Data compression techniques significantly improve storage efficiency, bandwidth utilization, and energy efficiency, yet they introduce challenges for the rapid browsing and retrieval of valuable information within compressed data. Existing approaches achieve high-speed, lossless matching by exploiting the context-free property of automata. However, they are constrained by the recursive reference structures in compressed data, which necessitate state copying to ensure matching safety.

In the evolution of 6G-based Vehicular Ad-hoc Networks (VANETs) from closed single-domain environments to open cross-domain environments, several security challenges arise, including heterogeneous domain trust barriers, vehicle identity privacy leakage, and high authentication overhead in dynamic scenarios. Existing schemes based on centralized public key infrastructure (PKI) suffer from single point failure risks and have difficulty balancing low latency with conditional privacy preservation. Meanwhile, blockchain-assisted solutions are often constrained by on-chain storage expansion and high computational overhead. To address these issues, this paper proposes a blockchain-assisted anonymous authentication scheme for 6G-VANETs. The proposed scheme uses blockchain to construct distributed trust anchors and enable secure sharing of public parameters across domains. By generating lightweight authentication parameters based on Lagrange interpolation polynomials, the scheme supports direct mutual authentication and session key agreement between vehicles without requiring massive certificate-related on-chain transactions. In addition, a pseudo-identity mechanism is introduced to achieve conditional privacy preservation, thereby balancing vehicle identity privacy and traceability. Security analysis demonstrates that the proposed scheme satisfies the required security properties under the random oracle model. Performance evaluation shows that compared with existing solutions, the proposed scheme significantly reduces computational overhead by 22.31%, 11.02%, and 29.19%, respectively, and communication overhead by 51.2%, 20.08%, and 24.61%, respectively.

Federated diagnosis, a concept emerging in Internet of Things (IoT)-based e-health systems, addresses the interconnectivity challenges of medical resources across different regions. Furthermore, flexible access control is required, which allows users to modify the access policy for encrypted data in the cloud without revealing sensitive information. Current solutions rely on third parties for policy modification, incur high computational overheads during user revocation, and expose user attributes to plaintext access policies. To address these issues, this study introduces a blockchain-assisted revocable federated diagnostic ciphertext policy attribute-based encryption (RFD-CPABE) scheme that enables policy conversion and revocation, which allows users to convert attribute-based encryption ciphertext to inner product encryption ciphertext swiftly and facilitates fast revocation using binary trees. This scheme enhances privacy protection by separating attribute names from values, thus concealing sensitive information within the access policies. Moreover, to reduce the computational burden on trusted institutions, the workload is decentralized utilizing a blockchain to minimize the pressure on the central servers. The formal security proof demonstrates the resilience of the scheme against selective chosen-plaintext attacks, and the experimental analysis confirms its superior efficiency compared to existing solutions.

In psychometry, psychometric profiles of an individual subject as well as correlations among the psychometric profiles are crucial supports for assessing the psychometric preference of the individual subject. Intuitively, while sufficient psychometric profiles in terms of amount and types yield high assessment accuracy, too many psychometric profiles increase workloads of subjects, because measuring a psychometric profile of an individual subject requires filling out one psychological questionnaire at least. The trade-off between assessment accuracy and participant burden constitutes a core challenge in psychometric research, because it directly affects both the statistical validity of findings and the cognitive feasibility of large-scale evaluation. Existing assessment frameworks often struggle to reconcile efficiency with precision. This challenge underscores the need for a new modeling paradigm capable of reducing measurement redundancy while preserving interpretability and reliability. Therefore, inspired by the semantic field, this paper defines a new concept, namely$\mathrm{\emph {profile}}$$\mathrm{\emph {field}}$, and proposes a novel framework, i.e.,$\mathrm{\emph {PsycHin}}$, to achieve the trade-off. Specifically,$\mathrm{\emph {PsycHin}}$can be decomposed into three phases:$i$) modeling the psychologically cognitive processes, where$\mathrm{\emph {PsycHin}}$learns multiple explicit and implicit correlations among psychometric profiles based on a heterogeneous information network and defines a profile meta structure to guide instance extraction;$ii$) fitting data and calculating similarities among subjects, where$\mathrm{\emph {PsycHin}}$utilizes$\mathrm{\emph {tanh}}$to make up for the rating biases caused by the discrete scores from options of psychological questionnaires and employs entropy to measure the cognitive levels of subjects on same objects; and$iii$) constructing profile fields, where$\mathrm{\emph {PsycHin}}$calculates the importance of psychometric profiles and filters the noisy ones by leveraging the contribution rates of psychometric profiles. Our experimental results not only show that$\mathrm{\emph {PsycHin}}$performs well, but also demonstrate that incorporating the heterogeneous information network into psychometric preference assessment does improve the performance of$\mathrm{\emph {PsycHin}}$.

In vehicular ad hoc networks (VANETs), distributed identity authentication provides the foundation for securing sessions among entities over wireless channels while eliminating single points of failure. However, existing distributed authentica tion schemes for VANETs typically make unrealistic assumptions about node reliability and trustworthiness, failing to account for scenarios where authentication nodes may be compromised or collude with vehicles. Moreover, these schemes expose the com munication process to linkability attacks while allowing vehicles to self-register their public keys. To address these limitations, we propose a privacy-preserving and accountable distributed collab orative authentication scheme for VANETs that is resilient to ma licious nodes. Using threshold signature techniques, distributed authentication nodes collaboratively perform decentralized ve hicle identity authentication using a predefined threshold. Zero knowledge proof protects the privacy of the signing process while maintaining accountability and effectively preventing malicious behavior by nodes under external or internal adversarial attacks. Furthermore, vehicles self-register their public keys via smart contracts and blockchain technology, ensuring anonymity and unlinkability during registration while enabling the traceability of malicious vehicles. Security and performance analyses show that the proposed scheme enhances the security and robustness of distributed collaborative authentication in VANETs, achieving a better balance between computational and communication costs than existing schemes

Attribute revocation is a secure data-sharing system that allows user revocation of shared data. The most effective attribute revocation scheme is still less effective in the revocation process. When revoking a user's access rights to a specified ciphertext, both that ciphertext and the keys of all other users must be updated. Similarly, when revoking a user from accessing all ciphertexts, all ciphertexts related to the revoked user and the keys of all non-revoked users must be updated, with computational cost linear to the number of attributes associated with the revoked user. In this work, to enhance the effectiveness of revocation, we design a cloud data-sharing system that supports flexible revocation. By introducing edge-server-assisted key puncturing techniques, our approach eliminates the need to update ciphertext and other users' keys when revoking a user's access rights to a specific ciphertext. Additionally, we leverage key splitting technology to divide data users' permissions between the data owner and the authority, ensuring that the update overhead for non-revoked users remains constant when revoking a user's access to all ciphertexts. On resource-constrained devices, when involving 50 attributes, non-revoked users only need approximately 0.02 milliseconds to update their keys, resulting in a 25x improvement in update speed.

Some smart contracts violate decentralization principles by defining privileged accounts that manage other users' assets without permission, introducing centralized risks that have caused financial losses. Existing methods, however, face challenges in accurately detecting diverse centralized risks due to their dependence on predefined behavior patterns. In this paper, we propose JANUS, an automated analyzer for Solidity smart contracts that detects financial centralized risks independently of their specific behaviors. JANUS identifies differences between states reached by privileged and ordinary accounts, and analyzes whether these differences are finance-related. Focusing on the impact of risks rather than behaviors, JANUS achieves improved accuracy compared to existing tools and can uncover centralized risks with unknown patterns. To evaluate JANUS's performance, we compare it with other tools using a dataset of 540 contracts. Our evaluation demonstrates that JANUS outperforms representative tools in terms of detection accuracy for financial centralized risks. Additionally, we evaluate JANUS on a real-world dataset of 33,151 contracts, successfully identifying two types of risks that other tools fail to detect. We also prove that the state traversal method and variable summaries, which are used in JANUS to reduce the number of states to be compared, do not introduce false alarms or omissions in detection.

In vehicular ad hoc networks (VANETs), authentication and key agreement (AKA) protocols are crucial for establishing secure authentication and session keys for network communications, ensuring security for short-term vehicle interactions. However, traditional VANETs AKA schemes heavily rely on centralized trust architectures. This dependence raises significant concerns about overall system security and resilience, especially when these schemes operate over insecure wireless channels. Although recent studies have introduced decentralized architectures to mitigate this issue, a key limitation remains. These approaches typically assume synchronous network environments, which in practice limits their true decentralization capabilities in dynamic VANETs. To address these challenges, we propose a decentralized and asynchronous AKA scheme based on a consortium blockchain that enables the execution of the key agreement process in asynchronous VANETs environments. Furthermore, we employ lightweight cryptographic techniques combined with a Cuckoo filter to optimize computational efficiency, reduce communication overhead, and minimize on-chain storage costs. Security analyses and simulation experiments demonstrate that the proposed scheme delivers robust security and high performance under realistic network conditions.

Recently, unmanned aerial vehicles (UAVs) have undergone rapid development, demonstrating significant potential in various fields, including logistics, military operations, and entertainment. By collaborating to form swarms, UAVs can undertake more complex tasks such as mapping and disaster relief. To address the limited flexibility of UAV swarm identity authentication and the requirement for swarm splitting during task execution, we propose a runtime threshold signature (RTS) scheme. Unlike traditional threshold signatures, RTS defers the selection of the threshold from the initialization phase to the signing phase, allowing verifiers to dynamically adjust the threshold as required, thus achieving an effective balance between efficiency and security. Moreover, the RTS has the same signature size as the Schnorr signature, which is a non-interactive threshold signature. Building on the RTS primitive, we designed a novel identity authentication scheme that supports the autonomous splitting of UAV swarms. This scheme enables secure swarm-level identity authentication while adapting naturally to dynamic swarm restructuring. Furthermore, we demonstrate that the proposed scheme satisfies unforgeability under the t-VCDH assumption. To evaluate its performance, we implemented our scheme in C++ on AmovLab Prometheus 600 (P600) UAVs and assessed it under varying network latency and bandwidth conditions. Comparative results with existing schemes demonstrate that our approach achieves lower computational overhead and high practical applicability. Notably, even with the threshold set to 128, the authentication process takes only 2.6 ms per UAV.

Multi-replica data storage is widely adopted in edge computing to improve both data availability and access efficiency for latency-sensitive applications. Integrity auditing is a critical mechanism for ensuring data reliability in this distributed setting. However, existing schemes face a trade-off between security and efficiency: ensuring replica authenticity typically requires users to generate unique tags for all copies, creating a bottleneck for resource-constrained devices. Delegation schemes reduce this burden but struggle to prevent collusion or on-the-fly generation attacks. Therefore, this study proposes ATRIA to resolve this dilemma. Uniquely, ATRIA leverages the Trusted Execution Environments (TEEs) not only for isolation but to securely offload the intensive replica tag generation from the user, ensuring authentic physical storage with minimal user overhead. By leveraging the hardware isolation of the TEEs, this mechanism ensures authentic physical storage and protects against on-the-fly and collusion attacks. In addition, the scheme incorporates a privacy-preserving identity management solution that balances anonymity and traceability. It employs a traceable anonymous identity mechanism whereby users interact via pseudonyms, hiding their real identities while allowing a trusted Key Generation Center (KGC) to perform identity tracing only when authorized. Our security analysis demonstrates that the proposed scheme achieves its security objectives and resists various attacks. Furthermore, a comprehensive performance evaluation demonstrates that ATRIA outperforms related schemes in terms of computational overhead.

In unmanned aerial vehicle (UAV) scenarios, the execution of specific flight missions requires anonymous certificates containing multiple attributes as proof of authorization. However, existing certificate- management schemes are ineffective in achieving an optimal trade-off between verification overhead and attribute-level revocation. First, most existing schemes bind multiple attributes to a single certificate but typically lack the capability of fine-grained revocation at the individual attribute level. Second, most existing schemes rely on centralized certificate authorities, necessitating UAVs to apply for certificates from multiple regions separately when performing cross-regional access. This scenario increases the certificate management burden. To address these challenges, this paper proposes a distributed multiattribute anonymous certificate management scheme for UAVs. First, the proposed scheme integrates redactable signatures and dynamic accumulators, enabling the selective disclosure and fine-grained revocation of attributes within a single certificate. Second, the proposed scheme utilizes a distributed key-generation mechanism, enabling decentralized certificate issuance and secure management.

Federated learning is a privacy-preserving distributed learning paradigm in which a server coordinates multiple clients to train a global model. However, current federated optimization introduces bias by favoring the interests of specific clients, overlooking the concerns of vulnerable participants to maximize global benefits. Many efforts have been made in the pursuit of fairness for this shortcoming, yet we notice that such endeavors exhibit extremely poor robustness. A minimal amount of malicious tampering is sufficient to disrupt convergence. In fact, we recognize a subtle trade-off between robustness and fairness, which remains an open question. To address these concerns, we propose FairRoP, a systematic strategy that enhances fairness and guarantees robustness with adaptive client selection. We model complex multi-objective optimization problems using a simple and efficient ϵ-greedy Thompson Sampling Multi-Armed Bandit (TS-MAB). At the core of this approach are three submodules:fairness awareness, attack detection, andq-Balance, each designed to tackle specific sub-problems within the broader optimization challenge. Our experimental results, conducted on real datasets, showcase that FairRoP significantly improves overall fairness and robustness compared to state-of-the-art solutions. Furthermore, our approach seamlessly integrates with other aggregation algorithms.

In recent years, vehicle announcement sharing has become increasingly important in intelligent transportation networks. However, the demand for secure communication and real-time responses necessitates the development of an efficient and confidential announcement sharing scheme. Existing solutions are constrained by inadequate privacy in inter-group sharing and lack of storage security consideration. To address these issues, we propose a blockchain-assisted secure announcement sharing scheme with controllable verifiable distributed security. This scheme constructs a re-encrypted group signature framework to achieve controlled confidentiality of announcements while ensuring efficient and secure sharing. Additionally, by designing a lightweight verification algorithm powered by the Inter Planetary File System (IPFS) and blockchain, the scheme ensures rapid verifiable secure both the initial and long-term storage of announcements. Security proof and analysis show that the proposed scheme offers enhanced security and robust privacy protection. Performance analysis demonstrates that, while providing better computational efficiency than other schemes, the proposed scheme maintains low communication overhead and smaller storage verification costs, outperforming existing announcement sharing schemes.

In vehicular ad-hoc networks (VANETs), message reporting is an effective method for improving traffic safety and efficiency. Most existing VANET message reporting schemes rely on the trust value of a single vehicle to determine message authenticity, which leads to unreliable message sources. Even multi vehicle-assisted reporting schemes are limited by the assumption that all vehicles have the same credibility, which does not reflect the actual dynamic VANET environment in which vehicles have different credibilities. To address this issue, we propose a blockchain-assisted VANET message reporting scheme with weighted threshold signatures. Through the design of weights, the credibility of different vehicles is quantified, and the impact of vehicles on the signing process is differentiated. Threshold signature generation relies on the weight sum of all signatories reaching a predetermined threshold, to enable flexible and reliable message reporting. Security analysis shows that our proposed scheme combined with blockchain can satisfy the security and privacy requirements of VANET message reporting. Performance analysis indicates that our proposed scheme outperforms the most advanced VANET message reporting schemes in terms of transmission and computation performance.

With increasingly complex tasks, cooperation among multiple unmanned aerial vehicle (UAV) groups has become more significant. However, in complex operational environments, UAVs may operate outside the communication coverage of the trusted authority (TA), making continuous online TA services unavailable. Under such circumstances, most existing group management methods have difficulty achieving group fusion and cannot flexibly update post-fusion member certificates. Therefore, we propose an autonomous UAV group management scheme based on mobile proactive secret sharing. First, the scheme achieves autonomous group fusion by updating the subsecrets of UAVs. Second, without the participation of a TA, the scheme supports the dynamic self-updating of certificates, ensuring secure communication in the new group and continuous availability of certificates. Security proofs and analyses show that the proposed scheme is secure under the random oracle model and can resist several common attacks. The experimental results demonstrate that the proposed scheme outperforms related schemes in computational performance and is suitable for secure and efficient UAV group management scenarios.

In the Industrial Internet of Things (IIoT), data is shared among different production segments for collaborative production. However, industrial production processes often involve corpus sensitive information, and during data sharing, every flow of data between different subjects increases its exposure to vulnerabilities. Proxy re-encryption offers a practical approach to enabling secure data exchange, thereby partially mitigating the tension between information sharing and privacy protection. Many scholars have proposed data-sharing schemes utilizing proxy re-encryption technologies. However, existing schemes still face issues, such as excessive communication and computational overhead, and cannot guarantee forward security. Therefore, this study proposes a lightweight and forward-secure data-sharing scheme. First, the proxy generates the re-encryption key, substantially alleviating the overhead on the data owner. Second, whenever the time node changes or a data user is revoked, the data user loses access to historical data, which effectively ensures forward security. The security proof confirms the scheme’s IND-CPA security under the DBDH assumption. Performance analyses reveals that the proposed scheme achieves higher security in data sharing with a lower computational overhead.

In the vehicular ad-hoc networks (VANETs), crossdomain communication among vehicles significantly improves traffic efficiency and road safety. However, due to the vulnerabilities of vehicle communication, it faces numerous security challenges when performing cross-domain communication. Existing schemes rely on trusted third parties for cross-domain authentication, resulting in issues such as low computational efficiency and weak privacy protection for vehicles, which cannot meet the demands of large-scale vehicle cross-domain communication. To address these problems, we propose an efficient and anonymous cross-domain authentication scheme based on edge computing. By using edge gateways to manage vehicle groups and handle cross-domain event requests, we solve the performance bottleneck issues caused by centralized authentication. Additionally, the use of a batch authentication mechanism further improves computational efficiency during large-scale authentications and reduces authentication latency. Security and performance analyses show that the proposed scheme can meet the security and performance requirements for cross-domain vehicle communication.

