Current congestion control algorithms ignore the application-layer delay, where the untransmitted data waiting at source nodes degrades the delay performance of services. Moreover, differentiated priorities are necessary for the application services with various delay requirements, especially for mission-critical services. Different from the existing works only considering the network delay, in this paper, by adding the flow queueing delay at source nodes, we formulate the network utility maximization (NUM) problem with additional deterministic service delay constraints. We propose a general TCP-based two-timescale congestion window control (TCWC) framework with delay-aware priority to enhance traditional algorithms. Specifically, to handle the obstacle of new delay constraints, we transform them to the time-average stability of virtual queues. By solving the new NUM problem via Lyapunov optimization, we design a short-term congestion window adjustment strategy in each time slot. To further guarantee the service delay, we apply extreme value theory (EVT) to evaluate the priorities of different flows, and determine the long-term control of window update rates. We deploy the proposed framework in three classic algorithms including NewReno, Vegas and DCTCP. In addition, simulation results show that our TCWC framework can significantly reduce the average service delay and provide deterministic guarantees compared with time-aware TCP congestion control algorithms such as TIMELY and BBRv2.

A reliable log audit system is a fundamental tool for efficient security management and attack detection. Blockchain has emerged as a prominent technology for building log audit systems, thanks to its non-repudiation and immutability properties. However, current blockchain-based solutions are computationally intensive and typically rely on coarse-grained queries, making them impractical for real-world systems. Therefore, we propose a blockchain-based verifiable log audit system, BLAS, which adopts three novel techniques. Firstly, we propose a novel data structure called the Index-Object Merkle Forest (IOMF), which combines modified Merkle Tree data structures and keyword-range bitmap indexes to support efficient log auditing. Secondly, we propose a hierarchical extension of IOMF to create an Authenticated Layered Index Structure (ALIS). ALIS enables fine-grained auditing at the entry level. Finally, we propose two optimization techniques in ALIS to reduce computational and communication costs. The performance evaluation confirms that BLAS is consistently faster than the baseline solutions with similar settings in various experiments, achieving speedups of hundreds to over ten thousand times for the most challenging workloads.

Time series data analysis, employing dynamic time warping (DTW) algorithms, has a wide range of applications in fields such as medicine and economics. Given the widespread distribution of data across different domains, integrating and analyzing these datasets through outsourced cloud computing can enhance analytics, though privacy concerns arise. Privacy preserving data analysis, underpinned by secure multi-party computing, emerges as a crucial approach to address this challenge. However, existing efforts face high communication costs and increased interactions, resulting in significant efficiency constraints in practical applications. In this paper, we propose a function secret sharing (FSS)-based framework for secure collaborative analysis of time series data using the DTW algorithm. Utilizing the distributed comparison function, we develop efficient building blocks with minimal online interaction and communication, enhancing the practicability of security protocols. To address the challenges of FSS key generation due to uncertain computational topology when cascading multiple distances, we adopt a modular design and decompose the analysis process into several critical modules. Furthermore, our framework efficiently supports various constraint methods for DTW. We implement and evaluate our framework using publicly available datasets. The results demonstrate a significant reduction in communication costs and the number of interactions during the online phase.

Anomaly detection plays a vital role in processing multi-source data through public cloud servers, yet existing privacy-preserving schemes fail to efficiently detect anomalies while protecting data source privacy. Although isolation forest offer advantages for unsupervised high-dimensional data analysis, implementing its tree-based privacy-preserving mechanisms remains challenging. In this paper, we propose IFAD, a novel isolation forest-based scheme for detecting anomalies in private data. IFAD guarantees end-to-end privacy protection by safeguarding original data, tree structures, and intermediate information throughout detection workflows. Our design achieves efficiency through three key contributions: 1) Cryptographic building blocks combining function secret sharing (FSS) and secret sharing (SS) to enable secure computations; 2) A split index protocol and layer update protocol to facilitate efficient, layer-by-layer isolation forest construction; 3) A detection phase optimization converting the anomaly score calculations into lookup table operations. Experimental evaluations demonstrate that IFAD achieves superior performance, outperforming prior schemes by 2.4×-3.1× in runtime under LAN and WAN environments, and by 1.8×-7.8× in online communication overhead, while maintaining comparable detection accuracy. Our solution establishes an effective balance between privacy preservation and operational efficiency for cloud-based anomaly detection.

Authentication and Key Agreement (AKA) are essential for UAV networks operating in open and hostile environments, as they assist in preventing common threats such as impersonation and replay attacks. However, traditional protocols often rely on a centralized server for key and identity management, creating risks of key leakage and a single point of failure. To address these issues, we propose a blockchain-based decentralized authentication mechanism that remains effective even under partial node compromise. Our design adopts Physical Unclonable Functions (PUFs) in place of key-based authentication to mitigate key leakage risk. To mitigate machine learning (ML) attacks inherent in existing PUF-based protocols, we design a lightweight Encrypted Randomized Challenge-Response Pair (ERCRP) structure, which incorporates external randomness to obfuscate underlying PUF mapping. Meanwhile, to address CRP leakage in prior centralized schemes, we combine Shamir's Secret Sharing and blockchain for secure CRP management. Specially, we introduce a decoupled design that separates interaction-intensive secret reconstruction process from blockchain consensus to ensure high efficiency. Finally, we develop a lightweight commitment-based management mechanism to prevent unauthorized CRP consumption and reuse from malicious authentication attempts. Additionally, the protocol provides UAV identity untraceability via dynamic identity updates. Comprehensive formal and informal security analyses, together with comparative performance evaluations, demonstrate the protocol's strong security guarantees and practical efficiency.

Principal component analysis (PCA) is an essential algorithm for dimensionality reduction in various data analysis tasks. Recently, PCA has gained widespread use in cloud outsourcing services due to its effectiveness and versatility. However, privacy concerns in outsourced PCA have led to the development of privacy-preserving schemes. Despite this, existing solutions face significant performance bottlenecks due to the iterative matrix computations involved in PCA, resulting in high overhead that limits their practicality. In this paper, we propose an efficient privacy-preserving outsourced PCA scheme. Specifically, we propose a secure Jacobi-EVD protocol, which improves efficiency by reducing nonlinear operations and iterations. Furthermore, by optimizing the matrix update operator in Jacobi-EVD using a hybrid protocol, we significantly reduce the communication overhead and communication rounds in iterative matrix computations. Security analysis demonstrates that our scheme preserves the privacy of data and PCA results. Performance evaluation shows our scheme significantly reduces 29.3× communication overhead compared to existing schemes.

Network asset auditing constitutes a systematic assessment of organizational IT infrastructures, encompassing comprehensive identification of active hosts, operating systems, and service configurations. This foundational process plays a pivotal role in discovering and managing potential vulnerabilities that adversaries may exploit. While various existing network scanning tools (e.g., Nmap, Masscan, ZMap) provide elementary auditing capabilities, their efficacy is fundamentally constrained in detecting devices/services concealed behind Network Address Translation (NAT) gateways. To address this critical limitation, we propose DMIF (Detection framework based on Multiple Inherent Fingerprints), which introduces two methodological innovations: (1) a frequency domain analytical approach for extracting inherent traffic characteristics, and (2) an adaptive multi-fingerprint aggregation mechanism. Our DMIF builds upon the key observation that different hosts and different operating systems exhibit distinctive traffic fingerprints stemming from their hardware architectures and protocol implementations. The framework’s feature extraction module employs spectral analysis to capture these device-specific patterns, while the fingerprint aggregation module dynamically optimizes weight assignments across multiple fingerprint dimensions through machine learning techniques. We evaluate DMIF in two scenarios and consider the effects of network fluctuations and user behaviors. Experimental results demonstrate that DMIF’s detection F1 score exceeds 0.91 for a wide range of device types, including personal computers, mobile phones, and IoT devices.

Malicious traffic detection is an important technique for network management, assisting network administrators in identifying malicious hosts and activities. With the growing proportion of encrypted traffic, recent studies incorporate Machine Learning (ML) and Deep Learning (DL) methods. These methods can achieve effective classification but rely heavily on large-scale and high-quality datasets. Due to the coarse-grained traffic collection at the level of hosts or switches in existing datasets, the introduction of noisy traffic degrades the performance of malicious traffic detection models. In this paper, to tackle the efficacy challenge caused by noisy traffic, we propose a traffic dataset purification framework named PureFlow. Specifically, PureFlow adopts an unsupervised clustering algorithm to categorize the collected traffic based on their sources, and thus overcome the feature confusion caused by mixing noisy traffic from different sources. With a set of autoencoders based on reconstruction loss, PureFlow can distinguish the feature differences between noisy and valid traffic. We conduct extensive experiments on public datasets. The results show that PureFlow can effectively filter noisy traffic and significantly enhance the performance of several malicious traffic detection models without additional modifications, achieving average accuracy and F1-score improvements of 5.58% and 0.056, respectively.

In recent years, most botnets have utilized Domain Generation Algorithms (DGAs) to dynamically generate domains to establish communication with Command and Control (C&C) servers, enabling malicious activities. However, recent research mainly proposes methods based on labeled DGA domain datasets that already yield high detection rates, but cannot be applied directly to realistic network environments. In this paper, we propose a novel hybrid threshold-behavior analysis system that examines and processes network traffic in several layers to detect DGA domains precisely. Our system incorporates a multi-level filtering approach that dramatically increases the precision of domain identification. At the system’s center lies its innovative hybrid threshold-behavior analysis framework, which employs a cascaded filtering process to enhance malicious domain identification while efficiently preserving computational resources. To address the issue of separating highly random DGA domains from their legitimate ones, we utilize adaptive thresholding combined with contextual analysis of domain query patterns to enable stealthy DGA domain detection. We test on realistic network traffic datasets to verify the performance of our system. The experiments show that our system has a 97.88% recall rate for labeled DGA domains and can correctly identify a huge number of previously unlabeled DGA domains, demonstrating its effectiveness and feasibility.

With the continuous evolution of web application attack techniques, attackers have widely adopted fuzzing-based penetration testing. However, traditional rule-based feature-matching detection mechanisms and machine learning-based detection systems face challenges including ineffective malicious traffic with local mutations, complex and time-consuming model training, and excessive server load. This paper introduces Fuzzydetect, a novel detection framework for identifying malicious HTTP fuzzing traffic. It applies a sliding window mechanism to segment network traffic and uses fuzzy hashing to capture similarity patterns in consecutive packets and compute similarity scores, utilizing Support Vector Machine (SVM) to distinguish malicious activity from benign traffic. We conduct comprehensive experiments using mainstream datasets to evaluate our system with existing solutions. Experimental results demonstrate that the proposed system achieves a True Positive Rate of 99.64%, accuracy of 98.2%, and F1-score of 0.9867, with a faster processing speed that satisfies real-time detection requirements.

Network probing serves as a potent technique in network security protection, enabling the effective identification of dangerous devices and potential threats. This paper focuses on network probing against Network Address Translation (NAT) hidden networks, especially for campus or public networks. However, it is noted that the traditional active probing techniques usually need to inject probes into the network, posing a challenge in public network scenarios. Moreover, current passive techniques cannot achieve high accuracy, low computational resources, and real-time requirements simultaneously. To this end, we design a host probing system named Hostprober for NAT networks based on Network Time Protocol (NTP) traffic analysis. Leveraging the widely used and featured NTP traffic, the Hostprober can identify the NTP traffic fingerprints by normalizing polling intervals and dynamically adjusting the time window. Based on the captured fingerprints, the Hostprober can reorganize the NTP traffic into traffic sets corresponding to different hosts, and match the NTP traffic to the models to achieve the purpose of host detection and network probing. Furthermore, we evaluate our proposed internal network probing method in both a controlled virtual environment and a real network environment, comparing it with other baselines. The evaluation results show that our approach demonstrates good accuracy and outperforms other comparison methods.

Privacy-preserving data integration (PPDI) is a secure method to integrate datasets from different data sources while protecting the privacy of data. Existing PPDI work usually uses the outsourced framework and executes data integration through a cloud server. Due to the need to protect the privacy of the relations between IDs and associated data, the associated data must be encrypted or blinded before uploading to the cloud server, which leads to poor performance. For the efficient PPDI solution, we first carefully analyze the privacy goals of PPDI. After that, we adopt the distributed computing model, and then propose a multi-party PPDI protocol named DPPDI. Our scheme removes the overhead caused by encrypting associated data while protecting privacy, and realizes the outer join functionality and arbitrary combination of data sources. Besides, to avoid dropping records when duplicate IDs exist, we propose a method embedded into the PPDI protocol to handle duplicate IDs. Finally, we conduct extensive experiments to evaluate our scheme's performance, and the result shows that our scheme outperforms previous PPDI schemes.

Federated learning addresses the issue of data silo in machine learning. However, in practical applications, it still encounters challenges such as privacy leakage and communication bottleneck. Previous studies have proposed two main technologies to these challenges: secure aggregation to preserve privacy and Top-k gradient sparsification to reduce communication overhead, respectively. However, for both privacy preservation and communication efficiency, combining these two technologies results in compatibility issues and additional privacy leakage. In this paper, we propose a secure aggregation protocol with Top-k sparsification to achieve secure and efficient federated learning. We employ a differential privacy perturbation mechanism to protect Top-k features, thus preventing client's privacy leakage. Additionally, we design a sparse communication graph to ensure compatibility between secure aggregation and Top-k sparsification perturbed by differential privacy. We prove that our protocol protects Top-k features and conduct extensive experiments to evaluate its performance, which shows a significant reduction in the communication overhead compared to traditional secure aggregation protocols.

Low earth orbit satellite networks (LEOSNs) are increasingly favored for providing ubiquitous Internet access. However, the dynamic characteristics in LEOSNs pose two challenging issues to congestion control algorithms (CCAs) in transport layer: 1) time-varying link capacity when links remain connected, leading to a continuous mismatch between CCA's sending rate and capacity, and 2) brief but significant link interruptions during satellite handovers. To address these issues, this paper proposes a two-phase CCA called Creo, in which each phase tackles one of the two aforementioned issues in LEOSNs individually. In Creo's connected phase where links remain connected, we design a deep reinforcement learning framework, which captures complex patterns of highly variable link capacities in LEOSNs to generate dynamically adaptive congestion control strategies. In Creo's handover phase where links suffer interruptions, we introduce a handover-aware process, which leverages cross-layer notifications to notify TCP sender in advance of handover occurrence to instruct sender when to stop and resume sending at precise timestamps. Extensive simulation results show that, compared to other CCAs, Creo consistently tracks time-varying capacity, reduces average handover recovery time by 60.5%, and overall achieves a 55% average throughput improvement while maintaining low latency and low delay jitter.

Multi-factor authentication (MFA) has become an essential method for enhancing security in authentication procedures by leveraging multi-dimensional authentication anchors, such as Biometrics-Based Authentication and One-time Password (OTP). However, MFA usually triggers for each login attempt and significantly impacts user usability. To this end, Risk-Based Authentication (RBA) is developed to achieve a better balance between user usability and security by dynamically checking the user authentication information. Opposite to the previous RBA designs that leverage static rules, this paper introduces Dynamic User Behavior Authentication (DUBA), an enhanced RBA design proposed to further improve both security and user experience. Our design uses probabilistic statistical methods to evaluate and score user behaviors. In this, authentication procedures can be dynamically adjusted in response to real-time user patterns and potential threats. Besides, DUBA introduces the weight adjust scheme that can efficiently defend against malicious behavior while improving usability, utilizing multi-dimensional behavioral data, such as login frequency, device information, and geographic location. We implement DUBA and evaluate its effectiveness by integrating it into the actual Single Sign-On (SSO) system in use on our campus. The results show that DUBA significantly reduces false positives and strengthens defenses against identity impersonation attacks.

Federated learning can support multiple clients to train a global model with the assistance of the central server without sharing raw clients' data. However, the gradients uploaded by clients still compromise privacy and federated learning is vulnerable to poisoning attacks by malicious clients. Previous studies have focused on privacy preservation or defense against poisoning attacks, respectively. In practice, privacy preservation further increases the difficulty of defending against poisoning attacks, leading to the problem of severe degradation of model accuracy under strong privacy preservation. In this paper, we propose a lightweight, robust, and privacy-preserving federated learning scheme that can effectively resist poisoning attacks under strong privacy protection and prevent model accuracy degradation. We employ a differential privacy technique that adds noise to the upload gradient to protect data privacy. To address the problem that it is difficult to detect malicious clients under strong privacy preservation, we design a probabilistic grouping mechanism based on trust scores to support the detection of malicious clients. We conduct extensive experiments to evaluate our scheme, and the results show that our scheme can resist different types of poisoning attacks under strong privacy preservation, thus improving the accuracy of the model.

The rapid growth of blockchain-based decentralized applications (DApps) highlights blockchain's potential to enhance application security. However, expensive on-chain data storage limits the deployment of DApps with large datasets. Additionally, DApp development tools, such as Ethereum smart contracts, lack support for complex queries, further hindering dataintensive DApps. To address the challenges of expensive storage and inability of complex queries, we propose ContractDB, a framework that integrates external verifiable databases (VDBs) with blockchain DApps. ContractDB offloads data storage and processing to VDBs, thereby reducing on-chain storage costs and enhancing data handling capabilities. Existing VDBs incur high verification costs and lack support for public verifiable update. In this paper, we propose a novel VDB design using authenticated dictionaries and authenticated set operations to reduce verification cost and enable verifiable updates. Performance evaluations show that ContractDB can verify the results of 6-condition conjunction (with mixed equivalent and range) queries on a 220-line data table within 2.4 million gas cost, with potential for optimization. For comparison, storing those data in contracts requires over 36 billion gas and still cannot support range or multi-condition queries. Therefore, the proposed ContractDB makes it feasible to support DApps with large datasets.

Malicious traffic detection has gained increasing importance in network security research due to its potential for detecting network attacks in real time. Currently, malicious traffic detection methods primarily rely on either a single feature or a single model architecture. This limitation often leads to high false positive rates when deployed in complex open environments and constrains their capability to handle diverse types of malicious traffic effectively. To address these challenges, in this paper, we propose a novel hybrid model that leverages feature fusion and attention mechanisms to enhance the accuracy of malicious traffic detection. Specifically, we first employ both Decision Tree (DT) and Random Forest (RF) models to extract traffic features. Their predictions are then fused using a stacking method to enrich the feature representation. Subsequently, a Multilayer Perceptron (MLP) is introduced as the meta-learner, with a self-attention mechanism incorporated into its hidden layer to dynamically optimize feature weight allocation, thereby enabling the model to focus more accurately on key traffic features. Extensive experiments were conducted using the CICIDS2017 and CICIDS2018 datasets. The experimental results demonstrate that our proposed model, which combines feature fusion and attention mechanisms, achieves significantly superior detection performance compared to traditional singlemodel approaches, particularly in terms of precision, recall, and F1-score.

Electronic voting is crucial for contemporary democratic processes. However, conventional systems often struggle with a single point of failure and insufficient support for intricate voting semantics, especially in ranked-choice elections requiring distinct ranking constraints. Although blockchain technology enhances fault tolerance and auditability, existing blockchainbased solutions primarily focus on simpler voting schemes, encountering difficulties in effectively verifying privacy-preserving ranked ballots. To address this gap, we propose AranVoting, an innovative blockchain-based ranked-choice voting scheme designed to ensure anonymity and fairness through homomorphic encryption. AranVoting employs a structured matrix ballot format alongside zero-knowledge proof to ensure the correctness of the ballot format. Furthermore, we introduce a smart contractdriven counting mechanism that facilitates the availability and transparency of ballot tallying through gradient incentive and committee election algorithms. Our security and performance evaluations demonstrate that AranVoting provides secure rankedchoice voting, effectively guaranteeing essential security properties such as anonymity, correctness, and verifiability while maintaining practicality and reasonable computational overhead throughout the voting process.

Entanglement distribution between distant quantum nodes plays an important role in quantum networks. However, due to the unique properties of quantum mechanics and hardware limitations, entanglement resources in quantum networks are scarce. Quantum links that fail to meet request demands become bottleneck links, significantly hindering remote entanglement distribution in multi-request scenarios. In this paper, we propose an entanglement routing scheme called SwappingBoost that can effectively reduce resource consumption along entanglement distribution paths, alleviating the negative impact of bottleneck links. SwappingBoost first employs a decreasing resource reservation method to compensate for resource losses caused by failed entanglement swapping, freeing up pre-reserved resources on downstream links to accommodate other paths and requests. Besides, SwappingBoost introduces a path-priority-based rounding algorithm that achieves integer-level resource allocation while ensuring balanced resource allocation. Extensive simulation results demonstrate that SwappingBoost can effectively reduce the load of bottleneck links, enhancing network throughput while maintaining fairness among multiple requests.

Quantum communication networks enable advanced quantum applications through remote entanglement distribution among source-destination pairs. Despite efforts to optimize entanglement distribution, fairness in multi-request scenarios has been neglected, potentially causing issues like “request starvation”. To address such issue, this paper concentrates on the unique properties of entangled systems and introduces a process-oriented fairness metric, i.e., expected throughput, departing from conventional approaches used in classical networks. Furthermore, we propose an entanglement distribution scheme named Fair-EAS, which prioritizes entanglement allocation and selection for batching multiple requests to maximize overall throughput while maintaining max-min fairness. To facilitate a convenient solution, we transform the nonlinearity of the problem into an equivalent linear programming formulation and decouple the solution into offline and online phases. In the offline phase, we design a multi-round water-filling-like optimization algorithm to determine the optimal path set for predicting entanglement allocation. In the online phase, we introduce an adaptive compensation algorithm and an entanglement “fragment” exhaustion algorithm to dynamically adjust the path set based on successfully generated entangled pairs. Comprehensive simulations show that Fair-EAS outperforms the existing schemes in terms of fairness by significantly enhancing the minimum throughput and throughput deviation among multiple requests while maintaining an overall throughput close to the optimal level.

Electronic voting plays a crucial role in facilitating democratic and convenient decision-making in people’s lives. However, implementing an electronic voting system poses challenges, such as meeting the stringent security requirements for anonymity, fairness, and verifiability. Another concern is the performance degradation when dealing with a large number of voters. In this paper, we propose$S^{3}$Voting, a blockchain sharding-based e-voting scheme that addresses these challenges. By combining robust security and scalability,$S^{3}$Voting provides reliable technical support for conducting large-scale elections. Utilizing advanced technologies such asHomomorphic Time-Lock Puzzle (HTLP)andone-time ring signature, the system safeguards voters’ privacy and ballot confidentiality. The approach involves dividing voters and miners into smaller shards, and implementing shard managing mechanisms to ensure security and enhance system efficiency. Through thorough security analysis, we demonstrate that$S^{3}$Voting not only meets the fundamental security requirements of e-voting but also offers verifiability and strong robustness-essential elements for successful large-scale elections. Moreover, experimental results indicate that$S^{3}$Voting significantly reduces the computational burden on individual miners and minimizes system processing time compared to existing blockchain-based e-voting solutions.

