We present CCA-Droid, a static analysis tool designed to detect cryptographic misuse related to chosen-ciphertext attacks (CCA) and chosen-plaintext attacks (CPA). CCA-Droid utilizes three key techniques: domain-specific slicing optimization to reduce analysis noise, crypto-state-aware call graph construction to capture indirect data flows via member variables, and conditional constant propagation for improved path sensitivity. Our evaluation demonstrates that CCA-Droid achieves 100% accuracy on CryptoAPI-Bench, surpassing CryptoGuard (72.3%), and maintains 94.8% accuracy on mutated code. Evaluations on the Ghera benchmark further confirm CCA-Droid's effectiveness, achieving 100% recall and 81.8% accuracy. On 16,284 real-world Android apps, CCA-Droid analyzed 96.4%, significantly outperforming existing tools such as CryptoGuard (80.4%) and QARK (40.0%). It identified cryptographic vulnerabilities in 12,678 apps (77.9%), with IV reuse, hardcoded keys, and missing authenticated encryption being the most prevalent issues.

Privacy-preserving data trading allows data owners to sell data to consumers through a data trading web platform, the data market, without disclosing sensitive information in raw data. It enables legitimate data transmission and aggregation, facilitating large-scale data-driven model training. However, existing differential privacy-based approaches struggle to inject precisely calibrated noise in a trustworthy manner without revealing raw data to a third party, thus making them fail in achieving strong fairness and controllable privacy simultaneously, especially when facing malicious external adversaries or a corrupted data market.

Established in 1982, Computers & Security (COSE) was the first journal dedicated to the technical and organizational dimensions of information security. This study examines COSE’s development from 1982 to 2024 through a bibliometric retrospective based on 4,405 Scopus-indexed documents, complemented by selected Web of Science analyses. Following the SPAR-4-SLR protocol, we combine publication and citation indicators with co-citation, bibliographic coupling, and keyword co-occurrence analyses using VOSviewer and bibliometrix . The results show four phases of publication growth, with the strongest expansion after 2016. Citation patterns indicate a sustained influence in network security, intrusion detection, privacy, malware analysis, and behavioral information security, while recent clusters point to growing attention to adversarial machine learning, blockchain, and cyber-physical systems. Author, institutional, and country-level patterns also suggest a broadening contributor base, with increased participation from Asian research systems in the most recent period. The network and keyword analyses show that COSE has retained links to its foundational security themes while incorporating newer socio-technical and AI-related topics. By mapping publication performance, intellectual structure, and topical change, the study provides a longitudinal account of COSE’s role in cybersecurity research and offers evidence that may support future editorial planning, author positioning, and research-policy discussions.

In IoT-enabled electricity markets, trading is often conducted in a forward-style manner, where parties agree on prices and quantities in advance and settle upon future delivery. However, deploying such forward-style exchanges across chains is incompatible with execution-restricted blockchains and typically incurs significant cross-chain gas overhead. Moreover, existing low-overhead cross-chain mechanisms, particularly HTLC-based schemes, inherently rely on pairwise locking and thus cannot efficiently support one-to-many settlement. We propose an inter-chain forward-style exchange framework based on a dual-track validation architecture. The framework integrates a double-spend fraud-proof mechanism to ensure correctness and a proof-of-acceptance (PoAc) mechanism to reduce cross-chain overhead for successful settlements. We further introduce a novel k-directional hash lock enabling one-to-many settlement, allowing a single buy order to be split across multiple sellers. Our analysis shows that the framework resists griefing attacks, prevents adversarial losses, and preserves cross-chain atomicity. Experiments demonstrate support for execution-restricted blockchains such as Bitcoin, scalability to 862,000 sellers per order, and a 78.25% reduction in settlement cost compared to light-client approaches.

The rapid development of the automotive industry and the Internet of Vehicles (IoV) has led to an exponential growth of distributed vehicular data, driving the need for secure and efficient collaborative machine learning solutions. However, existing distributed collaborative machine learning (DCML) approaches, such as federated learning and split learning, face significant challenges in IoV scenarios, including limited training efficiency, centralized aggregation vulnerabilities, and constrained privacy and model protection. To address these issues, we propose a blockchain-based split federated learning (BSFL) scheme for IoV applications. BSFL non-trivially combines federated learning and split learning to enable vehicles with low computational power to participate in parallel training, improving both model accuracy and training efficiency. By utilizing blockchain as a decentralized infrastructure, BSFL eliminates the risks of single points of failure and ensures model consistency through Byzantine fault-tolerant consensus. Furthermore, we design a noise addition mechanism based on differential privacy to safeguard client data privacy and model security. Formal security analysis and extensive experiments demonstrate that BSFL achieves enhanced privacy, security, and training performance. Comparing to related DCML schemes, BSFL reduces computational overhead by up to 88.84% and client training time by up to 29.49% while maintaining comparable accuracy. When training on ResNet-50 based on CIFAR10, BSFL achieved an accuracy of 93.15%. And the verification process for each model’s training results on the blockchain requires 1.49 ms.

Dynamic Proactive Secret Sharing (DPSS) is essential for distributed systems, enabling long-term key escrow, BFT protocol reconfiguration, and confidential state machine replication. Yet existing asynchronous schemes, while crucial for realistic settings, suffer from high communication overhead and poor practicality, limiting real-world deployment. We propose PlainDrop, a concise and efficient DPSS protocol designed specifically for asynchronous networks. PlainDrop achieves optimized communication complexity ofO(n2) via commitment–share decoupling combined with homomorphic threshold encryption techniques. PlainDrop also eliminates the need for expensive distributed key generation and complex bivariate polynomial structures by introducing a lightweight silent setup framework and employing direct share processing based on univariate polynomials. We formally prove that PlainDrop provides secrecy, integrity, and termination in asynchronous networks against a mobile adversary corrupting up to one third of the parties. We implement PlainDrop and evaluate it on Amazon EC2 with up to 100 nodes. Our experimental results demonstrate average reductions of 37% and 67% in completion time, and 61% and 89% in communication volume, compared to DyCAPS and LongLive, respectively.

Post-quantum key-encapsulation mechanisms (KEMs) usually use the well-known Fujisaki-Okamoto (FO) transformation during key decapsulation to achieve chosen ciphertext attack (CCA) security. In the FO transformation, the re-encryption procedure depends on the message. The side-channel leakage of re-encryption can be exploited to recover the coefficients of the secret key under chosen ciphertexts, even if the KEM scheme is CCA secure. However, it still requires a large amount of trace during the profiling and attacking phase. In this work, we introduce the first non-profiled deep learning-based attack on lattice-based KEMs. We propose a chosen ciphertexts method that is suitable for non-profiled deep learning-based attacks. The horizontal chunking strategy is employed to partition the coefficients into chunks, enabling the independent recovery of multiple secret key coefficients within each chunk. Then, we adopt an incremental learning strategy to allow the deep learning model to gradually learn the knowledge of each chunk. Moreover, we push the limits of traditional non-profiled deep learning-based attacks by combining the unsupervised domain adaptation with the correlation distinguisher, eliminating the necessity of neural network training for each possible key guess. The feasibility of the attack is verified by practical experiments for the unprotected and masked implementations of Kyber on the ARM Cortex-M4.

Blockchain-based information storage and retrieval systems face significant challenges in achieving efficiency, privacy, and auditability when operating across heterogeneous blockchain platforms. Existing solutions often struggle to balance these requirements, particularly in cross-chain environments involving both public and consortium blockchains. This paper proposes a novel framework that leverages cross-chain technology to address these limitations. The framework integrates multi-party threshold cross-chain consensus to optimize verification efficiency and reduce the computational burden on trusted nodes. To ensure privacy-preserving information querying and retrieval, advanced cryptographic techniques are employed. Additionally, a dedicated auditor set within the consortium blockchain is introduced to detect malicious behavior and enforce regulatory compliance. Comparative evaluations demonstrate that the proposed framework outperforms existing methods in terms of privacy protection, efficiency, and auditability. Experimental results on Hyperledger Fabric demonstrate significant improvements in throughput, achieving at least 20 Transactions Per Second (TPS), along with latency below 3.5 seconds and 300MB memory utilization under standard PC configurations. These findings validate the framework's practical viability for secure and efficient cross-chain information retrieval while maintaining superior performance compared to existing solutions.

Proof-of-Stake (PoS) blockchain protocols have gained increasing prominence in recent years due to their energy efficiency. In PoS systems, users stake tokens to become validators. Those who stake more tokens are elected to propose new blocks with higher probabilities and possess greater voting power in consensus decisions. At first glance, threshold signatures appear to be a promising mechanism for aggregating multiple block attestations in PoS blockchain protocols. However, traditional threshold signatures treat each participant equally in signature generation, disregarding the differing weights of participants. This lack of weight consideration poses a challenge in PoS blockchains, where validators inherently have varying levels of influence. To address this issue, a weighted threshold signature scheme is necessary—one that accounts for the distinct weights of signers, reflecting their respective voting power in PoS blockchains. Despite this need, no existing weighted threshold signature schemes are resistant to attacks by quantum computing. To fill this gap in the literature, we propose the first lattice-based weighted threshold signature scheme, proven secure under the module short integer solution (MSIS) assumption in the random oracle model. Furthermore, we demonstrate the integration of this novel scheme into PoS blockchain protocols for block attestation. Finally, we implement our weighted threshold signature scheme and present its efficiency evaluation.

Public key authenticated encryption with keyword search (PAEKS) is a cryptographic primitive applicable in cloud storage systems. It empowers cloud servers to conduct searches on encrypted data without decryption while safeguarding against the brute-force attack known as insider-keyword-guessing attacks (IKGAs). In contrast to the pioneering primitive PEKS, which is vulnerable to IKGAs, PAEKS incurs additional computational and communication overhead due to the sender keys' involvement in encryption and trapdoor-generation processes. Although the recent work improves the efficiency of PAEKS by re-encrypting received ciphertexts, the requirement of a fully trusted proxy is rather costly for users to implement in practice. To reduce the economic cost and to keep a high efficiency, we propose a new primitive ofProxy-free Public-key Authenticated Updatable and Searchable Encryption(PF-AUKS). The key concept is to let the cloud server, instead of the proxy, directly convert different-source ciphertexts into a uniform format securely. We propose a concrete PF-AUKS scheme that supports fast search, constant trapdoor generation, and secure ciphertext update. Theoretical evaluation and experimental results illustrate high algorithm running speed and retrieval efficiency. We formally define the security model of PF-AUKS and prove that our scheme is secure under this model.

Data has become a critical driver of innovation in artificial intelligence and the evolution of 6G technologies. The explosive growth of data volume accelerates the convergence of cloud and edge computing, while simultaneously posing heightened challenges to data security and privacy. The emerging cloud-edge-device collaborative paradigm enables dynamic and large-scale data circulation across heterogeneous entities, exposing systems to complex threats such as malicious edge nodes and eavesdropping over untrusted communication channels. In response to these issues, we propose EdgeGuard, a secure and decentralized framework for cloud-edge-device data circulation. EdgeGuard is specifically designed for highly dynamic environments and ensures robust data confidentiality, integrity, traceability, and resilience against both malicious external attackers and compromised edge servers. To underpin its cryptographic foundation, we develop two core primitives. Specifically, we introduce an Aggregatable Publicly Verifiable Secret Sharing (APVSS) scheme that enables efficient sharing of field elements while supporting aggregation and public verifiability. Furthermore, we construct AggDKG, a distributed key generation (DKG) protocol. AggDKG achieves public verifiability and bias resistance with an expected total communication cost of${\mathcal {O}}(\kappa n^{3})$effectively overcoming the scalability limitations inherent in traditional complaint-based protocols. Collectively, these components form a comprehensive framework that strengthens secure and efficient data circulation in cloud-edge-device systems. Experimental data show that AggDKG delivers clear performance gains: across all tested scales, its total running time is only about 8%–65% of that of the DKG of Gurkan et al., and at$n=256$, it reduces per-node runtime by approximately 27% compared with the DKG of Gennaro et al. These results highlight EdgeGuard's superior scalability, lower latency, and stronger Byzantine resilience for secure large-scale deployments.

The rapid adoption of cloud computing has intensified concerns over data privacy, particularly in the context of outsourced datasets. Attribute-Based Keyword Search (ABKS) has emerged as a promising cryptographic solution for enabling secure and efficient search over encrypted data. However, most existing ABKS schemes typically assume that all clients behave honestly, which weakens their applicability in real-world scenarios. In this work, we challenge this assumption by introducing ABKSUT, a new framework that incorporates user accountability and traceable ownership into ABKS. We formalize ABKSUT and present a concrete instantiation, Minos, which properly embeds the user's identity in the trapdoor and the data owner's identity in the ciphertext, enabling secure search, fine-grained access control, and post-hoc accountability. We formally prove the security and correctness of Minos and evaluate its performance using real-world datasets. Results show that Minos achieves strong security guarantees with practical efficiency, making it suitable for real-world deployment.

Long-range attacks pose a significant threat to the integrity of Proof-of-Stake (PoS) blockchains by enabling adversaries to reconstruct an alternative chain history embedded with fraudulent transactions. These attacks can deceive honest participants into accepting a maliciously crafted branch as the canonical chain. While Key Evolving Signature (KES) schemes are widely adopted to mitigate such threats, they typically rely on the assumption that validators behave honestly. In this work, we challenge this assumption by demonstrating how a malicious validator can exploit inherent limitations in existing KES-based mechanisms to mount a successful long-range attack. To address this critical vulnerability, we introduce a novel cryptographic construction that combines one-time signatures with commitment schemes. Our approach imposes constraints on the signing capabilities of validators, thereby significantly reducing the feasibility of long-range attacks. We provide rigorous formal security proofs to substantiate the robustness of our scheme and conduct a comprehensive performance evaluation. The results show that our solution is both computationally and storage efficient, making it a practical and scalable defense mechanism for real-world PoS blockchain deployments.

Federated Learning (FL) enables collaborative machine learning training while preserving data privacy. However, reliance on a central server of the typical FL confronts the risk of single server failure. Decentralized Federated Learning (DFL) emerges as a promising distributed framework, allowing clients to directly share models without server intervention, thereby addressing this challenge. Nevertheless, due to its decentralized nature, DFL is highly susceptible to Byzantine attacks orchestrated by malicious clients. Existing Byzantine-resilient DFL algorithms, though few, remain vulnerable to adaptive attacks due to their heavy reliance ongradient checksof local models, which can be adaptively manipulated by intelligent adversaries. To tackle this issue, we propose a DFL aggregation scheme called FORCE (Byzantine-Resilient Decentralized Federated Learning via Game-Theoretic Contribution Aggregation). Drawing inspiration from the Shapley value in game theory, FORCE shifts from gradient-checking approaches to employ a universal metric, the loss of the local model—independent of specific gradients, to identify potentially malicious clients. Moreover, to reduce the computational overhead of FORCE as the number of neighboring clients scales up, we propose a computationlightweight variant, FORCE−, which is optimized through approximating Shapley value computation. This variant becomes more scalable for resource-restricted DFL clients that are also aggregators. Experimental results on three diverse datasets (two image modalities and one textual modality datasets) under three existing attacks demonstrate that FORCE outperforms existing state-of-the-art Byzantine-resilient DFL aggregation methods, effectively defending against Byzantine attacks.

Federated Learning (FL) enables collaborative model training across distributed devices while preserving data privacy. However, it faces critical security challenges, including centralization risks and poisoning attacks, which degrade robustness and scalability. Existing schemes struggle to simultaneously mitigate targeted and untargeted poisoning attacks, impose restrictive adversary ratio assumptions (poison ratio < 50%), and suffer from privacy-performance trade-offs. To address these limitations, we propose SharBipole, a decentralized FL scheme integrating sharding blockchain with a novel dual-metric defense mechanism, Bipole. SharBipole employs a Byzantine Fault Tolerant-enabled sharding architecture to eliminate single points of failure, reduce communication overhead, and enable parallel model aggregation. Meanwhile, the Bipole module defends against poisoning attacks using two adaptive similarity metrics to filter malicious updates dynamically. Reinforcement learning optimizes threshold adjustments, while noise-aware adaptive clipping balances privacy and model utility. Further, we give convergence analysis to prove the theoretical soundness and scalability of SharBipole. Lastly, extensive experimental evaluations demonstrate that SharBipole supports poison ratios exceeding 50% and improves throughput and latency. The model replacement attack with 60% adversaries is entirely ineffective against SharBipole, and the label-flipping attack achieves an attack success rate of only 2.344%. SharBipole establishes a scalable, secure, and privacy-preserving solution for distributed learning in massive environments.

The rapid growth of sensitive cross-domain data, such as electronic health records and genomic sequences in healthcare, presents significant opportunities for large-scale, multi-institutional collaborative analysis. Meeting stringent privacy regulations while utilizing data has become a critical challenge. Private set operations (PSO) play a crucial role to address this challenge. PSO protocols enable privacy-preserving data alignment across parties (such as interinstitutional data matching based on private set intersection (PSI)) and secure data aggregation (such as federated data aggregation through private set union (PSU)), providing fundamental support for cross-domain data collaboration. This type of technology is not only applicable to multi-center medical research but also has broad value in other scenarios requiring confidential data sharing. However, existing delegated/outsourced PSO schemes face two key limitations: (1) high client-side preprocessing overhead, requiring clients to expensively mask private data before uploading; (2) performance and single-point dependency bottlenecks in client-assisted computation where one client must act as a computational leader. To address these issues, we propose a secret-shared PSO framework for lightweight clients. In our scheme, the clients can go offline while servers perform all computations, significantly reducing clients’ burden. Notably, our protocol can be extended to support multi-party settings, making it well-suited for collaborative research across multiple institutions. In addition, we prove the security of all constructions under the semi-honest model. Experiments show that when the set sizen≥ 216, our protocol has a significant advantage and is well-suited for lightweight client that holds a large set.