The Metaverse, an immersive parallel digital world, faces critical security challenges such as data leakage and impersonation attack. Existing authentication schemes often suffer from single-point failures due to centralization, incomplete decentralization, and low efficiency. To address these challenges, this paper proposes TDID, a three-factor decentralized identity authentication scheme. Our core contribution lies in the novel synergy of a confidential smart contract, executed within a Trusted Execution Environment (TEE), with the offline attackresistant OPAQUE password-authenticated key exchange protocol. The scheme achieves full decentralization by using the TEE-based contract as a decentralized root of trust. It allows users to establish a globally unique, collision-resistant identity, and ensures that a user's password and biometric key are never revealed to the server during authentication, thus providing robust resistance against offline dictionary attacks even from a compromised server. Rigorous security analysis, including formal verification using ProVerif and a provable security proof, along with performance evaluations, demonstrates that the proposed scheme significantly enhances security while maintaining efficient computational and communication performance.

To achieve secure communication in unmanned aerial vehicle (UAV) swarms during emergency rescue operations, A wide range of authentication key agreement (AKA) schemes has emerged in recent research. However, these schemes generally face three critical limitations. First, UAVs may struggle to maintain persistent communication with the trusted authority in complex environments, and efficient authentication cannot be guaranteed when the TA is offline. Second, most existing schemes lack traceability, preventing the TA from revealing the true identity of malicious UAVs. Finally, UAVs are constrained by limited computational and communication resources. So we propose an AKA scheme that enables secure communication between the UAV and BS. Specifically, proposed scheme eliminates reliance on a trusted authority during the AKA phase, while still ensuring the establishment of a secure communication channel. In addition, by combining the Chinese remainder theorem with the chameleon hash function, the scheme not only enables mutual authentication between UAVs and base stations but also enhances overall computational efficiency in complex environments. Formal security analysis and rigorous proof indicate this design upholds various protective attributes and effectively withstands diverse known attacks. Finally, experimental evaluations validate efficiency and practicality about proposed scheme in some environments.

The widespread availability of similarity queries over trajectory data has led to numerous real-world applications, such as traffic management and path planning. With the proliferation of trajectory data, data owners often outsource storage and computation tasks to the cloud due to limited computing and storage resources. However, this scenario raises sharp security concerns, where it is critical to ensure both the integrity of query results and privacy during query processing. Furthermore, most existing works assume a single-user setting where all query users share the same key, which may lead to query privacy leakage. Therefore, in this article, we take the first step in studying the issue of multiuser and secure trajectory similarity range query (MSRQ). Specifically, inspired by the M-tree, we propose a secure index based on a distributed two-trapdoor public-key cryptosystem (DT-PKC), called M*-tree, and devise secure protocols to support multiuser query processing. We also carefully design a filtering strategy and verification scheme to ensure fast search and integrity guarantees. Finally, we theoretically analyze the security and complexity and empirically evaluate the performance and feasibility of our proposed approach.

Dynamic searchable symmetric encryption (DSSE) ensures that outsourced data can be searched and updated without compromising data availability. Recent efforts on DSSE have mainly focused on exact keyword retrieval, but considering that misspellings are common and practical, it is necessary to support the functionality of fuzzy keyword search. However, most existing fuzzy keyword search schemes do not consider malicious cloud servers and forward-privacy guarantees. The former may lead to the implementation of a fraction of search operations or forge the results and the latter may reveal the association between the newly updated data and previous search tokens. Therefore, in this article, we investigate the issue of dynamic and verifiable fuzzy keyword search with forward security (DVFKF). Specifically, DVFKF first uses locality sensitive hash to map approximate keywords into the same hash bucket, then links the hash buckets to obtain the bucket strings. Next, to accelerate the performance and support forward privacy, we propose a chain index for each bucket string through counters. Further, to guarantee the integrity of the results, we integrate the Merkle hash tree and chain index to verify the correctness and completeness of the results. Finally, we conduct formal security analysis and empirical evaluations to demonstrate the feasibility and practicality of our scheme on real datasets.

Deploying machine learning models on large-scale IoT devices in edge networks is challenging. Federated edge learning (FEEL) has emerged as a potential solution based on a hierarchical architecture. However, existing research relies primarily on an idealized cross-device assumption, overlooking more realistic cross-silo scenarios where devices typically belong to different organizational silos. To facilitate multi-group collaboration, we first propose a semi-decentralized FEEL structure called FEELPGen, in which different silos collaborate in training to maximize local model benefits without relying on trusted third-party coordination. Based on that, a two-layer aggregation algorithm is proposed to enhance the generalization ability under highly heterogeneous data distribution. For inner-silo learning, we devise a heterogeneity-aware, synchronous inner-silo aggregation algorithm utilizing data-free knowledge distillation based on generative learning (Gen). Feature vectors are generated to approximate silo knowledge. For inter-silo learning, a personalized (P), asynchronous inter-silo aggregation algorithm is proposed with adaptive selection and dynamic weight queues. To further improve efficiency, we introduce an optional optimized scheme, FEELPGen+, which integrates a privacy-preserving dimension-reduction algorithm. Finally, we provide a detailed analysis for convergence and complexity to verify the feasibility of FEELPGen. Extensive experiments demonstrate that FEELPGen achieves significant improvement in accuracy compared to the state-of-the-art schemes.

With the advancement of computing and communication technologies, Industrial Internet of Things (IIoT) has emerged accordingly. In IIoT environments, efficient data sharing is achieved through collaboration among end devices, edge servers, and cloud servers. However, ensuring the security, efficiency, and fairness of service data access for end devices remains a significant challenge. To address this, we propose a fair and efficient revocable access control scheme based on blockchain. The proposed scheme leverages smart contracts to establish a fair payment mechanism, ensuring fairness for IIoT data sharing. In addition, a proxy-assisted decryption approach is employed to minimize the decryption overhead on end devices. Moreover, the scheme supports efficient user revocation without requiring updates to the private keys of end users. This enhances the overall security and usability of the system. Finally, a thorough security and performance analysis indicate that the proposed scheme fits well within IIoT scenarios.

Event Extraction involves extracting event-related information such as event types and event arguments from context, which has long been tackled through well-designed neural networks or fine-tuned pre-trained language models. These approaches require substantial annotated data for tuning parameters and are resource-intensive. Recently, Prompting strategies with frozen parameters, such as Chain-of-Thought and Self-Consistency, have delivered success in NLP using LLMs by generating intermediate thought steps. However, they suffer from the challenge of error propagation and lack of interaction between different thoughts. In this paper, we proposeNeural Network-based Prompting(NetPrompt), a novel network-structured prompting strategy for event extraction. The core idea behind NetPrompt is to imitate the excellent information integration capabilities of neural network structures. Specifically, we first decompose the event extraction problem into diverse intermediate subtasks, and each subtask is represented as a node in different layers of the network, the output of the nodes in the preceding layer is fed into the subsequent layer. Secondly, we propose pruning strategies to adapt the reasoning overhead to different problems. Finally, we have conducted extensive experiments on two widely used event extraction benchmarks to evaluate NetPrompt. The results demonstrated that NetPrompt significantly improved the event extraction performance compared to previous methods.

The anonymity of blockchain may be exploited by criminals for illegal fund transfers, thus a conditional privacy-preserving scheme is important for blockchain regulation. Currently, sharding technology under a multi-chain architecture is used to improve blockchain scalability. However, current conditional privacy-preserving schemes cannot work on this architecture. To protect the privacy of the transaction, we present a conditional privacy-preserving transaction scheme (MC-CPPT) for multi-chain blockchain system. In this system, we proposed a zero-knowledge proof based anonymous transaction, in terms of the identities of transaction participants and amounts, which also enables the unlinkability of transactions and indistinguishability between cross-chain and intra-chain transactions in multi-chain blockchain system. In addition, a multi-node regulatory agency is introduced to control the transaction amount and frequency in the system without a single point of failure. Moreover, an ECC-based encryption scheme is proposed to achieve the traceability of suspicious transactions. A security model is defined and the security of MC-CPPT is demonstrated to meet the expected security goals. Evaluating the prototype revealed acceptable performance and additional security features.

Ensuring cloud data security and reducing cloud storage costs have become particularly important. Many schemes expose user file ownership privacy when deduplicating authentication tags and during integrity auditing. Moreover, key management becomes more difficult as the number of files increases. Also, many audit schemes rely on third-party auditors (TPAs), but finding a fully trustworthy TPA is challenging. Therefore, we propose a blockchain-based integrity audit scheme supporting data deduplication. It protects file tag privacy during deduplication of ciphertexts and authentication tags, safeguards audit proof privacy, and effectively protects user file ownership privacy. To reduce key management costs, we introduce identity-based broadcast encryption (IBBE) that does not require interaction with key servers, eliminating additional communication costs. Additionally, we use smart contracts for integrity auditing, eliminating the need for a fully trusted TPA. We evaluate the proposed scheme through security and theoretical analyses and a series of experiments, demonstrating its efficiency and practicality.

Cloud Data Centers are typically equipped with various types and performance levels of GPUs, making it crucial to effectively leverage these heterogeneous resources when deploying deep learning tasks. However, differences in GPU performance pose complex resource management challenges. Accurate workload forecasting can help address these challenges. Many existing prediction models employ Multi-Layer Perceptrons (MLPs) due to their simplicity, computational efficiency, and general applicability. Nevertheless, most MLP-based methods tend to prioritize low-frequency features, neglecting high-frequency features that are essential for capturing fine-grained patterns in resource utilization data. Our analysis reveals that this bias primarily stems from the dominance of low-frequency features in the dataset, causing the model's attention to disproportionately focus on them. To tackle this issue, we propose a frequency domain patch-based MLP model called FP-MLP, which partitions the frequency series into small patches, thereby balancing the representation of high and low-frequency features across different bands. This approach enables the model to fully capture hidden features in high-frequency data, thus improving predictive accuracy. Extensive experiments demonstrate that the FP-MLP model consistently outperforms various state-of-the-art baseline models with stable performance. For instance, on the Alibaba dataset, compared to the best baseline model, the FP-MLP model reduces the Mean Squared Error (MSE) by 8% and the Mean Absolute Error (MAE) by 17%; meanwhile, it also achieves competitive results on the Google.

The rapid growth of Cloud Computing, Artificial Intelligence, and Big Data cloud workloads, intensifying resource contention, operational costs, and carbon emissions due to underutilized data centers. Accurate workload prediction is thus for proactive resource management and improved utilization of Cloud data centers. However, traditional statistical and machine learning methods struggle with the dynamic, high-dimensional, and heterogeneous nature of cloud workloads. This paper proposes STiFF, a novel prediction framework that, for the first time in workload forecasting, transforms time series data into graph-based image representations to capture spatiotemporal dependencies. STiFF integrates three key modules: (1) a Two-Dimensional Moving Average Decomposition (2D-MAD) for trend smoothing, (2) a Global-Local Feature Extraction (GLE) module combining CNNs and Transformers for hierarchical pattern learning, and (3) a Multi-modal Feature Fusion (MFF) module leveraging attention mechanisms and partial prior knowledge. Extensive experiments on four real-world datasets demonstrate that STiFF achieves an average error reduction of 62.14%, with a maximum of 90.84%, and outperforms state-of-the-art methods in 84.375% of the evaluated cases.

With the rapid development of vehicular ad-hoc networks (VANETs) and the increasing diversification of user demands, interactions between different management domains have become more frequent. Identity authentication is an effective way to establish cross-domain trust and secure communication. However, the existing cross-domain authentication schemes of VANETs are limited to the same management or authentication technology for each domain and rely on centralized cross-domain identity management. Even distributed management solutions encounter latency sensitivity, security and privacy challenges. To address these challenges, we propose a blockchain-assisted revocable cross-domain authentication scheme for VANETs. The proposed scheme can establish trust between domain entities by deploying different authentication methods and using distributed management to avoid single-point failures. In addition, the scheme can revoke the identity of malicious vehicles by updating the group public key, thereby ensuring the security and privacy of cross-domain Vehicle-to-Vehicle (V2V) and Vehicle-to-Infrastructure (V2I) communication. This design avoids the additional impacts of blockchain technology constraints on the high mobility and real-time requirements of VANETs. Security analysis and performance evaluation show that our scheme can resist more attacks and has better security than other related schemes while also achieving a better balance between communication and computational cost.

The network architecture of modern vehicles is composed of multiple communication protocols and electronic control units (ECU). Compared to the widely used protocol of Controller Area Network (CAN), CAN with Flexible Data-Rate (CAN-FD) protocol is suitable for applications requiring higher data throughput. However, the CAN-FD bus is vulnerable to intrusion by external attackers. Nowadays, several secure mechanisms have been proposed to protect the security of in-vehicle data. However, there are still two issues: 1) Most schemes use a centralized controller for key distribution, which can easily lead to a single point of failure; 2) The existing key management modes are not suitable for real-world CAN-FD networks in vehicle manufacturing. To address these issues, we propose a lightweight semi-decentralized scheme based on Database CAN (DBC) files to secure in-vehicle communication. ECUs are grouped on the send-receive relationships set in the DBC file, considering both the communication mode and sending efficiency. Furthermore, the proposed scheme overcomes reliance on long-term keys. Moreover, the security is analyzed by the random oracle model. The performance analysis is evaluated on microcontroller units (MCU) STM32H743IIT and Raspberry Pi 3B. The proposed scheme optimizes the computational costs of authentication, key agreement, and secure communication stages by up to 97.89%, 99.95%, and 82.35%, and optimizes the communication costs by up to 75.52%, 98.42%, and 29.41% compared to existing methods. Simulation experiments demonstrate that the bus load of the scheme increases by up to 9.84% compared to the baseline network.

Introducing the SDN paradigm can further improve the handover efficiency of mobile nodes, and researchers have proposed corresponding solutions to the security problems in the handover process. Some existing cryptography-based schemes delegate authentication to the fog nodes to accelerate the handover process, however, the computation and communication overheads are not low enough to satisfy the requirements of delay-sensitive vehicular applications. To realize secure handover of vehicles in software defined vehicular networks (SDVN), in this paper, based on symmetric cryptography, we propose a lightweight and secure handover scheme with conditional privacy-preserving for group-based SDVN. The handover authentication only involves lightweight operation, without based on elliptic curve cryptography or involving complex bilinear pairing operations. After successfully authenticating with the SDN controller, the vehicle can directly authenticate with the fog nodes in the same group. The polynomial and one-way hash chain are used to realize group key update. We use BAN logic and ProVerif to formally analyze and test the security of our scheme. The detailed security analyses show that the scheme can resist common types of attacks and meet the essential security and privacy requirements. Compared with other related and represented works, our scheme exhibits better performance in computation and communication overheads.

Vertical Federated Learning (VFL), as one of the key paradigms in federated learning, is commonly employed in scenarios where multiple parties share the same sample set but possess different features for these samples. Previous studies have demonstrated that VFL is vulnerable to backdoor attacks due to its inherent characteristics. However, the issue of backdoor attacks in encryption-protected VFL has been underexplored. In such scenarios, adversaries cannot directly access plaintext sample-level gradients, which seemingly offers enhanced security for VFL. Adversaries are restricted to leveraging their own bottom model and a small subset of auxiliary samples to conduct backdoor attacks, rendering many existing attack strategies ineffective. In this paper, we propose a powerful backdoor attack: BAEVFL (Backdoor Attack on Encryption-protected Vertical federated Learning), which is executed through three key stages: pseudo-label inference, trigger optimization, and backdoor poisoning. Our attack can be successfully launched without access to plaintext gradient information or auxiliary samples including all classes. Instead, it requires only the adversary’s bottom model and a minimal set of target class samples. We conducted extensive experiments demonstrating that BAEVFL outperforms various state-of-the-art baseline methods, achieving over 98% ASR on four benchmark datasets, while the impact on model utility remained below 0.3%. Additionally, we evaluated the effectiveness of current representative defense methods against our BAEVFL. The results indicate that existing defenses fail to strike a balance between defense and utility, and we provide key suggestions for potential improvements to these methods. The BAEVFL, with its stealth and effectiveness, exposes significant security vulnerabilities in encryption-protected VFL, underscoring the urgent need for future research on robust defense mechanisms for this paradigm.

Due to the rising requirement for data sharing, multi-data owner access control schemes have emerged, where a single data file is jointly owned by multiple data owners. Since the shared files contain information from multiple data owners, it is crucial to revoke malicious users to minimize harm when data leakage occurs. However, current multi-data owner solutions typically rely on a single data owner to encrypt and share data and fail to provide robust user revocation. When revocation is managed by a single entity, it may fail to protect the rights of all data owners and can introduce a single point of failure in multi-data owner settings. On the other hand, if revocation requires the participation of all data owners, user access may fail if some owners are offline or compromised. To address these issues, we propose a robust multi-data owner access control scheme with efficient user revocation. We construct a secret resharing protocol based on secret sharing technology and proposed a multi-data owner access control scheme. Only users who obtain a sufficient number of private keys can decrypt the ciphertext. To achieve multi-owner controlled revocation, we use key splitting to divide the user’s private key into an authorization key and an update key and embed a period into the update keys. During user revocation, the cloud updates the ciphertext and the data user can decrypt the ciphertext without obtaining the update keys of all data owners. The thorough performance analysis shows that the overhead of the proposed scheme is acceptable. Specifically, the proposed scheme takes approximately 0.5 seconds to encrypt, and with preprocessing, this time is reduced to 0.06 seconds, while decryption requires around 0.15 seconds on the Raspberry Pi.

In vehicular networks, caching service content on edge servers (ESs) is a widely accepted strategy for promptly responding to vehicle requests, reducing communication overhead, and improving service experience. However, implementing such an architecture requires addressing the challenges associated with ES response data reliability and communication security. In this study, to tackle the ES response data reliability issue, a blockchain-assisted threshold signature scheme for cache-based vehicular networks is proposed. The scheme utilizes a threshold mechanism to sign the data broadcast by the ES, incorporates blockchain to trace malicious signers, and avoids the shortcomings and limitations associated with idealized assumptions for the ES in existing data-sharing schemes. Moreover, considering the communication security and high-speed mobility of vehicles, using the non-interactive signatures of knowledge based on the Σ-protocol, a secure and efficient message authentication scheme for vehicles and ESs is provided. Through rigorous security proofs and comprehensive analyses, our scheme satisfies the communication security requirements of vehicular networks. By leveraging the JPBC library for performance analysis, the proposed scheme demonstrates advantages as concerns both computation and communication overheads compared to related schemes. Moreover, we implemented the proposed scheme on an Ethereum test network (i.e., Goerli) to validate its feasibility.