The surge in blockchain-based cryptocurrencies has created a pressing need for Cross-Chain Transaction (CCTx) solutions. Existing solutions either lack sufficient security, like centralized exchanges, or suffer from poor efficiency and scalability, such as atomic swaps. Inspired by the success of the Lightning Network in accelerating Bitcoin transactions, we propose CrossChannel that establishes cross-and-off-chain micropayment channels to achieve efficient and scalable CCTx. Specifically, we analyze the challenges of extending one-chain channels to cross-chain scenarios caused by the separation of blockchains. To overcome these challenges, we employ the chain relay mechanism to synchronize channel-related information across blockchains and construct the channel management protocol on this basis, ensuring the same security level as one-chain channels in cross-chain settings. We prototype CrossChannel between two Ethereum testnets, comparing its transaction efficiency and costs with a typical HTLC-swap scheme. Results demonstrate the significant advancements in efficiency and scalability offered by CrossChannel. Even with channels closing after just 20 transactions, CrossChannel exhibits a fivefold capacity increase for handling CCTxs compared to HTLC swaps.

The lack of privacy-preserving capabilities hinders the further development of blockchains and smart contracts. While numerous privacy solutions have been proposed, limitations persist. First, most existing solutions focus on specific privacy protections such as anonymous payments, private data, or multi-party computation tasks. However, these solutions lack a general privacy ability, allowing users to deploy applications with diverse privacy requirements. Second, existing solutions have limited customizability, which means users cannot easily customize and adapt the privacy policies according to their specific demands or preferences. In this article, we present EtherCloak, which adopts trusted execution environments (TEEs) to achieve a general and customizable privacy policy on account model blockchains, enabling users to conceal any on-chain information. To address the security issues caused by the unreliability of the host the TEE runs on, we design the enclave state check and crash recovery mechanisms and employ them in the block generation process. In addition, we propose an access control mechanism for privacy policy management and data query. We prove that EtherCloak offers general and customizable privacy protection with a minimal increase in transaction size (less than triple) and communication overhead (approximately 10%) compared to Ethereum.

With the ever-growing attention on communication security, machine learning-based network intrusion detection system (NIDS) is widely utilized to meet different security requirements. However, most of the existing methods manually extract or learn features from raw traffic, which is usually expensive, complicated, and time-consuming. Moreover, this also brings unprecedented challenges for preserving users’ privacy in the communication process, making it difficult for existing solutions to be deployed in practice due to the privacy requirements from legal policies. This paper proposes a privacy-preserving graph neural network (named NIGNN) for NIDS, which can encode the local structure and traffic features. To address the privacy issues pertaining to the application of graph representation learning, we design a privacy message-passing mechanism with formal privacy guarantees, in which sensitive information potentially contained in graph vertices will be kept private. Specifically, we design a privacy-enhancement graph representation that introduces a degree-sensitive item in vertex-based aggregation to reduce noise. Our theoretical analysis shows that NIGNN can provide a provable privacy guarantee. Extensive experiments demonstrate NIGNN's performance in maintaining a sound privacy-accuracy trade-off.

The integration of blockchain with crowdsourcing improves data security, reduces single-point failure risks, and enhances trust and traceability in the system. However, this integration also leads to scalability issues because of the decentralized consensus mechanism of blockchain. While multiple chain architecture can enhance system throughput and offer functionality extensions, they often require complex token locking and release mechanisms to prevent double-spending attacks. This leads to a significant portion of funds being locked, thereby reducing overall fund liquidity. In this paper, we propose FishboneChain, consisting of one main chain and multiple child chains. Specifically, we address the scalability issue by leveraging child chains to offload the crowdsourcing task result submission and verification transaction pressure from the main chain, while each child chain can deploy various crowdsourcing protocols to enhance the functionality. Furthermore, we design a fund management contract and periodic task settlement mechanism, which allows requesters to lock a single fund on the main chain to manage task status across multiple child chains, thereby reducing the locked fund percentage and improving fund liquidity. Our scheme satisfies the security requirements of a crowdsourcing platform, such as fund security, robustness, and double-spending resistance. Performance analysis shows our scheme can improve the system throughput to 100 times that of the main chain and maintain the locked fund percentage below 20%.

The widespread adoption of cloud storage has raised considerable data privacy concerns for outsourced databases. In recent years, Structured Encryption (STE) has emerged as a promising solution to build encrypted databases that efficiently handle queries while preserving privacy through underlying structures called Encrypted Multi-Maps (EMMs). However, current STE-based schemes primarily focus on static settings, and their direct extensions to dynamic settings introduce significant challenges in client storage overhead and update efficiency with join condition. In this paper, we present an efficient dynamic encrypted database scheme supporting large-scale data. To address the challenges in dynamic settings, we first propose a novel dynamic EMM design with constant client storage that utilizes a global counter to reduce client storage overhead. We then introduce an algorithm for dynamically handling join queries based on tags generated from values of the join attribute, significantly reducing update overhead. We implement our scheme and conduct comparative analyses with existing dynamic STE schemes. The experimental results demonstrate that our scheme offers significant advantages in terms of client storage overhead and update performance.

Searchable symmetric encryption (SSE) is a technique that enables secure outsourcing of data to an untrusted cloud server without sacrificing search functionality. Recently, multi-user SSE schemes for data sharing, which support access control from various users, have gained attention. However, the access control mechanisms in existing schemes are not adequate for realistic data-sharing scenarios as they do not consider time constraints or only partially address them, making these mechanisms unsuitable for SSE schemes. To address this issue, we first highlight the importance of time constraints in multi-user SSE and propose a completely time-constrained SSE scheme under a two-server model. By taking advantage of the Lagrange interpolation and pre-computation, our proposed scheme enables searching over time-related encrypted data with owner-enforced time constraints. Additionally, we employ the blinding technique with the assistance of a semi-honest time server to ensure the completeness of time constraints, which is not guaranteed in existing works. Based on the leakage function, we prove the security of our proposed scheme in the simulation-based security model. Furthermore, extensive experiments demonstrate the practicality of our scheme in supporting time-constrained functions.

Mobile users often prefer to sense only a subset of tasks based on their preferences or physical conditions, which distinguishes sparse crowdsensing from traditional crowdsensing. Sparse crowdsensing not only introduces a potential risk of privacy leakage regarding users’ preferences or conditions—due to the revelation of specific sensed objects—but also results in reduced accuracy of truth estimation. To address these challenges, we propose a Privacy-Preserving Truth Discovery (PPTD) scheme, named S-PPTD, that enables accurate and efficient PPTD for sparse crowdsensing. Our approach leverages edge nodes to geographically group users and introduces an effective padding strategy based on Bloom filters and mixed secret sharing. This strategy allows users to obfuscate the objects they sense, preventing adversaries from determining the specific objects being sensed. To improve accuracy, we design new protocols for precise and efficient approximation of nonlinear functions, enabling the use of commonly applied kernel functions to capture spatial and temporal correlations between objects, and incorporate these into the truth estimation process. Through extensive experiments and security analysis, we demonstrate that S-PPTD is secure, accurate, and efficient in the context of sparse mobile crowdsensing.

Privacy-preserving truth discovery (PPTD) enables the crowdsensing platform to extract reliable inferred truths from unreliable user sensory data. While mobile crowdsensing systems have driven the emergence of many applications, continuously extracting inferred truths of evolving objects over streaming data (continuous PPTD) remains a challenge. Most existing works focus on static scenarios and cannot handle the new challenges in continuous PPTD, such as accuracy decrease, user dynamics, real-time requirements, and outliers. To address these challenges, we present PTET, a PPTD framework for continuous PPTD. By mining evolving patterns, PTET extracts accurate inferred truths of evolving objects even when some epochs lack sufficient user sensory data. PTET ensures the privacy of both users and data requesters while achieving high accuracy. Furthermore, we present PTET-P for practical applications. It employs a virtual user combined with evolving patterns to effectively eliminate the impact of user dynamics in continuous PPTD. Meanwhile, PTET-P achieves “immediate on-arrival processing” to improve real-time performance significantly. In addition, we address the outliers problem with the help of evolving patterns. We provide security analysis to prove that our frameworks protect the privacy of both users and data requesters. Extensive experiments demonstrate that our frameworks dramatically outperform the existing schemes in extracting inferred truths of evolving objects in continuous PPTD.

Crowdsourcing has emerged as an effective paradigm for large-scale data collection and statistical analysis. However, the paramount concern about worker privacy has driven the development of privacy-preserving statistical analysis methods. We propose PSAC, a novel framework that leverages histograms to facilitate privacy-preserving statistical analysis in crowdsourcing. PSAC integrates secure statistical analysis protocols based on homomorphic encryption and secure two-party computation, addressing the limitations of a single cryptographic technique. It introduces innovative algorithms using histograms for statistical operations, including functions such as quantile estimation, outlier elimination, contingency table construction for$\chi ^{2}$test, and the Mann-Whitney$U$test. These algorithms exhibit minimal overhead growth with respect to data volume, demonstrating exceptional scalability for large numbers of data. Moreover, through a key-separation design, PSAC ensures that only the requester can decrypt the final results independently, even if the ciphertexts of data are exposed. Comprehensive evaluations validate the security, efficiency, and scalability of the PSAC framework.

Building encrypted databases has been a long-standing challenge in the field of database security. In recent years, Structured Encryption (STE) has emerged as a promising approach to constructing encrypted databases, striking a balance between security and efficiency. Although existing STE-based encrypted database systems achieve high efficiency in query processing, all these schemes struggle to support rich queries with minimal information leakage. In this paper, we present a new STE-based encrypted database system, named Filter-integrated Encrypted Database (FinEDB), which supports exact-match and range queries, conjunctive queries and join operations, while maintaining limited information leakage. We first design a novel secure inverted index to avoid storage overhead blow-up when extending to support rich query capabilities. Then, we integrate Binary Fuse filters into our proposed inverted index to enable efficient query processing. By leveraging the homomorphic property of Binary Fuse filters, our approach leaks less information than existing STE-based solutions. Besides, we provide rigorous proof for our proposed scheme under the simulation paradigm. To evaluate the performance, we implement the prototype of FinEDB and compare it with the baseline STE-based scheme. Experiment results demonstrate that FinEDB is practical and can support rich queries on real-world databases.

Clustering is a crucial unsupervised machine learning algorithm extensively used in various practical applications, such as patient refinement and fraud detection, which often involve vertically distributed data across multiple data centers. However, sharing datasets directly is typically prohibited under GDPR due to potential privacy breaches. Therefore, privacy-preserving joint clustering for vertically distributed datasets is highly desired. In this paper, we propose Privacy-Preserving Vertically Federated Clustering (PPVFC), a solution that not only achieves this goal but also significantly reduces computational and communication overhead for each data owner (DO). Unlike most previous works that achieve the goal with a single privacy-enhancing technology, PPVFC jointly leverages multiparty homomorphic encryption (MHE) and multiparty computation (MPC) to efficiently interleave communication-lightweight homomorphic computations on the local dataset with operations over collectively secret-shared intermediate data. Specifically, we design a coefficient-wise encoding for MHE to pack large datasets and minimize communication costs. Additionally, we develop a round-efficient bit extraction protocol for determining the minimum distance. Through extensive experiments and security analysis, we demonstrate the practical performance and robust security guarantees of PPVFC.

Privacy-preserving statistical analysis enables the data center to analyze datasets from multiple data owners, extracting valuable insights while safeguarding privacy. However, the observation of microdata involvement in various analysis tasks within the data center can indirectly lead to privacy breaches. For instance, when the data center observes microdata involved in a disease-related task, it may reveal information about the corresponding user’s disease. Existing schemes process the entire dataset for each analysis task to prevent privacy breaches, resulting in significant redundancy overhead due to the large amount of task-irrelevant data involved in processing. In this paper, we propose FDC, which can protect privacy and effectively reduce the redundancy overhead. It frees the data center from huge redundancy overhead. Specifically, we propose a co-design of local differential privacy and multiparty computation with preprocessing by the data owner. This design enables the data center to process only task-relevant and LDP noise-induced microdata instead of the entire dataset while maintaining analysis results without accuracy loss. In some scenarios where preprocessing by the data owner is unfeasible, we present a data center-assisted method to complete preprocessing within the data center. Additionally, we design and optimize a secure shuffle protocol within this method. Finally, we implement and evaluate FDC using the aggregation task as a baseline. With different proportions of task-relevant microdata, experimental results show that the runtime of FDC is 2~11x faster than existing schemes on LAN and 2~22x on WAN, and the communication overhead is up to 3~153x lower.

Self-healing group key distribution (SGKD) protocols guarantee the security of group communications by allowing authorized users to independently recover missed previous session keys from the current broadcast without retransmission. However, existing SGKD protocols have flaws: (1) collusion resistance and revocable nodes are both upper-bounded by the degree of polynomials used, (2) the disclosure of personal secrets enables the recovery of group key, (3) temporary revocation of a group member is not possible, and (4) a revoked node may obtain the session key when initiating mutual healing, moreover, a malicious node may cause the recovery of false group keys. To address these limitations, we propose an SGKD protocol using the Chinese remainder theorem (CRT) and Physical Unclonable Function (PUF). Our proposed SGKD protocol generates a PUF-based dynamic secret by stimulating nodes’ PUF using a polynomial-based encrypted challenge. This secret is then employed to retrieve a CRT-based encrypted group key. By combining PUF and CRT, we can generate dynamic secrets on the fly and reduce computation time significantly. Utilizing such a technique, our protocol achieves superior security goals, including resistance to any coalition of group nodes even if nodes’ personal secrets were disclosed. Furthermore, the proposed protocol provides an unlimited number of revocable nodes. Additionally, a revoked node can rejoin its group in later sessions without affecting backward secrecy. Moreover, the protocol provides a backward secrecy guaranteed mutual-healing feature free from desynchronization. Our performance and security analyses (i.e., theorem-based formal analysis, NS3-based experiment, and formal verification using the AVIPSA tool) show that our proposed protocol achieves stronger security goals and better efficiency in terms of computation, communication, and storage costs compared to existing SGKD schemes.

The high mobility in Vehicular Ad-hoc Networks (VANETs) significantly affects the reliability of data transmission. To solve this problem, Named Data Networking (NDN)-based VANETs are proposed, utilizing in-network caching and named-based forwarding to overcome the dual challenges of mobility and connectivity. Although in-network caching enhances content availability, a strategy that accurately locates and efficiently utilizes the cached content in VANETs with highly dynamic environments is still lacking. In this paper, we propose a novel NDN-based cache-aware adaptive forwarding (CAAF) strategy for VANETs. CAAF proactively predicts content locations and ensures reliable content retrieval by adaptively selecting forwarding nodes that prioritize fast delivery and stable transmission. Specifically, we design a content information table for each vehicle to record information about the Interest packets it receives. Furthermore, these tables are updated periodically across all vehicles and a prediction model is used to predict real-time in-network caching during the update interval. Subsequently, we execute a filter mechanism to sieve candidate forwarding vehicles that satisfy both the accessibility and stability requirements. These candidates are then evaluated using a multi-attribute decision-making method across diverse parameters to determine the optimal forwarding node. Our extensive simulation results demonstrate that the proposed CAAF outperforms the state-of-the-art forwarding strategy regarding content retrieval delay and Interest satisfaction ratio across diverse scenarios.

Multipath TCP (MPTCP) has gained popularity to enhance data transmission. From the last decade, proposed MPTCP enhancement schemes for congestion control, path management, and packet scheduling, have been used to benefit transmission performance. However, despite their efforts, they are exigent with a comprehensive understanding of real-world performance to guide the implementation of MPTCP to a more complex wireless network. To that end, we conduct a measurement-driven study of MPTCP enhancement schemes, providing insights and in-depth demonstrations of their performance with a comprehensive real-world platform. Our finding indicates that the enhancement schemes struggle to consistently maintain high performance at all times. One can achieve optimal efficiency in its specific scenarios, but suffers extreme degradation at times. To eliminate this transmission uncertainty in wireless networks, we further propose an adaptive control framework OLSch to integrate different schemes, emphasizing their strengths to provide consistently high performance. To be specific, OLSch is implemented with different scheduling schemes and leverages an online-learning-driven approach to choose one that best fits the current network conditions. Evaluations show that OLSch obviously improves the stability of transmission in harsh network scenarios, eliminates performance degradation, and increases the 95% tail throughput by 1.45×-2.39×.

Congestion control (CC) is crucial in data center networks (DCNs), providing high throughput and low latency transmission services for diverse applications. Existing CC schemes typically rely on iterative rate adjustment at ends, and suffer from performance issues such as slow convergence, throughput fluctuations, and fairness defects. Explicit rate control (ERC) promises to address these challenges by allowing switches to directly allocate rates for each flow, freeing senders from heuristic detection of available bandwidth. However, current ERC-based schemes employ inefficient feedback control to regulate the allocated rates, resulting in sub-optimal performance. In this paper, we propose RGuide, a fast and accurate CC scheme based on ERC. RGuide can calculate accurate fair share rates in real-time at switches with the consideration of low latency, and utilize the rate to guide host adjustments instead of the need for end-to-end iteration processes. We meticulously design the ERC trigger conditions, enabling switches to recognize the different congestion states of flows and rectify flows that deviate from the fair share rate at sub-RTT timescales. We conduct actual testbed experiments and extensive simulations to evaluate RGuide comprehensively. The results demonstrate the significant advantages of RGuide in terms of convergence speed, throughput stability, and fairness.

Quantum Key Distribution (QKD) technology leverages its inherent security advantages to ensure information-theoretic security for data transmission in networks. However, existing QKD networks still face critical challenges, including network congestion that stems from limited key resources and uneven resource allocation methods. Thus, in this paper, we focus on the issue of network congestion caused by bottleneck links and aim to achieve load balancing. Considering the limited key resources, we first introduce the key resource utilization ratio as an indicator of bottleneck links and formulate the resource allocation problem as an Integer Linear Programming (ILP) problem. To deal with the complexity of the ILP problem, especially in large-scale network scenarios, we design a heuristic algorithm that can obtain near-optimal solutions within polynomial time. Finally, we implement the proposed key resource allocation scheme in various real-world network topologies using a full-stack quantum network simulator. Compared to the existing algorithms, extensive results show that our method can reduce key resource consumption by up to 50% on bottleneck links and improve the robustness of QKD networks when facing burst quantum key agreement requests.

The entanglement transport protocol with a connection-oriented mode ensures the reliable distribution of remote entanglement by reserving dedicated resources on the selected path for users in a quantum network. In most existing protocols, entanglement generation and resource allocation operate with the support of global network-synchronized time slot. However, such synchronization in a large-scale quantum network is challenging, and the idealized time slot model is not conducive to continuous and concurrent requests. Meanwhile, different link performance in memory capacity and entanglement generation rate brings out critical issues, such as long distribution delay and low resource utilization, which has not been adequately addressed by the existing protocols relying on a heuristic adoption of TCP-like transport modes. In light of these observations, we propose a dynamic rate matching-based entanglement transport protocol called DRM-ETP, which allocates different memory units on each link along an entanglement distribution path. Moreover, DRM-ETP incorporates periodic forward and backward interactions to implement fine-grained feedback and a dynamic memory allocation based on priority differentiation. These mechanisms mitigate congestion and unfairness arising from resource contention among burst requests on shared links. Extensive simulation results demonstrate that DRM-ETP significantly outperforms the existing protocols in terms of throughput and resource utilization, with less distribution delay and higher fidelity. Moreover, DRM-ETP exhibits rapid and fair convergence when handling burst requests. Our study opens up possibilities for deploying efficient entanglement transport in quantum networks, thereby holding the promise of enhanced compatibility and novel functionality.

Quantum key distribution (QKD) networks can provide information-theoretically secure key distribution between distant end nodes through key relaying. In QKD networks, the key relay protocol is vital since it provides the coordination specifications between nodes for key relaying and thus directly determines the performance, especially as the network scale expands. However, most existing protocols adopt a synchronous contend-and-relay approach, where the contention and consumption of quantum keys occur simultaneously, neglecting the storable nature of quantum keys and presenting significant challenges in reliability and quantum key utilization. To tackle these challenges, in this paper, we propose an asynchronous key relay protocol (AKRP). AKRP considers the storable nature of quantum keys, and adopts a reserve-then-relay approach to achieve lossless and zero-queuing key relaying through precise management of quantum keys and requests. On this basis, to further improve the performance of the proposed AKRP, we design two enhanced mechanisms, i.e., collision detection and resolution mechanism and multipath routing extension. The former enhances the consensus efficiency of AKRP and provides fine-grained key utilization on each link, and the latter utilizes quantum keys on possible relay paths and thus effectively copes with quantum key exhaustion. By conducting extensive experiments on a semi-physical real QKD network platform, results demonstrate that AKRP is superior to existing schemes in terms of end-to-end key throughput, quantum key consumption, and relaying latency.

Real-time video streaming requires high throughput and low delivery time for enhanced user’s Quality of Experience (QoE). This motivates the use of multi-path transmission to improve performance. However, ensuring target performance within specified deadlines and priorities for video frames is particularly crucial for real-time communication and video quality, especially in scenarios with limited resources. To address this challenge, we propose a novel framework,vStreamPth, to guarantee high-quality real-time video streaming through multi-path transmission. For essential quality assurance,vStreamPthincorporates key requirement indicators that guide the transmission decisions of video frames across predefined multiple paths. In this framework, lightweight and robust decision-making is achieved through the collaboration of application-oriented and network-oriented data scheduling. Specifically, it employs robustness estimation to maintain the non-blocking delivery of frames, and further applies online fine-tuning to correct variations caused by changes in end-to-end transmission and multi-path network conditions. We implement a prototype ofvStreamPthin Linux user space and conduct a thorough evaluation. Experimental results demonstrate the absolute improvement ofvStreamPthin achieving high QoE and deadline satisfaction ratio compared to existing multi-path solutions.