Graph Neural Networks (GNNs) have powerful representation capabilities for graph data, achieving excellent performance across various fields. Considering the scarcity of labels in real-world scenarios, graph self-supervised learning (GSSL) has gained increasing attention due to its ability to train without relying on labels. However, recent studies have revealed that GNNs are vulnerable to stealthy backdoor attacks in GSSL scenarios, enabling the encoder to learn backdoor features simply by injecting triggers. Existing graph backdoor defense methods mainly focus on supervised settings and cannot be directly transferred to self-supervised scenarios due to the lack of label guidance. To bridge this gap, we proposeGDetox, the first backdoor defense approach against backdoored encoders in GSSL.GDetoxaims to eliminate backdoor logic in encoders while maintaining the encoder's original performance. Specifically,GDetoxcan purify the graph backdoor encoder based on the self-supervised distillation approach without relying on label information. Further, we introduce an adversarial contrastive learning that augments node representations without relying on labels to enhance teacher model performance, thereby improving distilled encoder performance. We evaluate the defense performance ofGDetoxon four node classifications and four graph classification datasets by comparing with four state-of-the-art (SOTA) defense methods against seven latest backdoor attack methods on GSSL. Extensive experiments demonstrate thatGDetoxfar outperforms the SOTA defense methods, reducing the attack success rate to 4% with negligible degradation in encoder performance (within 2%) in both node-level and graph-level tasks.

Cloud storage has become the most attractive way to achieve data sharing by setting flexible access policies. Cryptographic tools are considered the most popular approach to protecting the privacy of data stored on the cloud. Dividing data into different classes plays a significant role in cloud storage, making data organization more methodical and data sharing more expressive and efficient. Unfortunately, current data sharing solutions either neglect data classification or suffer from data leakage. Specifically, shared keys can decrypt newly added encrypted data within the same class, and have key abuse issues where shared keys are untraceable once sold. In this work, we propose a time-bound data sharing system that addresses all these issues simultaneously. In our scheme, data is divided into different classes and encrypted according to its class and associated time period. Decryption keys for a set of chosen data classes can be aggregated into a single key, allowing users to decrypt multiple ciphertexts whose classes are within the set. While other encrypted data with classes outside the set remain confidential. Moreover, the aggregate key is time-bound which can only decrypt the ciphertexts generated before the embedded time period, ensuring it cannot access newly added encrypted data. The key size is independent of the chosen class set size and is only logarithmic in the bit length of the time period used. For each sharing, the shared aggregate key is different. In the event of data leakage or key selling, the data provider can identify the responsible users. We provide formal security analysis of our system and evaluate its performance through experiments. The results demonstrate that our system is highly efficient in terms of shared keys. It provides a practical solution for achieving efficient and dynamic data sharing in cloud storage.

In Ethereum, DevP2P is the fundamental network-layer protocol set that supports consensus mechanisms, transaction propagation and smart contract execution. Due to the importance of DevP2P, its bugs can be exploited by the attacker to cause security problems like denial of service, leading to property loss on Ethereum. However, existing blockchain testing approaches focus on the bug detection of consensus and application layers, causing many serious DevP2P bugs to be missed. In fact, detecting DevP2P bugs has some key challenges, including how to generate effective inputs and how to detect complex bugs. This paper designs D2PFuzz, the first network-layer differential fuzzing approach of bug detection for Ethereum. It consists of two key techniques: (1) aquery-based fuzzing strategythat dynamically generates valid DevP2P messages according to network, chain and node state changes; and (2) amulti-node differential checking methodthat identifies important differences of DevP2P response messages from multiple nodes in the same blockchain to detect semantic bugs. We have evaluated D2PFuzz on five open-source and popular Ethereum node implementations, including Geth, Erigon, Reth, Besu and Nethermind. D2PFuzz in total finds 15 unique bugs, 12 of which are previously unknown. Compared to two state-of-the-art blockchain testing approaches including LOKI and Hive, D2PFuzz improves testing coverage by 3.7x and 21.6x, respectively, and finds 13 bugs missed by these approaches.

As blockchain technology advances, an increasing number of applications require interactions between smart contracts across multiple blockchains. However, existing cross-chain solutions exhibit limited scalability due to heterogeneous blockchain environments and diverse application requirements. A fundamental challenge lies in the absence of a unified resource definition for cross-chain processes, impeding moderate resource allocation and effective conflict resolution. Specifically, when extended to general cross-chain transactions involving invocations among multiple contracts, these methods lack the capability to correctly handle state transitions for all related contracts. This paper proposes AtomXross, a novel cross-chain scheme that supports arbitrary combinations of smart contracts during the cross-chain process. We build a scalable cross-chain architecture based on a relay chain and a cluster of cross-chain nodes to provide better scalability. We propose a unified definition for cross-chain resources within the system and implement an adaptive resource management mechanism on the relay chain, enabling it to record the invocation relationships of contract functions. When a cross-chain transaction involves multiple contract calls, AtomXross can index the calls and generate the corresponding call tree. To address the challenges posed by potential mutual invocations between smart contracts, we design an atomic transaction protocol based on buckle-lock, an ordered two-tier pessimistic locking mechanism. AtomXross ensures that cross-chain transactions do not conflict with each other while remaining compatible with non-cross-chain calls that may occur at any time. Furthermore, we propose a universal programming template for on-chain smart contracts, which enables ordinary smart contracts to acquire cross-chain capabilities. We implement AtomXross based on Hyperledger Fabric and FiscoBCOS. In comparison to WeCross, AtomXross lowers the gas cost on system initialization and incurs only a 14% increase in transaction latency while supporting inter-contract calls.

The rise of edge-cloud computing has accelerated data sharing among mobile users. To resist malicious senders within organizations from leaking sensitive data, access control encryption (ACE) schemes have been employed to secure data f lows, in which each sender obtains an encryption key according to the access control policy to encrypt the data, and a sanitizer (i.e., the edge node) inspects all shared data between the sender and receiver. Although attribute-based ACE schemes have been put forward to support fine-grained data sharing, they lack temporal constraints on write control, which is crucial in mobile data sharing scenarios, and have high sanitization overhead at the edge node. In addition, they only provide selective security and are therefore vulnerable to adaptive adversaries. To this end, we propose TSFlow, a time-aware secure flow control framework in mobile edge-cloud that regulates which senders can transmit data to which receivers during the authorized time interval, preventing malicious sending by expired senders. At its core is TA-ACE, a time-aware attribute-based ACE that issues each sender an encryption key tied to an expressive access structure and a time interval. Encrypted data can be sanitized at the edge only if it is well-formed with a valid encryption key and encrypted within the time interval, and any legitimate receiver satisfying the access structure can decrypt the sanitized ciphertext. We formally prove that TA-ACE satisfies the adaptive no-read and no-write rules, and demonstrate the reasonable efficiency of TSFlow through experiments for secure flow control in mobile edge-cloud.

Feature unlearning, forgetting sensitive features while maintaining the accuracy of models, is a pressing issue against Feature Inference Attacks (FIA) in Vertical Federated Learning (VFL). This issue is addressed by retraining the model from scratch on a dataset without the sensitive features from scratch or Federated Unlearning (FU) for all samples. However, they either introduce high overheads due to retraining or reduce the accuracy of the unlearned model. In this paper, we proposedCer-FeaUn, a certified feature unlearning, trading off between the overheads and accuracy. Specifically, a novelfeature perturbation strategyis first proposed to construct a perturbed dataset, where the sensitive features are perturbed with noises. Then, the effect is defined as the parameters difference between models trained with the original and perturbed dataset. Finally, an unlearned model is trained in first-order, where the effect is removed from the original model in one epoch. Furthermore, Cer-FeaUn performscertified removalfor server-side models with strongly convex loss functions. That is, the distribution of the unlearned model is statistically indistinguishable from that of the retrained model. For the scenario with a few sensitive features, simulation results show that the accuracy of the unlearned model is up to 84.79%, and the runtime of Cer-FeaUn is 15 times faster than that of the retrained model.

With the development of air transportation, Space-Air-Ground Integrated Network (SAGIN) are playing an increasingly important role in optimizing air traffic management and enhancing flight safety for billions of passengers and trillions dollars of aviation industry. As the key technology of SAGIN, the Automatic Dependent Surveillance-Broadcast (ADS-B) system is widely used due to its simple operation, low construction cost, and high information accuracy. However, the security problems in ADS-B system, including lack of identity authentication between all communication links, crucial information transmitted in plaintext, and susceptibility to the single point of failure, have been serious obstacle to its wide application. Existing solutions fail to account for the unique characteristics of ADS-B and SAGIN, leading to inadequate security and poor performance in these specialized contexts. Aiming to solve the above issues and provide security and scalability for ADS-B system, we conduct the following research. Firstly, an enhanced identity-based broadcast signcryption (e-IBBSC) scheme is designed to keep crucial information confidential and all messages authenticated simultaneously. Secondly, we propose an efficient batch message authentication method combined with the Merkle tree and proposed e-IBBSC, significantly improving the ADS-B message utilization ratio from 1.35% to 74.10%. Thirdly, we utilize the sharding blockchain and Byzantine fault tolerance protocol to design the first sharding-based distributed management system for SAGIN that realizes fault tolerance and scalability. Finally, after a detailed security analysis and comprehensive performance evaluation, we demonstrate that our solution can achieve all proposed system goals including security, scalability, and high performance of 1s flight transaction processing latency and 62KTPS throughput.

The integration of the Internet of Things (IoT) with cloud computing has expanded the scope of IoT applications but also introduced challenges in dynamic data management. Attribute-Based Encryption (ABE) serves as a crucial technology for constructing access control systems in data sharing environ ments. ABE schemes with policy updating capabilities allow data owners to dynamically and frequently modify access policies. Existing ABE schemes typically outsource the task of policy updating to a cloud server; however, the size of the update keys remains linear with the number of updated attributes and depends on the types of updated gates. The resulting updating costs are not less than generating a new ciphertext for data owners, especially when updating multiple attributes and threshold gates. Therefore, in this paper, we propose a novel ABE scheme, termed Policy Updatable Ciphertext-Policy ABE (PU CP-ABE), which enables efficient and flexible policy updating. Our construction ensures that the size of update keys depends only on the number of updating gates, independent of both the number of attributes and the gate types. Furthermore, PU-CP ABE provides a unified update mechanism that supports AND, OR, and threshold gates without requiring distinct update keys for different gate types.

Homomorphic permutation is fundamental to privacy-preserving computations based on batch-encoding homomorphic encryption. It underpins nearly all homomorphic matrix operations and predominantly influences their complexity. Permutation decomposition as a potential approach to optimize this critical component remains underexplored. In this paper, we propose novel decomposition techniques to optimize homomorphic permutations, advancing homomorphic encryption-based privacy-preserving computations. We start by defining an ideal decomposition form for permutations and propose an algorithm searching for depth-1 ideal decompositions. Based on this, we prove the full-depth ideal decomposability of permutations used in specific homomorphic matrix transposition (HMT) and multiplication (HMM) algorithms, allowing them to achieve asymptotic improvement in speed and rotation key reduction. As a demonstration of applicability, substituting the HMM components in the best-known inference framework of encrypted neural networks with our enhanced version shows up to a 3.9× reduction in latency. We further devise a new method for computing arbitrary homomorphic permutations, specifically those with weak structures that cannot be ideally decomposed. We design a network structure that deviates from the conventional scope of decomposition and outperforms the state-of-the-art technique under a limited rotation key budget, achieving a speed-up of up to 1.69 ×.

Unlike standard vulnerability disclosure, fixing vulnerabilities "silently" is another common approach in software development. While silent fixes can prevent potential targeted attacks without disclosing any details, they only offer short-term protection. Users often rely on publicly disclosed vulnerabilities to identify and eliminate vulnerabilities in their own software, particularly for open-source software (OSS). We conduct the first comprehensive empirical study in OSS to investigate potential security threats brought by silent fixes. By examining disclosed vulnerabilities and their corresponding patches in real-world OSSes, we investigated the prevalence of silent vulnerabilities and assessed the potential impacts they might cause. After analyzing 3,515 vulnerabilities, we observed that nearly 50% of the vulnerabilities, with half of them classified as high-severity, were exposed for over 30 days. Over 10% of them published exploits during the "silent" period, enabling adversaries to replicate the exploits and attack other OSS users. Due to delayed vulnerability disclosure, we even found one HIGH-severity vulnerability that was silently fixed still exists in downstream software, indicating that silent fixes may increase the risks for other OSSes, amplifying their impact throughout software supply chains.

Cyber threat actors are increasingly targeting networked assets and critical infrastructure, with the potential for major socioeconomic impacts. Moving target defence (MTD) is a cyber defence paradigm that creates constantly shifting attack surfaces (i.e., vulnerabilities). It intends to make it more difficult for cyber adversaries to exploit systems, thereby increasing costs and chances of detection. There is a lack of research into the efficiency of combined MTD techniques, especially regarding several types of security considerations like time, cost, and effort. This gap is particularly significant in the Internet of Things (IoT) context, where security problems arise from its heterogeneous architecture . Moreover, MTD may result in the overutilization of network and system resources to enhance cybersecurity. We present a Vulnerability Defence method to address this issue using the three-layer Temporal Hierarchical Attack Representation Model (3-layer-THARM). This approach overcomes this difficulty by evaluating the safety of aggregated network states, considering security metrics in each state and the accessibility of network nodes and edges. Using this model, we can recognize probable attack scenarios in the context of Internet of Things (IoT) systems, conduct a thorough security analysis of the IoT system using well-defined security metrics, and assess the effectiveness of various defence tactics. This feature inherently introduces an additional level of security for the system. Furthermore, this model showcases the ability to identify potential attack pathways and effectively mitigate the consequences of such attacks. Our analysis reveals a noteworthy trend: combining MTD techniques from different categories, such as shuffle and diversity, generally produces more favorable outcomes, including a lower probability of attack success, lower attack risk and higher attack cost.

As the artificial intelligence, large model, Metaverse, and Web 3.0 develop rapidly, data is being traded constantly. Existing data exchange methods primarily rely on trusted third parties, which compromises fairness and decentralization. Moreover, existing methods often overlook data access control during trading and typically employ an one-to-one model, resulting in high communication and computational overhead. To address these issues, this article makes the following contributions. First, we propose a blockchain-based secure and fair data trading scheme named fair data trading (FairDT). By leveraging blockchain and smart contracts, FairDT achieves decentralized data trading with high throughput and scalability. Second, we design a fair data exchange mechanism that utilizes commitment schemes, Merkle trees, and other techniques to facilitate dispute resolution with constant on-chain cost when conflicts arise. Third, we incorporate attribute-based encryption to enable fine-grained access control in data trading, thereby reducing the computational burden on data sellers. Finally, we prove that FairDT satisfies access control, fair exchange, completeness, and termination properties. Experimental results on the Ethereum testnet demonstrate that the on-chain cost remains constant, showing that FairDT is highly efficient.

Cross-modal retrieval is a technique that uses one modality to query another modality in multimedia data (e.g., retrieving images based on text, or retrieving text based on images). It can break down the barriers between different modalities and achieve seamless information connection. Secure cross-modal retrieval focuses on privacy issues in cross-modal retrieval, including private data of data owners and private query requests of users. Current work on secure cross-modal retrieval protects private information through homomorphic encryption, which makes the efficiency of the retrieval phase not ideal. Therefore, the conflict between retrieval efficiency and security has become an important issue that needs to be resolved in secure cross-modal retrieval. We propose a scheme to achieve secure cross-modal retrieval in the form of secret sharing in the IoT environment. In the scheme, the data owner (DO) can secretly divide all the original data into two parts and upload them to two non-collusive cloud servers respectively. The servers store the data and provide cross-modal retrieval for users. The security of the scheme is proved under semi-honest model, and the experiments show that our scheme is more efficient than previous work in the search phase. When the query dimension is 512 and the number of latent factors is 500, the search time is reduced by more than half compared with previous work.