Deep learning has emerged as a promising technology for achieving Android malware detection. To further unleash its detection potentials, software visualization can be integrated for analyzing the details of app behaviors clearly. However, facing increasingly sophisticated malware, existing visualization-based methods, analyzing from one or randomly-selected few views, can only detect limited attack types. We propose and implement LensDroid, a novel technique that detects Android malware by visualizing app behaviors from multiple complementary views. Our goal is to harness the power of combining deep learning and software visualization to automatically capture and aggregate high-level features that are not inherently linked, thereby revealing hidden maliciousness of Android app behaviors. To thoroughly comprehend the details of apps, we visualize app behaviors from three related but distinct views of behavioral sensitivities, operational contexts and supported environments. We then extract high-order semantics based on the views accordingly. To exploit semantic complementarity of the views, we design a deep neural network based model for fusing the visualized features from local to global based on their contributions to downstream tasks. A comprehensive comparison with six baseline techniques is performed on datasets of more than 51K apps in three real-world typical scenarios, including overall threats, app evolution and zero-day malware. The experimental results show that the overall effectiveness of LensDroid is better than the baseline techniques. We also validate the complementarity of the views and demonstrate that the multi-view fusion in LensDroid enhances Android malware detection.

Proof of Retrievability (POR) is an important cryptographic primitive that has attracted considerable attention in the research community for its ability to enable users to audit the integrity of outsourced files on cloud servers without retrieving them. A POR scheme with public verifiability further enhances usability by allowing users to delegate the auditing task to a third party, making it highly desirable for a wide range of applications. However, most existing publicly verifiable POR schemes derive their security from the computational hardness of discrete logarithm or factoring, making them vulnerable to quantum attacks. Although it is possible to construct quantum-resistant POR schemes with public verifiability upon hash trees or general lattices, the resulting schemes often exhibit performance limitations when compared to existing constructions, thereby limiting their deployment in real-world applications. In this work, we address this gap by constructing a publicly verifiable POR scheme on structured lattices. We show that our scheme is provably secure in the random oracle model under the Ring-LWE and Ring-SIS assumptions. We provide an implementation of our scheme and the experimental results show that its performance is comparable to certain well-known constructions based on traditional assumptions.

Vehicular ad-hoc networks (VANETs) are the cornerstone of intelligent transportation systems, designed to enhance road safety and traffic efficiency. However, their dynamic and distributed nature poses significant challenges for secure communication and key management. Traditional authentication and key agreement (AKA) schemes for VANETs often rely on centralized trust architectures, resulting in system security and reliability issues. Despite the introduction of distributed trust architecture schemes that have appeared recently, they fail to solve one issue, i.e., how the key agreement requests can be authenticated in the distributed communication scenario where the authentication authorities are all non-full-credible and have differentiated credibility. To solve this issue, we propose a hierarchical AKA scheme for VANETs with cloud-edge collaboration powered by consortium blockchain. Specifically, we first proposed a vehicle reputation evaluation algorithm for evaluating the trustworthiness of the vehicle, so that the AKA requests sent by vehicles with low reputation will be rejected. On the basis of the reputation evaluation algorithm, we proposed a hierarchical threshold-based AKA scheme for VANETs where cloud servers (CSs) and edge servers (ESs) can collaboratively authenticate the AKA requests, so that the authentication service can be trusted upon getting authenticated by a series of valid combinations of CSs and ESs. Both formal and informal security proofs validate the security of our proposed scheme, and simulation experiments demonstrate its efficiency.

The rapid evolution of the Industrial Internet of Things (IIoT) has necessitated increased device interactions across various management domains. This entails devices from different domains collaborating on the same production task. This poses significant challenges for the dynamics of cross-domain authentication schemes. Traditional cross-domain authentication schemes struggle to support seamless switching between domains and face difficulties when accommodating devices that join and leave the same domain. Moreover, these schemes suffer from intricate interactions and suboptimal efficiency. To address these issues, we propose a dynamic group signature scheme based on a dynamic accumulator and a non-interactive zero-knowledge proof. We integrated this scheme with blockchain technology to construct an efficient revocation cross-domain authentication scheme. The proposed scheme enables cross-domain anonymous authentication with simple interactions and provides an efficient revocation function for illegal devices. This approach ensures conditional privacy-preserving and enables efficient member joining and exiting through a dynamic accumulator. It effectively addresses the dynamic requirements of devices involved in IIoT production and manufacturing processes. We prove the security of the proposed scheme using a random Oracle model and conduct thorough analyses to verify its resistance against various attacks. Furthermore, the experimental results demonstrate that the proposed scheme achieves better performance in terms of computational and communication costs.

In Vehicular Ad-hoc Networks (VANETs), vehicles must authenticate their identities before accessing services. However, existing authentication schemes based on anonymous credentials still face single-point failure in multi-authority scenarios. In addition, in traditional anonymous credential schemes, the public key of credential authority is used directly to verify the credential, which may increase the risk of vehicle privacy being misused. To address these issues, we propose a decentralized threshold credential management system with fine-grained authentication for VANETs. The decentralized credential management architecture is proposed for VANETs with multiple credential authorities, each credential authority consists of multiple credential managers who issue credentials using the threshold mechanism, effectively solving the single-point failure. Based on this architecture, we design a fine-grained, privacy-preserving authentication scheme that allows vehicles to autonomously perform selective attribute disclosure, credential aggregation, and randomization before requesting verification from the Cloud Service Provider, thereby achieving a balance between privacy preservation and authentication efficiency. The security proofs and analysis show that our scheme satisfies the target security properties. Performance evaluations indicate that our scheme enables efficient, flexible credential management and authentication in VANETs while ensuring privacy preservation.

Vehicular ad hoc networks (VANETs) enable vehicles to engage in vehicle-to-vehicle and vehicle-to-infrastructure communications to enhance driving safety. However, the open nature of the network and the uncertainty of information sources make VANETs vulnerable to false message attacks, potentially causing severe traffic accidents. Existing false-message detection systems suffer from high false alarm rates and high resource consumption. To address these challenges, we propose a false message attack detection system based on a software-defined network architecture that can efficiently and accurately detect false message attacks with minimal consumption of system resources. The system aims to detect emergency and normal beacon messages broadcast by vehicles, construct an automotive reputation evaluation system using the voting mechanism of the Byzantine consensus, and introduce an XGBoost-based traffic event classifier to improve classification accuracy. Experimental results show that the system can reliably assess vehicle reputation levels, effectively defend against conspiracy attacks, and perform well in intrusion detection.

Owing to frequent traffic accidents, the violation reporting service is a promising method to enhance road safety in vehicular ad hoc networks (VANETs). However, to implement such a service, it is critical to ensure security, privacy, and efficiency when vehicles send messages to roadside units (RSU). In this study, to address these issues, a vehicle violation reporting service is proposed using reputation systems and a physically unclonable function. The proposed scheme ensures secure authentication between vehicles and RSUs, facilitates an efficient search for invalid signatures, and overcomes the limitations present in ID-based conditional privacy-preserving authentication schemes. Moreover, considering the dynamic VANET environment, the distribution of invalid signatures may vary across multiple scenarios. Therefore, a fault-tolerant mechanism is proposed to ensure the robustness of this approach. Security proof with the random oracle model and detailed security analysis proved that the scheme could satisfy the security requirements of VANETs. Our scheme outperforms related approaches in terms of authentication overhead and the identification of invalid signatures, achieving superior performance in both aspects.

The rapid development of network technology has allowed numerous vehicular applications to be deployed in vehicles, thereby enriching the driving experience of users. However, the openness of vehicular networks enables attackers to launch network attacks on vehicles through network ports, leading to the destruction of vehicular networks. To develop an intrusion detection system suitable for distributed vehicular networks, researchers have utilized federated learning to train detection models. Nevertheless, most federated learning-based vehicular intrusion detection systems seldom consider rapidly updating the detection model and fail to detect unknown attacks effectively. In this study, we propose a federated learning-based vehicular intrusion detection system that fully considers the traffic characteristics of multiple network regions and selects representative clients to participate in model aggregation, thereby accelerating the convergence of the global model. Furthermore, to enhance the robustness of the detection system, we utilize extreme value theory and multilayer activation vectors to construct an unknown attack discriminator that can determine whether a network flow is an unknown attack. Comprehensive experiments on three open datasets demonstrate that the proposed intrusion detection system can quickly update and effectively identify known/unknown attacks in open vehicular networks

Self-healing group key distribution (SGKD) protocols guarantee the security of group communications by allowing authorized users to independently recover missed previous session keys from the current broadcast without retransmission. However, existing SGKD protocols have flaws: (1) collusion resistance and revocable nodes are both upper-bounded by the degree of polynomials used, (2) the disclosure of personal secrets enables the recovery of group key, (3) temporary revocation of a group member is not possible, and (4) a revoked node may obtain the session key when initiating mutual healing, moreover, a malicious node may cause the recovery of false group keys. To address these limitations, we propose an SGKD protocol using the Chinese remainder theorem (CRT) and Physical Unclonable Function (PUF). Our proposed SGKD protocol generates a PUF-based dynamic secret by stimulating nodes’ PUF using a polynomial-based encrypted challenge. This secret is then employed to retrieve a CRT-based encrypted group key. By combining PUF and CRT, we can generate dynamic secrets on the fly and reduce computation time significantly. Utilizing such a technique, our protocol achieves superior security goals, including resistance to any coalition of group nodes even if nodes’ personal secrets were disclosed. Furthermore, the proposed protocol provides an unlimited number of revocable nodes. Additionally, a revoked node can rejoin its group in later sessions without affecting backward secrecy. Moreover, the protocol provides a backward secrecy guaranteed mutual-healing feature free from desynchronization. Our performance and security analyses (i.e., theorem-based formal analysis, NS3-based experiment, and formal verification using the AVIPSA tool) show that our proposed protocol achieves stronger security goals and better efficiency in terms of computation, communication, and storage costs compared to existing SGKD schemes.

With the widespread deployment of vehicular ad-hoc networks (VANETs), data sharing has garnered considerable attention as a core feature of VANETs. Attribute-based proxy re-encryption (ABPRE) enables fine-grained access control and provides flexible ciphertext updates. The initially authorized vehicle generates the re-encryption key to enable ciphertext-to-ciphertext conversion in the cloud, allowing ciphertext to be shared with new recipients. However, initially authorized vehicles may not always be trustworthy and could share data with malicious receivers. In addition, the computation and communication overhead of ABPRE hinders its widespread application in VANETs. To address these issues, we propose a lightweight sanitizable scheme for edge-assisted VANETs based on ABPRE. In this scheme, the re-encryption key is verified by a sanitizer, to prevent the data from being shared with malicious data receivers. In addition, key-splitting techniques and edge computing are employed to reduce the communication and computation overhead of re-encryption. A comprehensive security analysis and performance evaluation demonstrate that the proposed scheme is efficient and practical.

Blockchain technology is a decentralized distributed database technology, which greatly improves the security and credibility of the data exchange process through decentralization. A great deal of research has already been conducted on combining blockchain and vehicular ad-hoc networks(VANETs) applications to solve the problems of opaque user transactions, data tampering, and insufficient motivation of participating parties. However, in the large-scale VANETs, the commonly used blockchain consensus mechanism PBFT suffers from poor scalability, high communication volume, and insufficient control of node behaviour. Therefore, in this paper, an improved consensus mechanism N-PBFT is designed for the field of VANETs based on the construction of vehicle trust management system. The improved consensus mechanism N-PBFT solves the problems of node identity peering, poor scalability, and high communication volume. After experimental testing, the proposed reputation system is able to effectively manage the information of the VANETs. And the improved PBFT consensus algorithm has a significant performance improvement over the traditional PBFT, SG-PBFT and RIPPB in terms of both throughput and latency.

Blockchain has emerged as a prevailing paradigm for decentralized applications due to its reliability and transparency. To scale up retrieval services, a common strategy is to use a hybrid storage model, where on-chain storage is responsible for small metadata and off-chain storage is for outsourced raw data. However, data security and result authenticity are ongoing challenges in this scenario, and little work has been done due to the difficulty of combining result verification and privacy preservation, especially for dynamic updates while supporting forward privacy. In this paper, we formally define the problem of efficient, verifiable, and secure conjunctive keyword search in hybrid-storage blockchains (vsChain) and propose a novel hybrid index that achieves efficient query and verification while supporting dynamic updates with forward privacy guarantee. Finally, we provide empirical evaluations using real and synthetic datasets to demonstrate the feasibility of our proposed scheme.

Protocol reverse engineering can infer the specification or behaviour of unknown network protocols, which is essential in analyzing and evaluating network functionality and performance. There are variable-length fields in many network protocols, and the field boundaries significantly impact subsequent analysis as well as the inferred results. The existing works focus on extracting protocol keyword fields without considering whether the fields' length is variable. In this paper, we propose BERRY for extracting variable-length field of unknown binary network protocols from static traces. At first, BERRY clusters the same type of messages from the input trace and extracts their headers with the help of the information entropy. Then, it combines the feature of message length and location-aware association analysis with to locate candidate variable fields. Finally, it infers the variable-length field by the sequence alignment. We evaluate BERRY with BinaryInferno using six groups of real network protocol traces. BERRY exhibits high accuracy and reliability on the metrics of precision, recall, and F1-score while extracting variable-length fields. It also performs similar results to the Binaryinferno on extracting all the fields.

In the Industrial Internet of Things (IIoT), massive amounts of data are generated and shared among different industrial entities, and it is crucial to realize the security and flexibility of data sharing. Autonomous path proxy re-encryption technology enables the autonomous creation of an ordered data-sharing path as specified by the data owner, supporting multi-hop re-encryption. However, the security of this technology requires further enhancement. Therefore, we propose a verifiable data-sharing scheme. To prevent data leakage due to collusion between the proxy and users, we introduce blockchain technology to supervise the decryption behavior of users in the autonomous path. Second, we verify the proxy re-encryption computation, ensuring its validity. Finally, a security analysis demonstrates that the proposed scheme meets the security requirements. Furthermore, we evaluated the performance of the proposed scheme, and the results show that our scheme has only increased less overhead, but has enhanced security.

With the rapid development of the Internet-of-Vehicles (IoV) technologies, security and privacy issues associated with IoV data sharing have become increasingly prominent. Although attribute-based encryption (ABE) schemes offer effective solutions to these problems, the prevalent single-point failure vulnerabilities and risks of user privacy leakage in existing ABE schemes must be addressed. To this end, an original hidden policy scheme based on multi-authority ciphertext policy ABE is proposed. This scheme validates users by introducing multiple attribute authorities and generating intermediate attribute keys, effectively dispersing single-point performance pressure. Simultaneously, partial policy-hiding techniques are developed to ensure efficient system operation while protecting user privacy. Furthermore, this scheme introduces a central authority to track potentially malicious attribute authorities, preventing them from continuously generating incorrect attribute intermediate keys, thereby maintaining the overall security of the system. Additionally, by updating and revoking attribute versions, a flexible attribute revocation mechanism is achieved to further enhance system flexibility. Through in-depth security and performance analyses, the scheme is proven to be both secure and efficient for securing IoV.

Several studies have introduced edge computing and blockchain into the Industrial Internet of Things (IIoT) to satisfy the requirements of delay-sensitive applications and support cross-domain authentication. Although there have been many protocols to ensure the security and privacy of devices in the IIoT, existing protocols still suffer from problems. Updating keys and pseudonyms of devices by a trusted third party (e.g., certificate authority) will cause high communication and computation overhead, especially when the number of devices becomes much larger. Furthermore, an increasing number of transactions also cause high storage overhead on the blockchain. Therefore, we propose a blockchain-based cross-domain authentication protocol. Specifically, we propose a privacy-preserving method based on pseudonyms that offloads the task of generating pseudonyms from a trusted third party to edge servers to ensure the conditional anonymity of the devices. The device is allowed to request pseudonyms in bulk to reduce the number of transactions, thus reducing the storage overhead on the blockchain. Security analysis and experimental results demonstrate that our scheme achieves an efficient tradeoff between security and efficiency.

Providing high-quality network services for vehicles is a challenge because of the fast-moving character of the vehicles. To address the shortcomings of traditional centralized and distributed mobility management schemes, such as triangular routing and poor scalability, many researchers use software-defined networking (SDN) to build mobility management schemes. However, most schemes rarely consider how to select the optimal base station for high-speed mobile vehicles in a dense network environment. Only using the received signal strength to select the base station tends to cause a ping-pong effect. Moreover, due to the high mobility of vehicles, the routing updates between vehicles and communication nodes will frequently occur, resulting in the significant consumption of network resources. In this article, we propose a mobility management scheme MM-SDVN based on SDN for vehicles. MM-SDVN uses deep Q-network to construct the optimal base station selection model, designs a multipath prefix matching algorithm to reduce the cost of route update, and realizes the seamless handover of vehicles in SDN intradomain and interdomain scenarios. The comprehensive experimental results show that MM-SDVN greatly improves the network service quality and handover performance of the vehicle. Compared to the other schemes, MM-SDVN improved vehicle throughput by 6.14%, 8.85%, and 10.34%, respectively.