A Link Flooding Attack (LFA) is a type of link-aimed Distributed Denial of Service (DDoS) attack that can overwhelm the Internet critical links to cut off connections with lots of low-rate, seemingly benign traffic. To defend against such threats, a promising solution involves mitigating the attack through load balancing. However, adaptive attacks employ two effective means to circumvent existing load balancing strategies. The first is the frequent changing of targets, known as rolling attacks. Rolling attacks exploit the delay between attack detection feedback and the mitigation of load balancing, depleting the defender’s resources. The second is the strategical selection of target links to create the worst-case scenario for load balancing algorithms. To address these challenges, we propose LinkDam. Specifically, LinkDam adopts a proactive approach by tracking and predicting potential victim links, providing defense against all targets of rolling attacks. Subsequently, we introduce a robust load balancing strategy to prevent the exploitation of selected link combinations. Additionally, LinkDam introduces a partial deployment approach, demanding a mere 40% of nodes be programmable (i.e., SDN nodes) while maintaining an acceptable 10% performance reduction from the maximum achievable. The experimental results indicate that LinkDam surpasses an 80% accuracy threshold, and exhibits a 57% higher tolerance to attack budgets compared to state-of-the-art solutions.

Link-flooding attacks (LFAs) pose a significant challenge to Internet availability by attacking critical network links with high volumes of seemingly legitimate traffic. In response, researchers have developed network topology obfuscation (NTO) to safeguard critical links. However, state-of-the-art NTO defenses are coarse-grained, leading to less efficient security and usability. In addition, once under attack, NTO schemes cannot identify the attacker’s bot and launch counter-defensive measures. To address these issues, this paper introduces SpiderNet, which employs advanced obfuscation techniques to secure critical links while using strategically created honeypot links for effective bot identification. When adversaries probe the network, SpiderNet captures their probing behavior and deliberately feeds back misinformation about honeypot links. By analyzing the attack patterns directed at these decoy targets, SpiderNet correlates them with adversarial probing activities to effectively identify the bots. Our experiments demonstrate that SpiderNet is more robust than state-of-the-art NTO schemes in terms of security and usability, while also being capable of identifying LFA bots.

Quantum networks, which work by establishing entanglement between distant quantum end nodes (known as end-to-end entanglement distribution), are the promising infrastructure for quantum applications. However, the inherent loss in quantum channels and quantum decoherence contribute to the scarcity of entanglement resources in quantum networks. Consequently, there is an inevitable gap between available entanglement resources and requests’ demands, significantly hindering concurrent end-to-end entanglement distributions. In this paper, we present NarrowGap, an end-to-end entanglement distribution design that can alleviate the negative impact of entanglement resource scarcity on the request service capability of quantum networks. At the heart of NarrowGap, the resource transfer scheme (RTS) is designed to transfer idle entanglement resources to boost the bottlenecks’ capacities based on the unique feature of entanglement swapping, thus narrowing the gap between available entanglement resources and requests’ demands for end-to-end entanglements. Besides, NarrowGap presents a resource allocation scheme (RAS) to guarantee fairness, considering both the success probability of end-to-end entanglement distribution and each request’s demand, to address resource competition in bottlenecks. Extensive simulations demonstrate that NarrowGap outperforms three representative schemes and can achieve more than twice the performance improvement in request service rate.

Named Data Networking (NDN) has emerged as a promising network paradigm for the future Internet. It revolutionizes content retrieval by decoupling it from specific locations, thereby overcoming the limitations of traditional IP addressing and significantly enhancing data delivery efficiency. Additionally, NDN’s stateful forwarding plane for routers enables robust aggregation of identical requests, bolstering resistance against Distributed Denial of Service (DDoS) attacks. Despite these advancements, NDN remains vulnerable to the Interest Flooding Attack (IFA), wherein excessive requests from attackers can compromise transmission quality by depleting router resources. In the current landscape, researchers have proposed various strategies aimed at improving the accuracy, timeliness, and cost-effectiveness of defenses against IFA attacks, presuming stable user behavior. However, several challenges persist in effectively countering IFA attacks, including the need to ensure transmission quality throughout users’ lifecycles, eliminate attacks at their origin, and adapt to dynamic user behaviors. In response to these challenges, this paper presents the Hybrid Proactive Reactive Defense Scheme (HPR-DS). HPR-DS employs distinct proactive and reactive modules for resource management and user behavior analysis, respectively, at intermediate and edge nodes. It employs time series analysis to gauge evolving resource requirements and maintains separate resource pools for each content. Additionally, HPR-DS utilizes multidimensional data clustering to accurately identify attackers. Simulation results demonstrate the superior performance of HPR-DS in safeguarding user transmission quality throughout the entirety of their lifecycle and in enhancing detection precision in dynamic network environments.

Most existing models for entity alignment tasks are based on a single pre-training mode. Through multiple experiments, it has been verified that a single pre-training model is no longer sufficient to meet the needs of current entity alignment tasks. Based on considerations of multiple pre-training models, this paper proposes an entity alignment method that utilizes multiple pre-training models. The purpose of this method is to address the limited accuracy in entity alignment tasks, with a particular focus on separately pre-training the embedding of entity attribute information and link relationship information for matching. To achieve the goal of improving entity alignment accuracy, this paper adopts joint alignment using pre-training with BERT and GloVe word embeddings. Experimental evaluations are conducted on the DBP15k dataset, and the results demonstrate that leveraging multiple pre-training models for attribute and relationship joint alignment can enhance model performance. The evaluation metrics of the model on three different language datasets, Hits@1 and MRR, are as follows: 0.899, 0.930, 0.964, and 0.932, 0.951, 0.975, respectively. These metrics indicate that the model performs well in aligning entities and outperforms current mainstream entity alignment methods.

Nowadays, Quantum Key Distribution (QKD) has garnered widespread attention due to its ability to provide symmetric secret keys with information-theoretic security in point-to-point communication. Additionally, key relay technology has been introduced to complete end-to-end key distribution between remote parties by consuming keys in the intermediate links. The routing problem of selecting paths for key relay technology becomes crucial as it directly impacts the network's performance. In this paper, we focus on addressing the routing problem for a specific scenario to serve applications with real-time requirements. Real-time is a critical necessity for supporting various applications, such as video chatting and calling. To satisfy real-time requirements and achieve Quality of Service (QoS) provision to guarantee the completion time, we introduce a distributed routing protocol called Distributed Routing Protocol Based on Key Reservation (Q-RoKR). It reserves keys in advance along the selected path, thereby satisfying real-time requirements. We also propose a priority-awareness mechanism to address resource competition and make efficient use of keys in links. Extensive experiments demonstrate that our protocol effectively meets the real-time requirements and significantly improves throughput. Furthermore, our key efficiency approaches the optimal bound when compared to other comparison schemes.

Load balancing in data center networks (DCNs) is a crucial and complex undertaking. Multi-path TCP (MPTCP) has been proposed as a cost-effective solution that aims to distribute workloads and improve network resource utilization. However, it can escalate buffer occupancy and undermine burst tolerance, particularly in scenarios involving incast short flows. To address these limitations, we propose a novel multi-path congestion control algorithm, RateMP, to optimize bandwidth utilization efficiency while ensuring burst tolerance in DCNs. RateMP employs a hybrid window and rate control loop with coupled gradient projection adjustment, enabling fast and fine-grained bandwidth allocation and accelerating convergence. Additionally, RateMP eliminates the limitation of cwnd with under-rate pacing to protect incast and busty flows. We prove that RateMP is Lyapunov stable and asymptotically stable, and show the improvement of RateMP through a kernel-based implementation and extended large-scale simulations. RateMP keeps high bandwidth utilization, cuts RTT by 2x and reduces flow completion times (FCT) by 45% in incast scenarios compared to existing algorithms.

As multiple datacenters are established in different geographical locations, some applications run on cross-datacenter networks. In order to improve the service quality, service providers establish dedicated links between datacenters to take advantage of the high performance of RDMA. However, existing RDMA congestion control algorithms are designed for intra-datacenter networks. Due to the long distance between data-centers, cross-datacenter networks have higher latency, which leads to long feedback loop that prevents timely adjustments at the traffic source. Meanwhile, excessive congestion signals are generated due to untimely adjustments, which makes existing RDMA congestion control algorithms unable to accurately deal with congestion like in cross-datacenter networks. In addition, the long-haul link connecting datacenters has large bandwidth delay product (BDP), which brings great buffer pressure to switches. In this paper, link-segmented congestion control (LSCC) is proposed to avoid congestion through segmented link control. LSCC builds a segmented feedback loop between egress switches connecting to the long-haul link, which provides timely congestion feedback and greatly reduces the buffer pressure of switches. Evaluations based on DPDK implementation and large-scale simulation show that LSCC can reduce the average flow completion time (FCT) by 30%-65% and 31%-56% in realistic datacenter load and cross-datacenter load, respectively.

Remote entanglement distribution in an efficient and reliable manner, especially in the context of a large-scale quantum network with multiple requests, remains an unsolved challenge. The key difficulties lie in achieving spontaneous and precise control over the entanglement distribution procedure, as multiple nodes need to reach a consensus on how to perform it. From the network aspect, allocating link-layer entangled pairs as resources to achieve high efficiency is also challenging. To address these issues, we propose a decentralized Reliable Entanglement Distribution Protocol (REDP) for large-scale networks. The protocol operates in a Forward-Backward Propagation (FBP) manner, where consensus is reached hop-by-hop and disseminated to all nodes on the path. We further use probabilistic analysis and quasi-static modeling to seek the fairness and efficiency of the network based on the above transmission model. Accordingly, we introduce a Source Window Strategy (SWS) and an Entanglement Allocation Strategy (EAS) to assign sending windows and allocate resources for multiple requests, ensuring a high level of fairness and efficiency from a network perspective. Through systematic simulations involving both classical and quantum communication protocols, we demonstrate that REDP outperforms existing approaches in terms of fairness, throughput, and fidelity performance.

The metaverse is at the forefront of the next-generation internet application, where billions of users seamlessly immerse themselves in a hybrid reality of physical-virtual worlds and switch between virtual environments thanks to reliable resource allocation and synchronization. However, the exponential growth of users and computationally intensive applications make joint optimization of multiple indicators challenging. Therefore, predicting user behavior is pivotal in assisting the optimization process. Although graph neural networks have demonstrated remarkable performance in traffic prediction, most existing schemes link nodes based on their distances and require significant computational resources, limiting their generalization and deployment in the metaverse. To solve this problem, we propose an efficient Spatio-temporal Identity Multi-graph convolutional network Framework (SIMF) for application-level traffic prediction in the metaverse. In the SIMF, we design a spatio-temporal embedding layer and multi-graph convolutional module to jointly capture spatio-temporal correlations among nodes (avatars) and reduce the dependence on topology information, which is more consistent with the real relationship between avatars in the metaverse. We conduct extensive experiments to evaluate the SIMF, which show that our proposed framework achieves superior accuracy even without graph information while maintaining low time complexity, making it suitable for traffic prediction in the metaverse.

The utilization of Multi-path TCP (MPTCP) has been demonstrated to provide superior transport-layer support for data center networks (DCNs) due to its exceptional resource utilization and load-balancing capabilities. However, the substantial path diversity can make it challenging to utilize network resources to their full potential in DCNs. This paper focuses on studying the resource allocation issue of MPTCP from a resource optimization perspective. Based on theoretical analysis, we propose FMPTCP, which uses a feedback-based congestion control algorithm (FCC) and a feedback-based multi-path routing algorithm (FMP) to jointly achieve high bandwidth utilization and low round-trip time (RTT) in DCNs. The FCC algorithm utilizes probabilistic explicit congestion notification (ECN) to provide feedback on path congestion degree, and uses a gradient descent method to adjust the congestion window for optimal resource utilization and load balancing under a fixed routing topology. On the other hand, the FMP algorithm employs a hop-by-hop feedback mechanism to notify in-network congestion and path delay information, allowing for transparent multi-path routing for MPTCP flows. Our extensive simulations demonstrate that FMPTCP enables effective network resource utilization, which not only enhances overall throughput but also reduces transmission latency for DCNs.

Searchable Symmetric Encryption (SSE) is a valuable cryptographic tool that allows a client to retrieve its outsourced data from an untrusted server via keyword search. Initially, SSE research primarily focused on the efficiency-security trade-off. However, in recent years, attention has shifted towards range queries instead of exact keyword searches, resulting in significant developments in the SSE field. Despite the advancements in SSE schemes supporting range queries, many are susceptible to leakage-abuse attacks due to volumetric profile leakage. Although several schemes exist to prevent volume leakage, these solutions prove inefficient when dealing with large-scale datasets. In this paper, we highlight the efficiency-security trade-off for range queries in SSE. Subsequently, we propose a volume-hiding range SSE scheme that ensures efficient operations on extensive datasets. Leveraging the order-weighted inverted index and bitmap structure, our scheme achieves high search efficiency while maintaining the confidentiality of the volumetric profile. To facilitate searching within large-scale datasets, we introduce a partitioning strategy that divides a broad range into disjoint partitions and stores the information in a local binary tree. Through an analysis of the leakage function, we demonstrate the security of our proposed scheme within the ideal/real model simulation paradigm. Our experimental results further validate the practicality of our scheme with real-life large-scale datasets.

Set-valued data are commonly used to represent subsets of a universal set and are frequently utilized in online services, such as online shopping preferences, website browsing records, and recently visited places. By collecting set-valued data from users, service providers can perform statistical analysis to obtain a joint distribution of service usage data and subsequently learn the association between different kinds of set-valued data to improve the quality of service. However, collecting set-valued data raises privacy concerns about the potential misuse of records to infer individuals’ identities and preferences. Although some privacy-preserving aggregation mechanisms for set-valued data have been proposed, they have not yet achieved joint distribution analysis with high accuracy. In this paper, we propose a joint distribution analysis method for set-valued data with local differential privacy (LDP). We design a scalable perturbation mechanism under$\epsilon $-LDP by limiting the range of users’ responses in the collection process and cyclically shifting the set-valued data in an encoded uniform format, ensuring that the size of the universal set does not influence the accuracy of the results. Based on the perturbation method, we develop an analysis method to efficiently obtain association information between two sets. By performing specific bitwise operations on the perturbed data matrices, the computational overhead is linear with respect to the cardinality of the item set. In addition to theoretically analyzing the error bound and proving the security of our work, extensive experimental results on synthetic and real-world datasets demonstrate that our scheme achieves better utility than existing state-of-the-art approaches.

The partial ordered data is typically used to describe the order of some elements within a set, and it widely exists in various fields, such as clinical investigations, preference ranking and voting. However, the collection of partial ordered data poses critical privacy concerns about abusing records to infer individuals’ identities and preferences. To solve this problem, this paper proposes a distribution analysis method for partial ordered data with local differential privacy (LDP). The private information of partial ordered data includes whether an element is associated with a partial order relation and either a relation is preceding or succeeding. To preserve privacy, we perturb partial ordered data by randomly responding raw data or the data with mapped elements. This makes it impossible to distinguish whether any element has a partial order relationship with other elements and what kind of partial order relationship exists. To maintain the logicality of partial ordered data, we utilize the transitivity of partial orders to distinguish between direct and indirect orders in the perturbation. The inherent properties of partial orders are still satisfied after perturbation, which reduces the possibility of servers inferring the raw data through logical errors. Moreover, we theoretically analyze the error bound and prove the security of our work. Extensive experimental results on synthetic and real-world datasets demonstrate that our scheme achieves better utility than existing state-of-the-art approaches.

Sharding significantly enhances blockchain scalability by dividing the entire network into smaller shards that reach consensus and process transactions in parallel. Nevertheless, two new issues emerge with the adoption of sharding. One issue involves the shrinking size of consensus groups, which leads to vulnerability in consensus. Most existing works introduce periodic shuffle mechanisms to mitigate this problem. Nevertheless, these measures necessitate stronger security assumptions and can only offer a probabilistic assurance of consensus security. Another issue is the challenge in processing cross-shard transactions posed by the isolation of shards. Existing approaches utilize two-phase commit (2PC) or relay transaction mechanisms to handle cross-shard transactions. However, these approaches are vulnerable to double cross-shard attacks from malicious shards and are unable to achieve immediate atomicity. In this paper, to address the vulnerable consensus issue and achieve instant atomicity in cross-shard transactions, we design a hybrid consensus mechanism that embeds a lightweight global consensus into parallel intra-shard consensus processes. The global consensus allows all consensus nodes to jointly process cross-shard transactions, achieving cross-shard transaction instant atomicity. It also records shard snapshots to facilitate shard auditing to defend against malicious shards. Furthermore, we consider the performance of the proposed mechanism, and design a dynamic shard management mechanism. The dynamic shard management mechanism reduces transaction congestion and maintains an appropriate number of shards based on the system’s state. We conduct analyses of potential attacks and prove that our approach ensures safety and liveness even in the presence of malicious shards. We also evaluate the performance of our system and compare it with both non-sharded and classic blockchain-sharding systems. The evaluation results demonstrate the efficacy of our approach in dealing with transaction congestion while astutely controlling the number of shards.

With the ever-growing interest in modeling complex graph structures, graph neural networks (GNN) provide a generalized form of exploiting non-Euclidean space data. However, the global graph may be distributed across multiple data centers, which makes conventional graph-based models incapable of modeling a complete graph structure. This also brings an unprecedented challenge to user privacy protection in distributed graph learning. Due to privacy requirements of legal policies, existing graph-based solutions are difficult to deploy in practice. In this paper, we propose a privacy-preserving graph neural network based on local graph augmentation, named LGA-PGNN, which preserves user privacy by enforcing local differential privacy (LDP) noise into the decentralized local graphs held by different data holders. Moreover, we perform local neighborhood augmentation on low-degree vertices to enhance the expressiveness of the learned model. Specifically, we propose two graph privacy attacks, namely attribute inference attack and link stealing attack, which aim at compromising user privacy. The experimental results demonstrate that LGA-PGNN can effectively mitigate these two attacks and provably avoid potential privacy leakage while ensuring the utility of the learning model.

Federated Learning (FL) enables multiple distributed clients to collaboratively train a model with owned datasets. To avoid the potential privacy threat in FL, researchers propose the DP-FL strategy, which utilizes differential privacy (DP) to add elaborate noise to the exchanged parameters to hide privacy information. DP-FL guarantees the privacy of FL at the cost of model performance degradation. To balance the trade-off between model accuracy and security, we propose a differentially private federated learning scheme with an adaptive noise mechanism. This is challenging, as the distributed nature of FL makes it difficult to appropriately estimate sensitivity, where sensitivity is a concept in DP that determines the scale of noise. To resolve this, we design a generic method for sensitivity estimates based on local and global historical information. We also provide instances on four commonly used optimizers to verify its effectiveness. The experiments on MNIST, FMNIST and CIFAR-10 convincingly prove that our proposed scheme achieves higher accuracy while keeping high-level privacy protection compared to prior works.

As a promising complement to terrestrial cellular networks, satellite networks have recently drawn increasing attention, offering seamless coverage cost-effectively. However, with the rapidly increasing users' demand for multimedia content, how to achieve efficient content transmission seamlessly becomes a critical but knotty problem. To provide an efficient solution from the routing perspective, in this paper, we propose an opportunistic content-aware routing scheme. Our scheme combines the features of in-network caching and content awareness of information-centric networking (ICN) architecture. The basic idea of the proposed scheme is to sense users' requests and find the optimal route solution with the largest potential gain. Moreover, considering the limitation of real-time signaling collection in satellite networks, we design a cached content prediction method. The method is capable of inferring the probability of content being cached based on historical popularity information, providing essential information for measuring potential gains. Extensive simulation results demonstrate that the proposed opportunistic content-aware routing scheme outperforms baseline approaches with significantly reduced delay and traffic consumption.

Nowadays, Remote Direct Memory Access (RDMA) is gaining popularity in data centers for low CPU overhead, high throughput, and ultra-low latency. As one of the state-of-the-art RDMA Congestion Control (CC) mechanisms, HPCC leverages the In-band Network Telemetry (INT) features to achieve accurate control and significantly shortens the Flow Completion Time (FCT) for short flows. However, there exists redundant INT information increasing the processing latency at switches and affecting flows’ throughput. Besides, its end-to-end feedback mechanism is not timely enough to help senders cope well with bursty traffic, and there still exists a high probability of triggering Priority-based Flow Control (PFC) pauses under large-scale incast. In this paper, we propose a Congestion-Aware (CA) control mechanism called CACC, which attempts to push CC to the theoretical low INT overhead and PFC pause delay. CACC introduces two CA algorithms to quantize switch buffer and egress port congestion, separately, along with a fine-grained window size adjustment algorithm at the sender. Specifically, the buffer CA algorithm perceives large-scale congestion that may trigger PFC pauses and provides early feedback, significantly reducing the PFC pause delay. The egress port CA algorithm perceives the link state and selectively inserts useful INT data, achieving lower queue sizes and reducing the average overhead per packet from 42 bytes to 2 bits. In our evaluation, compared with HPCC, PINT, and Bolt, CACC shortens the average and tail FCT by up to 27% and 60.1%, respectively.

Entanglement distribution between distant quantum nodes plays an essential role in realizing quantum networks’ capabilities. In addition to path selection, remote entanglement distribution involves two pivotal quantum operations, i.e., entanglement generation and entanglement swapping. The existing studies mainly adopt two methods, i.e., Tell-and-Generation (TAG) and Tell-and-Swapping (TAS), to manage these two quantum operations on a selected path. However, both methods fatally introduce redundant stop-and-wait processes, which are detrimental to the performance of remote entanglement distribution in terms of latency and fidelity. To achieve low-latency and high-fidelity entanglement distribution between far-off quantum nodes, we propose a segment-based method consisting of an entanglement generation algorithm and a segment design to diminish the unnecessary stop-and-wait processes. The entanglement generation algorithm adopts a concurrent design to establish entanglement links using the one-demand generation model, thus effectively reducing waiting time compared to hop-by-hop and parallel designs. The segment design is proposed to split a long-distance path into multiple short-haul segments with the similar ability to swap entanglement, and these segments build multi-hop entanglement connections in parallel. Extensive simulations show that the segment-based method significantly outperforms the existing methods, including TAG and TAS, in entanglement distribution latency and effectively mitigates fidelity attenuation.

With the development of datacenter networks (DCNs) towards high bandwidth and low latency, the demands of high-level datacenter applications are heading towards high performance and high reliability, which makes traffic congestion one of the most notable problems in DCNs and brings new challenges to transport protocols. Proactive transport protocols are gaining prevalence due to their ability to provide accurate feedback and precise end-to-end control, while multipath transmission is having a broader application space in the multi-path topology of large-scale DCNs. However, these advanced transport protocols aim to improve their performance by addressing some specific congestion problems, but fail to handle multiple congestion problems caused by incast, high workload and load imbalance. Their performance in terms of flow completion time (FCT), delay, robustness, and balance still has room for further improvement. In this paper, we propose ProactMP, a novel proactive multipath transport protocol for further improvement of datacenter communications. ProactMP utilizes the rich resources of parallel paths in modern DCN and spreads the load across available network paths to improve network efficiency. ProactMP deploys a credit-based bandwidth allocation strategy to achieve low delay and zero packet loss, and overcommits receiver downlinks to ensure high link utilization. We have implemented ProactMP in the Linux system. Our testbed experiments show that ProactMP outperforms the TCP variants, MPTCP variants and a leading proactive transport protocol in FCT, link utilization, fairness and latency.