Federated learning allows clients to share model gradients instead of privacy-sensitive data, which can solve the issue of data silos, but lead to the problem of data privacy leakage due to the model gradient revealing the characteristics of the training data. Privacy-preserving federated learning based on homomorphic encryption schemes (HE-based PPFL) can properly solve the issues of participantsfs data privacy leakage, but they encounter some new challenges. Existing PPFL-based single-key homomorphic encryption schemes face the problem that clients can obtain othersf model gradients due to the shared key and PPFL-based multi-key homomorphic encryption schemes face the issues of incomplete privacy protection for models and high communication overhead due to the requirement of the collaborated decryption. Moreover, existing PPFL schemes either assume the server is always honest or the verification method is unreliable and expensive. To tackle these emerging challenges in HE-based PPFL, we propose an enhancing privacy-preserving and verifiable federated learning scheme. Specifically, we first construct a novel multi-key homomorphic encryption algorithm that achieves single-key decryption instead of the collaborated decryption in traditional PPFL-based multi-key homomorphic encryption. Meanwhile, we design a blockchain-based public verification method for the global model by applying a vector homomorphic hash, which can properly solve the issues of unreliable and expensive global model verification of the existing global model verification methods. Formal security analysis shows that the proposed scheme can well provide complete privacy protection and guarantee the integrity of the global model. Extensive experiments demonstrate that the proposed schemes can keep high accuracy (≈95%) compared with existing differential privacy-based PPFL schemes (≤90%). Meanwhile, the proposed schemes can achieve no decryption share size (0MB) compared to existing HE-based PPFL schemes and efficient verification compared wit

We propose a privacy-preserving machine learning scheme based on the cloud-edge–end architecture to address issues like weak computing power of Internet of Things (IoT) terminals, poor communication quality, and heavy cloud server burdens in traditional frameworks. Edge servers aggregate and forward terminal data, relieving terminals of heavy communication tasks and undertaking part of the computing tasks, which reduces the burden on cloud servers and improves system response speed. For privacy protection, we flexibly use homomorphic encryption and secret sharing techniques, and dynamically add differential privacy noise to resist member inference attacks. Task allocation is coordinated between different layers to optimize computing overhead. Shallow model training is performed on edge servers using homomorphic encryption, while deep model training is conducted on cloud servers using secret sharing. To achieve the conversion from homomorphic ciphertext to secret sharing shares, we design a distributed decryption protocol. Experimental results show our scheme reduces computation overhead by 20%–30% compared to existing privacy-preserving machine learning schemes based on the cloud-edge–end framework, while maintaining privacy protection throughout all stages.

The automatic dependent surveillance broadcast (ADS-B) system is a critical surveillance technology in air traffic management (ATM), essential for enhancing aviation safety and operational efficiency. However, ADS-B broadcasts plaintext messages over open channels without authentication mechanisms, and is constrained by message length limitations and low bandwidth, making it susceptible to various attacks, including deception, tampering, and replay. To address these challenges, we propose a secure and lightweight blockchain-integrated certificateless signature scheme (ECB-CLS) tailored for ADS-B systems with packet resilience. Specifically, we introduce an efficient signature verification algorithm based on elliptic curve cryptography (ECC) that supports batch verification without the need for certificate management, complex bilinear pairing, or hash-to-point calculations, significantly reducing computational overhead. Furthermore, our scheme leverages blockchain to ensure the decentralization and traceability of massive public keys and provides provable security against Type I and Type II adversary attacks. To address packet loss in practical environments, we incorporate both standard and enhanced Reed-Solomon (RS) coding to recover lost data. Experimental evaluations demonstrate that our blockchain-integrated ECB-CLS scheme offers substantial advantages in computational efficiency and signature length compared to existing methods, while also showing that RS coding introduces low-performance overhead. This makes our solution highly suitable for resource-constrained ADS-B systems.

Recently, protecting the Intellectual Property (IP) of deep neural networks (DNNs) has attracted attention from researchers. This is because training DNN models can be costly especially when acquiring and labeling training data require domain expertise. DNN watermarking and fingerprinting are two techniques proposed to prevent DNN IP infringement. Although these two techniques achieve high performance on defending against previously proposed DNN stealing attacks, researchers recently show that both of them are ineffective against generative model inversion attacks. Specifically, an adversary inverts training data from well-trained DNNs and uses the inverted data to train DNNs from scratch such that DNN watermarking and fingerprinting are both bypassed. This novel model stealing strategy shows that data inverted from victim models can be effectively exploited by adversaries, which poses a new threat to the IP protection of DNNs. To combat this new threat, one potential solution is to enable defenders to prove ownership on data inverted from models being protected. If the training data of a suspected model, which can be disclosed via the judicial process, are proven to be data inverted from victim models, then IP infringement is detected. This research direction is currently underexplored. In this paper, we fill the gap in the literature to investigate countermeasures against this emerging threat. We propose a simple but effective method, called InverseDataInspector (IDI), to detect whether data are inverted from victim models. Specifically, our method first extracts features from both the inverted data and victim models. These features are then combined and used for training classifiers. Experimental results demonstrate that our method achieves high performance on detecting inverted data and also generalizes to new generative model inversion methods that are not seen when training classifiers.

With the approach of the quantum era, public key cryptography (PKC) faces risks, which also presents challenges to blockchain technologies that utilize PKC as a core component. Sharding blockchain is a promising way to realize scalability, yet current research does not consider quantum-resistant sharding blockchains as it is non-trivial to design cross-shard communication and transaction processing method without PKC. Besides, blockchain enables reliability in data transmission and unbreakable communication while current schemes suffer from high overhead and low throughput. In this paper, we propose a quantum-resistant sharding blockchain (QRShar) and a secure data transmission scheme (QRDT) to fill the above gap. Firstly, we design a secure and efficient cross-shard communication pattern utilizing hash-based message authentication code (HMAC) and erasure code to reduce the transmission load and achieve high efficiency. Secondly, we propose the a quantum-resistant sharding blockchain utilizing optimized cross-shard transaction processing method to decrease the consensus execution frequency. Thirdly, we introduce a quantum-resistant key agreement protocol through the verifiable secret sharing on cryptographic hash function and we also offer a data transmission scheme to realize efficient QRDT. Furthermore, we conduct security analysis and performance evaluations for our schemes. The results show that the QRShar throughput can reach up to 34 KTPS and the latency stays below 2 seconds. The key agreement latency is just 43ms.

Cloud computing facilitates scalable data sharing across multiple organizations and users, but also raises concerns about data privacy. Matchmaking encryption (ME) is a prominent technique that enforces bilateral access control in cloud services such as cloud marketplace, allowing both senders and receivers to specify policies for the encrypted data to be revealed. However, receivers may be at risk of being exposed to malicious or harmful content, thus undermining their trust in cloud service platforms. To this end, we introduce MBAC, a content-moderated bilateral access control framework for privacy-preserving cloud data sharing services, which allows receivers to acquire data from authentic senders while preserving their anonymity, and report malicious content in a verifiable manner, i.e., empowering the service provider to hold senders accountable. MBAC is built upon a novel primitive called franking broadcast ME (FBME), which generates a franking signature for the data by designating the service provider as the moderator to ensure accountability and deniability, and encrypts both the data and its franking signature while embedding the sender secret key for privacy and authenticity. We then present a concrete construction of FBME from key-private public key encryption, strongly unforgeable one time signature and non-interactive zero-knowledge proof. Formal security analysis and extensive experiments demonstrate that MBAC provides efficient bilateral access control and content moderation for cloud data sharing services.

In recent years, Generative Adversarial Networks (GANs) have become essential tools in artificial intelligence research. Field Programmable Gate Arrays (FPGAs) offer remarkable flexibility, high performance, and energy efficiency for deploying GANs. However, the open and reprogrammable architecture of FPGAs, despite its advantages, introduces risks of unauthorized access and reverse engineering. To address this challenge, this paper presents a novel approach integrating Physical Unclonable Functions (PUFs) and logos to protect the Intellectual Property Rights (IPR) of GANs. Our method establishes a closed-loop conversion process where logos are transformed into PUF responses, generating unique identities fed into the GAN to reproduce the original logo. By embedding PUF response information into latent vectors, the generator produces images with embedded logos. Thanks to the uniqueness of PUF, a robust binding of the logo, FPGA, and GANs' IPR is implemented, allowing verification of the IPR with the assistance of a unique FPGA fingerprint, even when a publicly available logo is used. Experimental results show that embedding the logo does not change the performance of the original GANs, and the logo detection rate exceeds 90%. At the same time, the scheme can effectively resist brute force, fine-tuning and pruning attacks.

With the rapid advancement of technology, cloud computing has emerged as the most popular and promising service platform. A cloud user can delegate heavy computation tasks to cloud servers. To ensure the correctness of outsourced processing (e.g., machine learning and data mining), the cloud server must prove that the processing has been executed properly. However, even without malicious intent, it is possible for a cloud server to produce incorrect results. Consequently, clients may outsource the same task to multiple cloud servers and receive various results, aiding them in selecting the best outcome. To protect data privacy, the cloud server must encrypt the results before sending them back to the user. Yet, processing and verifying encrypted results remain significant challenges. To avoid the expensive computational overhead of decrypting ciphertexts from cloud servers one by one, clients prefer to use homomorphic encryption (HE) to obtain the combined output from a single server. However, existing schemes fall short of efficiently verifying the correctness of computations over encrypted data processed by multiple cloud servers, especially in extracting the results computed by each server. In this paper, we introduce a new framework for verifiable outsourced computing systems. In this system, each cloud server's computation result is protected by Paillier encryption, and the edge server can verify these results using zero-knowledge proofs and aggregate the verified ciphertexts. The client can extract the combined plaintext through the Base-3 conversion algorithm to identify each cloud server's results and any non-participating servers. We also prove the security of our scheme and analyze its performance from both theoretical and experimental aspects. Performance analysis shows that our system significantly reduces the client's workload and is userfriendly

In Web 3.0’s pursuit of a decentralized and user-autonomous network, traditional access control methods, such as central servers and weak decentralized algorithms, are insufficient regarding security, fault tolerance ability, and scalability. To solve this, we first design a decentralized multi-committee attribute-based encryption, X-ABE, to address the weak decentralization and low fault tolerance in Multi-Authority Attribute-Based Encryption (MA-ABE). X-ABE replaces MA-ABE’s fragile attribute authorities with robust attribute committees, each composed of multiple nodes. By developing dual-wrapped shares techniques, we address the increased dimensionality challenge of secret sharing while maintaining only 1 distributed key generation instance. Also, a formal security definition and proof under the partial adaptive model are given using dual system encryption. Second, X-LOCK, an X-ABE based decentralized access control utilizing consensus plus sharding, is proposed for Web 3.0, to achieve full decentralization, consistency, fault tolerance, user autonomy, and scalability. Third, X-ABE-R is proposed for attribute revocation and is demonstrated in X-LOCK-R with sharding blockchain as an immutable revocation ledger. Fourth, a formal definition and comparative analysis of X-ABE’s fault tolerance abilities are demonstrated, covering aspects of liveness and safety, along with the complexity analysis. Fifth, practical evaluations are conducted, demonstrating that while improving fault tolerance, the overhead remains acceptable.

Cryptocurrencies and permissionless blockchains allow nodes from all over the world to join, and their rapid development has created enormous blockchain networks with nodes spanning the globe. Blockchain network partitioning attacks split the network into separate node groups through disrupting communication, causing information inconsistency, and facilitating malicious behaviors like double-spending and selfish mining, threatening the blockchain security. Existing research primarily studies concrete partitioning attack methods. However, it is hard to analyze practical post-attack security and efficiency impacts on blockchains and design effective countermeasures. This paper studies practical network partitioning attacks’ impacts on existing proof-of-work-based (Bitcoin) and proof-of-stake-based (Ethereum) permissionless blockchains. We theoretically analyze and experimentally confirm the adverse effects of network partitioning on blockchain performance and security. Network partitioning will cause blockchain throughput to plummet, and cause block generation delay to increase rapidly. In our experiments on Ethereum 2.0, when the bandwidth between the partitioned networks is lower than 768 Kbps, the throughput begins to plummet precipitously until it ultimately falls to 0. What’s worse, network partitioning will significantly increase the success rate of double-spending. In our experiments on Bitcoin, when the bandwidth between the partitioned networks is less than 256 Kbps, the success rate of double-spending reaches 50%. To solve the above issues, we propose countermeasures leveraging a freezing threshold to safeguard the security of permissionless blockchains and resist double-spending attacks. We experimentally validate that the countermeasures enhance the resistance of permissionless blockchains to network partitioning attacks. It reduces the probability of double-spending in partitioned networks, thereby ensuring security and reliability.

Blockchain and cryptocurrencies are developing rapidly, and the scalability issue has become a constraint on their practical application and development. Off-chain payment channel is an effective solution to the scalability problem of blockchain. Currently, various payment channel protocols have been proposed. However, privacy issues are vital in payment channels. Existing works that consider privacy issues mainly focus on payment channel networks and payment channel hubs, while there is little work on two-party and multi-party channels. In addition, many existing payment channel works that consider privacy protection fix the transaction amounts to ensure the hiding of payment relationships or rely on smart contracts, which will hinder the practical application of payment channels. In this work, we propose a two-party privacy-preserving payment channel protocol that is compatible with Bitcoin (TBPChannel), achieving value privacy and unlinkability, while supporting variable transaction amounts. On this basis, we propose a privacy-preserving multi-party payment channel protocol (MBPChannel), which removes the role of untrusted operators in previous multi-party settings and further achieves robustness. We formally model the protocols in the universal composability framework and prove the security. Finally, we implement the protocols and provide a performance evaluation. The results demonstrate the scalability and practicality of our protocols. Compared to current protocols, even though we use privacy-preserving methods, our protocols are still efficient and applicable in practice.

In order to ensure data security and improve data usability, searchable encryption has been widely used in cloud computing systems. However, the evil single users with search privileges bring heavy privacy threats to the system. Threshold searchable encryption provides a collaborative search service for group users; a single user cannot search for ciphertext. However, the threshold searchable encryption based on the Shamir secret sharing mechanism cannot achieve flexible user dynamic since the Lagrange interpolation polynomial for recovering the secret value changes with the group user add or delete, resulting in the ciphertext or trapdoor containing Lagrange interpolation formula needs to be recreated. In this paper, the conjunctive keyword search with dynamic group-user scheme (CKSDGU) is proposed to realize group-user flexible addition and deletion. The proposed CKSDGU scheme can match successfully without the data owner resetting ciphertext and the original data user generating trapdoors. In addition, multi-keyword conjunctive retrieval is implemented in the CKSDGU scheme, and group users can search the target ciphertexts that contain all users’ query keyword sets. The security analysis illustrates that the CKSDGU scheme can resist chosen keyword attacks and keyword guessing attacks. The performance analysis presents that our scheme has considerable overhead and efficient computational cost in the user dynamic stage.

It is critical to achieve the following objectives in partially synchronous Byzantine Fault Tolerance (BFT) protocols: (1) two-phase commit regime, (2) standard optimistic responsiveness, and (3) linear communication complexity. These three properties significantly affect the efficiency of BFT protocols. A number of attempts, such as HotStuff and Tendermint, have been made to solve this problem, but they typically manage to achieve only a subset of these properties. In this work, we propose a two-phase BFT protocol called TockCuckoo that fully achieves the aforementioned three properties. A primary challenge intwo-phaseBFT protocols is HiddenLock: when a leader lacks visibility into the latest locked block states of honest replicas, it cannot safely proceed, potentially stalling the protocol. To address this issue, we introduce the proactive voting paradigm, which explicitly distinguishes between rejection and non-receipt states. After global stable time, an honest leader can always collect sufficient votes through proactive voting, enabling quick responses. TockCuckoo operates in continuous rounds of proactive voting, ensuring responsiveness. The proactive voting process requires only linear communication overhead, which directly results in TockCuckoo achieving linear communication complexity overall. Furthermore, we introduce TockCuckoo+, an extension of TockCuckoo. By introducing a cross-pipelined design, TockCuckoo+ enables more frequent block proposals without sacrificing the key characteristics of TockCuckoo, leading to improved throughput. Our experiments in wide-area networks demonstrate that, TockCuckoo reduces commit latency by 20% to 40% compared to HotStuff across different network sizes, and TockCuckoo+ achieves a throughput increase of 1.1× to 1.5× over HotStuff.

Outsourcing is an essential strategy for enterprises, and leveraging it can offer advantages such as saving costs, improving efficiency, and allowing them to concentrate on their primary business activities. Therefore, announcing and managing service requests is paramount for obtaining suitable quotes and partnering with the right outsourcing service providers. To achieve this, enterprises can employ digital signatures to ensure the authenticity and security of these service requests. However, the irrevocable nature of traditional digital signatures poses challenges, particularly when canceling the service requests is necessary. A withdrawable signature scheme provides a novel property for signers to initially create “withdrawable” signatures, which they can later confirm into additional conventional signatures. Withdrawable signatures can be regarded as withdrawn when the signer has not confirmed them yet. This property provided by the withdrawable signature mechanism can then be adopted as a solution to this problem, allowing the enterprise to retract announced signatures on service requests. However, to meet the demands in the outsourcing system, existing approaches on withdrawable signatures require further development since they only allow signers in outsourcing systems to confirm withdrawable signatures on service requests. This limitation prevents enterprises from accepting quotes for service requests simply by confirming the withdrawable signature. This paper focuses on this problem by applying the withdrawable signature to the outsourcing framework, identifying the limitations of existing withdrawable signature schemes, and proposing solutions. We demonstrate how revisiting of withdrawable signatures can lead to flexible outsourcing systems that ensure the cancellation of announced service requests. Additionally, we provide a performance evaluation demonstrating that our revised withdrawable signature scheme achieves acceptable efficiency and security within the outsourcing system.

With the growing popularity of various Internet of Things (IoT) applications, securing data transmission over these networks become critical. The authenticated key exchange (AKE) protocol is a fundamental cryptographic primitive that achieves this goal by creating a shared session key. However, since IoT end devices are usually resource-constrained, devising secure and efficient AKE protocols for IoT applications remains challenging. In this paper, we investigate the design of zero round-trip time (0-RTT) session resumption protocols based on pre-shared keys, which enables an end device to send encrypted data to a server without prior key exchange. Specifically, we first propose a new construction of puncturable pseudo-random function (PRF), and prove its security under the RSA assumption. Then, based on the proposed puncturable PRF and authenticated encryption with associated data, we put forward a new construction of 0-RTT session resumption protocol that simultaneously provides forward security and resistance against replay attacks. We further demonstrate how to combine the proposed 0-RTT session resumption protocol with other symmetric AKE protocols for IoT applications. Both theoretical comparisons and experimental results indicate that our proposal has significant advantages in terms of computation and storage costs for practical parameter settings. Thus, it is especially desirable for constrained devices.