In the Industrial Internet of Things (IIoT), data sharing is crucial for promoting the intelligent development of industrial production. To achieve effective data supervision, introducing blockchain into traditional cloud-based data-sharing frameworks has attracted widespread attention. However, existing blockchain-based data-sharing schemes still have issues with security and efficiency. Therefore, we propose a blockchain-enabled data-sharing scheme based on proxy re-encryption. First, the scheme considers both storage and access authentication, guaranteeing data sources’ trustworthiness and preventing data misuse. Second, the scheme uses an on-chain and off-chain cooperative storage mechanism, saving the storage resources of the blockchain. Third, the scheme supports data packing, which effectively improves data storage efficiency. The security analysis shows that our scheme satisfies the security requirements. Finally, we build a blockchain platform using the hyperledger fabric. The performance evaluation shows that our scheme is more advantageous regarding computational overhead than other related schemes.

Users have become accustomed to storing data on the cloud using ciphertext policy attribute-based encryption (CP-ABE) for fine-grained access control. However, this encryption method does not consider the ability of malicious users to launch thousands of file download requests when launching an economic denial of sustainability attack (EDoS), which may be more expensive for data owners. Existing solutions typically use a cloud server to verify the download permissions of the data users. However, cloud servers are not completely trusted and cloud server providers and colluding data users can still launch an EDoS attack. With our scheme, using CP-ABE, a blockchain is introduced for verifying the download permission of data users. In addition, we propose a new mechanism to solve the problem of malicious user revocations under EDoS attacks by updating the ciphertext and symmetric encryption technology. A formal security proof has demonstrated that the proposed scheme is suitable for plaintext attack security. Theoretical and experimental analyses show that our scheme performs more efficiently than previous methods.

There is a growing concern about the complete lifecycle security of data in Internet of Things (IoT). This may cause privacy and trust problems for users regarding data sources, data storage, and access control for data sharing. Blockchain is a valuable solution to the above problems through distributed ledger technology, and it has been widely applied in various fields such as public services, finance, and IoT. However, the data in IoT are characterized by a large quantity, large capacity, and timely response, and existing blockchain systems only partially resolve them for data security and performance. We propose DSChain for IoT data security to address the challenges mentioned above. Our system uses a certificateless signature to ensure a trusted data source and public auditing to ensure the integrity of stored data while using ciphertext-policy attribute-based encryption to control access to shared data. Moreover, we propose a packaging mechanism based on the Merkle Hash Tree that effectively improves system performance. We implement the DSChain and provide a detailed analysis of performance and security. The experimental results indicate that DSChain can achieve approximately 1,035 transactions per second on a single peer and is scalable.

In edge-assisted cross-domain Industrial Internet of Things (IIoT), blockchain-based authentication is an effective way to build cross-domain trust and secure cross-domain data. However, existing authentication schemes still have serious challenges in terms of efficiency and security. In this paper, we propose a blockchain-based lightweight message authentication scheme. First, to address efficiency challenges, we build a blockchain-enabled edge-assisted lightweight authentication framework. This framework uses edge servers to assist smart devices in achieving cross-domain authentication and effectively reduce redundant interactions between entities. Second, to resolve the security challenges, we design a lightweight message authentication algorithm for cross-domain IIoT. The algorithm guarantees message security with low computational overhead and is suitable for multi-receiver cross-domain IIoT. The security proof and analysis demonstrate that the proposed scheme is secure under the random oracle model and can resist various attacks. The performance evaluation shows that our proposed scheme is superior in terms of computation and communication overhead when compared with other related schemes.

With the development of the industrial Internet of Things (IIoT), the amount of data generated by industrial manufacturing equipment will increase. To reduce the cost of data management while achieving secure data sharing, data owners generally upload the resulting ciphertexts to a cloud server after encrypting their data. Attribute-based encryption (ABE) is a valuable technology that implements fine-grained access control over shared information; however, its computational complexity is not suitable for resource-constrained IIoT devices, making it difficult to apply directly to an IIoT environment. To address this problem, we design a fine-grained data sharing scheme based on proxy re-encryption in IIoT. In the proposed scheme, data files are encrypted through an identity-based encryption and a data owner can authorize a semi-trusted proxy server to transform the ciphertext into an ABE ciphertext. This realizes fine-grained access control and decreases a data owner's computational cost in data sharing. In addition, the computational burden is outsourced to a cloud server, and users only need to perform simple computing operations. A formal security proof indicates the proposed scheme's selective chosen-plaintext attack security. Theoretical and experimental analyses illustrate that our construction is more efficient than previous schemes.

In the Industrial Internet of Things (IIoT), blockchain-based data-sharing frameworks can effectively build cross-domain trust and facilitate data sharing. However, secure data-sharing schemes are lacking for the IIoT scenario, in which smart devices cannot communicate across domains and can only access data through edge servers. In this study, we propose a lightweight and secure data-sharing scheme for the blockchain-enabled cross-domain IIoT, in which authorized smart devices can access cross-domain data anonymously. First, smart devices can dynamically generate pseudonyms by themselves and without the online participation of domain authorization centers, effectively reducing the storage overhead of smart devices and the workload of domain authorization centers. Second, the scheme combines broadcast encryption and proxy re-encryption techniques, which realize flexible data sharing across domains while protecting the privacy of smart devices. Detailed security proofs and analyses demonstrate that the proposed scheme is secure and resistant to various attacks. The performance analysis shows that our proposed scheme is efficient and performs better than related schemes.

Recently, the concept of intelligent cyber-physical transportation systems (ICTS) has entered the vehicle network, providing more efficient, safe, and sustainable services by applying intelligent technology to the transportation system. Because the communication channel between the vehicle and the cloud service provider (CSP) is open and insecure. Therefore, we must construct a secure Vehicle-to-CSP (V2C) communication scheme to ensure the security of vehicle privacy data. Current communication schemes mainly have two limitations. One is that the user’s role in communication is not considered, and the other is that the computational and communication overhead are not sufficiently low to satisfy the low latency requirements. To address the deficiencies, we propose a user-centric V2C communication scheme. The primary key in the signature is concealed, which ensures the confidentiality of the user’s legal real identity. Its main steps, based on the extended Chebyshev chaotic map and hash function, reduce the computational and communication overhead in the process. The security proof and analysis show that our proposed scheme satisfies the security and privacy requirements. The performance analysis shows that our proposed scheme outperforms other related schemes.

Several authentication and key agreement (AKA) schemes have been proposed to ensure secure communication in the Industrial Internet of Things (IIoT). However, most of these schemes face two primary problems. First, they cannot resist various attacks, such as impersonation and device capture attacks. Second, these schemes overlook the resource-constrained IIoT devices, failing to guarantee lightweight overhead for device operations. Therefore, we propose a novel and efficient AKA scheme. Utilizing the chameleon hash function and physical unclonable function, the proposed scheme implements a lightweight overhead for both authentication parties while maintaining the overhead of the gateway within a reasonable range. Furthermore, we implement device anonymity based on lightweight operations such as hash and XOR. In addition, we perform a rigorous security analysis using the widely accepted Real-Or-Random model, BAN logic, and Proverif tool. Finally, through heuristic analysis and experiments, we substantiate that our scheme surpasses the compared schemes in terms of both security attributes and system overhead.

Electronic control units (ECUs) connected by a controller area network (CAN) are used to perform various functions in modern vehicles. In the latest autonomous vehicles, redundant ECUs and a backup bus (different from CAN) are always equipped to prevent a single point of failure or network attack. However, due to the lack of protection measures of CAN bus, attackers can remotely intrude into the vehicle. Many schemes have proposed to use encryption to solve the security problem of CAN bus. Considering the current ECU storage space is limited, it is impossible to store all ECUs’ keys. When a single point of failure or network attack against an ECU occurs, it is necessary for the backup ECU to process the messages related to the failed ECU. How to ensure that the backup ECU can decrypt the encrypted messages and at the same time securely isolates the backbone network from the backup network is an urgent issue to be solved. In order to solve the problem of forwarding and processing such messages under encryption conditions, we propose an efficient re-encryption scheme based on proxy re-encryption. The scheme is also suitable for cross-bus communication without backup networks. Burrows-Abadi-Needham (BAN) logic, random oracle model and Automated Validation of Internet Security Protocols and Applications (AVISPA) tool are utilized to prove that the scheme is secure. The scheme is simulated based on the MIRACL cryptography library on the computer and Raspberry Pi. The simulation results demonstrate that the proposed scheme is secure compared with the existing scheme.

To enable the vehicle control system to provide better service, an increasing number of network nodes are being introduced into the vehicle; this also dramatically expands the attack surface of modern vehicles. In recent years, the security of vehicle communication buses and electronic control units (ECUs) has been extensively studied. However, in actual deployment, there is little concern for the fine management of secure communication schemes with respect to the security level of the ECU on the controller area network (CAN). On this basis, this paper proposes a two-layer ECU group dynamic management scheme based on the Chinese remainder theorem. Dynamic grouping management based on the credibility of ECUs while the vehicle is running can effectively balance efficiency and security. During communication, different groups use different modes to achieve higher efficiency. Security analysis shows that the proposed scheme can satisfy the requirements of security and privacy. Simulation results further demonstrate that the proposed scheme performs well in terms of computing and communication costs.

This study proposes a distributed and extensible cross-region vehicle authentication scheme with the reputation for improving the security and efficiency of cross-region vehicle authentication. The existing authentication schemes demonstrate the following drawbacks: 1) Each vehicle is preloaded with the same system private key, which may be leaked so that the entire system would be destroyed; 2) Other schemes rely on trusted authority to aid in selecting some cluster head nodes; 3) The existing cross-region authentication schemes are not flexible and scalable since they depend on the infrastructure fixed on the roadside. With the proposed scheme, each vehicle stores a long-term private key that is different from those of other vehicles, thereby avoiding a system crash when destroying a vehicle. When the cross-region vehicle enters a new region, it can verify the reputation value of the surrounding vehicles to select the edge computing vehicle. The formal security proof shows that the proposed scheme has adequate security under the real-or-random model. The performance evaluation of our scheme with several related schemes reveals that it generates relatively low computation and communication overhead, is more robust, and achieves minimum packet loss ratio and delay.

Blockchain has emerged as a prevailing paradigm for decentralized applications due to its reliability and transparency. To scale up retrieval services, a common strategy is to use a hybrid storage model, where on-chain storage is responsible for small metadata and off-chain storage is for outsourced raw data. However, data security and result authenticity are ongoing challenges in this scenario, and little work has been done due to the difficulty of combining result verification and privacy preservation, especially for dynamic updates while supporting forward privacy. In this paper, we formally define the problem of efficient, verifiable, and secure conjunctive keyword search in hybrid-storage blockchains (vsChain) and propose a novel hybrid index that achieves efficient query and verification while supporting dynamic updates with forward privacy guarantee. We also design two optimized schemes to improve query and verification performance by using a partition-based method and an obfuscated counting Bloom filter mechanism. Finally, we provide a theoretical security analysis and empirical evaluations using real and synthetic datasets to demonstrate the feasibility of our proposed schemes.

Vehicular Ad hoc Networks (VANETs) are vulnerable to various types of attacks. Intrusion Detection System (IDS) based on machine learning can effectively detect malicious network attacks in VANETs. However, machine learning training necessitates ample data which contain significant ample private information, increasing the risk of privacy disclosure. The privacy protection of training data for machine learning used in the IDS of VANETs is rarely investigated. Meanwhile, Differential Privacy (DP) is one of the most secure privacy protection methods based on perturbations. Therefore, we propose a lightweight hybrid IDS (LH-IDS) based on machine learning and DP. It uses algorithms based on unsupervised learning to detect anomalous network behaviour with high performance, especially unknown attacks in VANETs, while protecting data privacy. The DP is used to secure the privacy of the training data. Noise from different privacy budgets is added to datasets to obtain DP datasets. Subsequently, LH-IDS is used to verify the utility of the DP datasets. Extensive experiments confirm LH-IDS can not only detect anomalous and normal traffic with excellent performance but can also protect the private information of the training data. Additionally, the proposed model incurs only minimal CPU and memory overhead, making it a lightweight solution.

Data sharing is one of the essential services of vehicular ad hoc networks (VANETs), which primarily requires data security and access control, and ciphertext-policy attribute-based encryption (CP-ABE) is a promising tool. However, data sharing schemes of distributed CP-ABE have concerns about the single-point performance bottleneck and privacy leakage. The factor for the former is that the authority manages a disjoint attribute set. The latter is because the user's identity and attributes are required to submit to authorities, which targets to bind this information to decryption keys for collusion-resistant. We propose a privacy-preserving distributed data sharing scheme for VANETs. This scheme introduces asymmetric group key agreement to distributed CP-ABE, which realizes that multiple authorities manage an attribute, and the user can obtain the attribute key bound with his identity from any authority in the group. To match up to the requirement of privacy-preserving, a key extract protocol provided user anonymity is proposed, which implements that attribute keys can be obtained without revealing the user's identity and attributes. Moreover, partial policy hiding is satisfied. Finally, we analyze and evaluate the proposed scheme, and the results indicate that our scheme is secure and efficient.

Since the communication channels in vehicular ad-hoc networks (VANETs) are wireless and open, malicious adversaries can monitor or fabricate messages transmitted across them. To secure vehicular communications, an authenticated key agreement (AKA) scheme needs to be designed for VNAETs. Traditional VANETs AKA schemes require the trusted authority (TA) to authenticate the legality of message and corresponding sender. However, the TA in these schemes is vulnerable to suffer from single-point-of-failure issues. Some blockchain-based VANETs AKA schemes have been proposed recently to address the deficiency. However, these schemes rely on the consortium or private blockchain in which TAs are still required for key generation, resulting that the practicality is limited. To solve the issue, we design a smart contract-based VANETs AKA scheme, where the AKA algorithm of our proposed scheme is implemented on smart contract deployed on a public blockchain system and the TA that is responsible for key generation will not be required. The security proof and analysis show that our proposed scheme satisfies the session-key semantic security and essential security and privacy requirements, respectively. The performance analysis demonstrates that our proposed scheme outperforms existing blockchain-based VANETs AKA schemes.

The authentication and key agreement (AKA) scheme for VANETs can produce a series of short-term session keys, which can be used to secure the vehicular communications across open and insecure wireless channels. Traditional VANETs AKA schemes tend to employ the centralized trust architecture as the core authentication backend, which raises concerns about system security and reliability. Recently, several VANETs AKA schemes that are constructed on decentralized trust architecture have been proposed. However, these schemes do not achieve full decentralization and tend to suffer from key exposure issues, insufficient performance, and lack of optimization for on-chain storage costs. To address these shortcomings, we propose a threshold-based full-decentralized VANETs AKA scheme that is powered by consortium blockchain. In our proposed scheme, the threshold-based voting concept is employed to mitigate the key exposure issue inherent to the network infrastructure. Furthermore, we leverage lightweight cryptography in conjunction with the Cuckoo filter to reduce computational, communication, and on-chain operation costs brought by cryptographic operations and smart contracts. The security proof together with the cryptographic protocol validation tool prove the security of our proposed scheme, whereas the simulation experiment demonstrates the efficiency of our proposed scheme.

Vehicular ad hoc networks (VANETs) connect all vehicles through wireless channels. They provide extensive real-time traffic information services that improve driving safety and traffic management efficiency. However, VANETs are vulnerable to security attacks because of the open wireless nature of their communication channels. Most security mechanisms for traditional VANETs are centralized and have certain limitations in satisfying security requirements, such as anti-single-point failure, distributed security authentication of messages, and privacy preservation in VANETs. To address these issues, herein, we propose a dual blockchain-assisted conditional privacy-preserving authentication framework and protocol for VANETs. The identity authentication and privacy preservation of vehicles in VANETs can be realized without relying on a centralized trusted third party. The proposed scheme also allows for the conditional tracking of illegal vehicles. The decentralized dynamic revocation of illegal vehicles can be realized through smart contracts, rendering the scheme efficient and scalable. We implement this scheme in an Ethereum test network to demonstrate its feasibility and conduct an in-depth security analysis and comprehensive performance evaluation of the proposed scheme. The results demonstrate that the proposed scheme is an effective solution for the development of a decentralized authentication system for VANETs.

In vehicular networks, caching content on an edge server (ES) is a popular method for quickly responding to massive vehicle service requests, reducing communication delays, and enhancing driver and passenger service experiences. However, after integrating ESs with vehicular networks to provide vehicles access to the cached content in these ESs, significant challenges regarding protecting the privacy of vehicle data and communication security arise. In this study, to address security and privacy-preserving issues, we propose a secure and revocable cache-based distributed data sharing scheme for vehicular networks wherein a token authentication mechanism and multi-authority ciphertext-policy attribute-based encryption are integrated. In this scheme, both authentication and authorization capabilities are delegated to an ES while restricting access to service content to only legal vehicles, achieving proper access control between vehicles and ESs, and effectively preserving the privacy of vehicle data. Moreover, we attributed the revocations of ESs to the associated attribute authorities, eliminating the need for a system-wide update of keying materials. Through rigorous security proofs and detailed security analyses, we demonstrate that the scheme meets the security requirements of vehicular networks and can resist more security attacks. The proposed scheme achieves better balance between computational and communication costs than related schemes.

Multi-Tenant Data Centers (MTDCs) allocate resources to tenants in terms of processors, memory, and storage. However, equal allocation of network resources is often overlooked, leading to unpredictable application performance. To address this issue, we propose Tenant-Aware Resource Allocation (TARA), a virtual resource allocation mechanism for MTDCs. TARA allocates tenants’ virtual network resources as virtual ports on the substrate physical network, enabling control and management by dedicated controllers. In this paper, we introduce a classification method for virtual nodes within Virtual Data Centers (VDCs) aimed at ensuring optimal network performance based on tenant demands. Furthermore, we present a source routing mechanism that utilizes path tables to minimize traffic forwarding delays and enhance network workload efficiency. The TARA model optimizes virtual resource allocation, enhances network performance, and simplifies virtual network resource management. Experimental evaluations demonstrate the effectiveness of the TARA system in improving network performance and meeting tenants’ quality of service requirements.