The quantum network that allows users to communicate in a quantum way will be available in the foreseeable future. The network capable of distributing Bell state entangled pairs faces many challenges due to entanglement decoherence and limited network performance, especially when the network scale is enormous. Many entanglement distribution protocols have been proposed so far, and most of them are in a centralized and synchronized manner, which may be infeasible in large-scale networks. As such, in this paper, we propose a full spontaneous version of quantum networks in which the quantum nodes autonomously manage multiple entanglement distribution requests. However, one major issue is that quantum nodes have little knowledge about the network, especially the congestion (e.g., some nodes may have no usable quantum memories). We present a routing algorithm to adaptive evaluate the congestion on the neighbor nodes to avoid potential congestion. We use SimQN, the new network layer simulation platform built by our research team, to evaluate our proposed design. The result demonstrates that it can adapt to changes in network resources and reduce the drop rate that eventually leads to a higher entanglement distribution rate but remains fair for multiple requests to use the network resources fairly and achieve a more balanced throughput.

Named Data Networking (NDN) stands out as a promising Information Centric Networking architecture capable of facilitating large-scale content distribution through in-network caching and location-independent data access. However, attackers can easily inject poisoned content into the network, called content poisoning attacks, which leads to a substantial deterioration in user experience and transmission efficiency. In existing schemes, routers fail to determine the contamination source of received poisoned content, leading to the inability to accurately identify attacker nodes. Besides, attackers’ dynamic behaviors and network instability could disrupt identification results. In this paper, we propose a Secure and Lightweight scheme against content poisoning attacks based on Probing (SLP), where a proactive and reliable probing protocol is designed to identify adversaries quickly and precisely. In SLP, a router sends specifically chosen interest packets to probe a suspicious node, so that the returned corresponding content can straightly reflect its trustworthiness without other nodes’ interference. In addition, a hypothesis testing algorithm is developed to analyze the returned content, which can exclude the impact of transmission errors and adapt to dynamic attackers. Moreover, we utilize users’ feedback to avoid unnecessary probing costs on unaffected routers, with its reliability guaranteed by an efficient cuckoo-filter-based feedback validation mechanism. Security analysis shows that SLP achieves resistance against content poisoning attacks and malicious feedback. The experimental results demonstrate that SLP makes users hardly be affected by attacks and brings in only slight overhead.

Named Data Networking (NDN), with a receiver-driven connectionless communication paradigm, naturally supports content delivery from multiple sources via multiple paths. In a dynamic environment, sources and paths may change unexpectedly and are uncontrollable for consumer, which requires flexible rate control and real-time multi-path management, still lacking investigations. To address this issue, we propose an Adaptive Multi-source Multi-path Congestion Control (AMM-CC) scheme based on online learning. AMM-CC explores source/path distribution with continuous micro-experiments and abstracts the empirically experienced performance by meticulously designed two-level utility functions. Specifically, AMM-CC enables each consumer to optimize a local transmission-level utility function that fuses multi-source characteristics, including congestion level and source weights. Then, a sub-gradient descent method is designed to adjust transmission rate adaptively and achieve fine-grained control. Moreover, AMM-CC coordinates consumer with the forwarding module to ensure efficient and on-time multi-path management. It enables consumer to determine congestion gap among multiple paths by a path-level utility that sensitively captures changes and congestion on each path. Then, consumer further notifies the forwarding module in achieving precise traffic transferring. We conducted comprehensive evaluations in dynamic scenario with various content distribution using the NDN simulator, ndnSIM. The evaluation results demonstrate that AMM-CC can adapt to flexible content acquisition from multi-sources and significantly improve bandwidth utilization of multi-path compared with state-of-the-art schemes.

To improve the security of crowdsourcing, existing studies introduce blockchain to ensure reliability and utilize cryptography (e.g., encryption and zero-knowledge proof) to protect data privacy. Nevertheless, the crowdsourcing process may involve sensitive identity information, and identity protection remains unresolved during stages such as data submission and correct payment. Especially, when workers invoke a smart contract to submit data, it inevitably exposes their identities. Identity disclosure significantly impacts the credibility of crowdsourcing platforms. Existing solutions suggest solving the problem through anonymous token contracts such as Zether. However, tokens can easily result in fund freezing or extra information leakage. Moreover, invoking the contract to submit data will still disclose workers' blockchain accounts. To tackle the identity protection issue, in this paper, we propose AcCrowd which achieves worker anonymity and payment correctness in crowdsourcing systems atop blockchain. We first design a verifiable proxy submission mechanism for data submission, enabling workers to invoke contracts without disclosing their accounts. Then, we introduce and improve the BlockMaze architecture to replace previous anonymous token-based methods, enhancing privacy and flexibility. Besides, we designed a revealed payment mechanism that utilizes an adaptor signature to bind data reveal and reward payment together, simultaneously protecting the requester and worker. Our security and performance evaluations demonstrate the security and practicability of AcCrowd.

Cloud-based Support Vector Machine (SVM) is a powerful technique for decision-assistance service. However, training data and models of SVM contain sensitive information, outsourcing these data to clouds may lead to severe privacy leakage. To address the privacy issue of SVM, many works focus on outsourced privacy-preserving SVM training. However, these works cannot support training SVM with non-linear kernel. This limitation renders these methods impractical for real-world scenarios where datasets are usually non-linear. In this paper, we propose a privacy-preserving SVM training scheme with support to non-linear kernel. Specifically, we redesign a gradient descent for SVM with kernel, which supports efficient kernel SVM training. We design basic computation protocols using secret sharing to achieve privacy preservation in outsourced SVM training. Additionally, we construct an incremental learning approach to support continuous data inflow. This approach is capable of reducing computational overhead significantly in practical scenario. Security analysis and efficiency evaluation illustrate that our proposed scheme achieves superior accuracy and less computation overhead compared to existing works, while also preserving privacy of training data and trained SVM model.

Graph Neural Networks (GNNs) as an emerging technique have shown excellent performance in a variety of fields, such as social networks and recommendation systems. However, GNNs may have to overcome privacy concerns as large amounts of information about their training datasets may be compromised. In this paper, we develop a privacy-preserving GNN to enforce privacy preservation, which utilizes a private Functional Mechanism (FM) to train the learning model. This mechanism perturbs the polynomial approximation of the objective function to enforce Differential Privacy (DP) in the GNN model. We show that our method can maximize the accuracy of the results with comparable prediction power to the unperturbed results while satisfying the privacy guarantees.

With potential advantages over TCP/IP for content delivery, mobility, and security, Named Data Networking (NDN) has become a promising architecture for the next-generation network. However, its poor performance in reliable transmission is still an unsolved problem. Many existing schemes in NDN employ inaccurate retransmission timeouts calculated with RTTs from diverse content sources to detect packet loss, which is lagging and may deteriorate transmission performance. Besides, after identifying the loss, the consumer costly resends the request to recover it, further increasing recovery time. In this paper, we propose an in-network Proactive Loss Recovery (PLR) scheme, which provides an efficient in-network method for timely detection and proactive recovery of lost packets. Deployed on each router, PLR detects the loss by monitoring queue status and sends high-priority explicit feedback to notify consumers of loss events timely. Meanwhile, lost packets are stored in each router's cache and will be retransmitted at an adaptive rate based on the detected remaining bandwidth. The simulation shows that PLR can vastly reduce the number of retransmissions on consumers, and the content completion time can be decreased by up to 21.8% compared with the baseline.

In data center networks (DCNs), numerous congestion control schemes utilize explicit congestion notification (ECN) to achieve low average queue delay. Such schemes generally mark packets based on the current queue length exceeding a marking threshold. However, due to the delay of ECN feedback, the queue length may further increase before the congestion notification is delivered to senders, which may lead to uncontrollable maximum queue length when bursts occur. In this paper, we propose an early ECN marking scheme based on prediction, E-ECN, to control the maximum queue length in DCNs. E-ECN uses predicted queue length rather than the current to indicate congestion with an advance time which offsets the hysteresis of ECN. We theoretically and experimentally demonstrate that early marking does not impact the throughput with appropriate selection of the advance time, and we provide guidelines for the selection in DCNs. Our simulation results show that E-ECN achieves shorter average queue delay and controllable maximum queue length in general with a bandwidth utilization guarantee. E-ECN greatly reduces queue overflow and improves the robustness of DCNs.

With Remote Direct Memory Access (RDMA) extended to commercial Ethernet, modern Data Center Networks (DCNs) carry both traditional TCP and RDMA, to support diversified application requirements. RDMA flows are guaranteed lossless transmission through Priority-based Flow Control (PFC), while TCP flows are generally lossy traffic with packet loss. However, TCP is prone to excessively occupy the shared buffer, frequently triggering PFC pause frames and overflows at switches, damaging the performance of RDMA, which expose the vulnerability of existing buffer management policies. In this paper, we propose L2BM, a buffer management algorithm for shared-memory switches to support dynamic hybrid traffic. L2BM utilizes the average occupying time of packets in each ingress queues, to perceive the congestion states timely at ingress ports, allocating the ingress pool fairly and flexibly. Based on the perception, L2BM allocates more buffer for ingress queues with faster drain and lower congestion degrees to absorb micro-burst and reduce pause frames, less buffer for long-occupied queues to prevent excessive injection. As a result, L2BM achieves low tail latency, high burst traffic absorption capacity and low buffer occupancy. Evaluations show that L2BM enable to cut the tail latency of RDMA traffic by 50% at high workloads, reduce the buffer occupancy by 40% and decrease average query delay by 57%, while ensuring few PFC pause frames and maintaining good performance of TCP flows.

The immutability of blockchains is an important security feature, but applications and studies have shown that it poses some problems. For instance, harmful information and vulnerable programs can be permanently stored on public blockchains such as Bitcoin and Ethereum, causing continuous damage. Therefore, researchers proposed the redactable blockchain to delete or modify those harmful data. Existing schemes usually adopt the Chameleon hash function (CHF) to keep the block hash unchanged so that other blocks remain unaffected. However, these schemes suffer from two security problems: (i) (unknown-version) users cannot determine whether a received block is the up-to-date version because different versions have the same hash; and (ii) (lazy-redaction) miners have no motivations to update historical blocks, causing continuous spreading of data which should have been discarded. To solve the problems, we propose SEREDACT, a secure and efficient redactable blockchain protocol with verifiable modification. Specifically, we design a Merkle tree-based verification mechanism with efficient dynamic updating that supports quick version checks and forcible modification updates, and further integrate it with restricted redaction policies to guarantee security. Our security and performance analyses show that SEREDACT has adequate security as a redactable blockchain protocol and retains close efficiency compared with the immutable blockchain.

The distribution of traffic shows a characteristic of different flow sizes in Data Center Networks (DCNs), which requires diverse demands for data transmission. However, most existing congestion control schemes treat all the flows equivalently and have a consistent control logic, which cannot meet the diverse demands of applications. In this paper, we propose FACC, a flow-size-aware congestion control scheme. In FACC, we design a distinguished congestion control logic to assign the transmission demands of different kinds of flows in the network. To meet the diverse demands, FACC provides an adaptable congestion window (cwnd) adjustment by assigning customized weights with a well-designed flow-size-aware reward function. Simulation results show that FACC can reduce the average FCT and the 99- th percentile FCT slowdown of short flows by 35% and 23% compared to the state-of-the-art congestion control schemes in DCNs, respectively.

As a promising implementation of Information Centric Networking, Named Data Networking (NDN) can facilitate content distribution with in-network caching and location-independent data access. However, the reliance on caches makes NDN vulnerable to content poisoning attacks, which waste network resources and decrease transmission efficiency. Most mitigating schemes follow the pattern that each content is repeatedly verified individually in each router and all producers have the same status, which wastes computation resources and degrades network performance. In this paper, we propose a Reputation-based Probabilistic Batch Verification (RPBV) scheme to address the issue, in which producers’ reputation is estimated according to verification results to distinguish different producers. We provide an adaptive probabilistic verification method based on reputation to avoid a lot of unnecessary verification operations. At the same time, we adopt an efficient batch verification algorithm to simultaneously verify multiple content, which reduces the overhead greatly. With the above mechanisms implemented only on the edge router to avoid repeated verification, we provide an optional probabilistic verification method on intermediate routers to strengthen the security. The extensive simulations show that RPBV achieves much lower computation overhead and shorter content retrieval time than the traditional schemes.

As the demand for Internet of Things (IoT) technologies continues to grow, IoT devices have been viable targets for malware infections. Although deep learning-based malware detection has achieved great success, the detection models are usually trained based on the collected user records, thereby leading to significant privacy risks. One promising solution is to leverage federated learning (FL) to enable distributed on-device training without centralizing the private user records. However, it is non-trivial for IoT users to label these records, where the quality and the trustworthiness of data labeling are hard to guarantee. To address the above issues, this paper develops a semi-supervised federated IoT malware detection framework based on knowledge transfer technologies, named by FedMalDE. Specifically, FedMalDE explores the underlying correlation between labeled and unlabeled records to infer labels towards unlabeled samples by the knowledge transfer mechanism. Moreover, a specially designed subgraph aggregated capsule network (SACN) is used to efficiently capture varied malicious behaviors. The extensive experiments conducted on real-world data demonstrate the effectiveness of FedMalDE in detecting IoT malware and its sufficient privacy and robustness guarantee.

With the coming of the Internet of Things (IoT) era, malware attacks targeting IoT networks have posed serious threats to users. Recently, the emerging of edge computing have paved the way for new data processing paradigms in IoT networks, but it is still a challenge for deploying malware detection systems on the IoT devices. This paper develops an IoT malware detection system based on trust hybrid user-edge evaluation, namely MDHE. This system decomposes a large and complex deep learning model into two parts, which are deployed on edge servers and end devices, respectively. Specifically, a trust evaluation mechanism is used to select the trusted devices to participate the model training. Moreover, we develop a private feature generation that leverages a graph mining technology to extract the subgraph features, which then are perturbed by leveraging the differential privacy technology to prevent user privacy from leaking. Finally, we reconstruct the perturbed features on edge server, and propose a Capsule Network (CapsNet) to identify malware. Experimental results show that MDHE can effectively detect malware. Specifically, it can reduce sensitive inference while maintaining the utility of data.

Federated learning (FL) is a popular collaborative distributed machine learning paradigm across mobile devices. However, practical FL over resource constrained mobile devices confronts multiple challenges, e.g., the local on-device training and model updates in FL are power hungry and radio resource intensive for mobile devices. To address these challenges, in this paper, we attempt to take FL into the design of future wireless networks and develop a novel joint design of wireless transmission and weight quantization for energy efficient FL over mobile devices. Specifically, we develop flexible weight quantization schemes to facilitate on-device local training over heterogeneous mobile devices. Based on the observation that the energy consumption of local computing is comparable to that of model updates, we formulate the energy efficient FL problem into a mixed-integer programming problem where the quantization and spectrum resource allocation strategies are jointly determined for heterogeneous mobile devices to minimize the overall FL energy consumption (computation + transmissions) while guaranteeing model performance and training latency. Since the optimization variables of the problem are strongly coupled, an efficient iterative algorithm is proposed, where the bandwidth allocation and weight quantization levels are derived. Extensive simulations are conducted to verify the effectiveness of the proposed scheme.

Recent advance of Intelligent Reflecting Surface (IRS) introduces a new dimension for secure communications by reconfiguring the transmission environments. In this paper, we devise a secure transmission scheme for multi-user Mutiple-Input Single-Output systems by leveraging multiple collaborative IRSs. Specifically, to guarantee the worst-case achievable secrecy rate among multiple legitimate users, we formulate a max-min problem that can be solved by an alternating optimization method to decouple it into multiple sub-problems. Based on semidefinite relaxation and successive convex approximation, each sub-problem can be further converted into convex problem and easily solved. Extensive experimental results demonstrate that our proposed scheme can adapt to complex scenarios for multiple users and achieve significant gain in terms of achievable secrecy rate. Compared to the traditional single IRS scheme, the proposed scheme can achieve better performance at the range of 2.4-6.4 bps/Hz with the increase in the number of reflecting elements in the multi-user scenarios. We also evaluate the gap between the secrecy rate for our proposed scheme under continuous phase shift/amplitude control and discrete phase shift/amplitude control, and our results show that the secrecy rate obtained from discrete approximation method converges to that achieved from the proposed scheme when increasing the discretization granularity.

It is often observed that people's data are scattered across various organizations and these data can be used to generate usable insights when integrated. However, data fusion from multiple data hosting sites could put user privacy at risk albeit with some security mechanisms. This paper studies a data-analytic platform that adopts the Kulldorff scan statistic to determine infectious-disease spatial hotspots by integrating and analyzing users’ health and location data that are respectively stored in two clouds. We examine the privacy threats to this platform which has a key-oblivious inner product encryption (KOIPE) mechanism in place to ensure that only coarse-grained statistical data is revealed to the honest-but-curious (HbC) entity. To protect user privacy from the designed inference attack, we exploit a game-theoretic approach to incentivize users to form anonymous clusters with a quantitative privacy guarantee. We conduct extensive simulations based on real-life datasets to demonstrate the performance of our scheme in terms of design overhead and privacy level.

Given the distributed nature of the massively connected “Things” in IoT, IoT networks have been a primary target for cyberattacks. Although machine learning based network intrusion detection systems (NIDS) can effectively detect abnormal network traffic behaviors, most existing approaches are based on a large amount of labeled traffic flow data, which hinders their implementation in the highly dynamic IoT networks with limited labeling. In this paper, we develop a novel Flow Topology based Graph Convolutional Network (FT-GCN) approach for label-limited IoT network intrusion detection. Our main idea is to leverage the underlying traffic flow patterns,$i.e.$, the flow topological structure, to unlock the full potential of the traffic flow data with limited labeling, where the FT-GCN will be deployed at the edge servers in IoT networks to detect intrusions via software defined network technologies. Specifically, FT-GCN first takes the time correlation of traffic flows into account to construct an interval-constrained traffic graph (ICTG). Besides, a Node-Level Spatial (NLS) attention mechanism is designed to further enhance the key statistical features of traffic flows in ICTG. Finally, the combined representation of statistical flow features and flow topological structure are learned by the cost-effective Topology Adaptive Graph Convolutional Networks (TAGCN) for intrusion identification in IoT networks. Extensive experiments are conducted on three real-world datasets, which demonstrate the effectiveness of the proposed FT-GCN compared to state-of-the-art approaches.

The quantum network is designed to connect numerous quantum nodes and support various ground-breaking quantum applications. Most of these applications require communicating parties to share entangled pairs. Therefore, entanglement routing, a technology distributing entangled pairs between distant quantum nodes, plays a vital role in realizing quantum networks’ capability. However, due to the limitation of quantum memory size and quantum decoherence, the entangled pairs shared by adjacent quantum nodes can hardly satisfy concurrent entanglement routing requests, thus leading to severe network congestion. In this paper, we propose a novel congestion mitigation (CM) scheme to tackle such bottleneck problems. The basic idea of CM is to “recycle” idle link-level entanglement resources from well-resourced links to bottleneck links utilizing a unique enabling technology of quantum networks, called entanglement swapping. CM can increase the capacity of each bottleneck link, thus overcoming resource limitations to improve resource utilization and network throughput. To complete our work, we also propose a swapping-based entanglement routing design, including path selection and resource allocation algorithms. Extensive simulations show that our design can significantly alleviate network congestion and improve the request service rate of quantum networks compared to the traditional entanglement routing designs.

Data Center Networks (DCNs) suffer from synchronized bursts for network topology and parallel applications, leading to buffer overflows at switches and increasing network delay. To overcome this problem, some congestion control algorithms like DCTCP use Explicit Congestion Notification (ECN) to notify in-network congestion and reduce switch buffer occupancy. However, the traditional Additive Increase Multiplicative Decrease (AIMD) method causes high fluctuation of round-trip time (RTT) in DCNs. Some intelligent congestion control algorithms designed for Internet can achieve great flexibility, but are not applicable in DCNs for a lack of accurate congestion feedback. In this paper, we analyze the deficiencies of utilizing RTT as congestion signals and the applicability of learning algorithms in DCNs. Then, we propose DECC, a smart TCP congestion control algorithm for DCNs, which combines Deep Reinforcement Learning (DRL) with ECN to achieve high bandwidth utilization as well as low queuing delay. DECC fully utilizes precise in-network feedback and formulates several QoS requirements to a multi-objective function. Meanwhile, it decouples cwnd adjustment with DRL decision making to gradually learn the optimal congestion control policy in real-time. We evaluate the performance of DECC in various scenarios. Simulation results show that DECC can reduce the queue length at bottleneck switches by more than 50% compared to DCTCP, while maintaining high bandwidth utilization and reducing Flow Completion Time (FCTs) under burst traffic.

Existing congestion control algorithms for MPTCP that care about only long flow transmission aim at the Congestion-Avoidance (CA) phase and they need a long time to reach convergence states. We verified that the exponential growth of congestion window (cwnd) in the uncoupled Slow-Start (SS) leads to not only unfairness to TCP but also buffer overflow due to burst data. Moreover, these algorithms cannot support fair bandwidth sharing among TCP/MPTCP flows before reaching convergence at the bottleneck, which may reduce the transmission efficiency of short flows and even hurts long flows. In this paper, we propose a Throughput Consistency Congestion Control (TCCC) algorithm consisting of Coupled Slow-Start (CSS) and Aggressive Congestion Avoidance (ACA). To prevent packet loss caused by excessive burst data, CSS couples the increment of subflows’ cwnd and reset the ssthresh value to safely move the flows to CA when it achieves expected throughput. Based on CSS, ACA periodically detects path states and allocates the same throughput increment as the best TCP to subflows to achieve fair bandwidth share in CA. Finally, we implement TCCC in both NS3 and real testbed. The results show that TCCC reduces retransmissions, improves transmission efficiency, and maintains better fairness.