Random beacons are of paramount importance in distributed systems (e.g., blockchain, electronic voting, governance). The sheer scale of nodes inherent in distributed environments necessitates minimizing communication overhead per node while ensuring protocol availability, particularly under adversarial conditions. Existing solutions have managed to reduce the optimistic overhead to a minimum ofO(n2), wherenrepresents the node count of the system. In this paper, we step further by proposing and implementing RandFlash, a leaderless random beacon protocol that achieves an optimistic communication complexity ofO(nlogn). Evaluation results demonstrate that RandFlash outperforms existing constructions, RandPiper (CCS’21) and OptRand (NDSS’23), in terms of the number of random beacons generated within largescale networks comprising 64 nodes or more (e.g., in sizes of 80 and 128). Furthermore, RandFlash exhibits resilience, capable of withstanding up to one-third of the nodes acting maliciously, all without the need for strongly trusted setups (i.e., embedding a secret trapdoor by trusted third parties). We also provide formal security proofs validating all properties upheld by this lineage.

Training Deep Neural Networks (DNNs) can be expensive when data is difficult to obtain or labeling them requires significant domain expertise. Hence, it is crucial that the Intellectual Property (IP) of DNNs trained on valuable data be protected against IP infringement. DNN fingerprinting and watermarking are two lines of work in DNN IP protection. Recently proposed DNN fingerprinting techniques are able to detect IP infringement while preserving model performance by relying on the key assumption that the decision boundaries of independently trained models are intrinsically different from one another. In contrast, DNN watermarking embeds a watermark in a model and verifies IP infringement if an identical or similar watermark is extracted from a suspect model. The techniques deployed in fingerprinting and watermarking vary significantly because their underlying mechanisms are different. From an adversary's perspective, a successful IP removal attack should defeat both fingerprinting and watermarking. However, to the best of our knowledge, there is no work on such attacks in the literature yet. In this paper, we fill this gap by presenting an IP removal attack that can defeat both fingerprinting and watermarking. We consider the challenging data-free scenario whereby all data is inverted from the victim model. Under this setting, a stolen model only depends on the victim model. Experimental results demonstrate the success of our attack in defeating state-of-the-art DNN fingerprinting and watermarking techniques. This work reveals a novel attack surface that exploits generative model inversion attacks to bypass DNN IP defenses. This threat must be addressed by future defenses for reliable IP protection.

As concerns over privacy protection grow and relevant laws come into effect, machine unlearning (MU) has emerged as a pivotal research area. Due to the complexity of the forgetting data distribution, the sample-wise MU is still open challenges. Gradient ascent, as the inverse of gradient descent, is naturally applied to machine unlearning, which is also the inverse process of machine learning. However, the straightforward gradient ascent MU method suffers from the trade-off between effectiveness, fidelity, and efficiency. In this work, we analyze the gradient ascent MU process from a multi-task learning (MTL) view. This perspective reveals two problems that cause the trade-off, i.e., the gradient direction problem and the gradient dominant problem. To address these problems, we propose a novel MU method, namely GDR-GMA, consisting of Gradient Direction Rectification (GDR) and Gradient Magnitude Adjustment (GMA). For the gradient direction problem, GDR rectifies the direction between the conflicting gradients by projecting a gradient onto the orthonormal plane of the conflicting gradient. For the gradient dominant problem, GMA dynamically adjusts the magnitude of the update gradients by assigning the dynamic magnitude weight parameter to the update gradients. Furthermore, we evaluate GDR-GMA against several baseline methods in three sample-wise MU scenarios: random data forgetting, sub-class forgetting, and class forgetting. Extensive experimental results demonstrate the superior performance of GDR-GMA in effectiveness, fidelity, and efficiency

Abstract A confidential reporting system (CRS) allows reporters to report concerns or problems in confidence without the fear of blame or reprisals. Nevertheless, privacy has been the primary concern of reporters. In this paper, we propose a privacy-preserving confidential reporting system with designated reporters (PPCRS-DR) to protect the privacy of reporters and the confidentiality of reports. Our PPCRS-DR provides the following interesting features: (1) for an event, an auditor can designate a reporter to report; (2) an auditor can neither see the report nor know the reporter’s identity from an encrypted report if the reporter is not the designated one; (3) when an auditor is unavailable, he/she can temporarily designate a delegatee to collect and review reports on behalf of him/her. We formalize both the definition and security model of our PPCRS-DR, and propose a concrete construction. Furthermore, the security of the proposed PPCRS-DR is formally proven. The implementation shows that it is efficient. The novelty is to implement flexible decryption delegation of CRSs and protect reporters’ privacy.

With the rise of the Internet of Things (IoT), IoT data analytics has gradually stepping into the spotlight of data mining. Existing research has primarily focused on enhancing the precision of IoT data mining, while the privacy protection aspects have not been fulfilled so far. The deployment of IoT data mining is contingent on the protection of data privacy and its economic worth to all parties. However, most existing IoT data mining research disregards economic benefits and lacks incentives, limiting its applicability. To address this issue, we provide a system for differential privacy-based IoT privacy-preserving data mining (IoT-PPDM) with dynamic incentive mechanism, and a formal economic model for IoT data mining is constructed. We utilized noncooperative game theory to simulate the multilateral interaction process in IoT data mining. To encourage participation from all parties, a dynamic incentive mechanism is designed to establish a balance between privacy protection and data mining requirements. In addition, we discuss the utility of all participants and theoretically validate the feasibility of IoT-PPDM. The experimental results show that IoT-PPDM with dynamic incentive mechanism can increase the benefits for all participants while avoiding irrational behavior of all parties.

Web3 is a revolutionary Internet paradigm that focusing decentralization, user empowerment, and intelligence. One of its key technologies is decentralized identity (DID), which has gained significant attention recently. However, existing DID solutions are not scalable enough to be compatible with the large-scale identity node applications required by Web3 across various fields. To overcome this challenge, we propose the first multi-layer Web3 DID architecture utilizing sharding blockchain, which provides management, scalability, and compatibility. This architecture leverages leader shards and the main chain to establish trust, while regular shards manage DID-related transactions. Specific system processes and query optimizations are also given. Besides, formal security analysis and comprehensive simulation evaluations have demonstrated that the architecture can achieve all proposed security and performance goals, including low latency of down to 2 seconds and high throughput of up to 90KTPS.

Polynomial commitment schemes (PCSs) are fundamental components that can effectively solve the problems arising from the combination of Internet of Things and blockchain. These allow a committer to commit to a polynomial and then later evaluate the committed polynomial at an arbitrary challenge point along with a proof of valid, without revealing any additional information about the polynomial. Recent works have presented polynomial commitment schemes based on the discrete logarithm assumption. Their schemes do not require a trusted setup, and the verifier uses homomorphism to check the polynomial evaluation proofs. However, these schemes require two-party interactions and satisfy only special soundness and special honest verifier zero-knowledge, which are infeasible for some nonsimultaneous online or decentralized applications. In this article, we propose a novel PCS inspired by the idea of the Fiat–Shamir heuristic. Our scheme is noninteractive between the committer and the verifier. Instead of waiting for the challenge values from the verifier, the committer generates the values by accessing a random oracle. Moreover, it satisfies computational soundness and zero-knowledge by using a group operation to enhance the unpredictability of challenge values. We also propose a trapdoor commitment scheme to ensure the honest use of challenge values by the committers. Finally, we present the security and performance analysis of our scheme, which shows that our scheme is feasible with an acceptable time overhead.

Outsourcing the heavy decryption computation to a cloud service provider has been a promising solution for a resource-constrained mobile device to deploy an attribute-based encryption scheme. However, the current attribute based encryption with outsourced decryption schemes only enable the mobile device to verify whether the cloud service provider has returned a correct decryption result, they lack a mechanism to enable the cloud service provider to escape from a mobile device's wrong claim if it has returned a correct decryption result. This article, for the first time, proposes an attribute based encryption with reliable outsourced decryption scheme using the blockchain smart contract. In the proposed scheme, not only can the mobile device verify whether the cloud service provider has returned a correct decryption result, but also the cloud service provider can escape from a wrong claim if the returned decryption result is correct. Moreover, our system achieves the fairness property, which means the cloud service provider can get the reward from the mobile device if and only if it has returned a correct decryption result. Finally, we conduct an implementation to demonstrate that the proposed scheme is practical and efficient.

Cloud computing, which provides adequate storage and computation capability, has been a prevalent information infrastructure. Secure data sharing is a basic demand when data was outsourced to a cloud server. Attribute-based proxy re-encryption has been a promising approach that allows secure encrypted data sharing on clouds. With attribute-based proxy re-encryption, a delegator can designate a set of shared users through issuing a re-encryption key which will be used by the cloud server to transform the delegator's encrypted data to the shared users’. However, the existing attribute-based proxy re-encryption schemes lack a mechanism of revoking users from the sharing set which is critical for data sharing systems. Therefore, in this article, we propose a concrete attribute-based proxy re-encryption with direct revocation mechanism (ABPRE-DR) for encrypted data sharing that enables the cloud server to directly revoke users from the original sharing set involved in the re-encryption key. We implemented the new schemes and evaluated its performance. The experimental results show that the proposed ABPRE-DR scheme is efficient and practical.

Cloud computing eliminates the need for local hardware, addressing the challenge of high computing expenses. However, entrusting data to the cloud may pose the risk of unintentional data loss. Using multiple copies and multi-cloud servers is promising because even if the data on one cloud storage server is compromised, the data proprietor can retrieve the information from alternate cloud storage servers. To protect data security, data needs to be encrypted before uploading to the cloud. However, users cannot directly confirm whether their encrypted documents and copies are stored securely and with integrity on cloud servers. To verify data copies on remote servers without downloading and decrypting, we propose Public Verification Public Key Encryption with Equality Test (PVPKEET). Under PVPKEET, users upload encrypted data to cloud servers, and then the test result and proof will be provided by the cloud server without decryption. The publicly verified proof can be examined by all users, allowing everyone to witness the copies stored correctly. Our approach is resistant to chosen-plaintext attacks and is verifiable. A comparison with prior research demonstrates the efficiency and feasibility of our design.

The cloud-edge-end architecture is suitable for many essential scenarios, such as 5 G, the Internet of Things (IoT), and mobile edge computing. Under this architecture, cross-domain and cross-layer data sharing is commonly in need. Considering cross-domain data sharing under the zero-trust model, where each entity does not trust the others, existing solutions have certain problems regarding security, fairness, scalability, and efficiency. Aiming at solving these issues, we conduct the following research. First, a new plaintext checkable encryption scheme is constructed, which can be used on lightweight IoT devices to verify the ciphertext validity sent by a data owner. Second, we propose a new multi-domain cloud-edge-end architecture based on sharding blockchains and design a cross-domain data sharing scheme under the partial trust model to achieve security, scalability, and high performance. Third, a cross-domain data sharing scheme under the zero trust model is further designed, which can ensure the fairness of both parties in data sharing. Fourth, we give a formal security definition and analysis of cross-domain data sharing. Fifth, we conduct a detailed theoretical analysis of the protocol and give an in-depth functional test and performance test, including the throughput and latency of data sharing policy registration and execution.

The primitive of verifiable data streaming (VDS) provides a secure data outsourcing solution for resource-constrained users, that is, they can stream their continuously-generated data items to untrusted servers while enabling publicly verifiable query and update. However, existing VDS schemes either require the server to store the authentication tags of all data items to support data query and auditing, or bind all data items into a constant-size tag to achieve optimal storage on the server side, but cannot achieve public auditing. To close this gap, in this paper, we first design a novel authentication data structure, dubbed retrievable homomorphic verifiable tags (RHVTs), which allows users to aggregate the authentication tags of all data items into a constant-size tag, and enables them to retrieve the original tags from the aggregated tag when necessary. Based on this, we propose a compact verifiable and auditable data streaming (CVADS) scheme, which adopts a single-level authentication mechanism to achieve more efficient data append and update, as well as optimal storage and public auditing. For better robustness and performance, we introduce a nested dual-level authentication mechanism and propose a blockchain-based CVADS (BCVADS) scheme to achieve a distributed CVADS with self-auditing. Finally, we prove the security of our schemes in the random oracle model and demonstrate their practicality through a visual performance evaluation.

Byzantine-robust federated learning (FL) endeavors to empower service providers in acquiring a precise global model, even in the presence of potentially malicious FL clients. While considerable strides have been taken in the development of robust aggregation algorithms for FL in recent years, their efficacy is confined to addressing particular forms of Byzantine attacks, and they exhibit vulnerabilities when confronted with a spectrum of attack vectors. Notably, a prevailing issue lies in the heavy reliance of these algorithms on the examination of local model gradients. It is worth noting that an attacker possesses the ability to manipulate a carefully chosen small gradient of a model within a context where there could be millions of gradients available, thereby facilitating adaptive attacks. Drawing inspiration from the foundational Shapley value methodology in game theory, we introduce an effective FL scheme namedCareFL. This scheme is designed to provide robustness against a spectrum of state-of-the-art Byzantine attacks. Unlike approaches that rely on the examination of gradients,CareFLemploys a universal metric, the loss of the local model—independent of specific gradients, to identify potentially malicious clients. Specifically, in each aggregation round, the FL server trains a reference model using a small auxiliary dataset— the auxiliary dataset can be removed with a slight defense degradation trade-off. It employs the Shapley value to assess the contribution of each client-submitted model in minimizing the global model loss. Subsequently, the server selects client models closer to the reference model in terms of Shapley values for the global model update. To reduce the computational overhead ofCareFLwhen the number of clients is relatively scaled-up, we construct its variant, namelyCareFL+ generally by grouping clients. Extensive experimentation conducted on well-established MNIST and CIFAR-10 datasets, encompassing diverse model architectures, including AlexNet, demonstrates thatCareFLconsistently achieves accuracy levels comparable to those attained under attack-free conditions when faced with five formidable attacks.CareFLand CareFL+ outperform six existing state-of-the-art Byzantine-robust FL aggregation methods, includingFLTrust, across both IID and non-IID data distribution settings.

With the growing use of mobile devices, location-based services (LBS) are becoming increasingly popular. BLS deliver accurate services to individuals according to their geographical locations, but privacy issues have been the primary concerns of users. Privacy-preserving LBS (PPLBS) were proposed to protect location privacy, but there are still some problems: 1) a semi-trusted third party (STTP) is required to blur users’ locations; 2) both the computation and communication costs of generating a query are linear with the size of queried areas; 3) the schemes were not formally treated, in terms of definition, security model, security proof, etc. In this paper, to protect location privacy and improve query efficiency, an oblivious location-based services (OLBS) scheme is proposed. Our scheme captures the following features: 1) an STTP is not required; 2) users can query services without revealing their exact location information; 3) the service provider only knows the size of queried areas and nothing else; and 4) both the computation and communication costs of generating a query is constant, instead of linear with the size of queried areas. We formalise both the definition and security model of our OLBS scheme, and propose a concrete construction. Furthermore, the implementation is conducted to show its efficiency. The security of our scheme is reduced to well-known complexity assumptions. The novelty is to reduce the computation and communication costs of generating a query and enable the service provider to obliviously generate decrypt keys for queried services. This contributes to the growing work of formalising PPLBS schemes and improving query efficiency.

Energy-efficient proof-of-stake (PoS) consensus protocols in blockchain have gained much attention from academia and industry recently. Despite their potential advantages, PoS protocols have not been extensively deployed in the existing digital currency market due to inherent security concerns, e.g., long-range attacks. Such attacks enable an adversary to rewrite the entire transaction history of a blockchain, severely compromising its immutability. The puncturable signature provides an efficient solution against long-range attacks due to secret key leakage. More specifically, a signer can update the secret key with chosen messages selectively, while the public key is unchanged. Unfortunately, the existing puncturable signature schemes suffer from either updating the public key repeatedly or large key size, which makes them unsuitable for PoS protocols. To resolve these drawbacks, we adopt a different approach to performing key puncture operations and propose a generic puncturable signature construction from delegated (key-policy) constrained signatures. We present a concrete puncturable signature scheme over lattices that is proven secure based on the short integer solution (SIS) assumption in the standard model.

E-healthcare as a significant facet of the Internet of Things (IoT) relies on wearable devices to continuously monitor users’ vital signals for health-related purposes. The sensitive and vast nature of the collected data necessitate secure encryption and storage on the cloud. Simultaneously, there is a need to share these data for healthcare purposes. How to balance the privacy and usability of these data is a challenging problem in the e-healthcare applications. A central problem arose from the continuous data collection is how to effectively share the data collected in one specific time period when users are unwell. We formalize it as the sequential data sharing problem. This problem appears in various IoT applications apart from e-healthcare, such as video surveillance. In this paper, we explain why all existing solutions cannot address the above problem. Then, we propose a novel sequential data sharing system (SDSS), where the data encrypted at any specific time period can be efficiently shared. We first present a practical construction of SDSS that supports securely sharing data within one specific time period in a symmetric manner. The decryption key are retrieved sequentially by utilizing the shared key and hash function. All involved calculations in the system are lightweight. Data pertaining to other non-selected time periods remain unknown. We then extend the SDSS to a multiple-range version, enabling simultaneous sharing data for multiple specific time periods, and show an example. We formalize the definition of security models and analyze the security of our systems. Finally, we evaluate the performance of our systems using SHA-256 and AES-256. Experimental results demonstrate that our systems are highly efficient. It takes less than 1 millisecond to encrypt 100KB data and less than 0.4 milliseconds to decrypt the corresponding cipher data. Our proposed systems provide a solution to balance the privacy and usability in the context of sequentially collected data. We believe that this work will enhance the adoption and practicality of IoT applications.