The popularity of cyber-physical systems is fueling the rapid growth of location-based services. This poses the risk of location privacy disclosure. Effective privacy preservation is foremost for various mobile applications. Recently, geo-indistinguishability and expected inference error are proposed for limiting location leakages. In this article, we argue that personalization means regionalization for geo-indistinguishability, and we propose a regionalized location obfuscation mechanism called DPIVE with personalized utility sensitivities. This substantially corrects the differential and distortion privacy problem of the PIVE framework proposed by Yu et al. on NDSS 2017. We develop DPIVE with two phases. In Phase I, we determine disjoint sets by partitioning all possible positions such that different locations in the same set share the Protection Location Set (PLS). In Phase II, we construct a probability distribution matrix in which the rows corresponding to the same PLS have their own sensitivity of utility (PLS diameter). Moreover, by designing a QK-means algorithm for more search space in 2-D space, we improve DPIVE with a refined location partition and present fine-grained personalization, enabling each location to have its own privacy level endowed with a customized privacy budget. Experiments with two public datasets demonstrate that our mechanisms have the superior performance, typically on skewed locations.

Since machine learning model is often trained on a limited data set, the model is trained multiple times on the same data sample, which causes the model to memorize most of the training set data. Membership Inference Attacks (MIAs) exploit this feature to determine whether a data sample is used for training a machine learning model. However, in realistic scenarios, it is difficult for the adversary to obtain enough qualified samples that mark accurate identity information, especially since most samples are non-members in real world applications. To address this limitation, in this paper, we propose a new attack method called CLMIA, which uses unsupervised contrastive learning to train an attack model. Meanwhile, in CLMIA, we require only a small amount of data with known membership status to fine-tune the attack model. We evaluated the performance of the attack using ROC curves showing a higher TPR at low FPR compared to other schemes.

In a cloud-edge-end cooperation environment, edge and core cloud services are complementary and synergistic, jointly processing a large amount of private data uploaded by users. To prevent the leakage of private data, users must ensure that services are secure and trusted through remote attestation. Traditional one-to-one remote attestation schemes are typically used to test the cloud services. However, as the cloud platform scales and the number of edge and core cloud services grows rapidly, the traditional attestation method has problems, such as poor scalability and low attestation efficiency. Thus far, there has been a lack of feasible methods for users to verify multiple related services in a cloud-edge-end cooperation environment quickly. This paper presents a scalable layered cooperative service attestation (SLCSA) scheme, the first secure and scalable protocol for the efficient attestation of multiple cooperative services. The SLCSA scheme is based on a Boneh–Lynn–Shacham (BLS) multi-signature to improve the scalability of the scheme while enabling users to conduct the batch verification of services. We also analyze the security of the proposed scheme. To evaluate the proposed scheme, we implement it using Intel SGX, which can provide basic hardware-assisted attestation and a trusted execution environment for services. The experimental results show that the SLCSA scheme is practical and efficient in a cloud-edge-end cooperative environment.

Network protocol specification is essential in analyzing and evaluating network functionality, performance, and security. However, increasing private protocols become a hindrance to these features. The existing works study how to extract protocol keyword fields rather than infer the semantics of the fields, such as the length field, which can indicate the length associated with a message and is fundamental for deep analysis of network protocols. In this paper, we propose a nonparametric and unsupervised method, ROSE, to extract the length field of unknown binary network protocols from static traces. It segments the fields from the raw network trace and gets the inferred length of a subset of messages by clustering similar fields with k-means. Then, it generates candidate fields using n-gram and builds a multidimensional equation based on the length of the clustered messages and the candidate length fields. Finally, ROSE extracts the inferred length fields through linear regression. As far as we know, it is the first study on extracting length field from the static trace. The evaluation experiments using raw network traces exhibit high precision and recall in extracting the length field or identifying protocols without the length field.

Pattern matching is a crucial technique for network traffic detection applications. As a fundamental computation model used by pattern matching, the finite state automata execute sequential matching due to the state dependence among transitions. Meanwhile, most services tend to compress their data to improve transmission or storage efficiency. The increased compressed data challenges the straightforward method of matching the whole decompressed data and incurs data dependence among the compression encodings. The related approaches either leverage techniques to break the state dependence of matching uncompressed data or accelerate matching compressed data in a single-threaded manner without considering the state and data dependence. None of them can perform parallel matching over compressed data. This paper provides PETALS, a parallel pattern matching method over Brotli compressed network traffic. PETALS partitions the original compressed traffic into fixed- length blocks for parallel matching and patches the broken compression encodings crossing blocks to break the data dependence. Then, it merges the compressed traffic matching method into path fusion, an enumerative parallelization of finite state automata, to present parallel matching over compressed traffic. Evaluation using real-world network traffic and regular expressions shows that PETALS can raise the speedup from 1.53x to 3.53x of the state-of-the-art parallelization schemes on a 56-cores machine.

Massive nodes in a blockchain form an off-chain distributed storage network to provide storage resources for users to meet large data upload requirements. However, this storage approach introduces security and performance issues. Firstly, it is difficult to guarantee the integrity of the data uploaded, and these data may be easily corrupted or lost. Moreover, uploading excessive duplicate data leads to a waste of storage resources. In this study, to address these issues, with a double-copy storage model for blockchain off-chain storage, a novel public auditing scheme with client-side deduplication is proposed to reduce the storage overhead of nodes and check the integrity of the off-chain data. Based on smart contracts, our scheme could realize efficient user ownership and off-chain data integrity verification automatically. In addition, both data encryption and deduplication are achieved based on message-locked encryption and an improved authenticator generation algorithm. Security analysis and experimental comparisons show that the proposed scheme is effective and practical.

Cloud storage services can support data sharing for a group of users. However, the cloud server may lose some of the shared data when attacked. The integrity of stored data is a key issue for cloud storage. However, identity anonymity, an important problem in data integrity, has not been fully investigated yet. Furthermore, the existing schemes of data integrity checking are usually based on public key infrastructure and thus have to perform complex certificate management. In this paper, we propose an efficient integrity checking scheme to achieve full identity anonymity. Additionally, the proposed scheme can reduce the workloads of certificate management and simplify key management. Inspired by the idea of attribute-based signature, we devise a common predicate to manage the identities of legitimate users and disable illegal users from joining the data sharing. By adopting the technique of the monotone span program, the legitimate user can compute the valid authenticators of shared data for all attributes in the common predicate without the need of binding his attribute set to the shared data. Whereupon, the user's identity remains anonymous to all parties in the data sharing because he can share the data and authenticators without revealing his attribute set to other parties. The extensive experimental results demonstrate that the proposed scheme has less computational and communication overhead compared with the existing schemes while achieving full identity anonymity.

Cloud service providers typically provide different types of virtual machines (VMs) to cloud users with various requirements. Thanks to its effectiveness and fairness,auctionhas been widely applied in this heterogeneous resource allocation. Recently, several strategy-proof combinatorial cloud auction mechanisms have been proposed. However, they fail to protect the bid privacy of users from being inferred from the auction results. In this article, we design adifferentially privatecombinatorial cloud auction mechanism (DPCA) to address this privacy issue. Technically, we employ the exponential mechanism to compute a clearing unit price vector with a probability proportional to the corresponding revenue. We further improve the mechanism to reduce the running time while maintaining high revenues, by computing a single clearing unit price, or a subgroup of clearing unit prices at a time, resulting in the improved mechanisms DPCA-S and its generalized version DPCA-M, respectively. We theoretically prove that our mechanisms can guarantee differential privacy, approximate truthfulness and high revenue. Extensive experimental results demonstrate that DPCA can generate near-optimal revenues at the price of relatively high time complexity, while the improved mechanisms achieve a tunable trade-off between auction revenue and running time.

Although proxy-assisted revocable attribute-based encryption provides fine-grained privacy protection and reduces the decryption cost of data users, it inherits several disadvantages in outsourcing decryption. The decryption capability in outsourcing decryption is divided into two parts: the outsourcing transformation key and the user decryption key. The proxy server utilizes transformation keys to transform the ciphertext which can only be decrypted by the users who generated the transformation key. When multiple users with the same attributes request outsourcing transformation, the proxy server must do numerous transformation operations, increasing the computing overhead of the proxy server and the user request response time. To address the aforementioned issues, we propose a multi-proxy assisted revocable attribute group-based encryption (MP-RAGBE) scheme. We form a user group out of users who have the same attributes and send the transformation keys directly to the proxy server. Users in the same group can decrypt the transformed ciphertext, and only a small number of transformation keys need to be updated when revocation occurs. The security and experimental analyses show that the proposed scheme meets the defined security requirements while significantly reducing user request response time, the overhead of transformation key generation, transmission, and ciphertext transformation.

Recently, the fog computing concept has been introduced into vehicular ad-hoc networks (VANETs) to formulate fog-based VANETs. Since the communication channels between vehicles and fog nodes are open and insecure, it is necessary to construct an authenticated key agreement (AKA) scheme for securing the channels. The existing AKA schemes have two main deficiencies. One is that the computational and communication overhead are not low enough to satisfy the requirements of delay-sensitive applications. The other is that the multi-trusted-authority (multi-TA) model has not been considered. To solve the deficiencies, we propose a lightweight and conditional privacy-preserving AKA scheme, where the main steps are designed with symmetric cryptography methods. The design can reduce the computational and communication overhead of the AKA process. Additionally, we consider the multi-TA model in the AKA process to solve the single-point-of-failure issue. By integrating Cuckoo filter into the multi-TA model, the secrecy of real identities of legal vehicles is guaranteed and the identity revocation function for illegal vehicles is supported in the AKA process. The security proof and analysis show that our proposed scheme satisfies the essential security and privacy requirements of VANETs. The performance analysis shows that our proposed scheme outperforms other related and represented schemes.

Data sharing is an integral part of vehicular ad hoc networks (VANETs), which provide drivers with safe and comfortable driving environments. However, when data are shared among multiple vehicles, they must be encrypted multiple times. Some solutions have used identity-based broadcast encryption to solve this problem. However, these schemes have two major limitations. First, the decryption cost is linearly related to the number of data receivers, where the identity of other receivers must be known. Second, only the data sender can forward the data. To address these important deficiencies, we propose an identity-based broadcast proxy re-encryption scheme to realize flexible and efficient data-sharing in VANETs. The data sender generates a fixed ciphertext that can be obtained by newly added vehicles through authorized vehicles. Data receivers can decrypt ciphertext directly without knowing the identities of other receivers, where the decryption overhead is constant. In addition, our scheme can achieve complete anonymous data sharing to protect vehicle privacy. A security proof shows that our scheme has sufficient security, and a performance analysis shows that our scheme performs well. Our proposed scheme is thus suitable for securing VANETs.

Owing to the open Industrial Internet of Things (IIoT) environment, information interacting between devices and servers is transmitted over the public channel, which may lead to privacy breach of the device identity. Furthermore, communication entities are not fully trusted, and they may maliciously disclose the device identity information. Therefore, the anonymity of devices must be guaranteed. In addition, IIoT is resource-constrained, and complex algorithms are unsuitable for the IIoT system. Several researchers have attempted to design anonymous authentication schemes. The one-authentication-multiple-access approach allows devices to access server resources multiple times after a single authentication, and its authentication overhead is independent of the number of accesses. This can reduce the computational burden for devices that need to access the server frequently. However, existing anonymous authentication schemes do not support multiple accesses after one authentication, and still suffer from privacy issues and low efficiency for devices that need frequent access to the server. To address these issues, we propose a new anonymous authentication scheme that uses group signature technology to ensure device anonymity and uses Merkle hash tree technology to achieve multiple accesses after one authentication, thereby greatly reducing the authentication overhead of IIoT devices. Then, we validate the security of the scheme using the random oracle model and the BAN logic. Finally, compared with other related schemes, the experimental results show that our proposed scheme is more efficient and practical for resource-constrained IIoTs than other schemes.

Since traffic accidents occur frequently, a real-time video traffic reporting service is necessary in vehicular networks for a prompt response to accidents. Although the fifth-generation (5G) network provides a solution for real-time services in vehicular networks, the security and privacy of the services needs to be addressed first. The existing secure video reporting service schemes in 5G-enabled vehicular networks have significant computing, communication, and storage overheads, because of public key certificates, expensive bilinear pairing operations, and repeated video reporting to the cloud. To address these issues, we propose a secure edge computing-assisted video reporting service in 5G-enabled vehicular networks. In the proposed method, edge nodes complete the message verification and classification. Moreover, these nodes send the first received report message of the same accident to the designated official vehicles to realizes a local upload and download of video reports and to minimize the storage of repeated accident reports in the cloud. Security analysis indicates the proposed scheme is secure under the random oracle model and meets a series of vehicular networks requirements. In addition, performance evaluations show that the scheme achieves lower authentication overhead than existing signature schemes, and has lower total delay than other relevant video reporting service schemes.

Autonomous Vehicles (AVs) are a highly discussed topic owing to their great performance and convenience. However, some requirements limit their wider deployment. Specifically, AV should be controlled by remote users during emergencies. It may lead to AV’s system facing the risk of being intruded on by a malicious party, resulting in unreasonable decisions. We, therefore, design the Internet of autonomous vehicle (IoAV) model to mitigate the problems arising from these limitations. To promote a secure remote control of the AV, a reliable authentication scheme, which can be used in IoAV, must be performed. Our proposed chaotic map-based authenticated key agreement (CMAKA) method provides secure remote control features for AVs. In this method, users, data centers, and AV establish a secure communication channel through the negotiation of three independent session keys. Furthermore, a physical unclonable function (PUF) is employed to produce a trusted private key during the authentication. The security of our scheme is evaluated using game hopping through the widespread Real-or-Random (ROR) model. Compared with other existing three-factor authentication schemes, the performance of our protocol is higher in both security requirements and total cost.

With the boom in cloud computing, data outsourcing in location-based services is proliferating and has attracted increasing interest from research communities and commercial applications. Nevertheless, since the cloud server is probably both untrusted and malicious, concerns about data security and result integrity have become on the rise sharply. In addition, in the single-user situation assumed by most existing works, query users can capture query content from each other even though the queries are encrypted, which may incur the leakage of query privacy. Unfortunately, there exists little work that can commendably assure data security and result integrity in the multi-user setting. To this end, in this article, we study the problem of multi-user, secure, and verifiable$k$nearest neighbor query (MSV$k$kNN). To support MSV$k$NN, we first propose a novel unified structure, called verifiable and secure index (VSI). Based on this, we devise a series of secure protocols to facilitate query processing and develop a compact verification strategy. Given an MSV$k$NN query, our proposed solution can not merely answer the query efficiently while can guarantee: 1) preservingdata privacy,query privacy,result privacy, andaccess patterns privacy; 2) authenticating thecorrectnessandcompletenessof the results; 3) supportingmulti-userwith different keys. Finally, the formal security analysis and complexity analysis are theoretically proven and the performance and feasibility of our proposed approach are empirically evaluated and demonstrated.

With the explosive growth of short texts on users' preferences, learning discriminative and coherent latent topics from short texts is a critical work, since many practical applications require semantic understandings that short texts convey explicitly and implicitly. However, existing short text topic learning methods face the challenge of fully capturing semantically related co-occurrence phrases. Therefore, this paper proposes a novel Heterogeneous Information Network-based Short Text Topic learning approach (HIN-ShoTT) in terms of parts of speech, without depending on any auxiliary information. Specifically, HIN-ShoTT can be decomposed into three phases: i) seeking semantic relations among words, where HIN-ShoTT models multiple semantic relations among words based on a Heterogeneous Information Network (HIN) in terms of parts of speech; ii) extracting co-occurrence phrases and filtering noises, where HIN-ShoTT defines parts-of-speech meta structures to guide co-occurrence phrase extraction and a self-adapting threshold filtering module is proposed for discarding noises; and iii) inferring topics, where HIN-ShoTT models the generative process of co-occurrence phrases to make topic learning effective with the abundant corpus-level information. Our experimental results on three real-world datasets not only show that HIN-ShoTT performs well, but also demonstrate that it is feasible to incorporate HIN into short text topic learning for accuracy improvement.

The way to use limited bandwidth resources to achieve high-quality video services in vehicular networks is an important research topic. A large number of studies have shown that the fast-growing field of software defined networking (SDN) can provide solutions to the problems encountered by traditional IP networks when implementing video multicasting. However, there is no research addressing the security issues for this scenario. In this paper, we explore the application scenarios of video multicast in software defined vehicular networks (SDVN), and propose a secure and effective access control protocol to solve multicast security issues. This protocol realizes the authentication of multicast video requesting vehicles and RSUs. According to the authentication results, the SDN controller constructs multicast paths that only reach legitimate RSUs and vehicles, and only the vehicle passing the authentication can obtain video decryption keys. The protocol resists common attacks and satisfies the security requirements in vehicular networks. In addition, the scheme supports batch verification, which reduces the time cost of authentication, and adopts broadcast encryption technology to effectively reduce the communication load. Compared with related schemes, our protocol performs better in terms of computation and communication cost, packet loss rate, and time delay.

In the industrial Internet of Things (IIoT) environment (e.g., a smart factory), smart devices with limited computing power can bring large amounts of privacy-sensitive data into insecure networks when they interact. If a network attacker intercepts and tampers with this data, it may cause chaos in production and even paralyze the entire IIoT system. Therefore, to ensure the regular operation of intelligent production, data receivers must authenticate the data before using them. However, existing message authentication schemes in the IIoT environment authenticate each message individually, which creates many redundant operations. Hence, to ensure data security among smart devices and reduce the computational overhead of data processing, we propose a batch authentication scheme based on edge computing in IIoT. Specifically, we design a lightweight batch authentication algorithm and use edge servers to assist smart devices in authenticating data, thus reducing the computational burden on smart devices and improving the efficiency of message authentication. The security analysis shows that the proposed scheme is secure in the random oracle model and meets the series of security requirements of the IIoT. In addition, we illustrate the efficiency of the scheme through experiments.

