existing methods developed for this purpose rely on operation logs, which can't express the dependency between different transactions directly. These methods usually use rollback mechanism and abandon results of innocent transactions to maintain correctness, which may indeed be used as an approach to realize DOS attack. Hence, it's necessary to find out the malicious transaction and subsequent transactions depending on it precisely. In this paper, the definition of transaction recovery log is presented and each log item records the actions taken in one transaction, by which, we can calculate transactions' dependency directly. Based on the log model and the algorithm for log's creation, the dependency calculation and data recovery algorithm are studied, which are proofed to be complete and correct. Using transaction recovery log and the algorithm, database system can significantly enhance the performance of recovery for defensive information warfare.

A significant difference between the linear complexity and the 2-adic complexity of periodic binary sequences is pointed out in this correspondence. Based on this observation, we present the concept of the symmetric 2-adic complexity of periodic binary sequences. The expected value of the 2-adic complexity is determined, and a lower bound on the expected value of the symmetric 2-adic complexity of periodic binary sequences is derived. We study the variance of the 2-adic complexity of periodic binary sequences, and the exact value for it is given. Because the k-adic complexity of periodic binary sequences is unstable, we present the concepts of thekappa-error 2-adic complexity and the k-error symmetric 2-adic complexity, and lower bounds on them are also derived. In particular, we give tighter upper and lower bounds for the minimum k-adic complexity of l-sequences by substituting two symbols within one period.

Password-authenticated key exchange protocols allow two entities who only share a human-memorable password to authenticate each other and agree on a large session key. Most password authenticated key exchange protocols provide an authenticated key exchange between a client and a server based on a pre-shared password. With the development of modern communication environments, it is necessary to design a secure authenticated key exchange between clients. In ICICS'02, Byun et al. presented a client to client password-authenticated key exchange protocol in a cross-realm setting. But the protocol is vulnerable to some attacks by an insider adversary or outsider adversary. In this paper, we present an improved protocol to solve the problem, and prove the improved protocol is secure against all types of attacks considered in the paper

In this correspondence, we construct some new quadratic bent functions in polynomial forms by using the theory of quadratic forms over finite fields. The results improve some previous work. Moreover, we solve a problem left by Yu and Gong in 2006.

Following the idea of Xing et al., we investigate a general method for constructing families of pseudorandom sequences with low correlation and large linear complexity from elliptic curves over finite fields in this correspondence. With the help of the tool of exponential sums on elliptic curves, we study their periods, linear complexities, linear complexity profiles, distributions of r-patterns, periodic correlation, partial period distributions, and aperiodic correlation in detail. The results show that they have nice randomness.

Oblivious transfer protocol is an important primitive in modern cryptography. Since its introduction, the subject has attracted a lot of attentions and has become the basis for realizing a broad class of cryptographic protocols, such as secret key exchange, contract signing, secure function evaluation, oblivious keyword search, etc. This work describes protocols for proxy oblivious transfer, in which the role of the sender is divided between two proxies, and a receiver (chooser) must contact one proxy in order to run the oblivious transfer protocol and another for some extra information. This proxy oblivious transfer protocol provides a method for the sender to delegate a proxy to transfer one of his messages to a receiver on behalf of him. The proxy oblivious transfer protocol has the same security properties as the oblivious transfer protocol using in our protocol.

Certificate-based public key infrastructure (PKI) scheme of International Civil Aviation Organization (ICAO) has some problems, especially with the distribution of public key. In this paper, we propose an identity-based PKI scheme for machine readable travel document (MRTD). By virtue of simple key management on identity-based signature, our scheme facilitates public key distribution among participating countries, and eliminates the need of a global public key directory (PKD).

XACML as a language of access policy and access context request based on attributes is widely accepted. Current XACML specification's main shortcoming is not considering delegation. A TC in OASIS proposed a draft about administrative policy, which extended XACML to describe delegation policies and stated how to process delegation policies in access decisions. In some cases, a supervisor may need to know administration authorities possessed by a manager who gets them through delegation policies. For providing such information, access control management systems should calculate total administration authority of a manager according to related delegation policies. Current XACML related works haven't addressed this topic. In this paper we define basic administrative scope and its simple XML schema, use a set of administrative scope representing administrative authority. Using these definitions, we formally describe the calculation of a manager's total administrative scope

In this paper, we present a new variant of the self-shrinking generator (SSG). The new construction inherits the conceptual simplicity and indispensable security properties of the SSG and all the known attacks on the SSG can be frustrated by the new model. Besides, its keystream has ideal run distribution and the flexibility of the new construction allows for efficient practical implementations at a large scale

An upper bound for the incomplete exponential sums over Galois rings is derived explicitly. Based on the incomplete exponential sums, we analyze the partial period properties of some binary sequences derived from Z/sub 2//sup l/ in detail, such as the Kerdock-code binary sequences and the highest level sequences of primitive sequences over Z/sub 2//sup l/. The results show that the partial period distributions and the partial period independent r-pattern distributions of these binary sequences are asymptotically uniform. Nontrivial upper bounds for the aperiodic autocorrelation of these sequences are also given.