Due to the promising scalability property, sharding technology has gained widespread attention. It improves the transaction throughput of blockchain systems but also introduces cross-shard transactions. Current two-phase commit (2PC) protocols process different cross-shard transactions sequentially, resulting in significant system overhead and low throughput. Besides, current sharding blockchains rely on Byzantine fault tolerance (BFT) as a black box, lacking specific designs to efficiently handle cross-shard proposals. Moreover, cross-shard communication complexity is high, and transaction processing parallelism is low. In this paper, we first propose P-2PC, a general framework to process cross-shard transactions of different phases in a pipelined way, suitable for most sharding blockchains. Further, we design Cherubim with improved quadruple 2PC, 4P-2PC. By combining P-2PC with an intra-shard pipelined BFT, 4P-2PC achieves both intra-shard and cross-shard pipelined processing. Combined with a newly designed batch processing method, each shard processes 4 transaction batches simultaneously through 1 round of calculation and communication, compared to 4 rounds in previous work. In particular, Cherubim seamlessly integrates a multi-signature algorithm supporting further aggregation, reducing communication complexity. Furthermore, we evaluate our work through theoretical analysis and implementation, proving that Cherubim has a communication complexity linear to the node number. We also propose horizontal and vertical consensus parallelism degrees to evaluate the parallelism ability. Compared to the state-of-the-art solutions, the evaluation demonstrates that Cherubim achieves a transaction throughput improvement of at least 2.28×.

Proxy re-encryption (PRE), as a promising cryptographic primitive for secure data sharing in clouds, has been widely studied for decades. PRE allows the proxies to use the re-encryption keys to convert ciphertexts computed under the delegator’s public key into ones that can be decrypted using the delegatees’ secret keys, without knowing anything about the underlying plaintext. This delegable property of decryption rights enables flexible cloud data sharing, but it raises an important issue: if some proxies reveal their re-encryption keys, or collude with some delegatees to create a pirate decoder, then anyone who gains access to the pirate decoder can decrypt all ciphertexts computed under the delegator’s public key without the delegator’s permission. This paper opens up a potentially new avenue of research to address the above (re-encryption) key abuse problem by proposing the first public trace-and-revoke PRE system, where the malicious delegatees and proxies involved in the generation of a pirate decoder can be identified by anyone who gains access to the pirate decoder, and their decryption capabilities can subsequently be revoked by the content distributor. Our construction is multi-hop, supports user revocation and public (black-box) traceability, and achieves significant efficiency advantages over previous constructions. Technically, our construction is a generic transformation from inner-product functional PRE (IPFPRE) that we introduce to trace-and-revoke PRE. In addition, we instantiate our generic construction of trace-and-revoke PRE from the Learning with Errors (LWE) assumption, which was widely believed to be quantum-resistant. This is achieved by proposing the first LWE-based IPFPRE scheme, which may be of independent interest. Finally, we conduct a comprehensive performance evaluation of our LWE-based trace-and-revoke PRE scheme, and the experimental results show that the proposed LWE-based trace-and-revoke PRE scheme is practical and outperforms current state-of-the-art traceable PRE schemes.

The cloud-edge collaborative data sharing supporting data confidentiality can be realized by adopting outsourced Attribute-Based Encryption (ABE) schemes. Yet, most existing schemes in such kind of scenarios are facing challenges such as vulnerable terminal devices that are easy to be attacked, lack of flexible authorization management methods for a large number of devices, and lack methods to securely specify on-demand data sharing domains. In this paper, we propose a Domain-specific On-demand Access Control scheme with fully Independent Revocation (DOACIR), which not only realizes a three-layer on-demand data sharing framework for cloud-edge collaborative IoT environments but also allows data uploader to restrict the data sharing domain through a succinct way. The attribute authority and multiple edge servers perform data access authorization collaboratively to improve the data sharing efficiency as well as avoid the key-abuse problem and key-leakage problem. Fully independent user revocation is also realized in DOACIR to flexibly manage terminal devices in IoT. Further, we improve the scheme to support cross-domain data sharing, namely Cross-Domain DOACIR (CD-DOACIR), by improving the encryption phase allowing data uploader to specify any number of sharing domains while the size of ciphertext remains constant. We provide the security proofs of DOACIR and CD-DOACIR, and the experiment results demonstrate the effectiveness and efficiency of our solutions in cloud-edge collaborative on-demand data sharing.

Consensus protocols play a crucial role in determining the security and performance of blockchain systems, with committee-based consensus protocols being particularly important, especially in sharding consensus protocols. Anonymous election of committee nodes can mitigate DDoS attacks and bribery attempts. This approach can also be applied to sharding systems to mitigate the risk associated with a single vulnerable shard. However, current node secret selection schemes still present remaining issues. Single secret leader election schemes struggle to elect multiple leaders with equal anonymity, and existing secret committee election schemes lack adequate measures for tracking malicious nodes. To address these issues, we propose accountable secret committee election schemes that not only regulate the number of nodes but also maintain anonymity during the phases of leader proposal and verifier voting. Furthermore, our schemes enable the tracing of malicious nodes in a threshold way. In addition, we introduce two efficient threshold traceable membership proof schemes for both ad hoc and interactive scenarios. Unlike traceable ring signatures, our scheme can trace malicious nodes even after a single malicious behavior. Subsequently, we apply the accountable secret committee election scheme to sharding blockchains and devise a fully accountable anonymous consensus protocol. The experiment demonstrates that this protocol can elevate the difficulty of corrupting a single shard to the level of compromising the entire system, thereby significantly enhancing the security of the sharding system.

Secret leader election in consensus could protect leaders from Denial of Service (DoS) or bribery attacks, enhancing the blockchain system security. Single Secret Leader Election (SSLE), proposed by Boneh et al., supports electing a single random leader from a group of nodes while the leader’s identity remains secret until he reveals himself. Subsequent research endeavors have introduced distinct approaches to realize SSLE, yet most of these solutions consume relatively high communication complexity. In this paper, we propose an extended SSLE scheme, Secret Multiple Leaders Election (SMLE), based on linkable membership proof. A general SMLE scheme supports the one-time election of multiple consecutive secret leaders while reducing the average communication cost of a single leader election to constant complexity. In particular, SMLE is proven to satisfy a newly proposed consistent unpredictability property for each leader. Specifically, two concrete SMLE constructions are constructed. The first construction is designed for non-interactive scenarios where pre-configured system nodes are not required. The second one is designed for interactive scenarios where nodes operate within a committee. Furthermore, we extend SMLE to Secret Committee Election (SCE) and realize the anonymous node allocation in sharding blockchains utilizing SCE, thereby significantly enhancing the security of the sharding system. Finally, the experimental results indicate that our constructions exhibit minimal communication and computational overhead. When integrated into sharding systems, our protocol could increase an adversary’s attack difficulty, with the enhancement proportion approximately equal to the shard number.

Recent studies have demonstrated that backdoor attacks can cause a significant security threat to federated learning. Existing defense methods mainly focus on detecting or eliminating the backdoor patterns after the model is backdoored. However, these methods either cause model performance degradation or heavily rely on impractical assumptions, such as labeled clean data, which exhibit limited effectiveness in federated learning. To this end, we proposeFLPurifier, a novel backdoor defense method in federated learning that can effectively purify the possible backdoor attributes before federated aggregation. Specifically,FLPurifiersplits a complete model into a feature extractor and classifier, in which the extractor is trained in a decoupled contrastive manner to break the strong correlation between trigger features and the target label. Compared with existing backdoor mitigation methods,FLPurifierdoesn’t rely on impractical assumptions since it can effectively purify the backdoor effects in the training process rather than an already trained model. Moreover, to decrease the negative impact of backdoored classifiers and improve global model accuracy, we further design an adaptive classifier aggregation strategy to dynamically adjust the weight coefficients. Extensive experimental evaluations on six benchmark datasets demonstrate thatFLPurifieris effective against known backdoor attacks in federated learning with negligible performance degradation and outperforms the state-of-the-art defense methods.

The rapid development of both hardware and software has promoted the popularization of various real-time applications like health monitoring and intrusion detection that are widely deployed in outsourcing scenarios, e.g., mobile edge computing and cloud computing. In these applications, end devices continuously generate unbounded sequences of data items at a fast rate, i.e., the so-called streaming data. Nevertheless, storing and processing massive amounts of streaming data poses a challenge for resources-restricted end devices. Although outsourcing data items to edge servers or cloud servers is an attractive solution to the above problem, it also brings a new challenge, i.e., how to guarantee the integrity of outsourced data, since streaming data applications are usually sensitive of both location and the corresponding context, and servers are not completely trusted. To this end, the primitive of verifiable data streaming (VDS) protocol was introduced to maintain outsourced streaming data, while preserving its integrity. However, existing VDS constructions mainly use the structure of Merkle hash tree, and inherently have logarithmic costs. Consequently, they are infeasible for real-time applications that are delay sensitive and generate unpredictable size of streaming data. In this paper, we optimize previous VDS protocols from the aspects of communication overhead and computation cost. Specifically, we adopt a technical route different from Merkle hash tree, i.e, combining the digital signature with the cryptographic accumulator. In our construction, we employ Boneh-Lynn-Shacham (BLS) signature to guarantee the integrity of the context and position of each outsourced data item, and adopt an RSA accumulator to invalidate the old signature after the corresponding data item was updated. This immediately yields an optimal VDS construction that has constant costs even under concurrent queries, which is more desirable for those resource-limited mobile devices. In addition, the aggregability of BLS signature makes our VDS construction capable of data auditing, which enables the user to remotely verify the integrity of outsourced streaming data. We provide a formal security proof of the proposed VDS construction under well-studied complexity assumptions in the random oracle model. As a proof-of-concept, we also implement our proposal, and conduct extensive experiments to demonstrate its practicability.

Privacy-preserving data evaluation is one of the prominent research topics in the Big Data era. In many data evaluation applications that involve sensitive information, such as the medical records of patients in a medical system, protecting data privacy during the data evaluation process has become an essential requirement. Aiming at solving this problem, numerous fuzzy encryption systems for different similarity metrics have been proposed in literature. Unfortunately, the existing fuzzy encryption systems either fail to achieve attribute-hiding or achieve it, but are impractical. In this article, we propose a new fuzzy encryption scheme for privacy-preserving data evaluation based on overlap distance, which can work in an integer domain while achieving attribute-hiding. In particular, we develop a novel approach to enable an accurate overlap distance to be fast calculated. This technique makes the number of pairing operations during decryption stage negative correlation with the size of the threshold, which is pretty practical for some applications especially with a large threshold. Additionally, we provide a formal security analysis of the proposed scheme, followed by a comprehensive experimental. Also we show that our scheme can be well applied to some scenarios, such as fuzzy keyword searchable encryption and attribute-hiding closest substring encryption.

Storing and sharing confidential data in a public cloud storage system always raises privacy and security issues. When data is outsourced to a cloud server, the basic demands are secure and authenticated data storage, fine-grained data access control, secure search for the outsourced data, and search results verification. Attribute-Based Signcryption (ABSC) is a promising public-key cryptosystem for accomplishing data confidentiality and authenticity together. However, incorporating verifiable Boolean formula based keyword search and verifiable outsourced unsigncryption mechanisms into an ABSC is quite challenging. This is because the data user should be able to check whether the search result, returned by the untrusted cloud, has been correctly created. Precisely, the data user should be able to verify the correctness of the search, transform and signature verification operations involved in generating the search result. In this paper, for the first time, we propose a secure Searchable Attribute-Based Signcryption (sABSC) scheme that simultaneously supports (i) Boolean formula search over signcrypted data, (ii) keyword privacy, (iii) verifiable outsourced unsigncryption, and (iv) search results self-verifiability. In sABSC, each data user can efficiently verify the correctness of the search results returned by the cloud without interacting with any authority. We define more general security definitions of sABSC and provide rigorous security analysis. Performance evaluation exhibits that the proposed sABSC is practical.

Phishing scams are one of Ethereum's most representative security risks that can defraud many transactions in a short period and severely threaten network security. Existing deep learning-based phishing scam detection methods mainly rely on constructing static transaction graphs which are assumed to be accessible before model training. However, static methods that have a high false positive rate to detect newly generated phishing scams by adding this newly generated data to existing algorithms for execution, due to new accounts and transactions constantly appearing in the real-world Ethereum network. Therefore, this article, for the first time, proposes a novel evolve-based phishing scams detection method (named GrabPhisher) that extracts temporal features of accounts and captures information about the dynamic topology of the graph as it evolves. Specifically, GrabPhisher can build the evolutionary pattern of accounts trading on Ethereum as a diffusion network graph in continuous time. It can continue to capture new transaction features based on existing transactions, which facilitates the identification of phishing accounts. Additionally, we implement GrabPhisher on the real-world Ethereum phishing scams datasets. Extensive experimental results demonstrate that GrabPhisher can effectively extract dynamic temporal features and outperform state-of-the-art methods (95% Recall, and 88% F1-score).

Deep neural networks excel at solving intuitive tasks that are hard to describe formally, such as classification, but are easily deceived by maliciously crafted samples, leading to misclassification. Recently, it has been observed that the attack-specific robustness of models obtained through adversarial training does not generalize well to novel or unseen attacks. While data augmentation through mixup in the input space has been shown to improve the generalization and robustness of models, there has been limited research progress on mixup in the latent space. Furthermore, almost no research on mixup has considered the robustness of models against emerging on-manifold adversarial attacks. In this paper, we first design a latent-space data augmentation strategy called dual-mode manifold interpolation, which allows for interpolating disentangled representations of source samples in two modes: convex mixing and binary mask mixing, to synthesize semantic samples. We then propose a resilient training framework, LatentRepresentationMixup (LarepMixup), that employs mixed examples and softlabel-based cross-entropy loss to refine the boundary. Experimental investigations on diverse datasets (CIFAR-10, SVHN, ImageNet-Mixed10) demonstrate that our approach delivers competitive performance in training models that are robust to off/on-manifold adversarial example attacks compared to leading mixup training techniques.

As a critical threat to deep neural networks (DNNs), backdoor attacks can be categorized into two types, i.e., source-agnostic backdoor attacks (SABAs) and source-specific backdoor attacks (SSBAs). Compared to traditional SABAs, SSBAs are more advanced in that they have superior stealthier in bypassing mainstream countermeasures that are effective against SABAs. Nonetheless, existing SSBAs suffer from two major limitations. First, they can hardly achieve a good trade-off between ASR (attack success rate) and FPR (false positive rate). Besides, they can be effectively detected by the state-of-the-art (SOTA) countermeasures (e.g., SCAn [40]).

Machine unlearning can fortify the privacy and security of machine learning applications. Unfortunately, the exact unlearning approaches are inefficient, and the approximate unlearning approaches are unsuitable for complicated CNNs. Moreover, the approximate approaches have serious security flaws because even unlearning completely different data points can produce the same contribution estimation as unlearning the target data points. To address the above problems, we try to define machine unlearning from the knowledge perspective, and we propose a knowledge-level machine unlearning method, namely ERM-KTP. Specifically, we propose an entanglement-reduced mask (ERM) structure to reduce the knowledge entanglement among classes during the training phase. When receiving the un-learning requests, we transfer the knowledge of the non-target data points from the original model to the unlearned model and meanwhile prohibit the knowledge of the target data points via our proposed knowledge transfer and prohibition (KTP) method. Finally, we will get the un-learned model as the result and delete the original model to accomplish the unlearning process. Especially, our proposed ERM-KTP is an interpretable unlearning method because the ERM structure and the crafted masks in KTP can explicitly explain the operation and the effect of un-learning data points. Extensive experiments demonstrate the effectiveness, efficiency, high fidelity, and scalability of the ERM-KTP unlearning method. Code is available at https://github.com/RUIYUN-ML/ERM-KTP

Automated Access Control List (ACL) configuration has remained an area of research interest for a significant period. However, previous research has not addressed the challenges associated with ACL automation in the context of a complex and evolving industry landscape. We examine the existing research literature on this topic and identify a series of key requirements (“success criteria”) that any new system must achieve to be considered an improvement over the status quo. We then design, develop, and demonstrate an approach to ACL automation that embodies these characteristics by combining model-driven ACL synthesis with a modern DevOps-style deployment system. We explain the rationale that drove the design decisions behind the Hyron ACL generation toolkit and how it can enable a fully automated ACL delivery pipeline when integrated with standard developer tools. In contrast to previous research, our design approach reflects automation trends in the industry to ensure mainstream engineers readily adopt our solution. We provide an analysis comparing our approach's benefits to those of previous research.