Traffic route management is essential for reducing traffic jams and enhancing driving safety because of the growing number of vehicles and frequent occurrence of traffic accidents. However, in vehicular ad-hoc networks (VANETs), real-time messages are transmitted via wireless channels, which can result in security and privacy concerns. Existing proposals for traffic route management exist security vulnerabilities, as well as high calculation and communication costs. Encouraged by this fact, we design a lightweight traffic route management scheme for fog-based VANETs. In this scheme, vehicles utilize homomorphic encryption to encrypt their driving routes and then send the encrypted information to a fog node. The traffic management center (TMC) decrypts the received ciphertexts that are aggregated by the fog node and performs traffic management according to the decrypted data, without knowing individual route of each vehicle. Furthermore, blockchain is used in the scheme to conduct public keys management of vehicles. Our detailed security proof and analysis indicate that our proposal can meet the security objectives of VANETs. Further, to demonstrate the feasibility of the scheme, we also implement it in the Ethereum test network (i.e., Rinkeby). Significantly, the performance analysis demonstrates that our proposal achieves a better performance than other relevant representative schemes.

With the continuous innovations and development in communication technology and intelligent transportation systems, a new generation of vehicular ad hoc networks (VANETs) has become increasingly popular, making VANET communication security increasingly important. An intrusion detection system (IDS) is an important tool for detecting network attacks and is an effective means of improving network security. However, existing IDSs encounter several problems involving inaccurate detections, low detection efficiencies, and incomplete detections owing to extensive changes in vehicle locations in VANETs. This study explores federated learning in software-defined VANETs and designs an efficient and accurate collaborative intrusion detection system (CIDS) model. The model utilizes the collaboration among local software-defined networks (SDNs) to jointly train the CIDS model without directly exchanging local network data flows to improve the expansibility and globality of IDSs. To reduce the model difference between different SDN clients and improve the detection accuracy, this study regards the prediction loss for each SDN client as an objective from the perspective of constrained multi-objective optimization. By optimizing a surrogate maximum function containing all the objectives, the method adopts two-stage gradient optimization to achieve Pareto optimality for SDN clients with the worst fairness constraint maximization performance. In addition, this study evaluates the training model using two open-source datasets and compares it with the latest methods. Experimental results reveal that the proposed model ensures local data privacy and demonstrates high accuracy and efficiency in detecting attacks and is thus superior to the current schemes.

As the disruptor of cloud storage, decentralized storage could lead to a major shift in how organizations store data in the future. To ensure data availability, users generally encrypt the data and distribute it to multiple storage service providers. It is necessary to study data integrity verification in decentralized storage. Although some recent studies have proposed the using blockchain technology to assist auditing work in decentralized storage networks, the on-chain overhead still increases linearly with an increase in audit requests. Blockchain networks will inevitably be overloaded. In this study, we propose an efficient data integrity auditing scheme for multiple copies in decentralized storage. Particularly, using different polynomial commitment schemes, we first propose a basic scheme for verifying multiple copies of a single file, and then we propose an efficient batch auditing scheme for multiple copies of multiple files. Our scheme can significantly reduce the computation overhead of storage service providers while keeping the on-chain storage overhead constant. Security analysis and performance analysis show that our scheme is efficient and practical.

Cloud storage services improve the efficiency and popularity of data sharing. These services allow groups of participants to jointly maintain the shared data. As important security properties of cloud data sharing, the integrity and the reliability of the shared data have been studied recently. However, the existing research cannot sufficiently solve the issue of participant identity anonymity in the scenario of data modification. In this paper, we propose a novel approach to achieve fully anonymous integrity checking and reliability authentication for cloud data sharing. We design a predicate for the shared data, and construct the Lagrange interpolation polynomials for all participants to compute the secret keys based on the designed predicate. When modifying the shared data, the participants compute the authenticators of the modified data using the secret key associated with the designed predicate instead of their identities. In this way, the integrity checking and reliability authentication of the shared data modified by different participants can be performed while the identities of the corresponding participants remain fully anonymous. In addition, the traceability and revocation of participant identity are considered. The performance analysis demonstrates the efficiency of the proposed approach, and the security analysis shows that the proposed approach satisfies the desired properties.

Deep neural network (DNN)-based video processing methods are applied in mobile video analytics because of high accuracy. Edge computing is an efficient paradigm that improves the performance of mobile video analytics. However, due to the limited computing and storage resources at edge devices, deploying DNN-based video analytics at edge devices may have difficulty to meet user’s requirements in terms of accuracy, delay, power consumption, and device costs. Choosing optimal system configuration, including resources on edge devices and parameters in video stream and DNN models, can better satisfy user’s performance requirements; however, there lacks practical approaches to find such optimal configurations. In this article, we take an initial step to investigate the optimal system configuration problem, and propose a data-driven approach, EdgeEye, which first models the above problem as a combinatorial optimization problem, and then designs an algorithm to find the solutions for the optimal configuration. These models and algorithms are applied in a real-world face detection and recognition application based on two edge computing models, including edge only and edge server. Comprehensive evaluation results demonstrate that EdgeEye can find both feasible and optimal system configurations including optimal edge computing model to satisfy varying user requirements under different network conditions.

Vehicular ad hoc networks (VANETs) play an ever-increasing important role in improving traffic management and enhancing driving safety. However, vehicular communication using a wireless channel faces security and privacy challenges. The conditional privacy-preserving authentication (CPPA) scheme is suitable for solving the above challenges, but the existing identity-based CPPA schemes suffer from inborn key escrow issues. Motivated by this, we propose a lightweight CPPA scheme based on elliptic curve cryptography to solve the above issues, in which the pseudonym and public/private key pair of the vehicle is generated by itself, so that the proposed scheme avoids the key escrow issue. Furthermore, to achieve efficient vehicular communication, a CPPA scheme is proposed using a fog computing model that supports mobility, low latency, and location awareness. The pseudonym of the vehicle is generated by two hash chains in the proposed scheme, so that the storage overhead can be reduced efficiently under the condition that backward security is guaranteed. Security analysis shows that the scheme is secure under the random oracle and satisfies the security requirements of VANETs. Performance evaluation demonstrates that the proposed scheme outperforms related schemes in terms of computational and communication overhead.

Cross-cloud data migration is one of the prevailing challenges faced by mobile users, which is an essential process when users change their mobile phones to a different provider. However, due to the insufficient local storage and computational capabilities of the smart phones, it is often very difficult for users to backup all data from the original cloud servers to their mobile phones in order to further upload the downloaded data to the new cloud provider. To solve this problem, we propose an efficient data migration model between cloud providers and construct a mutual authentication and key agreement scheme based on elliptic curve certificate-free cryptography for peer-to-peer cloud. The proposed scheme helps to develop trust between different cloud providers and lays a foundation for the realization of cross-cloud data migration. Mathematical verification and security correctness of our scheme is evaluated against notable existing schemes of data migration, which demonstrate that our proposed scheme exhibits a better performance than other state-of-the-art scheme in terms of the achieved reduction in both the computational and communication cost.

In vehicular networks, caching content in fog nodes is a widely accepted and favorable way to quickly respond to massive vehicle requests, reduce content retrieval delay and improve service quality. However, to implement such caching mode, it is critical to ensure efficient security and privacy protection when vehicles access the cached content in fog nodes. In this paper, aiming at the security issue, a novel lightweight cryptography-based access control scheme for software defined vehicular networks (SDVN) is proposed, by using TESLA broadcast authentication protocol and Pederson commitment. The scheme realizes direct and efficient authentication between vehicles and fog nodes while limiting only legitimate vehicles can get request responses, and avoids limitations or deficiencies in existing access control schemes. Moreover, considering the limited cache space of the fog node, by utilizing the flexibility of the SDN paradigm, a cooperative cache update mechanism is provided. The security verification with ProVerif and detailed security analyses prove that the scheme can meet the security requirements in SDVN. And compared with the related works, our scheme achieves better performance in terms of computation and communication costs.

With the rapid development of the industrial Internet of Things (IIoT) and cloud computing, an increasing number of companies outsource their data to cloud servers to save costs. To protect data privacy, sensitive industrial data must be encrypted before being outsourced to cloud servers. A multiuser searchable encryption (MUSE) scheme was introduced to ensure high efficiency of encrypted data retrieval. In an IIoT system with numerous users, the existing MUSE schemes suffer from certain key exposure problems owing to the limited key protection of smart devices and frequent queries by users. In this article, we propose a parallel key-insulated MUSE scheme for IIoT. This scheme utilizes broadcast encryption technology to implement MUSE. In addition, our scheme introduces a key-insulated primitive to improve the tolerance to key exposure. The security of our scheme is proved in the random oracle model. The experimental results show that our scheme achieves high computational efficiency.

The large amount of driving data can help intelligent vehicles make decisions to drive safely, improve vehicular services and enhance driving experience. In traditional vehicular networks, data sharing needs to be done with roadside units (RSUs). However, RSUs cannot be entirely trusted and the data stored in the RSUs may be tampered with. In addition, the deployment of RSUs along roads consumes a large amount of social resources. Further, data sharing between vehicles lacks a trusted environment, and vehicles may be unwilling to share data with others because of data security and privacy concerns. Moreover, in the event of unauthorized data sharing, the source of the leaked data is difficult to trace. In this study, we exploit consortium blockchain technology to achieve traceable and anonymous vehicle-to-vehicle (V2V) data sharing, effectively preventing second-hand sharing of data. The combination of 5G and blockchain makes it possible to share data without using RSUs. We design an enhanced delegated proof-of-stake consensus algorithm to make it more suitable for applications in the distributed Internet of Vehicles (IoV). A comprehensive analysis shows that the proposed scheme is secure and efficient.

Conditional privacy preservation and message authentication serve as the primary research issues in terms of security in vehicular networks. With the arrival of 5G era, the downloading speed of network services and the message transmission speed have significantly improved. Consequently, the content exchanged by users in vehicular networks is not limited to traffic information, and vehicles moving at high speeds can share a wide variety of contents. However, sharing content reliably and efficiently remains challenging owing to the fast-moving character of vehicles. To solve this problem, we propose a reliable and efficient content sharing scheme in 5G-enabled vehicular networks. The vehicles with content downloading requests quickly filter the adjacent vehicles to choose capable and suitable proxy vehicles and request them for content services. Thus, the purpose of obtaining a good hit ratio, saving network traffic, reducing time delay, and easing congestion during peak hours can be achieved. The security analysis indicates that the proposed scheme meets the security requirements of vehicular networks. Our cryptographic operations are based on the elliptic curve, and finally, the proposed scheme also displays favorable performance compared to other related schemes.

Vehicular ad hoc networks (VANETs) are vulnerable to many kinds of security attacks, so it is necessary to design an authenticated key agreement (AKA) scheme for securing communication channels in VANETs. Existing AKA schemes in VANETs have not provided an efficient and secure method to secure V2V and V2I communications simultaneously while meeting the necessary security and privacy requirements. Further, few key updating mechanisms, which are secure, conditional privacy-preserving, practical, and lightweight, exist in current VANETs AKA schemes. In this paper, we propose a proven secure AKA scheme for securing V2V and V2I communications in VANETs, which can be divided into two parts. The first part is a three-party authentication process in which vehicles, road side unit (RSU), and trust authority (TA) authenticate each other. The second part is the key agreement process, which is used in the key generation and updating processes. For this phase, we design a tree-based key agreement algorithm that considers two scenarios, i.e., the joining of an authenticated vehicle and the leaving of the vehicle. The formal security proof and the security analysis show that our proposed scheme satisfies session key security and the necessary security requirements in VANETs, respectively. The performance analysis demonstrates that our proposed scheme has an advantage over several representative AKA schemes in VANETs.

To effectively boost computer usage, machine learning models are used in several phishing detection systems to classify enormous phishing datasets. Based on phishing patterns, researchers prefer to extract a considerable number of features to improve phishing detection performance. However, redundant and useless features in the feature set degrade the performance of the underlying classification models. In addition, several existing phishing detection models mainly focus on detection accuracy and overlook recall rates. However, in phishing detection, it is more harmful to falsely detect a phishing website as a legitimate website than it is to detect a legitimate website as a phishing website. This study proposes a novel phishing detection model, multi-objective evolution/random forest (MOE/RF), which is based on the revised multi-objective evolution optimization algorithm (MOE) and random forest (RF). The MOE/RF model uses accuracy as the detection target and minimizes the probability of false detection of phishing sites. In addition, two new strategies, the symmetric uncertainty-based population initialization and the population state-based adaptive environmental selection, are proposed to improve the performance of the MOE. Experimental results on testing five different phishing datasets demonstrated that the MOE/RF performs superior to several existing methods.

With the development of IoT, more and more data is offloaded from the cloud to the edge for computing, eventually forming a collaborative computing model at the edge. However, in this model, the problem of secure data transmission has not been solved. In this model, data is transmitted and forwarded in multiple messaging systems, and existing security schemes cannot achieve end-to-end security in a multi-hop, broadcast transmission model. Therefore, in this paper, we propose a new security scheme based on proxy re-encryption and broadcast encryption techniques. Moreover, the performance and security of the scheme are further enhanced by using online-offline techniques and a trusted execution environment when integrating the scheme with edge collaboration. Finally, this paper proves the security of the scheme in theory, compares the functionality of the scheme, analyzes the theoretical performance of the scheme, and finally measures the actual performance of the scheme in the edge collaboration system.

The cloud computing paradigm provides numerous tempting advantages, enabling users to store and share their data conveniently. However, users are naturally resistant to directly outsourcing their data to the cloud since the data often contain sensitive information. Although several fine-grained access control schemes for cloud-data sharing have been proposed, most of them focus on the access control of the encrypted data (e.g., restricting the decryption capabilities of the receivers). Distinct from the existing work, this article aims to address this challenging problem by developing a more practical bidirectional fine-grained access control scheme that can restrict the capabilities of both senders and receivers. To this end, we systematically investigate the access control for cloud data sharing. Inspired by the access control encryption (ACE), we propose a novel data sharing framework that combines the cloud side and the edge side. The edge server is located in the middle of all the communications, checking and preventing illegal communications according to the predefined access policy. Next, we develop an efficient access control algorithm by exploiting the attribute-based encryption and proxy re-encryption for the proposed framework. The experimental results show that our scheme exhibits superior performance in the encryption and decryption compared to the prior work.

For comprehensive analyzing or efficient searching from massive data, string matching is widely used as a core technique of the network traffic detection applications and text editors. However, the increasing compressed text challenges string matching to achieve high-speed processing. In this paper, we propose KCM, a fast Knuth-Morris-Pratt based string matching method over LZ77 compressed text. It leverages the gathered heuristic information during scanning to skip the characters that should have been scanned. In our evaluation with real traffic, KCM skips more than 90% compression text, which nearly approaches the theoretical upper bound. It can achieve 1.61 Gbps throughput and boost 1.87 times than the classic string matching.

Because network nodes are transparent in media streaming applications, traditional networks cannot utilize the scalability feature of Scalable video coding (SVC). Compared with the traditional network, SDN supports various flows in a more fine-grained and scalable manner via the OpenFlow protocol, making QoS requirements easier and more feasible. In previous studies, a Ternary Content-Addressable Memory (TCAM) space in the switch has not been considered. This paper proposes a scalable QoS-aware multicast scheme for SVC streams, and formulates the scalable QoS-aware multicast routing problem as a nonlinear programming model. Then, we design heuristic algorithms that reduce the TCAM space consumption and construct the multicast tree for SVC layers according to video streaming requests. To alleviate video quality degradation, a dynamic layered multicast routing algorithm is proposed. Our experimental results demonstrate the performance of this method in terms of the packet loss ratio, scalability, the average satisfaction, and system utility.

The rapid development of the Internet of Things (IoT) accumulates a large number of communication records, which are utilized for anomaly detection in IoT communication. However, only a small part of these records can be labeled, which increases the difficulty in anomaly detection. This article proposes a semisupervised hierarchical stacking temporal convolutional network (HS-TCN), which is the first semisupervised model for anomaly detection in IoT communication, and it can train unlabeled data based on a small number of labeled data. Furthermore, HS-TCN fully considers the features of streaming data in IoT communication and can weed out uncertain records. Finally, the experimental results demonstrate that HS-TCN promotes the performance of anomaly detection and attains better efficiency.

A connected and autonomous vehicle (CAV) is often fitted with a large number of onboard sensors and applications to support autonomous driving functions. Based on the current research, little work on applications' access to in-vehicle data has been done. Furthermore, most existing autonomous driving operating systems lack authentication and encryption units. As such, applications can excessively obtain confidential information, such as vehicle location and owner preferences and even upload it to the cloud, threatening the security of the vehicle and the privacy of the owner. In this study, we propose a fine-grained access control scheme to restrict applications' access to data in CAVs (FGAC-inCAVs). First, we present a system model composed of the following elements: a trusted third party (TTP), which is a fully trusted authority; perception components like sensors, which can capture the road information (pictures, videos, etc.); and multiple applications. Then, a fast attribute-based encryption (ABE) is presented, and security analysis also shows it is secure against selective and chosen-plaintext attacks. Furthermore, we propose a key update scheme based on the Chinese remainder theorem (CRT). Finally, the theoretical analysis and simulation experiments demonstrate its feasibility and efficiency.

Sensing data plays a pivotal role in connected and autonomous vehicles (CAVs), enabling CAV to perceive surroundings. For example, malicious applications might tamper this life-critical data, resulting in erroneous driving decisions and threatening the safety of passengers. Access control, one of the promising solutions to protect data from unauthorized access, is urgently needed for vehicle sensing data. However, due to the intrinsic complexity of vehicle sensing data, including historical and real time, and access patterns of different data sources, there is currently no suitable access control framework that can systematically solve this problem; current frameworks only focus on one aspect. In this article, we propose a novel and flexible access control framework,AC4AV, which aims to support various access control models, and provide APIs for dynamically adjusting access control models and developing customized access control models, thus supporting access control research on CAV for the community. In addition, we propose a data abstraction method to clearly identify data, applications, and access operations in CAV, and therefore is easily able to configure the permits of each data and application in access control policies. We have implemented a prototype to demonstrate our architecture on NATS for real-time data and NGINX for historical data, and three access control models as built-in models. We measured the performance of ourAC4AVwhile applying these access control models to real-time and historical data. The experimental results show that the framework has little impact on real-time data access within a tolerable range.