Distributed systems today are very vulnerable to malicious attacks, either from insiders or outsiders. When an attacker controls a component of the system, he may steal some sensitive information, create some false information, or prevent legitimate users from using the system. An intrusion-tolerant distributed system is a system which is designed so that any intrusion into a part of the system will not endanger confidentiality, integrity and availability. This paper describes two such systems we are developing: an intrusion tolerance CA system and a survivable repository, which are highly resilient to both insider and outsider attacks that compromise one or more components.

Recently Xing et al constructed some families of binary sequences with low correlation and large linear complexity by making use of the theory of Artin-Schreier extensions of function fields. In this paper, we present a new construction by using the theory of Kummer extensions of function fields. The analysis shows than they have large periods, large linear complexities, and low correlations. In some cases, our method is better than that of Xing et al

Camellia is the final winner of 128-bit block cipher in NESSIE.In this paper, we construct some efficient distinguishers between 4-round Camellia and a random permutation of the blocks space.By using collision-searching techniques, the distinguishers are used to attack on 6,7,8 and 9 rounds of Camellia with 128bit key and 8,9 and 10 rounds of Camellia with 192/256-bit key.The 128-bit key of 6 rounds Camellia can be recovered with 2 10 chosen plaintexts and 2 15 encryptions.The 128-bit key of 7 rounds Camellia can be recovered with 2 12 chosen plaintexts and 2 54.5 encryptions.The 128-bit key of 8 rounds Camellia can be recovered with 2 13 chosen plaintexts and 2 112.1 encryptions.The 128-bit key of 9 rounds Camellia can be recovered with 2 113.6 chosen plaintexts and 2 121 encryptions.The 192/256-bit key of 8 rounds Camellia can be recovered with 2 13 chosen plaintexts and 2 111.1 encryptions.The 192/256-bit key of 9 rounds Camellia can be recovered with 2 13 chosen plaintexts and 2 175.6 encryptions.The 256-bit key of 10 rounds Camellia can be recovered with 2 14 chosen plaintexts and 2 239.9 encryptions.

Being as unique nonlinear components of block ciphers, S-boxes control the security of the cryptographic algorithms. The design of S-boxes with genetic algorithms is a recent research focus. For the popular bijective S-boxes, an effective evolutionary strategy is given in this paper, including fitness function, breeding strategy and hill climbing algorithm. Under this strategy, an effective genetic algorithm for 8 /spl times/ 8 bijective S-boxes is provided and a large number of S-boxes with high nonlinearity and low difference uniformity can be obtained.

NUSH is a block cipher as a candidate for NESSIE. NUSH is analyzed by linear crypt-analysis. The complexity δ=(ε, η) of the attack consists of data complexity ε and time complexity η. Three linear approximations are used to analyze NUSH with 64-bit block. When | K |=128 bits, the complexities of three attacks are (2 58 , 2 124 ), (2 60 , 2 78 ) and (2 62 , 2 55 ) respectively. When | K |=192 bits, the complexities of three attacks are (2 58 , 2 157 ) (2 60 , 2 96 ) and (2 62 , 2 58 ) respectively. When | K | =256 bits, the complexities of three attacks are (2 58 , 2 125 ), (2 60 , 2 78 ) and (2 62 , 2 53 ) respectively. Three linear approximations are used to analyze NUSH with 128-bit block. When | K |=128 bits, the complexities of three attacks are (2 122 , 2 95 ), (2 124 , 2 57 ) and (2 126 , 2 52 ) respectively. When | K |=192 bits, the complexities of three attacks are (2 122 , 2 142 ), (2 124 , 2 75 ) and (2 126 , 2 58 ) respectively. When | K |=256 bits, the complexities of three attacks are (2 122 , 2 168 ), (2 124 , 2 81 ) and (2 126 , 2 64 ) respectively. Two linear approximations are used to analyze NUSH with 256-bit block. When | K |=128 bits, the complexities of two attacks are (2 252 , 2 122 ) and (2 254 , 2 119 ) respectively. When | K |=192 bits, the complexities of two attacks are (2 252 , 2 181 ) and (2 254 , 2 177 ) respectively. When | K |=256 bits, the complexities of two attacks are (2 252 , 2 240 ) and (2 254 , 2 219 ) respectively. These results show that NUSH is not immune to linear cryptanalysis, and longer key cannot enhance the security of NUSH.