While deep learning techniques have achieved great success in modern digital products, researchers have shown that deep learning models are susceptible to Trojan attacks. In a Trojan attack, an adversary stealthily modifies a deep learning model such that the model will output a predefined label whenever a trigger is present in the input. In this paper, we present TrojanModel, a practical Trojan attack against Automatic Speech Recognition (ASR) systems. ASR systems aim to transcribe voice input into text, which is easier for subsequent downstream applications to process. We consider a practical attack scenario in which an adversary inserts a Trojan into the acoustic model of a target ASR system. Unlike existing work that uses noise-like triggers that will easily arouse user suspicion, the work in this paper focuses on the use of unsuspicious sounds as a trigger, e.g., a piece of music playing in the background. In addition, TrojanModel does not require the retraining of a target model. Experimental results show that TrojanModel can achieve high attack success rates with negligible effect on the target model’s performance. We also demonstrate that the attack is effective in an over-the-air attack scenario, where audio is played over a physical speaker and received by a microphone.

Abstract As a prominent cryptographic tool, geometric searchable encryption (GSE) can be applied in many scenarios, such as location-based services (LBS), social networks and vehicle networks. Unfortunately, most of existing searchable encryption schemes supporting the functionality of geometric range searches suffer from false positives, which will lead people to make a wrong decision and further raise some serious consequences such as financial loss. In addition, some of them are designed under a symmetric system, which is not enough flexible deployed in LBS since in a symmetric system only a private key holder creates ciphertext, whereas in a public-key system anyone who holds a public key can produce ciphertext. In this paper, we intend to design a novel GSE scheme without any false positive under a public-key system supporting arbitrary geometric area searches, which is able to guarantee an accurate query result. Toward this goal, we develop a novel technique in handling the relation between a point and any convex polygon in combination with an inner product encryption, which is able to support arbitrary convex polygon range searches without any false positive. A comprehensive experiment demonstrates that, compared with the known schemes, our scheme possesses a 100% accuracy as well as an acceptable efficiency in the sense that it can guarantee that all files retrieved by users are exactly matched ones. Finally, we provide two practical examples of our GSE scheme: privacy-preserving friend-nearby notification with a common point of interest and privacy-preserving parking monitor and guiding system.

Driven by various legal obligations and service requirements, the redactable blockchain was introduced to balance the modifiability and immutability of blockchain technology. However, such a blockchain inevitably generates one or even more acceptable versions for the same block data, enabling malicious full nodes to deceive light/new nodes with old data, and even disrupt the consistency of the blockchain ledger. In this paper, we introduce the concept of verifiable redactable blockchain (VRBC) to provide efficient validity verification for on-chain data. To this end, we design a novel authentication data structure, called blockchain authentication tree (BAT), which employs a chameleon hash function and aggregatable vector commitment to bind continuously-appended blocks. Based on this, we propose an efficient VRBC scheme supporting integrity auditing, which not only allows the light nodes to query and validate on-chain data, but also enables new nodes to check the integrity of the blockchain ledger before synchronizing it, effectively avoiding resource waste and security risks caused by invalid queries and ledger synchronization. Furthermore, we introduce some optimized strategies to improve the performance of our scheme and extend it to transaction-level and permissionless VRBC. Finally, we demonstrate the practicability of our scheme through detailed security analysis and visual performance evaluation.

Cloud auditing enables the integrity verification of cloud data without the necessity of data retrieval, which significantly promotes the storage service of cloud computing. Auditing with ownership transfer is a variation where both cloud data and the tags for integrity verification can be transferred. In some scenarios, like joint-stock enterprise acquisition and electronic medical records migration, we argue that auditing and transferring data belonging to multiple owners are significantly important. However, to the best of our knowledge, there exists no such protocol in multi-ownership scenarios in the literature. In this paper, we propose a blockchain-based accountable auditing protocol with multi-ownership transfer for the first time. One distinguishable property is the simultaneous achievement of verifiability, accountability and multi-ownership transferability, merely with very little extra cost. Specifically, we construct a novel tag structure based on homomorphic authenticators and compact multi-signatures, enabling integrity verification and multi-ownership transfer. Subsequently, we record the information concerning data generation and ownership transfer on immutable blockchains to make these procedures accountable. Furthermore, we present a comprehensive analysis and extensive experiments to demonstrate the security and efficiency of the proposed protocol.

The Internet of Things and cloud services have been widely adopted in many applications, and personal health records (PHR) can provide tailored medical care. The PHR data is usually stored on cloud servers for sharing. Weighted ABE is a practical and flexible technique to protect PHR data. Under a weighted ABE policy, the data user's attributes will be “scored”, if and only if the score reaches the threshold value, they can access the data. However, while this approach offers a flexible access policy, the data owners have difficulty controlling their privacy, especially sharing PHR data in collaborative e-health systems. This paper aims to find a balance between privacy and flexibility and proposes an AND-weighted ABE scheme in cloud-based personal health records sharing systems. The proposed scheme can meet both privacy and flexibility. Only when the data user satisfies the scored-based policy and is in the specified organization(s), can the data user access the PHR data. Besides, we give the security proof and the performance evaluation of the proposed scheme. The security proof and performance analysis show that the proposed scheme can efficiently and securely share PHR data in cloud service.

Public-key encryption with equality test (PKEET) provides cloud servers with an effective way to check the equality of outsourced encrypted data without decryption. This enables PKEET to attract much attention and be widely researched in cloud computing. However, we claim that the existing PKEET schemes suffer from an inherited problem, called message-consistency unverifiability of testers (MCUT). Applying the MCUT problem, outsourcers can fool cloud servers into outputting incorrect testing results of encrypted data, which negates the practicability of PKEET in cloud computing. We investigate the PKEET literature and find the main reason for the MCUT problem is the independence between the messages inserted in the decryption and testing modules in their ciphertexts. To bridge the technical gap between PKEET and its practical applications, we present a new notion, called PKE with tester verifiable equality test (PKE-TVET), which solves the MCUT problem by allowing testers to verify the message consistency in two modules. We then instantiate the PKE-TVET and give a specific construction in the standard model. In our PKE-TVET scheme, the testing module is integrated into the decryption module so that there is only one message inserted in the ciphertext for both decryption and testing. This special setting lets our scheme directly get rid of the MCUT problem. For better applications in actual scenarios, we further extend the scheme to support authorization and tester designation. Finally, we analyze the tradeoff of parameter sizes and computation costs for the security against MCUT attacks in our PKE-TVET scheme.

By collecting and analyzing patients' e-healthcare data in Medical Internet-of-Things (MIOT), e-Healthcare providers can offer alternative and helpful evaluation services of the risk of diseases to patients. However, e-Healthcare providers cannot cope with the huge volumes of data and respond to this online service. Providers typically outsource medical data to powerful medical cloud servers. Since outsourced servers are not fully trusted, a direct evaluation service will inevitably result in privacy risks concerning the patient's identity or original medical data. It is hard to hide the results of an evaluation from the single-server model unless a fully homomorphic cryptosystem is used or the patients must communicate online with the cloud multiple times in an inefficient manner. With regards to these issues, this article proposes aSecure andPrivacy-PreservingDecisionTreeEvaluation scheme (namely SPP-DTE) to achievesecure disease diagnosis classification under e-Healthcare systems without revealing the sensitive information of patients such as physiological data or the private data of medical providers such as the structure of decision trees.Our proposed scheme usesmodified KNN computation to match the similarity and preserve the confidentiality of raw dataand also appliesmatrix randomization and monotonically increasing and one-way functions to confuse the intermediate results. The experiment is conducted in data sets from UCI machine learning repository of medical health data. Our analysis indicates that the proposed SPP-DTE scheme is efficient in terms of computational cost and communication overhead that is practical and efficient for privacy protection in e-Healthcare classification and diagnosis system.

The purpose of privacy-preserving spam filtering is to inspect email while preserving the privacy of its detection rules and the email content. Although many solutions have emerged, they suffer from the following: 1) Theprivacyprovided is insufficient as the email content or detection rules may be exposed to third parties; 2) Due to improper use of encryption, exhaustive word search attacks are possible, potentially breaking theconfidentialityof encrypted emails; 3) When spam filtering is outsourced, email is given to the outsource, whereuser privacy may be compromisedif privacy protection measures are not properly put in place; 4) Confirmation of whether the encrypted email is spam is only determinedafterthe receiver receives the email, which can lead to a situation in which spam is loaded to the memory of the receiver’s terminal for spam filtering. This can be harmful, for example, when an attacker inserts a web browser vulnerability into the body of an email to lure users to a phishing site simply by reading the email; 5)Computationally expensive operationsare unavoidable to provide required features of privacy-preserving spam filtering. We present Privacy-preserving Content-based Spam Filter (PCSF), which is a spam filter system that does not suffer from the aforementioned issues. Additionally, our system providespre-validationbefore the receiver reads the email. We provide an implementation of our system based on the Naive Bayes spam filter and prove its security.

To improve the quality of medical care and reduce unnecessary medical errors, electronic medical records (EMRs) are widely applied in hospital information systems. However, rapidly increasing EMRs bring heavy storage burden to hospitals. Professional data management service provided by cloud server can save the hospital local storage, and meanwhile, realize EMRs sharing among external researchers. However, the risk of leaking information of patients discourages hospitals to outsource patients’ EMRs to the remote cloud server. In this paper, a secure and efficient cloud storing and sharing method can be achieved by applying the proposed public key authenticated encryption with ciphertext update and keyword search (PAUKS). The proposed PAUKS scheme enables EMRs to be encrypted and queried without decryption, and is secure against inside keyword guessing attacks. Compared with the recently proposed PAEKS in literature, the PAUKS scheme enjoys smaller computation and communication overheads. The required number of trapdoors per query is constant in PAUKS scheme, instead of the linearly expanding as the number of senders increases in PAEKS. Furthermore, an inverted index can be built safely in PAUKS scheme to accelerate the query procedure. Experiment results show that our PAUKS scheme owns a comparable running overhead, but enjoys a higher query efficiency after ciphertexts update.

With the prevalence of outsourced computation, such as Machine Learning as a Service, protecting the privacy of sensitive data throughout the whole computation is a critical yet challenging task. The problem becomes even more tricky when multiple sources of input and/or multiple recipients of output are involved, who would encrypt/decrypt data using different keys. Considering many computation tasks demand binary operands and operations but there are only outsourced computation constructions for arithmetic calculations [1], in this paper, the authors propose a privacy-preserving outsourced computation framework for Boolean circuits. The proposed framework can protect sensitive data throughout the whole computation, i.e., input, output and all the intermediate values, ensuring privacy for general outsourced tasks. Moreover, it compresses the ciphertext domain of [1] and attains secure protocols for four logic gates (AND, OR, NOT, and XOR) which are the basic operations in Boolean circuits. With the proposed framework as a building block, a novel Privacy-preserved (encrypted) Bloom Filter and a Multi-keyword Searchable Encryption scheme under the multi-user setting are presented. Security proof and experimental results show that the proposal is reliable and practical.

Blockchain technology has been highly praised for its immutability, attracting considerable attention in the academic and industrial community. However, since permanent storage in blockchains would result in copyright disputes and harmful information spreads, it is desired to equip blockchains with mutability nowadays for legal and moral duty restrictions. A redactable blockchain is a variation, which enables the editing of block objects without affecting other blocks in the blockchain. Most existing redactable blockchains can only support editing operations such as modification and deletion, rather than insertion. However, insertion is necessary for some scenarios, especially when patching codes are needed for smart contracts and mistaken deletions occur. In addition, we argue that the verifiability of blockchains is also significantly important, especially for the redactable ones, in which one block may have multiple versions. Hence, an efficient mechanism is required to invalidate history versions and incent distributed adoptions of editing operations. In this paper, we propose a verifiable and redactable blockchain with fully editing operations for the first time. One distinguishable property is the simultaneous achievement of fully editability of block objects and verifiability of blockchain state, with acceptable extra cost. Specifically, we construct the redactable blockchain based on a double trapdoor chameleon hash family, enabling computationally efficient and key-exposure resistant block editing. Additionally, we combine trapdoorless universal accumulators and the largest sequence number principle to make the blockchain state verifiable. Furthermore, we present a comprehensive analysis and extensive experiments to demonstrate the security and feasibility of the proposed redactable blockchain.

To know the most recent market conditions, an e-commerce platform needs to be aware of the sales situation of its sellers’ commodities. The most recent market conditions can help to forecast future market trends and develop policies to guide sellers in reasonably allocating their inventory proportion. Statistical analysis is a fundamental approach to studying the sales situation. However, the sales data of an e-commerce platform usually has a significant volume. Therefore, outsourcing statistical analysis to cloud servers is an effective method. Nevertheless, sellers do not want their sales data leaked to anyone or any other organization. Moreover, in many circumstances, we cannot fully trust cloud servers. Thus, we need to utilize cryptographic or non-cryptographic tools to realize the above outsourcing. Secret sharing is a lightweight and powerful non-cryptographic tool to realize privacy-preserving data analysis. However, it needs secure channels to distribute secret shares. On the other hand, homomorphic encryption is a powerful cryptographic tool for designing privacy-preserving data analysis schemes. Nevertheless, these schemes usually do not allow the entity that holds the decryption key to collude with other entities. We propose a privacy-preserving and verifiable statistical analysis scheme for an e-commerce platform that combines a threshold secret sharing scheme with a verifiable threshold homomorphic encryption scheme. Our solution’s demand for secure channels is reduced by 40% ~ 60% compared with a traditional threshold secret sharing scheme, thanking the designed novel distribution model for delivering secret shares. Furthermore, our solution has a stronger ability to resist collusive attacks, keep sales data private from any entity, and ensure that the platform can only obtain the analysis results with the help of some cloud servers, alleviating the single point of trust. And meanwhile, the novel distributed model makes our solution enjoy better robustness and fault tolerance. The proposed solution is validated through security analyses, performance evaluations, and comparison analyses.

Mobile crowdsensing (MCS) combined with federated learning, as an emerging data collection and intelligent process paradigm, has received lots of attention in social networks and mobile Internet-of-Things, etc. However, as the openness and transparent of mobile crowdsensing tasks, federated learning model and training samples for crowdsensing data still face enormous privacy revealing risks, and it will reduce the willingness of people or nodes to actively participate and provide data in MCS. In this paper, we present a Privacy-Enhanced Aggregation for Federated Learning in MCS, namely PrivacyEAFL, to implement the training of federated learning under mobile crowdsensing system in terms of privacy protection of all participants. Firstly, considering that the crowdsensing server might share information with some participants to obtain and leak some local models, we design a collusion-resistant data aggregation approach by combining homomorphic cryptosystem and hashed Diffie-Hellman key exchange protocol. Secondly, we design a data encoding and aggregating method with data packing which can reduce the computation cost and communication overhead for the system. Thirdly, as the number of participants’ samples are dynamically changeable in MCS, we design a sample number protection method that can implement the security and privacy of the number of training samples owned by participants. Finally, we provide the experimental results on real-world datasets (i.e, MNIST and Car Evaluation) with crowdsensing devices underRaspberry-Pi 4BandRedmi-K30 Pro, respectively, and the results demonstrate that our scheme is more efficient and practical in secure and privacy-enhanced model aggregation for federated learning in mobile crowdsensing.

The wide use of internet-connected services makes massive personal data collected by service providers without the need of our consent. Although the archived data may enable them to provide better service experiences for users, it also presents serious risks to individual privacy, especially when active or unexpected data breaches have become commonplace. To mitigate this issue, several acts and regulations (e.g., the European Union general data protection regulation) have been issued and specified a lot of security requirements for personal data management. Among these various requirements, we mainly focus on the requirement of giving back the access control of personal data to data owners themselves and the right to be forgotten for data erasure. In this article, we provide a cryptographic solution of achieving these two requirements in the setting of outsourced storage. Specifically, we introduce a personal data management framework built upon a novel cryptographic primitive dubbed as forward-secure attribute-based puncturable encryption (FS-DABPE). This primitive simultaneously features of system-wide forward secrecy and practical key management as well as fine-grained access control of the encrypted personal data. Consequently, by locally puncturing, updating and erasing system-wide secret keys, it securely realizes fine-grained personal data sharing and data erasure without interactions. Furthermore, to instantiate the proposed framework, we present a concrete FS-DABPE construction, and prove its security under a well-studied complexity assumption. In addition, we provide a prototype implementation of the concrete construction, and present extensive experimental results that illustrate its feasibility and practicability.

Location data play an important role in location-based services (LBS) since they can help a service provider analyze users’ daily activities and further derive users’ behavioral patterns. However, in the meanwhile the use of the location data in LBS can also enable the service provider to track users’ journeys which will reveal their personal information, such as house address and places of interest they visited, all of which users are usually unwilling to disclose. Therefore, security and privacy incidents can and do occur often. In this article, aiming at how to hide location privacy and meanwhile provide an accurate search for LBS, we design a new geometric searchable encryption scheme under a public-key system (a.k.a. asymmetric system) for different types of geometric range queries, which enables the service provider to respond to the range queries from users accurately without learning the information about users’ location. Towards this goal, we first exploit a novel encoding, and then develop some sophisticated transformations in combination with a special pairing function, which eventually converts different types of geometric range queries in LBS into different inner product problems. Finally, we present our construction by virtue of the techniques above with the inner product encryption technique. In addition, a comprehensive experimental analysis running on a specific application of privacy-preserving LBS and comparison demonstrate, our proposal is able to guarantee a higher accuracy for users’ range queries without any false positive, and meanwhile express richer queries. Furthermore, we show another application of our proposal to privacy-preserving remote medical diagnosis at the end of this article.