By equipping various sensors and analyzing sensed data, vehicles can perform automatic driving; these vehicles are known as connected and autonomous vehicles (CAVs). In CAVs, tampered data will result in incorrect driving decisions. Hence, secure data transmission should be ensured to enable correct life-critical decisions. Untrusted resource-constrained modules allow attackers to obtain private data from CAVs, such as the key. Benefitting from trusted computing, the proposed scheme can verify the trusted status of internal modules and achieve secure data transmission by adopting the remote attestation and hash message authentication code. The scheme is proven to be secure in the random oracle model under the computational Diffie–Hellman problem. Furthermore, we perform experiments and evaluate the performance using Intel Software Guard eXtensions, which provide part of the trusted computing function. The experimental results show that the scheme could be efficient and suitable for CAVs.

The k-nearest neighbors (k-NN) query is a fundamental primitive in spatial and multimedia databases. It has extensive applications in location-based services, classification & clustering and so on. With the promise of confidentiality and privacy, massive data are increasingly outsourced to cloud in the encrypted form for enjoying the advantages of cloud computing (e.g., reduce storage and query processing costs). Recently, many schemes have been proposed to support k-NN query on encrypted cloud data. However, prior works have all assumed that the query users (QUs) are fully-trusted and know the key of the data owner (DO), which is used to encrypt and decrypt outsourced data. The assumptions are unrealistic in many situations, since many users are neither trusted nor knowing the key. In this paper, we propose a novel scheme for secure k-NN query on encrypted cloud data with multiple keys, in which the DO and each QU all hold their own different keys, and do not share them with each other; meanwhile, the DO encrypts and decrypts outsourced data using the key of his own. Our scheme is constructed by a distributed two trapdoors public-key cryptosystem (DT-PKC) and a set of protocols of secure two-party computation, which not only preserves the data confidentiality and query privacy but also supports the offline data owner. Our extensive theoretical and experimental evaluations demonstrate the effectiveness of our scheme in terms of security and performance.

Existing security and identity-based vehicular communication protocols used in Vehicular Ad-hoc Networks (VANETs) to achieve conditional privacy-preserving mostly rely on an ideal hardware device called tamper-proof device (TPD) equipped in vehicles. Achieving fast authentication during the message verification process is usually challenging in such strategies and further they suffer performance constraints from resulting overheads. To address such challenges, this paper proposes a novel Chinese remainder theorem (CRT)-based conditional privacy-preserving authentication scheme for securing vehicular authentication. The proposed protocol only requires realistic TPDs, and eliminates the need for pre-loading the master key onto the vehicle's TPDs. Chinese remainder theorem can dynamically assist the trusted authorities (TAs) whilst generating and broadcasting new group keys to the vehicles in the network. The proposed scheme solves the leakage problem during side channel attacks, and ensures higher level of security for the entire system. In addition, the proposed scheme avoids using the bilinear pairing operation and map-to-point hash operation during the authentication process, which helps achieving faster verification even under increasing number of signature. Moreover, the security analysis shows that our proposed scheme is secure under the random oracle model and the performance analysis shows that our proposed scheme is efficient in reducing computation and communication overheads.

Owing to the development of wireless communication technology and the increasing number of automobiles, vehicular ad hoc networks (VANETs) have become essential tools to secure traffic safety and enhance driving convenience. It is necessary to design a conditional privacy-preserving authentication (CPPA) scheme for VANETs because of their vulnerability and security requirements. Traditional CPPA schemes have two deficiencies. One is that the communication or storage overhead is not sufficiently low, but the traffic emergency message requires an ultra-low transmission delay. The other is that traditional CPPA schemes do not consider updating the system secret key (SSK), which is stored in an unhackable Tamper Proof Device (TPD), whereas side-channel attack methods and the wide usage of the SSK increase the probability of breaking the SSK. To solve the first issue, we propose a CPPA signature scheme based on elliptic curve cryptography, which can achieve message recovery and be reduced to elliptic curve discrete logarithm assumption, so that traffic emergency messages are secured with ultra-low communication overhead. To solve the second issue, we design an SSK updating algorithm, which is constructed on Shamir's secret sharing algorithm and secure pseudo random function, so that the TPDs of unrevoked vehicles can update SSK securely. Formal security proof and analysis show that our proposed scheme satisfies the security and privacy requirements of VANETs. Performance analysis demonstrates that our proposed scheme requires less storage size and has a lower transmission delay compared with related schemes.

With the rising popularity of the Internet and communication technology, vehicles can analyze and judge the real-time data collected by various cloud service providers (CSPs) in a vehicular network. However, in a vehicular network environment, real-time data are transmitted via wireless channels, which can lead to security and privacy issues. To avoid illegal access by adversaries, vehicle authentication and key agreement mechanism has been considered as one of the promising security measures in vehicular network environments. Besides, most of the solutions focus on authentication between one vehicle and one CSP. In such strategies, the implementation of efficient authentication for multiple vehicles and CSPs simultaneously is usually challenging. Further, they are also subjected to performance limitations due to the overhead incurred. To solve these issues, we propose a many-to-many authentication and key agreement scheme for secure authentication between multiple vehicles and CSPs. The proposed scheme can prevent unauthorized access and provide SK-security even if temporary information is leaked. To improve the service, the CSP only needs to broadcast an anonymous message periodically instead of having to generate a unique anonymous message for each of vehicles. Similarly, when a vehicle wants to request the services of m CSPs, it only needs to send one request message instead of m. Therefore, the proposed scheme not only implements many-to-many communication but also significantly reduces the computation and communication overhead. Moreover, a thorough security analysis shows that the proposed scheme provides better security compared to other related schemes.

Scalable Video Coding (SVC) is a promising coding technique that enables flexible video transmission to support heterogeneous devices. However, the current best-effort delivery model characterized by the Internet cannot fully exploit the scalability feature of SVC because the network nodes are transparent for multimedia streaming applications. Software-defined networking (SDN) has emerged as an innovative network paradigm that decouples the control and forwarding planes while routing. This architecture with the OpenFlow protocol enables network operators to obtain per-flow QoS control in a more scalable, flexible, and finely granular manner compared to the conventional network architecture. Inspired by these facts, this paper designs a comprehensive QoS-aware multicast scheme for scalable video streaming over SDN networks. First, we present the designed multimedia streaming multicast system architecture and formulate the QoS-aware multicast routing problem as a non-linear programming model. We then propose a fundamental tree construction algorithm that decomposes the video streaming requests into subrequests and serves them in a bottom-up manner. Furthermore, we design a layer switching strategy based on the video distortion model to mitigate network-induced video quality distortion. Finally, the experimental results are presented to validate the performance of our methods in terms of scalability, network utility, video playout quality, and playback interruption ratio.

Summary Elevator scheduling algorithms generally denote methods used to calculate how to use the elevator. These algorithms can distribute elevators to various floors of a building, thereby achieving efficient transportation. From the perspective of the elevator scheduling problem, we address the load‐balancing problem for software‐defined networking (SDN) architecture and propose a load‐balancing method based on the elevator scheduling algorithm, LBBESA. We take advantage of the flexibility of the SDN architecture, obtain the real‐time load of the server through real‐time statistical analyses of the SDN switch port traffic by the controller, and combine this with the idea of regional elevator allocation to coordinate the connection of the client's requests and realize the load balancing of each server in the cluster. Simulation experiments show that, compared with the round‐robin algorithm, LBBESA is more effective in the load balancing of the server pool and can improve the throughput of the server pool to a certain extent. In addition, our scheme is easy to implement and has high scalability.

In recent years, research on the security of Industry 4.0 and the Internet of Things (IoT) has attracted a close attention from industry, government, and the scientific community. Smart vehicular networks, as a type of industrial IoT, inevitably exchange large amounts of security and privacy-sensitive data, which make them attractive targets for attackers. For protecting network security and privacy, we have proposed an extensible and effective anonymous batch authentication scheme. In contrast to traditional pseudonym authentication schemes, the same system private key need not to be preloaded in our scheme, effectively avoiding a system failure when destroying a vehicle. Besides, the certificate revocation list (CRL) size is merely related to the number of vehicles that have been revoked, regardless of the number of pseudonym certificates for revoked vehicles. Moreover, this scheme maintains the effectiveness of the traditional scheme, effectively reduces the scale of the CRL, and employs an identity revocation scheme that supports rapid distribution. The scheme supports conditional privacy protection, namely, only the trusted authority (TA) can uniquely trace and revoke vehicles. For illegal vehicles, the TA releases the two hashed seeds to facilitate traceability by all entities in its domain. Furthermore, security analysis indicates that our solution is secure under the random oracle model and fulfills a series of security requirements of vehicular networks. Compared to existing authentication schemes, performance evaluations show that the scheme offers relatively good performance in terms of time consumption.

With the advancements in social media and rising demand for real traffic information, the data shared in vehicular ad hoc networks (VANETs) indicate that the size and amount of requested data will continue increasing. Vehicles in the same area often have similar data downloading requests. If we ignore the common requests, the resource allocation efficiency of the VANET system will be quite low. Motivated by this fact, we propose an efficient and privacy-preserving data downloading scheme for VANETs, based on the edge computing concept. In the proposed scheme, a roadside unit (RSU) can find the popular data by analyzing the encrypted requests sent from nearby vehicles without having to sacrifice the privacy of their download requests. Further, the RSU caches the popular data in nearby qualified vehicles called edge computing vehicles (ECVs). If a vehicle wishes to download the popular data, it can download it directly from the nearby ECVs. This method increases the downloading efficiency of the system. The security analysis results show that the proposed scheme can resist multiple security attacks. The performance analysis results demonstrate that our scheme has reasonable computation and communication overhead. Finally, the OMNeT++ simulation results indicate that our scheme has good network performance.

With an increasing number of cloud service providers (CSPs), research works on multi-cloud environments to provide solutions to avoid vendor lock-in and deal with the single-point failure problem have expanded considerably. However, a few schemes focus on the conditional privacy protection authentication of vehicular networks under a multi-cloud environment. In this regard, we propose a robust and extensible authentication scheme for vehicular networks to fulfil the ever-growing diversified service demands from users. According to our solution, the vehicles need to register with the trusted authority (TA) only once to achieve a fast and efficient authentication with CSPs. Additionally, as long as the new CSP is successfully registered in TA, it can participate in vehicular service. A cloud broker, which is managed by the TA, is responsible for connecting all the cloud services; consequently, the complexity involved in the selection of CSPs is hidden from the users' view. A detailed security analysis establishes that our scheme can fulfil conditional privacy protection and achieve the security objectives of vehicular networks. Our scheme is based on elliptic curve cryptography and does not employ the complex bilinear pairing operation. An evaluation of performance of the proposed scheme indicates that it is suitable for applications involving vehicular networks.

Auction is an efficient trading mechanism for cloud markets and adopted by many major cloud providers, such as Amazon EC2. However, most cloud auction designs only target at economic robustness without considering the bidding privacy leakage, which would dramatically hamper the practical applications of truthful cloud auctions. Existing secure cloud auction mechanisms only work on the single-sided cloud markets rather than more practical two-sided markets, and these schemes are too unwieldy to be practical due to significant computation and communication overheads. To fill these gaps, in this paper we propose a privacy-preserving double auction mechanism for two-sided cloud markets, which would not leak any bidding information beyond the auction results to anyone. Technically, we start by presenting a novel secure sorting protocol in the mixed form, which combines additive secret sharing and garbled circuits together. On this basis, our design for secure cloud auction is implemented given consideration to bidding privacy and auction efficiency. Finally, we use extensive experiments to validate its efficacy and performance.

As the rapid growth of connected and autonomous vehicles (CAVs) and 5G intensifies, more third-party applications are increasingly being deployed on CAVs. They not only improve user experience but also provide more helpful services, for example, enhancing public safety by recognizing criminals in real-time videos. Current CAVs prefer to process collected data on the vehicle to avoid long transmission latency and extra network cost. However, due to the limitations of the on-board vehicle computing unit (VCU) and increasing use of computing-intensive in-vehicle applications, the burden of on-board VCU has sharply increased, which may affect driving safety. In particular, for existing vehicles on the road, adding more computing devices is a challenge if not impossible due to cost concerns. Inspired by edge computing, we propose a novel platform, MobileEdge, to enhance the computing capability of the unchangeable on-board VCU, which leverages mobile devices as edge nodes, e.g., the passengers' smartphones, by offloading computing tasks to them for collaboratively computing. Moreover, MobileEdge provides the dynamic management of mobile devices, monitoring device status and interfaces for customizable task offloading strategies and eventually achieves optimal task scheduling. We build a prototype to demonstrate the designed platform and evaluate three task offloading strategies which were implemented based on the developed interfaces. The results show that MobileEdge significantly reduces the application response latency. Compared with the baseline which does not employ task offloading, the response latency is almost near real-time when more computing resources are available. In addition, the proposed shortest response latency strategy outperforms the best overall task scheduling among the three strategies.

The rapid development of Internet of Things (IoT) accumulates lots of communication data. Not being processed in time, these massive data increase the difficulty of anomaly detection for smart service. Furthermore, labeling all communication data is unpractical. Therefore, it is necessary to accomplish some feasible ways which can incorporate unlabeled data effectively. In recent years, Temporal Convolutional Network (TCN) has been proposed to solve sequence problems and got better performance compared to Recurrent Neural Network (RNN) in most cases. This paper proposes a semi-supervised hierarchical stacking TCN for the first time, which concentrates on the anomaly detection of the communication in smart home. The ideology of hierarchical model fully considers the features of streaming data in smart home scenario, and the stacking method is used to weed out the outliers. In this way, the detection accuracy can be highly improved. Finally, experimental results demonstrate that the proposed model can promote the security of the communication in smart home with a large extent as well as get much better performance.

Traditional public key infrastructure-based authentication schemes provide vehicular networks with identity authentication and conditional privacy protection, which are not sufficient for assessing the credibility of messages. Additionally, although the new generation of cellular networks (5G) can dramatically improve the transmission efficiency of the messages, many existing authentication schemes are based on complex bilinear pairing operations, and the calculation time is too long to be suitable for delay-sensitive 5G-enabled vehicular networks. To address these issues, we propose a reputation system-based lightweight message authentication framework and protocol for 5G-enabled vehicular networks. The trusted authority (TA) is in charge of reputation management. A vehicle with a reputation score below the given threshold cannot obtain a credit reference from the TA for participating in the communication; therefore, the number of untrusted messages in vehicular networks is reduced from the source. Security analysis shows that our scheme is secure against an adaptively chosen-message attack, and also satisfies a series of requirements of vehicular networks. The scheme is based on the elliptic curve cryptosystem and supports batch authentication; therefore, it shows better performance in terms of time consumption when compared with related schemes.

The Internet of Things (IoT)-based health system provides patients and doctors a lot of conveniences, doctors can diagnose patients in time through monitored health data. However, doctors may make a wrong diagnosis of the patient's illness, if the health data stored on the cloud is tampered or lost due to an external attack or power failure. Therefore, it is of great importance to verify the integrity of the patient's health data stored on the cloud. Existing data integrity verification technologies usually need data owner to compute data authenticators for verification, but sensors on a patient in IoT-based health system have limited computation ability, thus existing data integrity verification technologies are not very suitable in IoT-based health system. This paper proposes a lightweight secure IoT-based health storage system to solve this problem. The proposed system employs edge server to compute data authenticators and verify data integrity, greatly reduces the system's computation cost and management burden of third party verifier. Security analysis and performance evaluation show the proposed system is feasible.

With the installation of enormous public safety and transportation infrastructure cameras, video analytics has come to play an essential part in public safety. Typically, video analytics is to collectively leverage the advanced computer vision (CV) and artificial intelligence (AI) to solve the four-W problem. That is to identify Who has done something (What) at a specific place (Where) at some time (When). According to the difference of latency requirements, video analytics can be applied to postevent retrospective analysis, such as archive management, search, forensic investigation and real-time live video stream analysis, such as situation awareness, alerting, and interested object (criminal suspect/missing vehicle) detection. The latter is characterized as having higher requirements on hardware resources as the sophisticated image processing algorithms under the hood. However, analyzing large-scale live video streams on the Cloud is impractical as the edge solution that conducts the video analytics on (or close to) the camera provides a silvering light. Analyzing live video streams on the edge is not trivial due to the constrained hardware resources on edge. The AI-dominated video analytics requires higher bandwidth, consumes considerable CPU/GPU resources for processing, and demands larger memory for caching. In this paper, we review the applications, algorithms, and solutions that have been proposed recently to facilitate edge video analytics for public safety.

Spectrum auction is an effective approach to improve the spectrum utilization, by leasing an idle spectrum from primary users to secondary users. Recently, a few differentially private spectrum auction mechanisms have been proposed, but, as far as we know, none of them addressed the differential privacy in the setting of double spectrum auctions. In this paper, we combine the concept of differential privacy with double spectrum auction design and present a differentially private double spectrum auction mechanism with approximate social welfare maximization (DDSM). Specifically, we design the mechanism by employing the exponential mechanism to select clearing prices for the double spectrum auction with probabilities exponentially proportional to the related social welfare values and then improve the mechanism in several aspects, such as the designs of the auction algorithm, the utility function, and the buyer grouping algorithm. Through theoretical analysis, we prove that DDSM achieves differential privacy, approximate truthfulness, and approximate social welfare maximization. Extensive experimental evaluations show that DDSM achieves a good performance in terms of social welfare.

With the progress in wireless communication technology and the increasing number of vehicles, vehicular ad hoc networks (VANETs) have become essential for improving road conditions and enhancing driving experience. The core of the VANETs is the communication between different vehicles, and the security of the communication is based on message authentication. Several schemes have been designed to enhance the efficiency of message authentication. However, these schemes have the disadvantage of redundant authentication, i.e., repeated authentication of the same message, and fail to seek invalid messages from the batch of messages. To solve these problems, this paper introduces a novel edge-computing concept into the message-authentication process of VANETs. In our scheme, the roadside unit can efficiently authenticate messages from nearby vehicles and broadcast the authentication results to the vehicles within its communication range, thereby reducing redundant authentication and enhancing the efficiency of the entire system. The security analysis results show that the proposed scheme satisfies the security requirements of the VANETs. The performance analysis results show that the proposed scheme can not only work well in an ideal environment where the attacker is absent but also capable of quickly identifying valid and invalid messages even if the VANET is attacked.