The upgrade of network devices to be equipped with multiple network interfaces makes it possible to improve network throughput performance through multipath transmission protocols, especially multipath TCP (MPTCP). However, so far the mostly used MPTCP protocols have a common limitation, namely the rigid and conservative method. They have been designed with little consideration of the fact that real networks are dynamic and the network status changes frequently, thus leading to the poor performance of current MPTCP in many realistic scenarios. In this paper, we propose a lightweight multipath congestion control algorithm based on online learning, named MP-OL. MP-OL models congestion control as a multi-armed bandit problem, and adjusts the sending rate of each subflow flexibly and adaptively through online learning. Therefore, MP-OL possesses the capability of suiting various network scenarios, and can achieve fairness and high performance in dynamic network environment. It can also flexibly switch between online learning and traditional method, which reduces the computational complexity while ensuring the learning efficiency, thus making MP-OL easy to deploy and use. As the experimental results demonstrated, compared with the leading MPTCP variants, MP-OL achieves significant improvements in fairness and link utilization, and shows better resilience to non-congestion loss and better adaptability to unstable network conditions. In real networks, MP-OL also obtains better throughput performance.

Multipath TCP is designed to utilize multiple network paths to achieve improved throughput and robustness against network failure. These features are supposed to make MPTCP preferable to single-path TCP in mobile networks. However, it fails to achieve the expected performance in practice. A key challenge of using MPTCP in mobile networks is how to effectively spread packets over heterogeneous and unstable network paths to mobile devices with limited buffers. If packets are not sent in an effective way, MPTCP may only provide equal or even lower throughput than single-path TCP. Several packet scheduling algorithms have been designed to tackle this challenge. Unfortunately, they still cannot achieve the expected performance in dynamic scenarios such as mobile networks. In this paper, we propose an Online-Learning Assisted Packet Scheduler (OLAPS) to solve the packet scheduling problem by modeling it as a multi-armed bandit problem. Over time, OLAPS can adaptively learn from current network conditions to make the best scheduling policy to provide the highest possible throughput in a dynamic environment. Moreover, when the inbuilt reward monitor detects the mismatch between network conditions and the learned policy, OLAPS aborts the outdated policy and switches to a new one swiftly. We implement OLAPS as a Linux kernel module and evaluate it over a wide range of ns-3 -simulated network conditions. The results show that OLAPS retains MPTCP’s ability to provide higher throughput and also significantly improves the throughput performance of MPTCP when other in-kernel schedulers suffer a dramatic throughput decline.

Multipath TCP (MPTCP) improves the bandwidth utilization in wireless network scenarios, since it can simultaneously utilize multiple interfaces for data transmission. However, with the fast growth of mobile devices and applications, link interruptions caused by handoffs still lead to drastic performance degradation in such scenarios. Typically, a series of packet losses on part of the links will block the transmission of the entire connection when handoff occurs. This paper proposes an Experience-driven Adaptive Redundant packet scheduler (EdAR) for MPTCP, aiming at achieving seamless handoffs in mobile networks. EdAR enables flexibly scheduling redundant packets with an experience-driven learning-based approach in the face of drastic network environment changes for multipath performance enhancement. To enable accurate learning and prediction, both the network environment and the best course of actions are jointly learned via a Deep Reinforcement Learning (DRL) agent, which we design with a hybrid structure to deal with the complexity of system states. Furthermore, both offline and online learning are utilized to allow the agent to adapt to different and changing network environments. Evaluation results show that EdAR outperforms the state-of-the-art MPTCP schedulers in most network scenarios. Specifically in mobile networks with frequent handoffs, EdAR brings$2\times $improvement in terms of the overall goodput.

A QUIC (Quick UDP Internet Connections) protocol is designed to improve Hypertext Transfer Protocol (HTTP) traffic and carries a non-negligible portion of the traffic in the current Internet. As its extension, Multipath QUIC (MPQUIC) provides higher bandwidth and smoother network handover by using multiple network interfaces simultaneously. However, to improve HTTP traffic, there are still some issues not yet carefully addressed in the existing MPQUIC, and packet scheduling is a vital one among the issues. Specifically, existing methods fail to respond to the stream prioritization of HTTP Version 2 (HTTP/2), leading to unsatisfying web page load performance. Besides, managing asymmetric and dynamic network paths is also a challenging issue, which may result in Head-of-Line (HoL) blocking and excessive buffer usage if not effectively handled. In this paper, we present a stream-aware per-packet scheduler, HoL Blocking Eliminating Scheduler (HBES), to improve the performance of MPQUIC in mobile networks. Firstly, HBES provides a fair allocation of aggregated bandwidth for different streams based on their priority. Then, it keeps stream data arriving at the receiver in order by estimating packet arrival time to mitigate HoL blocking and excessive buffer usage. We implement HBES and evaluate its performance in various network scenarios. Experimental results verify the superiority of HBES in reducing stream completion time and buffer occupation over those existing MPQUIC schedulers.

Bluetooth is a short-range wireless communication technology widely used by billions of personal computing, IoT, peripheral, and wearable devices. Bluetooth devices exchange commands and data, such as keyboard/mouse inputs, audio, and files, through a secure communication channel that is established through a pairing process. Due to the sensitivity of those commands and data, security mechanisms, such as encryption, authentication, and authorization, have been developed and adopted in the standards. Nevertheless, vulnerabilities continue to be discovered.

Truth discovery is an effective tool to infer true information from multi-source data and has been widely applied in mobile crowdsensing systems. In some specific scenarios, the sensory data are collected in a streaming fashion with time-varying information, and the server should update the truth in time. Under such circumstances, local differential privacy-based mechanism can satisfy the requirement of real-time processing properly while keeping the privacy of sensory data. However, directly applying local differential privacy to handle streaming data will disclose the long-term potential privacy and decrease the accuracy. To address these problems, we propose an incentive-based privacy-preserving truth discovery framework over streaming data. Firstly, we adopt the sequential composition theorem of w-event privacy to protect workers' long-term privacy. Second, we design an incentive mechanism to improve the submitted data utility and thus avoid the decrease in accuracy. In this way, our scheme ensures that workers submit more accurate data while their global privacy is still guaranteed. Finally, we prove our scheme satisfies w-event (∊, δ) differential privacy and theoretically analyze the result utility. Extensive experiments also demonstrate the effectiveness of our incentive mechanism.

As a promising complement to terrestrial cellular networks, such as 5G/6G, satellite networks have recently drawn increasing attention. However, facing the challenges of the rapidly increasing users' demand for multimedia content, how to achieve efficient data delivery in a dynamic environment becomes a critical but knotty problem. To provide an efficient solution from the routing perspective, in this paper, we consider the Information-Centric Networking (ICN) architecture and propose a content-aware routing scheme. The basic idea of the proposed routing scheme is to leverage the cached content on cache-enabled satellites and find the optimal route solution with maximum net-gains, i.e., how much delay is reduced. Considering the limitation of periodical signaling collection in satellite networks, we also design a cached content prediction model, which can infer the probability that a certain content could be cached according to the content's historical popularity information, to provide necessary information to measure net-gains. Extensive simulation results show that the proposed content-aware routing scheme outperforms the traditional routing scheme with a 20% reduction in terms of content retrieval delay and traffic consumption.

E-voting plays a vital role in guaranteeing and promoting social fairness and democracy. However, traditional e-voting schemes rely on a centralized organization, leading to a crisis of trust in the vote-counting results. In response to this problem, researchers have introduced blockchain to realize decentralized e-voting, but the adoption of blockchain also brings new issues in terms of flexibility, anonymity, and usability. To this end, in this paper, we propose WeVoting, which provides weight-based flexibility with solid anonymity and enhances usability by designing a voter-independent on-chain counting mechanism. Specifically, we use distributed ElGamal homomorphic encryption and zero-knowledge proof to achieve voting anonymity with weight. Besides, WeVoting develops a counter-based counting mechanism to enhance usability compared with those self-tallying schemes. By critically designing an honesty-and-activity-based incentive algorithm, WeVoting can guarantee a correct counting result even in the presence of malicious counters. Our security and performance analyses elaborate that WeVoting achieves high anonymity in weighed voting under the premise of meeting the basic security requirements of e-voting. And meanwhile, its counting mechanism is sufficient for practical demands with reasonable overheads.

Through Searchable Symmetric Encryption (SSE), a user can make search over encrypted documents that are stored on an untrusted cloud server. Multi-client SSE schemes require that one client can search documents contributed by other clients and upload documents. Nevertheless, existing multi- client SSE schemes implement the fine-grained access control with high complexity. Although fine-grained access control adapts to complex scenarios, it is not necessary anytime and may cause heavy costs over computation in SSE schemes. Moreover, it is crucial to support documents updating and forward privacy. To combat that, we design a multi-client SSE scheme with efficient access control over dynamic encrypted documents. Specifically, we first modify Symmetric Hidden Vector Encryption (SHVE) and utilize Bloom filter to implement the access control, which reduces much of computation overhead. We then employ Oblivious Dynamic Cross-Tag (ODXT) protocol to preserve the forward privacy of our scheme. Finally, the corresponding security and experimental evaluation demonstrate both security and practicality of our scheme, respectively.

Recently, there have been many discussions in mobile crowd-sensing about privacy-preserving truth discovery because of its ability to extract truthful information from noisy or biased sensory data without privacy breaches. However, in practical applications, users (referred to as workers) may report outliers due to device malfunction, malicious workers, etc. These outliers will dramatically impact the accuracy of the truth discovery result. Detecting outliers based on existing privacy preservation schemes will carry an intolerable overhead, dramatically reducing the system's availability. In this paper, we propose our privacy-preserving truth discovery scheme that can detect outliers. Specifically, we adopt an anonymous mechanism to achieve privacy preservation. Since the existing anonymous mechanisms require huge overhead and do not work correctly when some workers exit, they are difficult to be applied in mobile crowdsensing systems. We design a lightweight and robust anonymous mechanism based on the edge computing paradigm. In addition, we eliminate the impact of outliers through outlier detection to achieve robustness of truth discovery results. Finally, we demonstrate the security of our scheme through security analysis and the efficiency of our scheme in terms of computation and communication overhead through extensive experiments.

Software-Defined Networking (SDN) is a new and highly flexible network architecture, but the bottleneck between the control plane and the data plane makes it vulnerable to the control plane saturation DoS attacks. When the attack happens, traditional schemes in DoS scrubbing agent use a binary classification and a First In First Out (FIFO) queue to filter attack flows. However, this scheme is inimical to the end-to-end latency of benign traffic. To tackle this issue, we propose LLDM, leveraging a dynamic priority scheme and a priority queue to detect, mitigate the attacks while ensuring low latency for benign traffic. After detecting the attack, LLDM leverages a two-phase scheme for mitigation. First, LLDM marks packets from the ports under attack as suspicious and migrates them to the mitigation agent. Then, the dynamic priority manager assigns each packet a priority corresponding to its legality, which is used in the priority queue for DoS scrubbing. We evaluate LLDM in a simulation SDN environment. The experimental results show that LLDM can reduce 90.4% of the queuing delay compared with the traditional scheme under a 5000 Packets Per Second (PPS) attack, and it is also resistant to more sophisticated attacks. Under the high rate attack of 50000 PPS, LLDM installs a flow rule for legitimate traffic in 0.2 seconds. Moreover, for benign HTTP requests, LLDM can keep the request time at 1.39 seconds.

In Software-Defined Networking (SDN), the controllers implement flexible and scalability networking policies by installing different flow rules. Each rule matches a specific class of flows, instructs the switches to execute actions, and then expires when they finish their tasks. OpenFlow introduces the timeout mechanism to manage these flow rules. However, finding a reasonable timeout value becomes a difficult problem for the network managers. When a relatively small timeout value is given to an elephant flow, the rule expires early, introducing extra cost for the controller and long latency for the matching flow, respectively. On the contrary, a large timeout value for a mice flow makes a rule occupy the switch memory too long, wasting the caching memory and causing the flow table prone to overflow. Therefore, it is necessary to allocate appropriate timeouts for different flows dynamically. In this paper, we achieve this goal with real-time traffic monitoring and heuristic algorithms. By considering different network loads and designing corresponding dynamic timeout algorithms for different scenarios, we make full use of the advantages of SDN to improve the utilization rate of the switch memory and save the controller resources. Further, we implement our scheme in a simulation SDN platform and evaluate the algorithms with the public datasets. Experiments show that our scheme has low control overhead and is memory efficient compared with current mechanisms.

E-voting plays a vital role in modern social life. However, traditional e-voting systems usually rely on a trusted third party and therefore non-verifiable and prone to a single point of failure. In recent years, many researchers have tried to turn to blockchain to eliminate the vulnerabilities of e-voting systems. However, blockchain-based e-voting brings new problems in protecting voters’ privacy and ballots’ confidentiality, and causes a great performance degradation. In this paper, we propose AvecVoting, an anonymous and verifiable blockchain-based e-voting scheme, providing both strong security and high performance. Specifically, we utilize threshold encryption and one-time ring signature to protect voters’ privacy and ballots’ confidentiality. Furthermore, to improve the performance, we introduce the concept "counter" to count the ballots. Through the carefully designed RandomSortition and reputation-based PayOff algorithms based on smart contracts, AvecVoting can achieve correct counting even when some counters are untrustworthy. Our security and performance analyses show that AvecVoting provides strong security such as anonymity, non-repeatability, confidentiality, verifiability, etc., and meanwhile overcome the performance issues caused by blockchain and provides good efficiency in both voting and counting stages.

As the voucher for identity, digital certificates and the public key infrastructure (PKI) system have always played a vital role to provide the authentication services. In recent years, with the increase in attacks on traditional centralized PKIs and the extensive deployment of blockchains, researchers have tried to establish blockchain-based secure decentralized PKIs and have made significant progress. Although blockchain enhances security, it brings new problems in scalability due to the inherent limitations of blockchain’s data structure and consensus mechanism, which become much severe for the massive access in the era of 5G and B5G. In this paper, we propose ScalaCert to mitigate the scalability problems of blockchain-based PKIs by utilizing redactable blockchain for "on-cert" revocation. Specifically, we utilize the redactable blockchain to record revocation information directly on the original certificate ("on-cert") and remove additional data structures such as CRL, significantly reducing storage overhead. Moreover, the combination of redactable and consortium blockchains brings a new kind of attack called deception of versions (DoV) attack. To defend against it, we design a random-block-node-check (RBNC) based freshness check mechanism. Security and performance analyses show that ScalaCert has sufficient security and effectively solves the scalability problem of the blockchain-based PKI system.

Remote entanglement distribution plays a crucial role in large-scale quantum networks, and the key enabler for entanglement distribution is quantum routers (or repeaters) that can extend the entanglement transmission distance. However, the performance of quantum routers is far from perfect yet. Amongst the causes, the limited quantum memories in quantum routers largely affect the rate and efficiency of entanglement distribution. To overcome this challenge, this paper presents a new modeling for the maximization of entanglement distribution rate (EDR) on a memory-limited path, which is then transformed into entanglement generation and swapping sub-problems. We propose a greedy algorithm for short-distance entanglement generation so that the quantum memories can be efficiently used. As for the entanglement swapping sub-problem, we model it using an Entanglement Graph (EG), whose solution is yet found to be at least NP-complete. In light of it, we propose a heuristic algorithm by dividing the original EG into several sub-problems, each of which can be solved using dynamic programming (DP) in polynomial time. By conducting simulations, the results show that our proposed scheme can achieve a high EDR, and the developed algorithm has a polynomial-time upper bound and reasonable average runtime complexity.

Entanglement routing establishes remote entanglement connection between two arbitrary nodes, which is one of the most important functions in quantum networks. The existing routing mechanisms mainly improve the robustness and throughput facing the failure of entanglement generations, which, however, rarely include the considerations on the most important metric to evaluate the quality of connection, entanglement fidelity. To solve this problem, we propose purification-enabled entanglement routing designs to provide fidelity guarantee for multiple Source-Destination (S-D) pairs in quantum networks. In our proposal, we first consider the single S-D pair scenario and design an iterative routing algorithm, Q-PATH, to find the optimal purification decisions along the routing path with minimum entangled pair cost. Further, a low-complexity routing algorithm using an extended Dijkstra algorithm, Q-LEAP, is designed to reduce the computational complexity by using a simple but effective purification decision method. Finally, we consider the common scenario with multiple S-D pairs and design a greedy-based algorithm considering resource allocation and re-routing process for multiple routing requests. Simulation results show that the proposed algorithms not only can provide fidelity-guaranteed routing solutions, but also has superior performance in terms of throughput, fidelity of end-to-end entanglement connection, and resource utilization ratio, compared with the existing routing scheme.

Under the assumption of honest-but-curious cloud service provider, various cryptographic techniques have been used to address the issues of data access control and confidentiality in public cloud storage. Among which, attribute-based encryption (ABE) has been shown to be an attractive scheme. Although the technique of ABE brings in various benefits, its onerous overhead should not be ignored. In this article, based on an improved LSSS (linear secret sharing scheme) matrix expression integrated in CP-ABE (Ciphertext-Policy Attribute-Based Encryption) algorithm, we present an efficient and secure attribute-based access control scheme for the scenarios where multiple data are shared and encrypted with frequently used sub-policies. In the scheme, a user can store the parameters about a specific sub-policy in his/her first decryption, which can be reused in the subsequent data decryptions whose embedded access policies include the same sub-policy so as to significantly reduce the computation cost. Our proposed scheme is proved to be semantically secure under chosen plaintext attacks and can well preserve the confidentiality of the data sharing system. Our analysis and experimentation also show that our scheme does significantly reduce the decryption time and while trades in only very little storage overhead, and thus effectively promotes the efficiency.

As a new architecture of Internet infrastructure, Information-Centric Networking (ICN) is mainly designed to effectively handle the rapidly increasing user demand for content delivery through in-network caching. While facilitating the dissemination of content to users and making better use of the network resources, ICN is also vulnerable in that attackers can inject poisoned content into the network and isolate users from valid content sources. The introduction of signature verification in each router can effectively prevent this attack, but it also introduces great computation overhead. Existing schemes in ICN reduce verification overhead from a single routing perspective but do not consider integrating resources within ICN for collaborative content authentication and cyber self-defense. In this paper, we propose a collaborative, secure, and efficient content validation protection framework, named CSEVP, to implement a multi-router collaborative defense mechanism for ICN. On the one hand, we conduct content verification by probabilistically choosing one router involved in the transmission path to offload the computation overhead of content verification from a single router to multiple ones. On the other hand, we adopt bloom filters for routers to record and share verification results to further facilitate a more efficient content validity verification. The security and efficiency analysis shows that our proposed CSEVP can achieve efficient content validity verification among multiple routers with acceptable low communication and storage overhead.

As a promising implementation of Information-Centric Networking (ICN), Named Data Networking (NDN) has potential advantages over the TCP/IP network in content distribution, mobility support, etc. However, the research on NDN is still in its infancy, and congestion control, NDN’s most important functional element, poses many challenges, such as congestion detection, excessive window reduction for non-congested paths, and unfairness. In this paper, we propose an Intelligent Edge-Aided Congestion Control (IEACC) scheme for the NDN network based on Deep Reinforcement Learning (DRL). The proposed IEACC provides a proactive congestion detector that utilizes intermediate routers to transmit accurate congestion information along the path to consumers through data packets. Furthermore, considering the multi-source transmission in NDN, IEACC divides data packets into different congestion degrees by a lightweight clustering algorithm and provides suitable inputs for DRL, thereby obtaining a reasonable transmission rate. Then, it distributes the estimated bandwidth resources to consumers with transmission needs to maintain fairness. Finally, we implement our proposed scheme in the simulation platform and evaluate the performance in different scenarios. The results show that it can improve data transmission rate, reduce packet loss, and maintain fairness compared with others.

As one of the promising next generation network architectures, information centric networking (ICN) is highly anticipated to improve the bandwidth usage of the Internet and reduce duplicate traffic. Since contents in ICN are disseminated in the whole network, ICN is much more vulnerable and the issue of how to deliver contents securely has been intensively discussed. However, the scalability of the existing schemes is limited. A scalable scheme is expected to be able to achieve fine-grained access control and at the same time also support multiple content providers scenario with efficient key management at user side. Besides, different content providers may publish some identical contents and these contents may be cached in the same intermediate routers, which causes high data redundancy and in turn exerts an adverse impact on the performance of ICN. In this paper, we propose a Secure Content Delivery and Deduplication scheme, called SCD2, to achieve secure and efficient fine-grained access control in ICN with multiple content providers. We first propose a scalable key-policy attribute-based encryption (SKP-ABE) to provide fine-grained access control and allow different attribute authorities to share some public attributes to simplify the key management. Furthermore, based on SKP-ABE, we design a simple but effective mechanism to conduct content deduplication. Finally, we implement a prototype of SCD2 to test its performance and compare it with some existing schemes. The results show that SCD2 has lower storage overhead, a higher degree of deduplication, and better retrieval efficiency.

Energy harvesting (EH) endows device-to-device (D2D) communication and cellular equipment with the ability of continuous communication to provide internet-of-things (IoT) services in natural areas. While the available energy, which relies on EH, becomes an extra nonnegligible factor in resource allocation. Besides, we integrate uplink non-orthogonal multiple access (NOMA) with D2D communication to provide multiple access for D2D transmitters for more efficient IoT service and more efficient utilization of limited spectrum. In this scenario, ingenious resource allocation approach is a key focus for utilizing the advantages in energy and spectral efficiency. Aiming to investigate the inherent resource allocation issue, we set our goal as maximizing the energy efficiency for both NOMA-based D2D groups and cellular users (CUs), where the power and spectrum allocation are both considered. Then we propose a two-stage game approach, which is theoretically proved to be capable of obtaining the equilibrium and a stable result, to solve the unilateral energy efficiency maximization problems. Besides, an energy-aware screening method is proposed to reduce the computations based on the available energy of user equipment. Finally, the effectiveness of our proposed method is verified through elaborated simulation results.

Truth discovery is an effective method to infer truthful information from a large amount of sensory data in mobile crowdsensing systems. Privacy-preserving truth discovery schemes require the cloud server not to access each worker's sensory data directly so that the privacy of sensory data can be preserved. In some specific applications such as sparse mobile crowdsensing, workers can only contribute sensory data on a small part of sensing tasks, implying that the information of which tasks are completed by a worker should also be preserved. However, existing privacy-preserving truth discovery schemes do not consider such sparse data scenarios in mobile crowdsensing systems. In this paper, we first identify the privacy issues in truth discovery when sensory data are sparse. To address these issues, we design a privacy-preserving truth discovery scheme by employing the additively homomorphic cryptosystem and additive secret sharing with two non-colluding servers. Through detailed analysis and extensive experiments, we demonstrate that our proposed scheme can satisfy strong privacy-preserving requirements with low computation and communication overhead.