Ethereum leverages ECDSA as the digital signature scheme to validate transactions. From the provable security standpoint, ECDSA built on an 80-bit security Elliptic Curve group can achieve at most 50-bit concrete security, rather than 80-bit security, due to its reduction loss for$2^{30}$signature queries in security analysis. The state-of-the-art ECDSA scheme comes with no de facto formal security guarantee. Although there have been many signatures with higher concrete security, their structures are quite different from ECDSA and a total replacement of the signature field in Ethereum will incur high deployment cost. In this work, we present EthereumX without compromising the signature structure in Ethereum while achieves better security. The security gain is built on top of a new technique named randomness preprocessing module (RPM), which can securely pre-generate and verify randomness with the help of Ethereum. Calling RPM allows to pre-select randomness, which will be used for the subsequent signature, and to verify the randomness, assuring that it is previously generated. We give an instantiation with formal security guarantee and prove that it can be improved to 80-bit concrete security under the same discrete logarithm assumption as ECDSA. From this instantiated scheme, we implement EthereumX via a deployment into a locally simulated network. Experiment results show that EthereumX costs 5 seconds for a block generation which is equal to Ethereum, and generates/verifies at least$17017/10623$transactions per second that is practical enough in application, even if they are slightly slower than Ethereum which generates/verifies at least$17908/11257$transactions per second. We also mention that RMP can be applied to other DL-based signatures for the security improvement.

With the rapid development of digital media technology, many people prefer to read e-books over article versions. The digital publishing platform can collect and analyze massive amounts of readers’ reading information. The statistical analysis results can be regarded as the platform's digital assets based on which it provides paid services for its users. However, three privacy issues are related to readers’ reading information, users’ statistical preferences, and the platform's digital assets. This article proposes a data-matching-based privacy-preserving statistic scheme. The proposed solution combines bloom filters, secret sharing, and perturbing technologies to realize an efficient match between users’ statistical preferences and massive readers’ corresponding reading information and statistical analysis of the matching results without compromising the privacy of different parties. Besides, the proposed solution adopts an edge computing paradigm to realize the process of massive data in a divide-and-conquer parallel way. It introduces the concepts of Mirror Secret Shares and Buddy Edge Devices to virtualize the$(m+1, m+1)$-threshold secret sharing scheme to an$(m+1, m+\lfloor m/2 \rfloor +2)$-threshold secret sharing scheme for achieving good robustness without adding hardware devices. The detailed analyses show that our solution meets the defined design goals. Furthermore, the experimental results demonstrate the efficiency of the proposed work.

The replication-Based Outsourced Computation (RBOC) mechanism allows a client to outsource the same computing job to multiple contractors and the honest contractors will get paid in the incentivized system based on the fact that a majority of contractors will honestly perform the computation. As self-executing contracts, smart contracts are utilized in the decentralized blockchain networks to execute coded programs automatically transparently, and publicly. It is natural to apply smart contracts to RBOC to improve performance by setting smart contracts as the converter between the client and contractors to reduce the load on the client. However, it is infeasible to directly combine these two blocks together because the data including returned computing results from contractors in the decentralized blockchain are in the form of plaintexts such that some lazy contractors could copy others’ results as their own and still get paid, which will compromise the security of RBOC. The existing public-key encryption with equality test (PKEET) is a promising candidate solution to stop the above lazy contractors, where the results are encrypted by PKEET and then transferred without hindering smart contracts to compare the equality of underlying results. Unfortunately, we found that the advanced lazy contractors can still compromise security by forging ciphertexts to pass the equality test only with the encrypted results of other contractors. In this paper, to achieve security against lazy contractors, we introduce the notion of PKEET against lazy encryptors (PKEET-LE). Besides the fundamental property of PKEET that performs equality test on ciphertexts without decryption, PKEET-LE additionally realizes the security against the lazy encryptors who aim to forge a ciphertext for a given one to pass the equality test between them without the knowledge of the underlying plaintext. We further propose a concrete and practical PKEET-LE construction along with formal security proof. Finally, we conduct a performance evaluation to demonstrate that our PKEET-LE scheme is efficient and practical in the RBOC system using smart contracts.

Cloud computing has emerged as a popular choice for distributing data among both individuals and companies. Ciphertext-policy attribute-based encryption (CP-ABE) has been extensively used to provide data security and enable fine-grained access control. With this encryption technique, only users whose attributes satisfy the access policy can access the plaintext. In order to mitigate the computational overhead on users, particularly on lightweight devices, partial decryption has been introduced, where the cloud assists in performing the decryption computations without revealing sensitive information. However, in this process, the cloud obtains the user's attributes, thus infringing on the user's privacy. To address this issue, this article proposes a privacy-preserving cloud-based data distribution system with filtering (PPDF) to enable partial decryption without revealing the user's attributes. The proposed system also employs an edge server to assist the user in filtering out invalid ciphertexts, i.e., ciphertexts where the user's attributes do not satisfy the access policy, and transmit only the valid partially decrypted ciphertexts to the data receiver. Consequently, the proposed PPDF scheme achieves constant decryption cost for the data receiver. We provide a security proof and a performance evaluation of the proposed scheme, which confirms its effectiveness and practicality in various real-world applications.

Puncturable encryption (PE), introduced by Green and Miers at IEEE S$&$P 2015, allows recipients to update their decryption keys to revoke decryption capability for selected messages without communicating with senders. In general, it allows users to control which ciphertexts their keys may decrypt. The notion of PE has been found very useful in many applications, such as asynchronous messaging systems, group messaging systems, public-key watermarking schemes, secure cloud emails, and many more. In this paper, we introduce a new primitive called hierarchical identity-based puncturable encryption (HIBPE) that enhances the concept of PE by allowing more general key delegation and flexible key puncture. It enhances the capability of the data owner for multi-level encrypted data sharing within a group of users by delegating the decryption keys of the users in higher-levels to generate decryption keys for the users in lower-levels. Moreover, it allows users to puncture (update) their decryption keys on tags so that a decryption key punctured on a tag can no longer decrypt ciphertexts under this tag. In addition, to control access to the users' data, the higher-level users can further puncture the delegated keys (for lower-level users) with some tags such that the part of the owner's data is labeled by the punctured tags will no longer be accessible by the lower-level users. These features offer an efficient and flexible solution for encrypted data sharing as well as data-access control mechanisms in a hierarchical setting. We propose the formal definition and security model for HIBPE schemes and provide a concrete HIBPE scheme based on the hardness of the learning with errors problem in the standard model. Further, we provide a generic construction of forward secure hierarchical identity-based encryption (fs-HIBE) from HIBPE, which enables the first quantum-safe construction of fs-HIBE in the standard model. Moreover, this is the first fs-HIBE construction by exploring the concept of PE. The proposed fs-HIBE provides quantum-safe protection for secret keys from exposure in multi-level encrypted data sharing by evolving the keys with time.

J1C2 Presentation Abstract at IEEE SERVICES 2022 for IEEE Transactions on Services Computing, doi: 10.1109/TSC.2021.3086023

Abstract Certificateless public key cryptography (CL-PKC) overcomes the difficulties of the certificate managements in traditional public key infrastructure (PKI) and the key escrow problem in ID-Based public key cryptography (ID-PKC), concurrently. In 2018, Tseng et al. proposed a certificateless signature (CLS) scheme and claimed that their proposal is the first scheme which satisfies the security against the level-3 KGC (according to Girault’s three categorizations of the honesty level of a trusted third party (TTP) which is proposed in 1991), in the standard model. However, we will show that unfortunately their scheme is even vulnerable against a malicious KGC. Afterwards, we will improve their scheme to be robust against the proposed attack. Finally, we will propose a CLS scheme secure against the level-3 KGC in the standard model, based on Yuan and Wang’s CLS scheme. We will show that our proposal not only satisfies the level-3 security as well as the basic security requirements of a CLS scheme in the standard model, but also is more efficient than the previous works in the sense of computation and communication costs.

The wide deployment of Internet of Things (IoT) devices enables the controller to continuously collect massive volume data in automation systems, and makes it possible to make intelligent decisions based on machine learning techniques. In fact, data-driven intelligent automation systems have been common in the industrial community. Nevertheless, how to effectively store the collected stream data and ensure their integrity is still challenging. To this end, the notion of verifiable data streaming (VDS) protocol, which enables a client to outsource the stream data to an untrusted server in a verifiable manner, was introduced. However, we argue that existing VDS protocols based on the chameleon authentication tree (CAT) are inefficient in the data update, since the whole CAT must be updated accordingly to avoid acute exposure of chameleon hashing. Thus, they are infeasible for intelligent automation systems that need to frequently update data. In this article, we first introduce a new primitive called double-trapdoor chameleon hash tree (DCHT) based on the double-trapdoor chameleon hash families, where each leaf of DCHT is calculated and fixed by using a double-trapdoor chameleon hash family, making the entire DCHT always unchanged. Furthermore, we propose a novel VDS protocol based on the DCHT. Due to the distinctive properties of the underlying DCHT, the proposed VDS protocol has a constant update cost and more efficient than previous VDS protocols based on CAT. Besides, we prove that the proposed VDS protocol is secure in the standard model.

In a traditional health system, it merely depends on doctors’ initiative reports to discover infectious diseases, which causes late responses from the Center for Disease Control (CDC) and therefore may result in snowballed loss of lives and economy. Sometimes, the disease has spread when doctors realize it is infectious, and the CDC has to invest more human and material resources to control it. In this article, we propose a new secure infectious diseases detection system with the help of the IoT-based e-health platform. In our system model, the hospitals collect patients’ electronic health records (EHRs) and outsource the encrypted EHRs to the contracted cloud. The CDC can regularly send a test query to the cloud server to check whether there are patients who have similar symptoms or some increasing signs, which are regarded as signs of infectious diseases. With this system, the CDC can find the small signs of infectious diseases so that it can make appropriate and timely measures to save more lives. To enable the cloud server to perform the required test, we propose a new cryptographic notion, called public-key encryption with DFET (PKE-DFET), with which we can check whether the underlying messages of two ciphertexts are equal or not after ignoring the bits on designated positions without decryption. The cloud server can utilize the PKE-DFET to flexibly count the number of patients with similar symptoms following the CDC’s instructions. We first instantiate the PKE-DFET into a concrete construction, where anyone can be a tester to perform the DFET on ciphertexts. Finally, we extend our PKE-DFET construction to enable it to be flexible in different actual application scenarios.

Homomorphic Proxy Re-Encryption (HPRE) is an extension of Proxy Re-Encryption (PRE) which combines the advantages of both Homomorphic Encryption (HE) and PRE. A HPRE scheme allows arbitrary evaluations to be performed on ciphertexts under one (the delegator's) public key and, using a re-encryption key, it transforms the resulting ciphertext to a new ciphertext under another (the delegatee's) public key. Prior HPRE schemes are either CPA-secure or CCA-secure but only support partial homomorphic operations. We propose a generic construction of single-hop HPRE scheme which supports fully homomorphic operations. The proposed scheme is proven secure in our new index-based CCA-HPRE model. Our technique is to give a generic transformation that turns any multi-identity identity-based FHE (IBFHE) scheme with key switching into Fully Homomorphic Encryption (FHE) with key switching from which we can obtain the proposed single-hop HPRE scheme. We also present a concrete instantiation of multi-identity IBFHE with key switching from learning with errors (LWE) in the standard model.

Cloud computing enables users to remove the necessity of the need of local hardware architecture, which removes the burden of the users from high computation costs. Therefore, it has attracted much attention and research has been conducted heavily on it. To protect users’ privacy, data is usually encrypted prior to being sent to the cloud server. As the resulting system is unusable, since the cloud can no longer search throughout the data, new cryptographic primitive such as public-key encryption with equality test (PKEET) has been introduced. In PKEET, users can test whether the underlying messages of two ciphertexts encrypted under different public keys are equal or not without the need to decrypt those ciphertexts. This is a very useful tool, especially for the cloud database, since PKEET mainly focuses on the equality test between two ciphertexts. However, in practice, the cloud server may need to verify the equivalence among more than two ciphertexts. This leads to disclosing unnecessary information of users and redundant computation cost will also occur when using traditional PKEET schemes. How to make this more efficient and practical remains an interesting research problem. In this article, to solve the aforementioned problems by providing a novel concept of public-key encryption with multi-ciphertext equality test (PKE-MET). In PKE-MET, each ciphertext can designate a number$s$such that the cloud server can only perform equality test on this ciphertext with other$s-1$ciphertexts, where all their designated numbers are$s$. For PKE-MET, besides traditional OW-CPA and IND-CPA security, we specially define Number security. We instantiate PKE-MET to a concrete scheme and give its security proof. Furthermore, to enable the primitive to be more practical in applications, we extend it to the concept of PKE with flexible MET (PKE-FMET). In PKE-FMET, the cloud server can perform equality test on any number of ciphertexts as long as the maximum number of their designated numbers is less than or equal to the number of ciphertexts. We construct a PKE-FMET scheme based on our PKE-MET construction and prove its security under the defined security models. Besides, the performance analysis mainly of efficiency and security between our constructions and existing equality test schemes in cloud computing show that our proposed schemes are more efficient and secure in the multi-ciphertext scenario.

Mobile payment system has been expected to provide more efficient and convenient payment methods. However, compared to traditional payments, mobile payment issues related to the security of electronic accounts and payment apps present serious challenges. In this paper, we find the potential security risks by analyzing the commonly used tokenized mobile payment method and put forward the corresponding off-site attack strategy. In this scenario, the attackers are not only limited to malicious third parties but also can be illegal merchants. To address the off-site attack, especially the potential attackers who may be malicious merchants, we also propose SALP, a secure and authenticated payment protocol, using time and position as necessary conditions for the payment confirmation. Furthermore, we leverage identity-based signature (IBS) to prevent altering the information and reduce the overhead of the third-party authentication. We conduct case studies to demonstrate that the SALP can effectively prevent the off-site payment attack without a trusted hardware environment. In particular, we finally argue that SALP does not bring additional system overhead without degrading the convenience of mobile payment.

Cloud computing enables enterprises and individuals to outsource and share their data. This way, cloud computing eliminates the heavy workload of local information infrastructure. Attribute-based encryption has become a promising solution for encrypted data access control in clouds due to the ability to achieve one-to-many encrypted data sharing. Revocation is a critical requirement for encrypted data access control systems. After outsourcing the encrypted attribute-based ciphertext to the cloud, the data owner may want to revoke some recipients that were authorized previously, which means that the outsourced attribute-based ciphertext needs to be updated to a new one that is under the revoked policy. The integrity issue arises when the revocation is executed. When a new ciphertext with the revoked access policy is generated by the cloud server, the data recipient cannot be sure that the newly generated ciphertext guarantees to be decrypted to the same plaintext as the originally encrypted data, since the cloud server is provided by a third party, which is not fully trusted. In this article, we consider a new security requirement for the revocable attribute-based encryption schemes: integrity. We introduce a formal definition and security model for the revocable attribute-based encryption with data integrity protection (RABE-DI). Then, we propose a concrete RABE-DI scheme and prove its confidentiality and integrity under the defined security model. Finally, we present an implementation result and provide performance evaluation which shows that our scheme is efficient and practical.

To manage outsourced encrypted data sharing in clouds, attribute-based proxy re-encryption (ABPRE) has become an elegant primitive. In ABPRE, a cloud server can transform an original recipient’s ciphertext to a new one of a shared user’s. As the transformation is computation consuming, a malicious cloud server may return an incorrect re-encrypted ciphertext to save its computation resources. Moreover, a shared user may accuse the cloud server of returning an incorrect re-encrypted ciphertext to refuse to pay the cost of using the cloud service. However, existing ABPRE schemes do not support a mechanism to achieve verifiability and fairness. In this article, a novel verifiable and fair attribute-based proxy re-encryption (VF-ABPRE) scheme is introduced to support verifiability and fairness. The verifiability enables a shared user to verify whether the re-encrypted ciphertext returned by the server is correct and the fairness ensures a cloud server escape from malicious accusation if it has indeed conducted the re-encryption operation honestly. Additionally, we conduct a performance experiment to show the efficiency and practicality of the new VF-ABPRE scheme.

Cloud computing offers on-demand availability of computing resources over the Internet. To attract users, cloud providers offer their resources as services at reasonable prices and provide various price models to reflect higher level of quality of service (QoS), which are referred as pricing schemes.$k$-times anonymous authentication ($k$-TAA) is an attractive approach to construct pricing schemes, providing access controllability, user anonymity and public traceability. In$k$-TAA schemes, authenticated users are permitted to anonymously access services from a provider at most$k$times, while the ones whose the number of access times exceeds$k$can be publicly traced. That is,$k$-TAA schemes offer a prepaid plan that charges users based on the amount of access times. Alternatively, pay-as-you-go (PAYG) is a pricing strategy that allows users to be charged based on the amount of usage, reducing the costs on unnecessary resources. Adopting$k$-TAA schemes to PAYG model, the access bound$k$is decided by the prepayment amount and the service usage is tracked by the number of access times. However, this approach is impractical, since existing$k$-TAA schemes only allow an one-time access in an authentication. This article aims to bridge this gap in the literature by designing an efficient and secure authentication system for PAYG cloud computing, supporting flexible access controllability, user anonymity and public traceability. To achieve this, we propose a new$k$-TAA primitive, called$k$-times anonymous pay-as-you-go authentication ($k$-TAA-PAYG), that allows users to access services for multiple times in an authentication as long as the number of their access times does not exceed$k$. We first formalize the definition and security model for$k$-TAA-PAYG scheme. Subsequently, we present a concrete construction of$k$-TAA-PAYG scheme, with the computational complexity as$O(1)$and the constant communicational cost. Finally, comparing with the most efficient$k$-TAA scheme proposed by Emuraet al., the experimental results show that our$k$-TAA-PAYG scheme is 2.5 to 3 times faster and saves up to 66 percent storage in grant processes. The time cost of an authentication of our$k$-TAA-PAYG scheme is constant (1.4-2.4 ms), while Emuraet al.’s scheme needs more than one second when the number of access time is greater than 1, 000.