Vehicular ad-hoc network (VANET) plays an extremely important role in future intelligent transportation systems. Many researchers proposed different schemes to improve communication efficiency under the premise that conditional privacy is preserved. In this paper, we propose an efficient conditional privacy-preserving authentication scheme using revocation messages to optimize VANET communication. Our scheme consists of two phases. First, in the anonymous identity generation and message signing phase, lightweight hash operations are used, and message length is reduced both the computation and communication overheads in VANET. Second, in the vehicle revocation phase, Road Side Units broadcast revocation messages to prevent malicious vehicles from generating anonymous identity and signing messages quickly. Security and performance analysis demonstrate that our proposed scheme is more secure and efficient than many existing schemes, and is more suitable for the deployment of VANET.

Software-defined Networking (SDN) brings new vitality to traditional network technology as its nice property of network programmability makes our network more open and flexible. By using interfaces of SDN controllers, different applications with diverse network functions can deploy their needed flow rules into SDN switches. However, some of these flow rules would probably produce conflicts that result in invalidation of network functions and cause security issues. To address this issue, we design a novel approach, Transaction-based flow rule Conflict Detection and Resolution (TCDR), which can isolate the flow rules of different network functions to avoid interference between different network functions. Meanwhile, our proposed method introduces a transaction-based authentication to guarantee the legality of flow rules. Finally, we implement a prototype of our solution, and evaluate its effectiveness and efficiency. The performance evaluation shows that TCDR can reject illegal flow rules and avoid many flow rule conflicts with a small overhead.

In this paper, we envision the future connected and autonomous vehicles (CAVs) as a sophisticated computer on wheels, with substantial on-board sensors as data sources and a variety of services running on top to support autonomous driving or other functions. In general, these services are computationally expensive, especially for the machine learning based applications (e.g., CNN-based object detection). Nevertheless, the on-board computation unit possess limited compute resources, raising a huge challenge to deploy these computation-intensive services on the vehicle. On the contrary, the cloud-based architecture conceptually with unconstrained resources suffers from unexpected extended latency that attributes to the large-scale Internet data transmission; thus, adversely affecting the services' real-time performance, quality of services and user experiences. To address this dilemma, inspired by the promising edge computing paradigm, we propose to build an Open Vehicular Data Analytics Platform (OpenVDAP) for CAVs, which is a full-stack edge based platform including an on-board computing/communication unit, an isolation-supported and security & privacy-preserved vehicle operation system, an edge-aware application library, as well as an optimal workload of?oading and scheduling strategy, allowing CAVs to dynamically detect each service's status, computation overhead and the optimal of?oading destination so that each service could be finished within an acceptable latency and limited bandwidth consumption. Most importantly, contrast to the proprietary platform, OpenVDAP is an open-source platform that offers free APIs and real-?eld vehicle data to the researchers and developers in the community, allowing them to deploy and evaluate applications on the real environment.

Cloud storage is a significant service provided by the cloud that enables users to store their immense data into the cloud. As the advent of the big data era, cloud storage services are becoming increasingly popular. For security reasons, data owners would like to check the integrity of their data after storing it in the cloud. To do this, they usually make use of the public cloud data integrity checking schemes. This paper focuses on user anonymity in such schemes so that no third party could infer the identity information of any data owner from checking procedures. The problem is obviously inevitable in reality, however the current solutions are relatively involved as they heavily use public key certificates and/or incur huge communication overhead. In this paper we introduce the concept of attribute-based cloud data integrity checking to achieve user anonymity lightly and present security models for such systems. We also provide a practical construction and prove its security in the random oracle model. Finally, we show how to extend our construction to protect data privacy against any third party.

The development of vehicular ad-hoc network (VANET) allows vehicle users to enjoy location-based services through the network at any time and place. However, it also raises location privacy issues. Privacy-preservation of large amounts real-time location data is a critical issue. Existing research work, such as the mix-zone scheme, has protected users' location privacy and driving routes to a certain extent. However, existing schemes have some deficiencies in security and efficiency. This paper presents a novel location privacy protection scheme. Vehicles can generate virtual locations dynamically based on the situation of surrounding vehicles to provide misleading information regarding the driving route and thus achieve location privacy. We use entropy of anonymity set and tracking success ratio as metrics to measure the level of privacy-preserving. Simulation experiments have been carried out to compare with other existing schemes. The results show that entropy of anonymity set in our scheme is 100% larger than the compared scheme and the tracking success ratio has decreased from 10% to 1%. So, the results illustrate that the proposed scheme offers better security and location-based services.

In the Internet of Everything era, billions of geographically distributed things will connect to the Internet and generate hundreds of zettabytes of data per year. Pushing that data to the cloud requires tremendous network bandwidth cost and latency. This is too onerous for some latency-sensitive applications, such as vehicle tracking using city-wide cameras. One application currently limited by such obstacles is the America's Missing Broadcast Emergency Response (AMBER) Alert system-but edge computing could transform this system's capabilities. Edge computing is a new computing paradigm that greatly diminishes data transmission and response latency by processing data at the proximity of data sources. However, most vision-based analytics are compute-intensive, and an edge device might be overwhelmed given tens of frames each second for real-time analysis. Also, the system needs a customized and flexible interface to implement efficient tracking strategies. To meet these needs, here we extend a big data processing framework, called Firework, to support collaboration between multiple edge devices and customizable task-scheduling strategies. Based on this extended version of Firework, we implement the AMBER alert assistant (A3), which efficiently tracks and locates a vehicle by analyzing city cameras' data in real time. We also propose two kinds of customized task-scheduling algorithms for vehicle tracking in A3. Comprehensive evaluation results show that A3 achieves real-time video analytics by collaborating among multiple edge devices; and the proposed location-direction-related diffusion strategy effectively controls the searching area for vehicle tracking by smartly selecting candidate cameras.

In wireless sensor networks, data aggregation allows in-network processing, which leads to reduced packet transmissions and reduced redundancy, and thus is helpful to prolong the overall lifetime of wireless sensor networks. In current studies, Elliptic Curve ElGamal homomorphic encryption algorithm has been widely used to protect end-to-end data confidentiality. However, these works suffer from the expensive mapping function during decryption. If the aggregated results are huge, the base station has no way to gain the original data due to the hardness of the elliptic curve discrete logarithm problem. Therefore, these schemes are unsuitable for the large-scale WSNs. In this paper, we propose a secure energy-saving data aggregation scheme designed for the large-scale WSNs. We employ Okamoto-Uchiyama homomorphic encryption algorithm to protect end-to-end data confidentiality, use MAC to achieve in-network false data filtering, and utilize the homomorphic MAC algorithm to achieve end-to-end data integrity. Two popular IEEE 802.15.4-compliant wireless sensor network platforms, Tmote Sky and iMote 2 have been used to evaluate the efficiency and feasibility of our scheme. The results demonstrate that our scheme achieved better performance in reducing energy consumption. Moreover, system delay, especially decryption delay at the base station, has been reduced when compared to other state-of-art methods.

Software-defined networking (SDN) has become a popular paradigm for managing large-scale networks including cloud servers and data centers because of its advantages of centralized management and programmability. The issues of scalability and reliability that a single centralized controller suffers makes distributed controller architectures emerge. One key limitation of distributed controllers is the statically configured switch-controller mapping, easily causing uneven load distribution among controllers. Previous works have proposed load-balancing methods with switch migration to address this issue. However, the higher-load controller is always directly considered as the overloaded controller that need to shift its load to other controllers, even if it has no response time delay. The pursuit of absolute load-balancing effect can also result in frequent network delays and service interruptions. Additionally, if there are several overloaded controllers, just one controller with the maximum load can be addressed within a single load-balancing operation, reducing load-balancing efficiency. To address these problems, we propose SMCLBRT, a load-balancing strategy of multiple SDN controllers based on response time, considering the changing features of real-time response times versus controller loads. By selecting the appropriate response time threshold and dealing with multiple overloading controllers simultaneously, it can well solve load-balancing problem in SDN control plane with multiple overloaded controllers. Simulation experiments exhibit the effectiveness of our scheme.

Now we are entering the era of the Internet of Everything (IoE) and billions of sensors and actuators are connected to the network. As one of the most sophisticated IoE applications, real-time video analytics is promising to significantly improve public safety, business intelligence, and healthcare & life science, among others. However, cloud-centric video analytics requires that all video data must be preloaded to a centralized cluster or the cloud, which suffers from high response latency and high cost of data transmission, given the scale of zettabytes of video data generated by IoE devices. Moreover, video data is rarely shared among multiple stakeholders due to various concerns, which restricts the practical deployment of video analytics that takes advantages of many data sources to make smart decisions. Furthermore, there is no efficient programming interface for developers and users to easily program and deploy IoE applications across geographically distributed computation resources. In this paper, we present a new computing framework,Firework, which facilitates distributed data processing and sharing for IoE applications via a virtual shared data view and service composition. We designed an easy-to-use programming interface forFireworkto allow developers to program onFirework. This paper describes the system design, implementation, and programming interface of Firework. The experimental results of a video analytics application demonstrate thatFireworkreduces up to 19.52 percent of response latency and at least 72.77 percent of network bandwidth cost, compared to a cloud-centric solution.

Database-driven spectrum access is regarded as an effective spectrum redistribution mechanism. However, dialoguing with the spectrum database requires both primary and secondary users to reveal their sensitive data to the spectrum database manager (SDM), leading to serious privacy concerns. In this paper, we show that the SDM can perform database operations (both updates and queries) without knowing any information about the users' sensitive inputs and the database contents, by combining garbled circuits and secret sharing. Our design uses data-oblivious sorting networks to leverage parallelism of query operations, yielding an efficient query algorithm. We further combine secure computations with authentication techniques to get a verification mechanism for correctness checking. As far as we know, our proposal is the first secure and verifiable database-driven spectrum sharing scheme protecting both primary users' (PUs') and secondary users' (SUs') privacies. Finally, we fully implement our system, and demonstrate that even on commodity PC, our implementation suffers mild performance overhead.

Truthful spectrum auction is believed to be an effective method for spectrum redistribution. However, privacy concerns have largely hampered the practical applications of truthful spectrum auctions. In this paper, to make the applications of double spectrum auctions practical, we present a secure, efficient and practical double spectrum auction design, SDSA. Specifically, by combining three security techniques: homomorphic encryption, secret sharing and garbled circuits, we design a secure two-party protocol computing a socially efficient double spectrum auction, TDSA, without leaking any information about sellers' requests or buyers' bids beyond the auction outcome. We give the formal security definition in our context, and theoretically prove the security that our design achieves. Experimental results show that our design is efficient and practical even for large-scale double spectrum auctions.

Summary Group key management (GKM) is an important research topic in mobile multicast communication nowadays. With the development of multiple services based on groups, it may be a very common phenomenon that multiple multicast groups coexist under a single network, and mobile subscribers can subscribe a variety of these services. Nevertheless, the current GKM schemes are focused on the communication in only a single group, which do not fit for multiple multicast group scenarios because of inefficient use of keys. In this paper, we propose a novel GKM scheme for multiple multicast groups in the Internet of People, called the area based multiple GKM (AMGKM) scheme. AMGKM can be implemented in wireless mobile network environments such as VANETs, and supports users to move across the wireless networks in the Internet of People while users subscribing to multiple multicast services with minimized communication overheads. AMGKM can also effectively mitigate the investment pressure of signaling load, and satisfy both the forward and the backward security and support membership changes. Our proposed method exploits the master key encryption (MKE) algorithm for efficiently reducing the rekeying overheads while providing intense security. Copyright © 2016 John Wiley & Sons, Ltd.

From smart watch to remote healthcare system, wireless body sensor networks (WBSNs) play an important role in modern healthcare system. However, the weak capacity of devices has limited WBSNs development. Considering the huge processing and storage capacity of the cloud, it can be merged with WBSNs to make up for the deficiencies of weak capacity. Based on this consideration, the concept of cloud-assisted WBSNs has been proposed recently. In contrast to generic data, the data in cloud-assisted WBSNs will be used for providing medical diagnosis, so the integrity of data is very important because any modification will result in severe consequences such as misdiagnosis. The public auditing scheme could provide an efficient solution to check the data integrity remotely without downloading them. However, the traditional public auditing scheme for cloud cannot be used directly due to the high data density and weak processing capacity in WBSNs. So, in this paper, we proposed a lightweight and efficient public auditing scheme, LEPA, for cloud-assisted WBSNs. Compared with similar schemes, the WBSNs’ client only needs to do one symmetrical encryption with low computational cost in LEPA. Security proof shows that LEPA can resist two types of adversaries in random oracle model. The efficiency evaluation also shows that LEPA outperforms previous proposals.

Truthful spectrum auctions make bidders reveal their true valuations for spectrum to maximize their utilities. However, disclosure of one's true value causes numerous security vulnerabilities. Moreover, as a distinguished property of spectrum auction compared to classical auctions, spectrum reutilisation requires that the bidder locations be disclosed to the auctioneer to run the auction. We investigate the impact of disclosing bidder locations and demonstrate that such disclosure can be exploited by a malicious auctioneer to gain extra profit and significantly degrade bidders' utility.

Due to perceived fairness and allocation efficiency, cloud auctions for resource allocation and pricing have recently attracted significant attention. As an important economic property, truthfulness makes bidders reveal their true valuations for cloud resources to maximize their utilities. However, disclosure of one's true value causes numerous security vulnerabilities. Therefore, privacy-preserving cloud auctions are called for to prevent such information leakage. In this paper, we demonstrate how to perform privacy-preserving auctions in clouds that do not leak any information other than the auction results to anyone. Specifically, we design a privacy-preserving cloud auction framework that addresses the challenges posed by the cloud auction context by leveraging the techniques in garbled circuits and homomorphic encryption. As foundations of our privacy preserving cloud auction framework, we develop data-oblivious cloud auction algorithm and basic operations (e.g., comparison, swapping etc.), such that the execution path does not depend on the input. In practical systems with a large number of users and constrained resources, we develop an improved version with a computational complexity of O(n log2 n) in the number of bidders n. We further fully implement our framework and theoretically and experimentally show that it preserves privacy by incurring only limited computation and communication overhead.

Abstract By using pseudo‐identity‐based signature, a conditional privacy‐preserving authentication scheme was proposed in this paper, called EECB, to solve the anonymous authentication issue in vehicular ad hoc networks. In this scheme, pseudo‐identities and the corresponding private keys are generated by the private key generator alone, which is credible and independent. So only Adding private key generators can satisfy the increasing pseudo‐identities demand. In other words, it has achieved the extensible of the scheme. However, the malicious vehicle can only be traced by trust authority. Furthermore, the protocol supports batch verification and the operation of a signature verification only needs two bilinear pairings and some point multiplication. The security of the signature scheme in EECB can be proved to be equivalent to the standard computational Diffie–Hellman problem in the random oracle. The experiment and the analysis indicated that, compared with the existing well‐known schemes, EECB has higher authentication efficiency and less communication cost. Copyright © 2017 John Wiley & Sons, Ltd.

The existing homomorphic encryption schemes are mostly in the form of “one-to-one” deployment models, where one party usually encrypts the plaintext and another party decrypts the ciphertext in public key cryptosystem. This form of cryptography loses efficiency under the demands of “one-to-many”, “many-to-one”, and “many-to-many” scenarios. In practice, there are many “many-to-one” scenarios, where the number of the receivers is usually very small compared with the number of the senders, and a receiver may serve millions of senders. The traditional “one-to-one” homomorphic encryption schemes are inefficient in such “many-to-one” scenarios. In this paper, we combine the homomorphic encryption concept with the cryptography form of “multi-party encryption, one-party decryption” to propose the “many-to-one” homomorphic encryption scheme. Firstly, the model of “many-to-one” homomorphic encryption scheme is built. Secondly, a “many-to-one” homomorphic encryption scheme is constructed based on the “somewhat” scheme, following by which, proving the correctness, homomorphism and security of our proposed scheme. Furthermore, an application example of our scheme is illustrated, and the complexity analysis of our scheme is presented. The complexity analysis along with a comparative study of our scheme with the existing schemes indicates that our proposed scheme is more efficient than the existing schemes. Finally, based on the construction of our proposed many-to-one scheme, a multi-level “many-to-one” homomorphic encryption scheme is also proposed. Copyright © 2015 John Wiley & Sons, Ltd.

Abstract Traditional asymmetric encryption algorithms involve only two parties: one party is a sender (encrypter) and the other a receiver (decrypter), in which each party has two different keys: a private key and a public key. However, if applied in some multiparty‐oriented environments, there may be a serious problem that each party needs to store and manage many keys, which is not only an overload but also a potential safety hazard. In this paper, we built a new secure communication model for private client–server networks, in which each party only needs to store a private key, but it can still implement two‐way secure communications with two properties of “one‐to‐many encryption” (i.e., if the server encrypts a plaintext, all clients can decrypt the ciphertext by using their respective private keys) and “many‐to‐one encryption” (i.e., if each client encrypts a plaintext by using his or her private key, only the server can decrypt the ciphertext). Furthermore, by introducing the basic theories for solving linear equations and ElGamal cryptographic algorithms, we designed the corresponding encryption and decryption algorithms in detail. The analysis results show that our algorithms are secure and efficient, and there are many good potential applications in military and electronic commerce fields. Copyright © 2015 John Wiley & Sons, Ltd.

In multiple-precision algorithms, the design and implementation of division is the most complicated. On the basis of some classical algorithms, this paper introduces an efficient improved algorithm. This algorithm omits the most majority of normalization of classical algorithms and uses integer arithmetic instead of floating-point data. By analyzing the algorithm and comparing the arithmetic cost, we conclude that this algorithm is at least three times faster than the most efficient previous solution. Key words: multiple-precision, algorithm, division.