With the proliferation of mobile and wearable devices, mobile crowdsensing (MCS) is becoming a new paradigm for data collection and analysis. To effectively identify truthful information from crowdsensed data without privacy leakage, privacy-preserving truth discovery (PPTD) has gained much attention recently. Existing works either didn't consider real-time applications over data streams or failed to achieve enough efficiency for a large group of workers. In this paper, we propose FPTD, a Fog-aided Privacy-preserving Truth Discovery framework which is secure and efficient in handling real-time applications with a large group of workers. To reduce overhead, we adopt cloud-fog computing architecture to divide the complete worker group into many smaller ones. Then we design a unique secure aggregation protocol SecAgg which can securely and efficiently aggregate inputs from workers in smaller groups. Finally, we give detailed construction of FPTD, an efficient truth discovery framework based on SecAgg for real-time applications. Through extensive experiments and security analysis, we demonstrate that both SecAgg and FPTD are secure and efficient.

Many applications are bandwidth consuming but may tolerate longer flow completion times. Multipath protocols, such as multipath TCP (MPTCP), can offer bandwidth aggregation and resilience to link failures for such applications, and low priority congestion control (LPCC) mechanisms can make these applications yield to other time-sensitive ones. Properly combining the above two can improve the overall user experience. However, the existing LPCC mechanisms are not adequate for MPTCP. They do not take into account the characteristics of multiple network paths, and cannot ensure fairness among the same priority flows. Therefore, we propose a multipath LPCC mechanism, i.e., Dynamic Coupled Low Extra Delay Background Transport, named DC-LEDBAT. Our scheme is designed based on a standardized LPCC mechanism LEDBAT. To avoid unfairness among the same priority flows, DC-LEDBAT trades little throughput for precisely measuring the minimum delay. Moreover, to be friendly to single-path LEDBAT, our scheme leverages the correlation of the queuing delay to detect whether multiple paths go through a shared bottleneck. Then, DC-LEDBAT couples the congestion window at shared bottlenecks to control the sending rate. We implement DC-LEDBAT in a Linux kernel and experimental results show that DC-LEDBAT can not only utilize the excess bandwidth of MPTCP but also ensure fairness among the same priority flows.

360-degree virtual reality videos greatly improve the video experience by providing users with a more immersive and interactive environment than standard streaming video. However, 360-degree videos suffer from bandwidth limits. Existing bandwidth-efficient solutions mainly focus on spatially cutting 360-degree video into tiles, and only provide video content in the Field-of-View (FoV) of users with high quality to reduce bandwidth consumption. Although existing tile-based schemes can reduce the bandwidth consumption, the bandwidth and transmission delay provided by a single-path TCP may still not meet the high requirements of 360-degree videos. Multipath TCP (MPTCP) allows a TCP connection to operate across multiple paths simultaneously and becomes highly attractive to support the mobile devices with various radio interfaces to aggregate multipath bandwidth and improve the throughput. In this paper, by taking the advantage of MPTCP, we propose an MPTCP-based adaptive streaming framework for 360-degree Virtual Reality videos, named MP-VR. MP-VR dynamically selects the appropriate tile bitrate according to the bandwidth and transmission delay of different subflows. Then it schedules the video segments to subflows to improve QoE of users. We conduct experiments on a testbed in our lab and simulations on NS-3. Evaluation results show that MP-VR outperforms existing tile-based strategies when network fluctuations or errors in FoV predictions occur.

As the user demand for data transmission over high-speed and long distance (hereafter abbreviated as HSLD) networks increases significantly, multipath TCP (MPTCP) shows a great potential to further improve the utilization of HSLD network resources than traditional TCP, and provides better quality of service (QoS). It has been reported that TCP causes serious waste of bandwidth in HSLD networks, while MPTCP can transmit data by using multiple network paths simultaneously between two distant hosts, thus provides better resource utilization, higher throughput and smoother failure recovery for applications. However, the existing multipath congestion control algorithms cannot perfectly meet the efficiency requirements of HSLD network, since they mainly emphasize fairness rather than other critical indicators of QoS such as throughput, but still encounter fairness issues when coexist with various TCP variants. To solve these problems, we develop weighted Compound (wCompound), a loss-and-delay-based compound multipath congestion control algorithm which is originated from Compound TCP, and is applicable to HSLD networks. Different from the traditional methods of setting an empirical value as the threshold, wCompound innovatively adopts a dynamic threshold and have the flexibility to adjust the sending window of each subflow based on current network state, so as to effectively couple all subflows and fully utilize the network capacity. Moreover, with the cooperation of delay-based and loss-based methods, wCompound also ensures good fairness to different types of TCP variants. We implement wCompound in the Linux kernel, then carry out sufficient experiments on our testbed. The results show that wCompound achieves higher utilization of network resources and can always maintain an appropriate throughput no matter competing with loss-based or delay-based network traffic.

Recently, truth discovery in crowdsensing systems has received considerable attention with its appealing features for extracting truthful information from multiple unreliable data sources. However, it also poses new challenges to the issues of privacy and security. On the one hand, workers' sensed data can be used to infer their privacy. On the other hand, workers may be selfish and lazy, especially in the Internet-of-Things environment, devices are usually resource constrained, so they may dishonestly execute the costly sensing task so as to reduce resource consumption, or even break the protocol to obtain illegal rewards. Although some privacy-preserving truth discovery schemes have been proposed, they still cannot achieve strong privacy protection while keeping efficiency on the worker side, and still has no efficient incentive mechanism to persuade workers to participate in the system operations. In this article, we propose an incentive-based privacy-preserving truth discovery framework, named InPPTD. By adopting the Paillier homomorphic cryptosystem and two noncolluding servers, InPPTD not only effectively protects workers' sensed data information but also preserves the privacy of these workers' weight information. Meanwhile, a weight-based incentive mechanism is introduced in InPPTD to reduce the number of lazy workers. Security and performance analysis shows that InPPTD can guarantee stronger security features, while also ensure efficiency in terms of computation and communication overhead.

Inspired by Bitcoin, many different kinds of cryptocurrencies based on blockchain technology have turned up on the market. Due to the special structure of the blockchain, it has been deemed impossible to directly trade between traditional currencies and cryptocurrencies or between different types of cryptocurrencies. Generally, trading between different currencies is conducted through a centralized third-party platform. However, it has the problem of a single point of failure, which is vulnerable to attacks and thus affects the security of the transactions. In this paper, we propose a distributed cryptocurrency trading scheme to solve the problem of centralized exchanges, which can achieve secure trading between different types of cryptocurrencies. Our scheme is implemented with smart contracts on an Ethereum blockchain and deployed on an Ethereum test network. In addition to implementing transactions between individual users, our scheme also allows transactions among multiple users. The experimental result proves that the cost of our scheme is acceptable.

To reduce the duplicated traffic and improve the performance of distributing massive volumes of multimedia contents, in-network caching has been proposed recently. However, as in-network content caching can be directly utilized to respond users’ requests, multimedia content retrieval is beyond content providers’ control and makes it hard for them to implement access control and service accounting. In this paper, we propose a Fine-grained Accountable and Space-Efficient access control scheme, called FASE, for multimedia content distribution. FASE allows content providers to be fully offline while making the best of in-network caching. In FASE, the attribute-based encryption at multimedia content provider side and access policy based authentication at the edge router side jointly ensure secure fine-grained access control. Our scheme is efficient in both space and time. By designing one time chameleon signature (OTCS), users can keep anonymous during the authentication, and their privileges can be conveniently revoked when needed. Besides, secure service accounting is implemented by letting edge routers collect service credentials generated during users’ request process. Through formal security analysis, we prove the security of our scheme. Simulation results demonstrate that our scheme is efficient with acceptable overhead.

Service prioritization brings reasonable allocation of network resources and improves the overall quality of experience (QoE) of users, but it has not been thoroughly investigated in information centric networking (ICN). Existing works lack adaptability and they cannot ensure specific content provider (CP) get well caching service which is one of the most important functions in ICN. In this paper, we firstly propose a service prioritization scheme to flexibly provide different caching services for heterogeneous CPs to improve the overall network efficiency. The main idea is to allocate dedicated cache space for paying CPs and provide prioritized caching service for them, while normal CPs only enjoy the normal caching service. The scheme can be divided into two phases. First, we select a group of nodes with higher importance as core nodes based on network topology, and pair each edge node to a core node following the two-sided many-to-one matching algorithm. Second, we dynamically allocate and manage the dedicated cache space for core nodes. We model the allocation of dedicated cache space and convert it into a convex optimization problem to solve. After that, a practical caching strategy and system design are implemented in the ndnSIM simulator. Finally, we evaluate our scheme and conduct comparative experiments with the most representative work diff-caching, simulation results show that our scheme outperform it in terms of both delay and cache hit ratio.

Owing to the Network Function Virtualization (NFV) and Software-Defined Networks (SDN), Service Function Chain (SFC) has become a popular service in SDN and NFV-enabled network. However, as the Virtual Network Function (VNF) of each type is generally multi-instance and flows with SFC requests must traverse a series of specified VNFs in predefined orders, it is a challenge for dynamic SFC formation to optimally select VNF instances and construct paths. Moreover, the load balancing and end-to-end delay need to be paid attention to, when routing flows with SFC requests. Additionally, fine-grained scheduling for traffic at flow level needs differentiated routing which should take flow features into consideration. Unfortunately, traditional algorithms cannot fulfill all these requirements. In this paper, we study the Differentiated Routing Problem considering SFC (DRP-SFC) in SDN and NFV-enabled network. We formulate the DRP-SFC as a Binary Integer Programming (BIP) model aiming to minimize the resource consumption costs of flows with SFC requests. Then a novel routing algorithm, Resource Aware Routing Algorithm (RA-RA), is proposed to solve the DRP-SFC. Performance evaluation shows that RA-RA can efficiently solve the DRP-SFC and surpass the performance of other existing algorithms in acceptance rate, throughput, hop count and load balancing.

Multipath TCP (MPTCP) utilizes multiple paths for simultaneous data transmission to enhance performance. However, existing MPTCP protocols are still far from satisfactory in wireless networks because of their loss-based congestion control and the difficulty of managing multiple subflows. To overcome these problems, we redesign the coupled congestion control algorithm and scheduler to boost MPTCP in wireless heterogeneous networks. The main purpose is to promote transmission rate under lossy networks, while also provide stability when networks suffer physical link changes and asymmetric links. In this paper, inspired by Bottleneck Bandwidth and Round-trip propagation time (BBR), we first propose Coupled BBR that utilizes detected bandwidth to adjust the sending rate within an MPTCP connection. Coupled BBR provides high loss tolerance as well as balanced congestion among MPTCP subflows. Then, to further improve the performance, we propose an Adaptively Redundant and Predictive packet (AR&P) scheduler to improve adaptability and keep in-order packet delivery in highly dynamic network scenarios. Based on Linux kernel implementation and experiments in both testbed and real network scenarios, we show that the proposed scheme not only provides high throughput in wireless networks, but also improves robustness and reduces out-of-order packets in some harsh circumstances.

It is a known issue that low-latency communication is hard to achieve when using multiple network interfaces with asymmetric capacity and delay (e.g., LTE and WLAN) simultaneously. A main underlying cause of this issue is that the packets with lower sequence number are stalled on a high-latency path, thus the early arriving packets with higher sequence number become “out-of-order (OFO)” packets. These OFO packets may excessively consume receiver’s buffer, causing long reordering delay and unnecessary packet retransmission. In this paper, we present a novel design of packet scheduling for Multipath TCP (MPTCP), called OverLapped Scheduler (OLS), able to tackle the OFO-packet problem more effectively. OLS can guarantee sufficient throughput on demand of upper layer applications, and utilizes the remaining bandwidth to reduce OFO-packets. To do so, OLS schedules packets according to their arrival time and sends a controlled number of redundant packets to avoid the impact of inaccurate arrival-time estimations due to network jitter. We implement OLS in a Linux kernel, and the experiments show that in asymmetric networks with or without jitter, OLS can effectively reduce OFO-packets and transmission latency while maintaining a sufficient throughput, which makes it fully capable to meet the requirements of applications such as live video streaming.

Deep learning as a service has been widely deployed to utilize deep neural network models to provide prediction services. However, this raises privacy concerns since clients need to send sensitive information to servers. In this paper, we focus on the scenario where clients want to classify private images with a convolutional neural network model hosted in the server, while both parties keep their data private. We present FALCON, a fast and secure approach for CNN predictions based on fast Fourier Transform. Our solution enables linear layers of a CNN model to be evaluated simply and efficiently with fully homomorphic encryption. We also introduce the first efficient and privacy-preserving protocol for softmax function, which is an indispensable component in CNNs and has not yet been evaluated in previous work due to its high complexity.

Named data networking (NDN) is an emerging network paradigm that decouples content from its storage location by providing one or more content copies and distributing them within the whole network. Congestion control is a fundamental and important problem in NDN, but it has not been well solved yet. Existing works can be divided into three main types, receiver driven flow based control, hop-by-hop interest shaping and hybrid control. While they are faced with more or less high computational complexity, multi-content source and multitransmission path problems, we proposed our edge computing aided congestion control scheme (EACC). The main idea is to detect congestion along the transmission path and avoid it by interest forwarding control at edge nodes. We add a new field to data packet to record the congestion status of the transmission path when it returns. After that, we deploy the core computing functions of the solution at edge nodes, and formulate the interest packet forwarding control into a local MDP (Markov Decision Process) problem based on the returned path congestion status and local user request information. Then we use neuro-dynamic programming (NDP) to solve this decision problem and present a practical implementation at edge nodes. The proposed scheme is implemented in ndnSIM simulator and compared to other two methods. Simulation results show the effectiveness of our scheme.

Nowadays, mobile devices are equipped with multiple interfaces connected to various networks, which makes it possible to aggregate bandwidth in actual application. Multipath TCP (MPTCP) is one of the transport protocols that uses multiple interfaces simultaneously and provides robust and efficient data transmission. In practice, MPTCP will interact with various network facilities. Among them, Content Delivery Network (CDN) is a popular one, which is a widely distributed network system deployed across the Internet. Using MPTCP in CDN could provide better performance for users, however, we find that CDN may not give full play to its functions when working with MPTCP. Because the Default Server Selection (DSS) mechanism in CDN only obtains servers optimal in single path connection scenarios, it may not provide the globally optimal server for MPTCP. In this paper, we propose a new algorithm called Server Selection for MPTCP (SSMP), which utilizes all available multi-homed sources to provide the globally optimal performance. SSMP modifies the DNS mechanism to return the optimal server for each available interface by the origin strategy and further selects the globally optimal server for both elephant and mice flows. We compare SSMP with DSS through experiments under video streaming and file download scenarios with both stable and variable environments. Our results show that SSMP consistently utilizes available paths more efficiently than DSS, particularly for servers with a great gap in server quality.

Formal analyses of blockchain protocols have received much attention recently. Consistency results of Nakamoto's blockchain protocol are often expressed in a quantity c, which denotes the expected number of network delays before some block is mined. With μ (resp., ν) denoting the fraction of computational power controlled by benign miners (resp., the adversary), where μ+ν =1, we prove for the first time that to ensure the consistency property of Nakamoto's blockchain protocol in an asynchronous network, it suffices to have c to be just slightly greater than 2μ/(ln(μ/ν)). Such a result is both neater and stronger than existing ones. In the proof, we formulate novel Markov chains which characterize the numbers of mined blocks in different rounds.

The whole Software-Defined Networking (SDN) system might be out of service when the control plane is overloaded by control plane saturation attacks. In this attack, a malicious host can manipulate massive table-miss packets to exhaust the control plane resources. Even though many studies have focused on this problem, systems still suffer from more influenced switches because of centralized mitigation policies, and long recovery delay because of the remaining attack flows. To solve these problems, we propose FSDM, a Fast recovery Saturation attack Detection and Mitigation framework. For detection, FSDM extracts the distribution of Control Channel Occupation Rate (CCOR) to detect the attack and locates the port that attackers come from. For mitigation, with the attacker's location and distributed Mitigation Agents, FSDM adopts different policies to migrate or block attack flows, which influences fewer switches and protects the control plane from resource exhaustion. Besides, to reduce the system recovery delay, FSDM equips a novel functional module called Force_Checking, which enables the whole system to quickly clean up the remaining attack flows and recovery faster. Finally, we conducted extensive experiments, which show that, with the increasing of attack PPS (Packets Per Second), FSDM only suffers a minor recovery delay increase. Compared with traditional methods without cleaning up remaining flows, FSDM saves more than 81% of ping RTT under attack rate ranged from 1000 to 4000 PPS, and successfully reduced the delay of 87% of HTTP requests time under large attack rate ranged from 5000 to 30000 PPS.

Smart grid achieves reliable, efficient and flexible grid data processing by integrating traditional power grid with information and communication technology. The control center can evaluate the supply and demand of the power grid through aggregated data of users, and then dynamically adjust the power supply, price of the power, etc. However, since the grid data collected from users may disclose the user's electricity using habits and daily activities, the privacy concern has become a critical issue. Most of the existing privacy-preserving data collection schemes for smart grid adopt homomorphic encryption or randomization techniques which are either impractical because of the high computation overhead or unrealistic for requiring the trusted third party. In this paper, we propose a privacy-preserving smart grid data aggregation scheme satisfying local differential privacy (LDP) based on randomized response. Our scheme can achieve efficient and practical estimation of the statistics of power supply and demand while preserving any individual participant's privacy. The performance analysis shows that our scheme is efficient in terms of computation and communication overhead.

The Internet of Things (IoT) has set off a new information technology revolution due to its convenience and efficiency. An IoT enables sharing economy, as more people are willing to share their own things (mostly mobile devices) to leverage the under-used value. In such a situation where owners and users are often not familiar with each other, an efficient access control mechanism is needed to deal with the trust issue and support service accountability to help owners accurately get their deserved profits. Besides, in such a sharing economy environment, the mobility of most shared IoT devices and their privacy preserving should also be taken into account. Regrettably, the existing schemes cannot achieve all of the aforementioned goals simultaneously and only few schemes were implemented to evaluate the claimed performance. In this article, we propose an efficient, accountable, and privacy-preserving access control solution for IoT in a sharing economy environment. In our scheme, we utilize the one-time signature to achieve anonymous authentication and let gateways store the signatures as service credentials for accountability. Meanwhile, we adopt the identity-based authentication to exclude malicious gateways and shared devices from the system and design a specialized protocol for those devices moving with the users. We conduct a detailed security analysis to show that our scheme can effectively defend against potential attacks, and also implement a prototype system to demonstrate that our design is indeed an efficient one.

Secure data aggregation has been widely studied in the area of the smart grid. Many existing schemes have studied protecting user's privacy in data aggregation by using advanced cryptographic tools. However, they usually introduce a large computation burden to smart meters in limited computing power or require a trusted authority. How to ensure the efficiency on the user side while preserving user's privacy still has not been well addressed. In this article, we consider the scenario where there does not exist a trusted authority and users in the smart grid may dynamically change, and propose an efficient and robust data aggregation scheme without a trusted authority for the smart grid. Our proposed scheme not only ensures user's privacy and efficiency but also supports flexible dynamic user management with no need of involving a trusted authority. Analysis of security and performance shows that our scheme can guarantee stronger security features, while ensuring efficiency in terms of computation, communication, and storage overhead.

With the advances of Software-Defined Networks (SDN) and Network Function Virtualization (NFV), Service Function Chain (SFC) has been becoming a popular paradigm to carry and complete network services. Such new computing and networking paradigm enables Virtual Network Functions (VNFs) to be placed in software entities/virtual machines over a network of physical equipments in elastic and flexible way with low capital and operation expenses. VNFs are chained together to steer traffic as needed. However, most of the existing traffic steering and routing path computation algorithms for SFC are complex, unscalable, and low time-efficiency. In this paper, we study the VNF Selection and Chaining Problem (VNF-SCP) in SDN/NFV-enabled networks. We formulate VNF-SCP as a Binary Integer Programming (BIP) model in order to compute routing path for each SFC Request (SFCR) with the minimum end-to-end delay. Then, a novel Deep Learning-based Two-Phase Algorithm (DL-TPA) is introduced, where VNF selection network and VNF chaining network are designed to achieve intelligent and efficient VNF selection and chaining for SFCRs. Performance evaluation shows that DL-TPA can achieve high prediction accuracy and time efficiency of routing path computation, and the overall network performance can be improved significantly.

A key trend of current network evolution is in the direction of network softwarization and virtualization. These technological paradigms aim to enable a network to be programmable in a way that makes the network more flexible, scalable, and reliable, and in turn leads to agile service deployment and lower capital and operational expenses. So far, two related widely adopted solutions are software defined networks (SDN) and network function virtualization (NFV). There is one main difference between these two new networking paradigms. SDN separates the control plane from the data plane through a well-defined programming interface, such that the centralized controller can have a complete view of the entire network, while NFV decouples network functions from dedicated physical equipment by means of virtualization technology, and runs the virtual network functions (VNFs) in the general purpose physical or virtual network appliances. Both approaches make the network programmable in order to have the aforementioned desired features. SDN and NFV do not depend on each other, and they actually complement each other. They can work well individually and can also work in tandem for performance reasons. Due to such advantages, both SDN and NFV have become key enabling technologies for 5G networks, and have also been used in a wide range of important areas including IoT, mobile edge computing, smart grid, cloud datacenters, and cognition-based networks.

F2C (fog-to-cloud) enables service providers to rent the low-cost cloud/fog resources to publish their services, and the fog nodes, which are deployed at the edge, can provide short-latency service to users. However, new security threats come along with this new computing paradigm, where the access control and trusted payment are concerned in this work. We propose a privacy-preserving authentication scheme. By integrating k-times anonymous authentication (k-TAA) and attribute-based access control, in our proposed scheme, service providers can autonomously determine a fine-grained access policy and the maximal access times for authorized users. Thus, users who satisfy the access policy can receive benefits of this service for certain number of times without leaking any private information. Our authentication phase has a low latency because it is offloaded to the fog as what the service does. This paper presents a lightweight and trusted billing mechanism using Merkle Hash Tree (MHT), which can detect the cloud's service forgery with high probability, without costing too much of service provider's bandwidth and computation. Rigorous security analysis proves that the proposed scheme is secure against malicious users, fogs, and cloud, and the experimental results show the significant performance advantage on both the delay reduction and service providers' cost saving.

Smart grid adopts two-way communication and rich functionalities to gain a positive impact on the sustainability and efficiency of power usage, but on the other hand, also poses serious challenges to customers' privacy. Existing solutions in smart grid usually use cryptographic tools, such as homomorphic encryption, to protect individual privacy, which, however, can only support limited and simple functionalities. Moreover, the resource-constrained smart meters need to perform heavy asymmetric cryptography in these solutions, and thus unnecessarily increases load on smart grid. In this paper, we present a practical and secure SGX-enabled smart grid system, named SecGrid. Our system leverages trusted hardware SGX to ensure that grid utilities can efficiently execute rich functionalities on customers' private data, while guaranteeing their privacy. With our well-devised security protocols in SecGrid, only the smart meters need to perform AES encryption. To validate the superiority of our design, we conduct security analysis and experimentation. Security analysis shows that SecGrid can thwart various attacks from malicious adversaries, and the experimental results show that SecGrid is much faster than the existing privacy-preserving schemes in smart grid.

In order to be TCP-friendly, the original Multipath TCP (MPTCP) congestion control algorithm is always restricted to gain no better throughput than a traditional single-path TCP on the best path. However, it is unable to maximize the throughput over all available paths when they do not go through a shared bottleneck. Also, bottleneck fairness based solutions detect the bottleneck and conduct different congestion control algorithms at different bottleneck sets to increase throughput while remaining fair to single TCP. However, existing solutions generally detect shared bottlenecks through delay correlation and loss correlation between two flows, which often lead to misjudgement in dynamic and complex network scenarios. Therefore, in this paper, we first propose a new Shared Bottleneck based Congestion Control scheme, called SB-CC, which leverages ECN (Explicit Congestion Notification) mechanism to detect shared bottlenecks among subflows and estimate the congestion degree of each subflow. Then, with the congestion degree, SB-CC balances the loads among all subflows, and smooths out congestion window fluctuation. Also, in order to prevent throughput degradation due to out-of-order packets, we propose a Shared Bottleneck based Forward Prediction packet Scheduling scheme, called SB-FPS. SB-FPS distributes data according to the window size changes of each subflow, and thus could more accurately schedule data in shared bottleneck scenarios. We implement our proposed scheme in the Linux kernel and simulation platform to evaluate the performance in different scenarios. Measurement results indicate that our scheme can detect the bottleneck more accurately and improve the overall network performance while still keeping bottleneck fairness.

The new paradigm of outsourcing data to the cloud is a double-edged sword. On the one hand, it frees data owners from the technical management, and is easier for data owners to share their data with intended users. On the other hand, it poses new challenges on privacy and security protection. To protect data confidentiality against the honest-but-curious cloud service provider, numerous works have been proposed to support fine-grained data access control. However, till now, no schemes can support both fine-grained access control and time-sensitive data publishing. In this paper, by embedding timed-release encryption into Ciphertext-Policy Attribute-based Encryption (CP-ABE), we propose a new time and attribute factors combined access control on time-sensitive data for public cloud storage (named TAFC). Based on the proposed scheme, we further propose an efficient approach to design access policies faced with diverse access requirements for time-sensitive data. Extensive security and performance analysis shows that our proposed scheme is highly efficient and satisfies the security requirements for time-sensitive data storage in public cloud.

In order to cope with the explosive growth of mobile traffic, many traffic offloading schemes such as heterogenous networks have been developed to enhance network capacity of the Radio Access Network (RAN). Among them, networking of Low-Earth Orbit (LEO) satellites promises to significantly improve the RAN performance due to its economical prospect and advantages in high bandwidth and low latency. In this paper, by introducing the cache-enabled LEO satellite network as a part of RAN, we propose an integrated satellite/terrestrial cooperative transmission scheme to enable an energy-efficient RAN by offloading traffic from base stations through satellite's broadcast transmission. Considering energy-constraints of satellites, we then formulate a nonlinear fractional programming problem aiming at optimizing transmission energy efficiency of the system. In order to effectively solve this problem, we transform it into an equivalent one, and then adopt iteration and sub-problem decomposition to obtain the optimal solution for each optimization variable, i.e., block placement, power allocation, and cache sharing variable. Numerical results show that compared with traditional terrestrial scheme, our cooperative transmission scheme achieves significant performance improvement in terms of traffic offloading and energy efficiency, especially in an environment of high request consistency degree.

With rapid advances in satellite technology, space information network (SIN) has been proposed to meet the increasing demands of ubiquitous mobile communication due to its advantages in providing extensive access services. However, due to satellites' resource constraint and SIN's highly dynamic topology, it poses a challenge on management and resource utilization in the development of SIN. There have been some works integrating the software defined network (SDN) into SIN, defined as software defined space information network (SD-SIN), so as to simplify the management and improve resource utilization in SIN. However, these works ignore the security issue in SD-SIN. Meanwhile, the existing security mechanisms in SDN are still unable to cope with the uniqueness of satellite network, and some other critical security issues still haven't yet been well addressed. In this paper, based on (t,n) secret sharing, an SIN-specific lightweight group key agreement protocol is proposed for SD-SIN to ensure both the security and applicability. Moreover, considering the highly dynamic network topology, we also design a group key-based secure handover authentication scheme to reduce the overhead of handover authentication. Security analysis shows that the handover authentication protocol can resist to various known attacks. In addition, further performance evaluation shows its efficiency in terms of computation and communication overheads. Finally, the simulation results of computing overhead to the network entities demonstrate that our protocol is feasible in practical implementation.

To embrace the era of big data, there has been growing interest in designing distributed machine learning to exploit the collective computing power of the local computing nodes. Alternating Direction Method of Multipliers (ADMM) is one of the most popular methods. This method applies iterative local computations over local datasets at each agent and computation results exchange between the neighbors. During this iterative process, data privacy leakage arises when performing local computation over sensitive data. Although many differentially private ADMM algorithms have been proposed to deal with such privacy leakage, they still have to face many challenging issues such as low model accuracy over strict privacy constraints and requiring strong assumptions of convexity of the objective function. To address those issues, in this paper, we propose a differentially private robust ADMM algorithm (PR-ADMM) with Gaussian mechanism. We employ two kinds of noise variance decay schemes to carefully adjust the noise addition in the iterative process and utilize a threshold to eliminate the too noisy results from neighbors. We also prove that PR-ADMM satisfies dynamic zero-concentrated differential privacy (dynamic zCDP) and a total privacy loss is given by (∈, δ)-differential privacy. From a theoretical point of view, we analyze the convergence rate of PR-ADMM for general convex objectives, which is O(1/K) with K being the number of iterations. The performance of the proposed algorithm is evaluated on real-world datasets. The experimental results show that the proposed algorithm outperforms other differentially private ADMM based algorithms under the same total privacy loss.

Information Centric Networking (ICN), a new paradigm of Internet infrastructure, aims to better accommodate users' rapid growing demand for content delivery and optimize bandwidth utilization. Although the in-network cache feature of ICN facilitates the dissemination of content to users, it also poses new challenges on access control for content and network resource. Moreover, it is common that the access privilege of content dynamically change over time. However, existing access control mechanisms in ICN cannot support the publication and distribution of such time-sensitive content. In this paper, we propose a time- sensitive, lightweight, and secure access control mechanism, called TSLS, to solve this problem. We introduce broadcast encryption combined with time tokens for content providers to protect content confidentiality, and only authorized users satisfying the time limitation have capability to decrypt and access the content. Besides, a fast lightweight challenge-response verification is implemented at the edge routers to block unauthorized request from injecting into the network. The responses of authorized users are forwarded to content providers for pre-distribute popular content at in-network caches in advance. Our security analysis shows that TSLS possesses the properties of data confidentiality, unforgeability, anonymity, and DoS/DDoS attacks resistance. Our simulation results indicate that our proposed TSLS is an efficient mechanism with low computation cost and network delay.

Nowadays, multimedia content retrieval has become the major service requirement of the Internet and the traffic of these contents has dominated the IP traffic. To reduce the duplicated traffic and improve the performance of distributing massive volumes of multimedia contents, in-network caching has been proposed recently. However, because in-network content caching can be directly utilized to respond users' requests, multimedia content retrieval is beyond content providers' control and makes it hard for them to implement access control and service accounting. In this paper, we propose an attribute-based accountable access control scheme for multimedia content distribution while making the best of in-network caching, in which content providers can be fully offline. In our scheme, the attribute-based encryption at multimedia content provider side and access policy based authentication at the edge router side jointly ensure the secure access control, which is also efficient in both space and time. Besides, secure service accounting is implemented by letting edge routers collect service credentials generated during users' request process. Through the informal security analysis, we prove the security of our scheme. Simulation results demonstrate that our scheme is efficient with acceptable overhead.

With the dramatically increasing deployment of the Internet of Things (IoT), remote monitoring of health data to achieve intelligent healthcare has received great attention recently. However, due to the limited computing power and storage capacity of IoT devices, users' health data are generally stored in a centralized third party, such as the hospital database or cloud, and make users lose control of their health data, which can easily result in privacy leakage and single-point bottleneck. In this paper, we propose Healthchain, a large-scale health data privacy preserving scheme based on blockchain technology, where health data are encrypted to conduct fine-grained access control. Specifically, users can effectively revoke or add authorized doctors by leveraging user transactions for key management. Furthermore, by introducing Healthchain, both IoT data and doctor diagnosis cannot be deleted or tampered with so as to avoid medical disputes. Security analysis and experimental results show that the proposed Healthchain is applicable for smart healthcare system.

Space information network (SIN) makes it possible for any object to be connected to the Internet anywhere, even in the areas with extreme conditions, where a cellular network is not easy to deploy. Access authentication is the key to secure users' access control in SIN, mainly to prevent illegal adversaries from getting access to SIN services. However, the highly complicated communication environment of SIN (e.g., exposed links, higher signal delay, etc.) poses a challenging issue in the design of a secure and efficient authentication scheme. Although some authentication schemes have been proposed for SIN, they are unsuitable for Internet of Things (IoT) in SIN due to the high signaling overhead and insufficient security properties. Therefore, in this paper, we design a provably secure and efficient authentication protocol, along with an efficient handover mechanism, for IoT in SIN. In our design, we introduce a new authentication system model, where the satellites are given the ability to authenticate users to avoid the online involvement of the network control center (NCC) when authenticating users, thereby reducing long authentication delay and avoiding a single point of bottleneck in NCC. Furthermore, the support of batch verification in our design can significantly enhance handover efficiency when a group of users switch to another satellite. Our further analysis shows that our scheme is secure against various attacks and can meet a variety of security requirements. In addition, performance evaluation shows the superiority of our scheme on both delay and handover efficiency compared with existing schemes.

In power utility service outsourcing, some time-sensitive computations (e.g., dynamic prices prediction) are outsourced to a third-party service provider. This brings in new privacy threats to customers. Although some existing works focus on achieving privacy-preserving temporal and spatial aggregation for one center, they basically cannot be directly applied to the scenario of service outsourcing with multiple centers (e.g., with power utility and service providers). We thus propose a privacy-preserving service outsourcing scheme, called PPSO, for real-time pricing demand response in smart grid with fault tolerance and flexible customers' enrollment and revocation. In our proposed PPSO, power utility can outsource the dynamic pricing prediction to a service provider, while still preserving customers' privacy. Extensive experiment results demonstrate that PPSO has less computation overhead and lower transmission delay compared with existing schemes.

In public cloud storage services, data are outsourced to semi-trusted cloud servers which are outside of data owners' trusted domain. To prevent untrustworthy service providers from accessing data owners' sensitive data, outsourced data are often encrypted. In this scenario, conducting access control over these data becomes a challenging issue. Attribute-based encryption (ABE) has been proved to be a powerful cryptographic tool to express access policies over attributes, which can provide a fine-grained, flexible, and secure access control over outsourced data. However, the existing ABE-based access control schemes do not support users to gain access permission by collaboration. In this paper, we explore a special attribute-based access control scenario where multiple users having different attribute sets can collaborate to gain access permission if the data owner allows their collaboration in the access policy. Meanwhile, the collaboration that is not designated in the access policy should be regarded as a collusion and the access request will be denied. We propose an attribute-based controlled collaborative access control scheme through designating translation nodes in the access structure. Security analysis shows that our proposed scheme can guarantee data confidentiality and has many other critical security properties. Extensive performance analysis shows that our proposed scheme is efficient in terms of storage and computation overhead.

Nowadays, the Space Information Network (SIN) has been widely used in real life because of its advantages of communicating anywhere at any time. This feature is leading to a new trend that traditional wireless users are willing to roam to SIN to obtain a better service. However, the features of exposed links and higher signal latency in SIN make it difficult to design a secure and fast roaming authentication scheme for this new trend. Although some existing researches have been focused on designing secure authentication protocols for SIN or providing roaming authentication protocols for traditional wireless networks, these schemes cannot provide adequate requirements for the roaming communication in SIN and bring in critical issues, such as the privacy leakage or intolerable authentication delay. Observing these problems have not been well addressed, we design an anonymous and fast roaming authentication scheme for SIN. In our scheme, we utilize the group signature to provide the anonymity for roaming users, and assume that the satellites have limited computing capacity and make them have the defined authentication function to avoid the real-time involvement of the home network control center when authenticating the roaming users. The results of security and performance analysis show that the proposed scheme can provide the required security features, while providing a small authentication delay.

By means of network function virtualization (NFV), dedicated proprietary network devices can be implemented as software and instantiated flexibly on common-off-the-shelf servers, in the form of virtual network functions (VNF). NFV can bring great cost reduction as well as operation flexibility. However, it also brings new problems, one of which is how to meet the availability of network services in the VNF deployment process, because of the error prone nature of software. The availability aware VNF deployment problem has attracted attention by academics, and reserving redundancy has been treated as the de facto technology. Compared with traditional backup schemes for physical machines, resource orchestration in NFV is more flexible and the characteristics of software should be considered to improve resource utilization efficiency. Based on the above considerations, in this paper we further study the availability aware VNF deployment problem in datacenter networks. To improve the resource utilization efficiency, the sharing mechanism of redundancy and multi-tenancy technology are taken into account. Then we formulate the problem mathematically and propose a joint deployment and backup scheme (JDBS). Finally, we conduct a numerical simulation in detail and compare it with four contrasting schemes in the existing literature. The simulation results show that JDBS is obviously superior to the contrasting schemes and can save about 40% resources at most.

Information centric networking (ICN) has been regarded as an ideal architecture for the next-generation network to handle users' increasing demand for content delivery with in-network cache. While making better use of network resources and providing better service delivery, an effective access control mechanism is needed due to the widely disseminated contents. However, in the existing solutions, making cache-enabled routers or content providers authenticate users' requests causes high computation overhead and unnecessary delay. Also, the straight-forward utilization of advanced encryption algorithms makes the system vulnerable to DoS attacks. Besides, privacy protection and service accountability are rarely taken into account in this scenario. In this paper, we propose SEAF, a secure, efficient, and accountable edge-based access control framework for ICN, in which authentication is performed at the network edge to block unauthorized requests at the very beginning. We adopt group signature to achieve anonymous authentication and use hash chain technique to reduce greatly the overhead when users make continuous requests for the same file. At the same time, we provide an efficient revocation method to make our framework more robust. Furthermore, the content providers can affirm the service amount received from the network and extract feedback information from the signatures and hash chains. By formal security analysis and the comparison with related works, we show that SEAF achieves the expected security goals and possesses more useful features. The experimental results also demonstrate that our design is efficient for routers and content providers and bring in only slight delay for users' content retrieval.

Network Function Virtualization (NFV) and Software-Defined Networks (SDN) enable Internet Service Providers (ISPs) to place Virtual Network Functions (VNFs) to achieve the performance and security benefit without incurring high Operating Expenses (OPEX) and Capital Expenses (CAPEX). In NFV environment, Service Function Chains (SFCs) always need to steer the traffic through a series of VNF instances in predefined orders. Moreover, the required number and placement of VNF instances should be optimized to adapt to dynamic network load. Therefore, it is considerable for ISPs to conduct an optimal SFC embedding strategy to improve the network performance and revenue. In the paper, we study the SFC Embedding Problem (SFC-EP) with dynamic VNF placement in geo-distributed cloud system. We formulate this problem as a Binary Integer Programming (BIP) model aiming to embed SFC requests with the minimum embedding cost. Furthermore, the novel SFC eMbedding APproach (SFC-MAP) and VNF Dynamic Release Algorithm (VNF-DRA) have been proposed to efficiently embed SFC requests and optimize the number of placed VNF instances. Performance evaluation results show that the proposed algorithms can provide higher performance in terms of SFC request acceptance rate, network throughput, and mean VNF utilization rate and efficiently reduce the total VNF running time compared with the algorithms in existing literatures.

Information Centric Networking (ICN), a future network architecture candidate, aims to alleviate the problem of insufficient bandwidth in traditional IP network. In ICN, contents are distributed in the whole network, so access control becomes more intractable. As we know, almost all of existing solutions consider it as a "Yes or No" problem, where a user either has the permission to access the corresponding content or not. However, in many practical situations, a content provider doesn't expect a single authorized user has the ability to access its repertory without times limitation when taking copyright protection into account. In this paper, we propose LASA, a lightweight, auditable and secure solution where legitimate users are limited to access a content provider's data within pre-designate times. In LASA, each content provider sets maximum access times for each legitimate user and edge routers perform authentication and audit based on users' signatures attached to interest packets. Once a legitimate user attempts to exceed his/her limited access times, his/her secret key will be leaked and the dishonest behavior will be detected. Our security analysis shows that LASA can provide signature unforgeability, data confidentiality and other security features. Experiment results show that our scheme LASA brings a little computational cost.

Information Centric Networking (ICN) has been regarded as an ideal architecture for the next-generation network to handle users' increasing demand for content delivery with in-network cache. While making better use of network resources and providing better delivery service, an effective access control mechanism is needed due to wide dissemination of contents. However, in the existing solutions, making cache-enabled routers or content providers authenticate users' requests causes high computation overhead and unnecessary delay. Also, straightforward utilization of advanced encryption algorithms increases the opportunities for DoS attacks. Besides, privacy protection and service accountability are rarely taken into account in this scenario. In this paper, we propose a secure, efficient, and accountable access control framework, called SEAF, for ICN, in which authentication is performed at the network edge to block unauthorized requests at the very beginning. We adopt group signature to achieve anonymous authentication, and use hash chain technique to greatly reduce the overhead when users make continuous requests for the same file. Furthermore, the content providers can affirm the service amount received from the network and extract feedback information from the signatures and hash chains. By formal security analysis and the comparison with related works, we show that SEAF achieves the expected security goals and possesses more useful features. The experimental results also demonstrate that our design is efficient for routers and content providers, and introduces only slight delay for users' content retrieval.

With an advancement of mobile communication technology, the space information network (SIN) has been proposed to meet the increasing demands of mobile communication due to its advantage of providing great expanding access services. In SIN, authentication is significant for the security to prevent the network resource from unauthorized access. However, the features of highly exposed links and extremely high propagation delay make it difficult to design a secure and fast authentication scheme for SIN. Although some existing researches have tried to design authentication protocols for SIN, they haven't taken the intolerable authentication delay and the risk of satellite compromising into consideration. Faced with these problems, we design a proxy signature-based authentication scheme for SIN, in which, the interaction process of authentication can be only implemented between the mobile user and the satellite node, thus reducing the long authentication implementation delay. Furthermore, we utilize the proxy signature to mitigate the risk of satellites being attacked. The results of security and performance analysis show that the proposed scheme can provide the required security and largely reduce the authentication latency.

People endorse the great power of cloud computing, but cannot fully trust the cloud providers to host privacy-sensitive data, due to the absence of user-to-cloud controllability. To ensure confidentiality, data owners outsource encrypted data instead of plaintexts. To share the encrypted files with other users, ciphertext-policy attribute-based encryption (CP-ABE) can be utilized to conduct fine-grained and owner-centric access control. But this does not sufficiently become secure against other attacks. Many previous schemes did not grant the cloud provider the capability to verify whether a downloader can decrypt. Therefore, these files should be available to everyone accessible to the cloud storage. A malicious attacker can download thousands of files to launch economic denial of sustainability (EDoS) attacks, which will largely consume the cloud resource. The payer of the cloud service bears the expense. Besides, the cloud provider serves both as the accountant and the payee of resource consumption fee, lacking the transparency to data owners. These concerns should be resolved in real-world public cloud storage. In this paper, we propose a solution to secure encrypted cloud storages from EDoS attacks and provide resource consumption accountability. It uses CP-ABE schemes in a black-box manner and complies with arbitrary access policy of the CP-ABE. We present two protocols for different settings, followed by performance and security analysis.

Privacy-preserving data aggregation has been extensively studied in smart grid. However, almost all existing schemes aggregate the total electricity consumption data of the whole user set, which sometimes cannot meet the fine-grained demands from control center in smart grid. In this paper, we propose a privacy-preserving multisubset data aggregation scheme, named PPMA, in smart grid. PPMA can aggregate users' electricity consumption data of different ranges, while guaranteeing the privacy of individual users. Detailed security analysis shows that PPMA can protect individual user's electricity consumption privacy against a strong adversary. In addition, extensive experiments results demonstrate that PPMA has less computation overhead and no more extra communication and storage costs.

Network function virtualization (NFV) brings great conveniences and benefits for the enterprises to outsource their network functions to the cloud datacenter. In this paper, we address the virtual network function (VNF) placement problem in cloud datacenter considering users' service function chain requests (SFCRs). To optimize the resource utilization, we take two less-considered factors into consideration, which are the time-varying workloads, and the basic resource consumptions (BRCs) when instantiating VNFs in physical machines (PMs). Then the VNF placement problem is formulated as an integer linear programming (ILP) model with the aim of minimizing the number of used PMs. Afterwards, a Two-StAge heurisTic solution (T-SAT) is designed to solve the ILP. T-SAT consists of a correlation-based greedy algorithm for SFCR mapping (first stage) and a further adjustment algorithm for virtual network function requests (VNFRs) in each SFCR (second stage). Finally, we evaluate T-SAT with the artificial data we compose with Gaussian function and trace data derived from Google's datacenters. The simulation results demonstrate that the number of used PMs derived by T-SAT is near to the optimal results and much smaller than the benchmarks. Besides, it improves the network resource utilization significantly.

Multipath TCP (MPTCP) is designed to offer higher throughput than single-path TCP, and meanwhile MPTCP flow is fair to concurrent TCP flows at the bottleneck. Although the coupled congestion control in current MPTCP can achieve the goals by coupling different subflows, it only focuses on Congestion Avoidance but each subflow still behaves like an independent TCP flow in Slow-Start. However, during Slow-Start, MPTCP is unfair to concurrent TCP flows as it uses more network resources at the shared bottleneck than single-path TCP. Worse still, since the exponential growth of multiple concurrent subflows' congestion windows often results in serious buffer overflow and packet loss at the shared bottleneck, the latency of short flows using MPTCP is often not as good as using TCP. This leads to the fact that MPTCP cannot satisfy the above design goals when handling short flows. To address this issue, we present a Coupled Slow-Start (CSS) Algorithm in this paper. CSS links the exponential growth of subflows' congestion windows to ensure the fairness and reduce the burstiness of Slow- Start. To reduce the packet loss, CSS resets the Slow-Start Threshold (ssthresh) of different subflows for MPTCP to safely move to Congestion Avoidance when it achieves its expected throughput. Our simulation shows that CSS can lower short flows' latency of up to 45% and significantly reduce the packet loss in two typical network environments, meanwhile CSS is TCP-friendly at the shared bottleneck. Simulation results also indicate that CSS can perform at least as well as original MPTCP for the bulk data transfer in common network environments.

Smart grid facilitates reliable and efficient power generation and transmission by integrating information and communication technologies. By collecting users' power demands in advance, the control center (power operator) can adjust the amount of electricity generated to reduce the excess power, which can increase the profit of the power operator. However, on the one hand, user's privacy becomes a critical issue, since it may leak out a user's life habits, which may make user's safety and belongings under threat. On the other hand, the system needs to arm the capability to avoid diverse adversaries' attacks and trace misbehaving users (who request power irresponsibly). In this paper, we propose a privacy-preserving and real-time traceable power request scheme to fulfill the security requirements. We utilize aggregator as a proxy between users and the control center, which verifies the messages and aggregates multiple users' requests together to preserve their privacy. More importantly, this privacy-preserving mechanism has no effect for the control center to whether charge each user, or trace the misbehaving users in real time. The performance analysis shows that our scheme is efficient in terms of computation and storage overhead.

Attribute-based encryption (ABE) has opened up a popular research topic in cryptography over the past few years. It can be used in various circumstances, as it provides a flexible way to conduct fine-grained data access control. Despite its great advantages in data access control, current ABE based access control system cannot satisfy the requirement well when the system judges the access behavior according to attribute comparison, such as “greater than x” or “less than x”, which are called comparable attributes in this paper. In this paper, based on a set of well-designed sub-attributes representing each comparable attribute, we construct a comparable attribute-based encryption scheme (CABE for short) to address the aforementioned problem. The novelty lies in that we provide a more efficient construction based on the generation and management of the sub-attributes with the notion of 0-encoding and 1-encoding. Extensive analysis shows that: Compared with the existing schemes, our scheme drastically decreases the storage, communication and computation overheads, and thus is more efficient in dealing with the applications with comparable attributes.

Industries and individuals outsource database to realize convenient and low-cost applications and services. In order to provide sufficient functionality for SQL queries, many secure database schemes have been proposed. However, such schemes are vulnerable to privacy leakage to cloud server. The main reason is that database is hosted and processed in cloud server, which is beyond the control of data owners. For the numerical range query (“>,” “<;,” and so on), those schemes cannot provide sufficient privacy protection against practical challenges, e.g., privacy leakage of statistical properties, access pattern. Furthermore, increased number of queries will inevitably leak more information to the cloud server. In this paper, we propose a two-cloud architecture for secure database, with a series of intersection protocols that provide privacy preservation to various numeric-related range queries. Security analysis shows that privacy of numerical information is strongly protected against cloud providers in our proposed scheme.

Data access control is a challenging issue in public cloud storage systems. Ciphertext-policy attribute-based encryption (CP-ABE) has been adopted as a promising technique to provide flexible, fine-grained, and secure data access control for cloud storage with honest-but-curious cloud servers. However, in the existing CP-ABE schemes, the single attribute authority must execute the time-consuming user legitimacy verification and secret key distribution, and hence, it results in a single-point performance bottleneck when a CP-ABE scheme is adopted in a large-scale cloud storage system. Users may be stuck in the waiting queue for a long period to obtain their secret keys, thereby resulting in low efficiency of the system. Although multi-authority access control schemes have been proposed, these schemes still cannot overcome the drawbacks of single-point bottleneck and low efficiency, due to the fact that each of the authorities still independently manages a disjoint attribute set. In this paper, we propose a novel heterogeneous framework to remove the problem of single-point performance bottleneck and provide a more efficient access control scheme with an auditing mechanism. Our framework employs multiple attribute authorities to share the load of user legitimacy verification. Meanwhile, in our scheme, a central authority is introduced to generate secret keys for legitimacy verified users. Unlike other multi-authority access control schemes, each of the authorities in our scheme manages the whole attribute set individually. To enhance security, we also propose an auditing mechanism to detect which attribute authority has incorrectly or maliciously performed the legitimacy verification procedure. Analysis shows that our system not only guarantees the security requirements but also makes great performance improvement on key generation.

Data access control is a challenging issue in cloud storage. Ciphertext-Policy Attribute-based Encryption (CP-ABE) is a potential cryptographic technique to address the above issue, which is able to enforce data access control based on users' permanent characteristics. However, in some scenarios, access policies are associated with users' temporary conditions (such as access time and location) as well as their permanent ones. CP-ABE cannot deal with such situations commendably. In this paper, we focus on the scenario where users' access privilege is determined by their attributes, together with their locations. To cope with this data access control requirement, we propose a location-aware attribute-based access control mechanism (LABAC) for cloud. In LABAC, we uniquely integrate CP-ABE with location trapdoors to make up access policies. In this way, data owners can flexibly combine both users' attributes and locations to implement a fine-grained control of their data. A competitive advantage of LABAC is that it requires no any additional revocation mechanisms to revoke location-aware access privilege when user location changes. Security and performance analysis are presented which show the security and efficiency of LABAC for practical implementations.

Attribute-based Encryption (ABE) is regarded as a promising cryptographic conducting tool to guarantee data owners’ direct control over their data in public cloud storage. The earlier ABE schemes involve only one authority to maintain the whole attribute set, which can bring a single-point bottleneck on both security and performance. Subsequently, some multi-authority schemes are proposed, in which multiple authorities separately maintain disjoint attribute subsets. However, the single-point bottleneck problem remains unsolved. In this paper, from another perspective, we conduct a threshold multi-authority CP-ABE access control scheme for public cloud storage, named TMACS, in which multiple authorities jointly manage a uniform attribute set. In TMACS, taking advantage of ($t,n$) threshold secret sharing, the master key can be shared among multiple authorities, and a legal user can generate his/her secret key by interacting with any$t$authorities. Security and performance analysis results show that TMACS is not only verifiable secure when less than$t$authorities are compromised, but also robust when no less than$t$authorities are alive in the system. Furthermore, by efficiently combining the traditional multi-authority scheme with TMACS, we construct a hybrid one, which satisfies the scenario of attributes coming from different authorities as well as achieving security and system-level robustness.

The new paradigm of outsourcing data to the cloud is a double-edged sword. On one side, it frees up data owners from the technical management, and is easier for the data owners to share their data with intended recipients when data are stored in the cloud. On the other side, it brings about new challenges about privacy and security protection. To protect data confidentiality against the honest-but-curious cloud service provider, numerous works have been proposed to support fine-grained data access control. However, till now, no efficient schemes can provide the scenario of fine-grained access control together with the capacity of time-sensitive data publishing. In this paper, by embedding the mechanism of timed-release encryption into CP-ABE (Ciphertext-Policy Attribute-based Encryption), we propose TAFC: a new time and attribute factors combined access control on time-sensitive data stored in cloud. Extensive security and performance analysis shows that our proposed scheme is highly efficient and satisfies the security requirements for time-sensitive data storage in public cloud.

As terminals are equipped with multiple interfaces and allowed to access heterogeneous networks, transferring data simultaneously through all the available paths becomes possible and also brings many benefits. Multipath TCP (MPTCP) distributes an application stream over different TCP connections. Since different paths have disparate latencies, out-of-order packets problem occurs at receiver. Large number of these packets exhaust the limited receive buffer and make the receive window stall, which greatly degrade the throughput. Thus, a scheduling mechanism plays an important role to keep in-order delivery. Previous intelligent scheduling mechanisms schedule data independently each time and doesn't utilize the feedback carried in acknowledgements, which lose flexibility. Our Offset Compensation based Packet Scheduling (OCPS) mechanism gets feedback information from SACK options and gains the knowledge of whether last scheduling round still causes out-of-order problem. Then it modifies the scheduling next round accordingly by using an offset. The simulation results illustrate our mechanism enhance throughput and reduce cache occupancy at receiver.

In the above paper, Yanget al. have proposed a multi-authority ciphertext-policy attribute-based encryption-based data access control for cloud storage, in which the authors claimed that the mechanism in dealing with attribute revocation could achieve both forward security and backward security. Unfortunately, our further analysis and investigation show that their work adopts a bidirectional re-encryption method in ciphertext updating, so a security vulnerability appears. Our proposed attack method demonstrates that a revoked user can still decrypt new ciphertexts that are claimed to require the new-version secret keys to decrypt.

The last ten years have witnessed explosive growth in mobile data traffic, which leads to rapid increases in energy consumption of cellular networks. One potential solution to this issue is to seek out a green deployment strategy. In this paper, we investigate the energy-efficient deployment strategy under coverage performance constraints for both homogeneous and heterogeneous cellular networks. Unlike just considering the base station (BS) density in previous work, we jointly optimize the BS density and the BS transmission power. First, we derive the relation between the average coverage probability and deployment strategy (i.e., BS density and BS transmission power) with stochastic geometry tools. Then, based on the expression results, we formulate a network energy consumption minimization framework considering coverage performance constraints and jointly determine the optimal macro BS (MaBS) density, MaBS transmission power, and micro BS (MiBS) density. With practical data sets, numerical simulation results show the following: 1) compared with homogeneous network deployment, heterogeneous network deployment has the advantage in energy efficiency performance, and 2) our joint BS density and BS transmission power optimization strategy exceeds the existing strategy, which just considers the BS density optimization in terms of energy efficiency.

Nowadays, multi-interface terminals in heterogeneous network may access Internet through various access technologies, and further aggregate network resources from multiple paths as much as possible. Multipath TCP exploits multiple paths simultaneously by stripping data of a connection over multiple TCP flows, each of which is through a disjoint path. However, it encounters the problem caused by the great number of out-of-order packets at receiver due to dissimilar path characteristics, i.e. latency, bandwidth, packet loss rate, etc. The previous intelligent scheduling mechanisms to keep in-order delivery all ignored packet losses and became fragile in lossy networks. In this paper, we present Fine-grained Forward Prediction based Dynamic Packet Scheduling Mechanism(F2P-DPS) for multipath TCP. It utilizes the idea of TCP modeling to estimate the latency on the path under scheduling and the data amount sent on the other paths simultaneously, which takes packet loss rate into consideration, and then decides which packets to send on the under-scheduling path. From the simulation, we can see that our mechanism obviously improves throughput and reduces cache occupancy at receiver in lossy networks.

TCP with network coding (TCP/NC) makes the packet loss, which is caused by wireless transmission error, have no effect on congestion control. Current proposals prefer to use delay-based congestion control aspect(congestion avoidance phase) of TCP Vegas to deal with the congestion problem of TCP/NC. However, it is oversimplified and may lead to unfairness when both TCP flow and TCP/NC flow coexist in the congested wired bottleneck link in hybrid wired-wireless network. In this paper, congestion exposure enabled TCP/NC, named CEE-TCP/NC, is proposed to make TCP/NC be friendlier to TCP protocols in the case of congestion. CEE-TCP/NC replaces TCP's loss-based congestion indicator with a method based on analyzing gaps in the ACK stream that arrive at the TCP sender. Further, different levels of congestion can be detected and actions against congestion are taken accordingly. By theoretic analysis and simulation, we show that the scheme not only inherits the advantage of network coding to eliminate the effect of wireless transmission error, but also avoids damaging the performance of other competing flows.

Access control plays an important role in protecting security-sensitive sensor data from being utilized by malicious users. Despite the numerous studies on access control for wireless sensor networks WSNs, however, few of them pay attention to preserving user privacy, which has recently been an urgent demand of the network users. In this paper, we propose two access control schemes with different privacy preserving properties for WSNs, which can adaptively satisfy the demands of the sensor network users. First, on the basis of our signcryption approach, we propose a distributed query protected access control scheme where the query message is encrypted in the process of user authentication. Because no other users could decrypt and read the query message, the user can preserve the privacy of the target data type. With the additional help with proxy signature, we then design a distributed anonymous access control scheme. Apart from protecting the data type information, distributed anonymous access control preserves the privacy of the user's access behavior by anonymizing the user's identity. In contrast to the previous privacy-preserved access control schemes for WSNs, our schemes can efficiently protect the privacy of users without significantly increasing the network overhead and the energy consumption on sensors. Copyright © 2013 John Wiley & Sons, Ltd.

With the popularity of group data sharing in public cloud computing, the privacy and security of group sharing data have become two major issues. The cloud provider cannot be treated as a trusted third party because of its semi-trust nature, and thus the traditional security models cannot be straightforwardly generalized into cloud based group sharing frameworks. In this paper, we propose a novel secure group sharing framework for public cloud, which can effectively take advantage of the cloud servers' help but have no sensitive data being exposed to attackers and the cloud provider. The framework combines proxy signature, enhanced TGDH and proxy re-encryption together into a protocol. By applying the proxy signature technique, the group leader can effectively grant the privilege of group management to one or more chosen group members. The enhanced TGDH scheme enables the group to negotiate and update the group key pairs with the help of cloud servers, which does not require all of the group members been online all the time. By adopting proxy re-encryption, most computationally intensive operations can be delegated to cloud servers without disclosing any private information. Extensive security and performance analysis shows that our proposed scheme is highly efficient and satisfies the security requirements for public cloud based secure group sharing.

Complex field network coding (CFNC) can be employed to achieve ideal throughput as high as 1/2 symbol per source per time slot (sym/S/TS) in relay-based cooperative communications. In this paper, equiphase precoder (EP) scheme for CFNC-based system (EP-CFNC) is proposed to achieve better symbol error probability (SEP) performance. The distribution of transmitted symbol's constellation is carefully designed against noise. The theoretical analysis provides a method to estimate the SEP and verifies the coding gain obtained by equiphase precoder. Moreover, simulation results, in both additive complex White Gaussian noise (AWGN) channels and Rayleigh fading channels, show that SEP can be substantially reduced via the proposed EP-CFNC algorithm.

Relay-based cooperative communication has become a research focus in recent years because it can achieve diversity gain in wireless networks. In existing works, network coding and the two-path relay scheme is exploited to deal with the increase in network size and the half-duplex nature of relay, respectively. To further improve bandwidth efficiency, we propose a novel cooperative transmission scheme which combines network coding and the two-path relay scheme together in the multi-source system. Due to the utilization of two-path relay, our proposed scheme achieves full-rate transmission. Adopting complex field network coding (CFNC) at both the sources and the relays ensures that symbols from different sources are allowed to be broadcasted in the same time slot. We also adopt physical-layer network coding (PNC) at the relay nodes to deal with the inter-relay interference caused by the two-path relay. With careful process design, our scheme can achieve the ideal throughput up to 1 symbol per source per time slot (sym/S/TS). Furthermore, the theoretical analysis provides a method to estimate the symbol error probability (SEP) and throughput in complex additive white Gaussian noise (AWGN) and Rayleigh fading channels. The simulation results verify the improvements achieved by the proposed scheme.

Since multi-radio multi-channel wireless mesh networks are widely brought into use, the channel assignment scheme plays a critical role in determining the performance of wireless mesh networks. Nowadays many channel assignment schemes have been proposed to enhance the performance of the wireless networks. However, most of the existing schemes assume that all the interference links induce the same level of interference on the target link, which will lead to poor network performance as the assumption deviates from the actual situation. In this paper, we propose a novel clique-based clustering channel assignment (CCCA) scheme which takes different levels of interfering links into consideration. By locally calculating maximum cliques in the interfering graph, CCCA logically partitions the networks into clusters and executes channel assignment in three stages to minimize interference of links including both non-coordinated interference and coordinated interference. The simulation results demonstrate that CCCA can significantly increase the network throughput, improve the fairness of network capacity distribution and decrease the end-to-end delay, which enhances the performance of the wireless mesh networks effectively.

Coded cooperation (CC) is an excellent scheme for cooperative communication. However, the throughput of CC is not high enough. In this paper, we propose a novel cooperative scheme called hierarchically modulated coded cooperation (HMCC). This scheme takes the frame group as the input instead of a single frame in CC and adopts hierarchical modulation in source node according to the asymmetry between the links of source-relay and source-destination, expecting that some frames can be received by destination node directly and others are forwarded by relay node. In HMCC, a higher order modulation can be used by source node. Theoretical analysis and simulation show that HMCC achieves a better performance on throughput compared to other schemes. On the other hand, HMCC distributes burst errors to the frame group owing to the hierarchical modulation, which suggests that HMCC is able to struggle against the burst errors.

In this paper, we present a new architecture to mitigate inter-cell interference in the uplink and improve the uplink capacity of Long Term Evolution (LTE), which is named LTE-based multi-hop cellular networks with out-of-band relaying. Based on the receiving reference signal strength of User Equipments (UEs), each cell is divided into two parts, the inner circle and the outer ring. Each UE is dual-mode including an LTE air interface and an IEEE 802.11 air interface. An active UE in outer ring is free to choose an available idle UE in inner circle as a relay station (RS) within its IEEE 802.11 radio coverage area for dual-hop communication with the E-UTRAN NodeB (eNB). We analyze the probability of RS selection under this architecture. Then an analytic mode is used to compute the effect on uplink capacity. Our results show that system's uplink capacity can be improved significantly when some parameters are appropriately selected.

Heterogeneous networks (HetNets) can provide a significant performance leap while cross-tier interference will become serious in HetNets. This paper focuses on solutions to the enhanced inter-cell interference coordination (eICIC) through adaptive power control. Four observations are concluded through the analysis of a typical interference case. A novel power control scheme without additional signalling exchange is proposed for femtocell. The remarkable performance is confirmed via system level simulation for the metrics of outage probability (OP) and energy efficiency (EE). The result shows that the novel power control scheme reducing the OP of macro cell UE (MUE) and femto cell UE (HUE) can improve the HUE throughput and maintain the highest EE from the view of system.

Femto is introduced to enhance the indoor coverage and the system capacity in LTE-Advanced system. Some methods, such as time domain interference coordination (TDIC) and frequency domain interference coordination (FDIC), have been discussed to deal with the interference between macro and femto cell when they are deployed in co- channel manner. However, TDIC operates well even though the system load is heavy but it cannot offer enough throughput in certain scenarios. On the contrary, FDIC could offer high throughput under light-load conditions at the cost of much more bandwidth. Combined the advantages of TDIC and FDIC, an approach of hybrid domain interference coordination (HDIC) is proposed and a greedy algorithm is designed in this paper. Moreover, different to the pure TDIC, TDIC used in HDIC is enhanced by allowing the user hopping to a better carrier to cooperate, namely carrier selective TDIC (CS-TDIC). Simulations show that HDIC could improve the average throughput of system in the case of light load and enable more users to meet their QoS demand of services when the load is heavy.

Nowadays, energy saving in wireless communications has become a hot topic as energy consumption increasingly becomes a global environment problem. In this paper, we formulate an Energy Consumption Rating (ECR) minimization problem in a multi-layer network and provide analysis of its property and complexity. To solve this problem, we propose the Enhanced Mobility Load Balancing (EMLB) firstly. A heuristic and practical algorithm is then introduced, which transfers traffic using EMLB in vertical and horizontal directions and adaptively switches off/on some cells based on traffic load condition. The performance of the proposed algorithm is evaluated by comparing with existing static and dynamic schemes through system level simulations. The simulation results demonstrate that our proposed scheme not only has good system throughput performance, but also achieves significant power saving in typical traffic scenario.

In order to provide high data rate for indoor services, femtocells are proposed in LTE-Advanced system. Under this architecture, the main problem is how to reduce the interference between macro and femto cells and that among femtocells. In this paper, an interference graph is constructed in which the vertexes are Macro User (MUE) and femtocell. Besides, Regional Average Channel State (RACS) metric is proposed to estimate the weight of interference. Therefore, a dynamic spectrum assignment algorithm called hybrid clustering based on interference graph (HCIG) is proposed to reduce the interference, in which the optimal clustering problem is constructed as a MAX-K cut problem and a heuristic algorithm is given. Based on the cluster results, a resource allocation scheme is given to reduce the interference and improve the spectrum efficiency. System level simulation results show that compared to other three schemes, the SINR of both MUE and femto user are improved by HCIG.

Measurement studies of YouTube show that there are some distinctive properties regarding to video sharing service, e.g., small clip size, suggestion links between related clips. This observation motivates us to explore the possibility to use peer-assisted approach to offload content providers. Specifically, we want to leverage the suggestion links between video clips to construct cooperative caching overlay. In this paper, taking advantage of this correlation between video clips, we design a distributed algorithm to adapt the overlay towards a loosely connected Small World Network (SWN), in which similar-interest peers are clustered together by short links to maximize streaming cooperation, and long links are introduced to reduce switching delay when one peer switches to an unrelated clip. The simulation results indicate that our algorithm can reduce server load significantly, and maintains the overlay as a SWN.

In the pioneering works, network coding has shown great potential to improve the performance of wireless networks. However, most of them are implemented under specific traffic pattern. Since various traffic patterns will affect the promising gains of network coding, in this paper, we study how traffic pattern affects the benefits of general practical network coding scheme-Multi-hop Network Coding (MNC) in wireless networks. First, we analyze the idiosyncratic properties of MNC and raise two practical issues of MNC neglected before: iteration coding and path division. Subsequently, we put forward traffic factors to describe some characteristics of realistic traffic flows, and then qualitatively analyze the relations between the traffic factors and the gains of MNC. In addition, throughput boundary with MNC is formulated in the perspective of flows. Our evaluation also shows that particular MNC should be applied according to different traffic patterns to maximize network throughput and reduce the systematic overhead.

In Long Term Evolution (LTE) networks, Mobility Robustness Optimization (MRO) and Mobility Load Balancing (MLB) are two important functions to auto-optimize the network performances. There is a close correlation between them, as they both choose adjusting handover parameters as optimization actions. The conflict may occur between the two functions when they adjust the same handover parameter in opposite directions. This can not improve the performances but waste network resources. In this paper, we present a novel scheme to solve the problem. In order to prevent the occurrence of the conflict, we set an allowed range for MLB in which the handover problems can be prevented. Analyses and simulation results demonstrate that the proposed scheme can effectively solve the conflict problem and improve the performances of both functions.

In VANETs(Vehicular Ad Hoc Networks), moving from one RSU's coverage region to another will bring reauthentication in the new security domain, which can be named security handover problem. In this paper, based on mobility predictability, we propose a novel anonymous communication scheme called SCPT to address the security handover problem. It uses hash chain for vehicle's anonymous authentication. And it uses security context pre-transfer to provide security handover optimization. From security analysis and performance evaluation, SCPT can achieve security requirement in VANETs, and also reduce the implement latency after vehicle's handover.