The field of cryptography has endeavored to solve numerous security problems. However, a common premise of many of those problems is that the encryptor always generates the ciphertext correctly. Around 10 years ago, this premise was not a problem. However, due to the rapid development and the use of the cloud, which has introduced various access policies and functionalities to provide higher security, it is not correct to assume that this premise is always applied. A “Fake Policy Attack”, which we introduce in this article, is an attack that incorrectly sets the access policy of the ciphertext against the system rules so that users who do not meet the rules can decrypt the ciphertext. In other words, it is an attack that ignores the rules of the system and eventually breaks the security and leaks information. This attack can be more critical for the application environments that require strong security not to leak any related information about ciphertext. In this article, we demonstrate the possible threat of the Fake Policy Attack by providing two relevant examples. Then, we propose a scheme called Policy Authenticable ABE (PA-ABE) to resolve this issue. We provide a formal security analysis of the proposed scheme and performance evaluation results based on our implementation.

Cloud storage becomes the priority for storing and sharing data for enterprise users. Encrypting prior to uploading data to the cloud is the best way to protect business secrets, however, it hinders the convenient operations on plaintexts, such as searching over the cloud data. In addition, employees in an enterprise have multiple layer structures and a higher layer employee should have the privilege to monitor the lower layer employees’ data to check if these users violate the regulation without letting the employees be aware of. Public key encryption with keyword search (PEKS) is a well-known cryptographic primitive suitable for secure cloud storage, which supports keyword search without decryption in public key encryption settings. Unfortunately, no existing PEKS scheme supports the monitoring function without authorization from the sender. To address this issue, we propose a variant of PEKS named Hierarchical Public Key Encryption with Keyword Search (HPEKS) and provide a semi-generic construction utilizing a public key tree (PKTree) and a PEKS scheme. To better suit for the enterprise secret data sharing, we build an advanced HPEKS scheme, named designated-tester decryptable hierarchical public key encryption with keyword search (dDHPEKS), which enjoys stronger security and integrates the public key and symmetric key encryptions. We prove our dDHPEKS scheme secure under the security definition in the random oracle model. Particularly, it satisfies the security against outside offline keyword guessing attacks and furthermore, enjoys thetransparencyproperty so that the sender does not need to know the internal hierarchy structure of an enterprise in order to share encrypted data to the enterprise. Theoretical evaluation and concrete experiments show that our dDHPEKS scheme has comparable running efficiency with existing PEKS schemes.

The Internet of Things (IoT) is experiencing explosive growth and has gained extensive attention from academia and industry in recent years. However, most of the existing IoT infrastructures are centralized, which may cause the issues of unscalability and single-point-of-failure. Consequently, decentralized IoT has been proposed by taking advantage of the emerging technology called blockchain. Voting systems are widely adopted in IoT, for example a leader election in wireless sensor networks. Self-tallying voting systems are alternatives to unsuitable, traditional centralized voting systems in decentralized IoT. Unfortunately, self-tallying voting systems inherently suffer from fairness issues, such as adaptive and abortive issues caused by malicious voters. To address these issues, in this article, we introduce a framework of the self-tallying voting system in decentralized IoT based on blockchain. We propose a concrete construction and prove that the proposed system satisfies all the security requirements, including fairness, dispute-freeness, and maximal ballot secrecy. We simulate the algorithms on a laptop, an Android phone, and a Raspberry Pi to test the time consumption and evaluate the gas cost of each algorithm in a private blockchain as well. The implementation results demonstrate the practicability of our system.

Cloud-based data storage service has drawn increasing interests from both academic and industry in the recent years due to its efficient and low cost management. Since it provides services in an open network, it is urgent for service providers to make use of secure data storage and sharing mechanism to ensure data confidentiality and service user privacy. To protect sensitive data from being compromised, the most widely used method is encryption. However, simply encrypting data (e.g., via AES) cannot fully address the practical need of data management. Besides, an effective access control over download request also needs to be considered so that Economic Denial of Sustainability (EDoS) attacks cannot be launched to hinder users from enjoying service. In this article, we consider thedual access control, in the context of cloud-based storage, in the sense that we design a control mechanism over both data access and download request without loss of security and efficiency. Two dual access control systems are designed in this article, where each of them is for a distinct designed setting. The security and experimental analysis for the systems are also presented.

Cloud computing is considered as one of the most prominent paradigms in the information technology industry, since it can significantly reduce the costs of hardware and software resources in computing infrastructure. This convenience has enabled corporations to efficiently use the cloud storage as a mechanism to share data among their employees. At the first sight, by merely storing the shared data as plaintext in the cloud storage and protect them using an appropriate access control would be a nice solution. This is assuming that the cloud is fully trusted for not leaking any information, which is impractical as the cloud is owned by a third party. Therefore, encryption is mandatory, and the shared data will need to be stored as a ciphertext using an appropriate access control. However, in practice, some of these employees may be malicious and may want to deviate from the required sharing policy. The existing protection in the literature has been explored to allow only legitimate recipients to decrypt the contents stored in the cloud storage, but unfortunately,no existing workdeals with issues raised due to the presence of malicious data publishers. Malicious data publishers construct data following the given policy, but the ciphertexts can actually be decrypted by unauthorized users without valid keys, or simply, anyone else who is unauthorized. The impact of the involvement of malicious data publishers is detrimental, as it may damage intellectual properties from the corporations. Therefore, it remains an elusive research problem on how to enable a sound approach to resolve the issue when malicious data publishers are involved in the system, which is a very practical question. In this work, we presenta new direction of researchthat can cope with the presence of malicious data publishers. We resolve the aforementioned problem by proposing the notion of Sanitizable Access Control System (SACS), which is designed for a secure cloud storage that can also resist against malicious data publishers. We define the threat model and its formal security model, as well as its design and scheme which is based on$q$q-Parallel Bilinear Diffie-Hellman Exponent Assumption. We provide the security proof of our construction as well as its performance analysis. We believe that this work has opened a new area of research which has never been explored before, even though it is very practical. Therefore, this work will enhance the adoption of secure cloud storage in practice.

Data deduplication and public auditing are significant for providing secure and efficient network storage services. However, the existing data deduplication schemes supporting auditing not only cannot effectively alleviate the threats of the single point of failure and duplicate-faking attack, but also have to bear the massive waste of computation and storage resources caused by metadata redundancy and repetitive audit tasks. In this article, we propose a blockchain-based secure deduplication and shared auditing scheme in decentralized storage. Specifically, our scheme utilizes a novel deduplication protocol based on the double-server storage model to achieve efficient space-saving while protecting data users from losing data under a single point of failure and duplicate-faking attack. Besides, it sharply reduces the computation and storage costs of metadata by introducing a lightweight authenticator generation algorithm and update protocol. On this basis, our scheme further adopts a blockchain-based two-way shared auditing mechanism to achieve decentralized public auditing without the third-party auditor, in which the audit authenticators and results of outsourced data are shared among its users to avoid repetitive audit tasks. Security and performance analysis indicates the practicability of our scheme.

In the above article, Zhanget al.(2021) proposed a many-to-many authentication and key agreement scheme named SMAKA for secure authentication and key agreement between multiple vehicles and cloud service providers (CSPs) in a vehicular network. However, we identify a security flaw in the design of Zhanget al.’s scheme, which allows an attacker to hijack an authentication session between a vehicle and a CSP and impersonate the vehicle to establish a shared key with the CSP with a high chance.

Cloud storage service provides a convenient way for users to store massive data. To guarantee the integrity of the outsourced data, provable data possession (PDP) schemes for multi-copy data and multi-cloud have been proposed respectively. To avoid a single point of failure and to increase the security of the outsourced data, many users store multiple copies on multiple cloud servers. However, few protocols support multi-copy data and multi-cloud at the same time. Considering that three entities (third-party auditor, cloud organizer and cloud storage servers) participate in the auditing process, it is difficult for users to locate the position of the faults, including entity position, file position and data block corruption position, when the auditor reports data corruption. In this paper we propose a certificateless multi-copy public auditing protocol in multi-cloud storage, which supports to locate the faults entities and corrupted data blocks. Specifically, instead of relying on a trusted centralized judgement entity to deal with the faults detection, smart contracts combined with the binary search technique are utilized to help achieve the reliability of faults localization result and the accuracy of the judgement. Additionally, the proposed protocol supports data dynamics update, including data modification, insertion and deletion. Theoretical analysis and experiment results show that our protocol is efficient and practical.

Attribute-based encryption scheme is a promising mechanism to realize one-to-many fine-grained access control which strengthens the security in cloud computing. However, massive amounts of data and various data sharing requirements bring great challenges to the complex but isolated and fixed access structures in most of the existing attribute-based encryption schemes. In this paper, we propose an attribute-based hierarchical encryption scheme with extendable policy, called Extendable Hierarchical Ciphertext-Policy Attribute-Based Encryption (EH-CP-ABE), to improve the data sharing efficiency and security simultaneously. The scheme realizes the function of hierarchical encryption, in which, data with hierarchical access control relationships could be encrypted together flexibly to improve the efficiency. The scheme also achieves external and internal extension of the access structure to further encrypt newly added hierarchical data without updating the original ciphertexts or with only a minor update depending on the data sharing requirements, which simplifies the encryption process and greatly reduces the computation overhead. We formally prove the security of the scheme is IND-CCA secure in the random oracle model based on bilinear Diffie-Hellman assumption, and we also implement our scheme to demonstrate its efficiency and practicality.

Dynamic searchable symmetric encryption (DSSE) has been widely recognized as a promising technique to delegateupdateandsearchqueries over an outsourced database to an untrusted server while guaranteeing the privacy of data. Many efforts on DSSE have been devoted to obtaining a good tradeoff between security and performance. However, it appears that all existing DSSE works miss studying on what will happen if the DSSE client issues irrationalupdatequeries carelessly, such as duplicateupdatequeries anddeletequeries to remove non-existent entries (that have been considered by many popular database system in the setting of plaintext). In this scenario, we find that (1) most prior works lose their claimed correctness or security, and (2) no single approach can achieve correctness, forward and backward security, and practical performance at the same time. To address this problem, we study for the first time the notion of robustness of DSSE. Generally, we say that a DSSE scheme is robust if it can keep the same correctness and security even in the case of misoperations. Then, we introduce a new cryptographic primitive named key-updatable pseudo-random function and apply this primitive to constructing ROSE, a robust DSSE scheme with forward and backward security. Finally, we demonstrate the efficiency of ROSE and give the experimental comparisons.

It is inevitable and evident that outsourcing complicated intensive tasks to public cloud vendors would be the primary option for resource-constrained clients in order to save cost. Unfortunately, the public cloud vendors are usually untrusted. They may inadvertently leak the data or misuse the user’s data, compromise user’s privacy or intentionally corrupt computational results to make the system unreliable. It is therefore important how to stop this happening whilst embracing the computational power of public cloud vendors. Non-negative matrix factorization (NMF) is a significant method for conducting data dimension reduction, which has been widely used in large-scale data processing. Nevertheless, due to its non-polynomial hardness, NMF cannot be conducted efficiently using local computation resources, especially when dealing with big data. Motivated by this issue, we address this by presenting a novel outsourced scheme for NMF (O-NMF), which aims to lessen clients’ computing burden and tackle secure problems faced by outsourcing NMF. Particularly, based on two non-collusion servers, O-NMF exploits Paillier homomorphism to preserve data privacy. Additionally, O-NMF allows a verification mechanism to assist clients in verifying returned results with high probability. Security analysis and experimental evaluation demonstrates that the validity and practicality of O-NMF is also provided in this work.

Broadcast encryption provides a promising technique of data access control for specified users in cloud computing. A data uploader can generate a ciphertext for a set of chosen users such that only the intended users are able to access the data. However, with the rapidly increasing of collaboration between users, it is desired to extend the receiver set to grant decryption right for more users. The existing broadcast encryption systems cannot support receiver extension. In this article, we for the first time take this problem into consideration and give a solution. We take the merits of identity-based cryptosystem and propose a notion of EIBBE: a flexible data access control with receiver extendable for cloud computing based on broadcast encryption. It allows the authorized user to extend the receiver set$S$stated in the IBBE ciphertext by adding a new receiver set$S^{\prime }$without re-encryption. Both the users in$S$and$S^{\prime }$can access the data successfully. Moreover, the data uploader determines the maximum number of extended receivers. We then give a concrete construction of EIBBE and provide a rigorous security analysis of our proposed scheme. Finally, we demonstrate the scheme's efficiency and feasibility.

Message-Locked Encryption (MLE) is a useful tool to enable deduplication over encrypted data in cloud storage. It can significantly improve the cloud service quality by eliminating redundancy to save storage resources, and hence user cost, and also providing defense against different types of attacks, such as duplicate faking attack and brute-force attack. A typical MLE scheme only focuses on deduplication. On the other hand, supporting search operations on stored content is another essential requirement for cloud storage. In this article, we present a message-locked searchable encryption (MLSE) scheme in a dual-server setting, which achieves simultaneously the desirable features of supporting deduplication and enabling users to perform search operations over encrypted data. In addition, it supports both multi-keyword and negative keyword searches. We formulate the security notions of MLSE and prove our scheme satisfies all the security requirements. Moreover, we provide an interesting extension of our construction to support Proof of Storage (PoS). Compared with the existing solutions, MLSE achieves better functionalities and efficiency, and hence enables more versatile and efficient cloud storage service.

Traditional data sharing systems are facing new challenges when implementing access control with more and more complex data sharing requirements. Flexibility of user revocation in completely decentralized environments needs to be taken into account. In this article, we propose a Key-Policy Attribute-Based Encryption scheme with Multiple and Flexible Revocation (MAFR-KP-ABE) to achieve the features of decentralized authorization and flexible revocation. We prove the security of our MAFR-KP-ABE scheme in the standard model and provide the comparison with relevant schemes to demonstrate its efficiency. Then we propose a fine-grained access control system based on MAFR-KP-ABE scheme and blockchain that matches the need of paid data sharing services with several security properties enhanced. Security analysis and system implementation are given subsequently to demonstrate our system efficient and secure.

Internet of Things based systems (IoT systems for short) are becoming increasingly popular across different industrial domains and their development is rapidly increasing to provide value-added services to end-users and citizens. Little research to date uncovers the core development process lifecycle needed for IoT systems, and thus software engineers find themselves unprepared and unfamiliar with this new genre of system development. To ameliorate this gap, we conducted a mixed quantitative and qualitative research study where we derived a conceptual process framework from the extant literature on IoT, through which 27 key tasks for incorporation into the development processes of IoT systems were identified. The framework was then validated by the means of a survey of 127 IoT practitioners from 35 countries across 6 continents with 15 different industry backgrounds. Our research provides an understanding of the most important development process tasks and informs both software engineering practitioners and researchers of the challenges and recommendations related to the development of next-generation of IoT systems.

Residue number systems provide efficient techniques for speeding up calculations and/or protecting against side channel attacks when used in the context of cryptographic engineering. One of the interests of such systems is their scalability, as the existence of large bases for some specialized systems is often an open question. In this paper, we present highly optimized methods for generating large bases for residue number systems and, in some cases, the largest possible bases. We show their efficiency by demonstrating their improvement over the state-of-the-art bases reported in the literature. This work make it possible to address the problem of the scalability issue of finding new bases for a specific system that arises whenever a parameter changes, and possibly open new application avenues.

The amount of encrypted Internet traffic almost doubles every year thanks to the wide adoption of end-to-end traffic encryption solutions such as IPSec, TLS and SSH. Despite all the benefits of user privacy the end-to-end encryption provides, the encrypted internet traffic blinds intrusion detection system (IDS) and makes detecting malicious traffic hugely difficult. The resulting conflict between the user's privacy and security has demanded solutions for deep packet inspection (DPI) over encrypted traffic. The approach of those solutions proposed to date is still restricted in that they require intensive computations during connection setup or detection. For example, BlindBox, introduced by Sherry et al. (SIGCOMM 2015) enables inspection over the TLS-encrypted traffic without compromising users' privacy, but its usage is limited due to a significant delay on establishing an inspected channel. PrivDPI, proposed more recently by Ning et al. (ACM CCS 2019), improves the overall efficiency of BlindBox and makes the inspection scenario more viable. Despite the improvement, we show in this paper that the user privacy of Ning et al.'s PrivDPI can be compromised entirely by the rule generator without involving any other parties, including the middlebox. Having observed the difficulties of realizing efficiency and security in the previous work, we propose a new DPI system for encrypted traffic, named "Practical and Privacy-Preserving Deep Packet Inspection (P2DPI)''. P2DPI enjoys the same level of security and privacy that BlindBox provides. At the same time, P2DPI offers fast setup and encryption and outperforms PrivDPI. Our results are supported by formal security analysis. We implemented our P2DPI and comparable PrivDPI and performed extensive experimentation for performance analysis and comparison.

Equivocation is one of the most fundamental problems that need to be solved when designing distributed protocols. Traditional methods to defeat equivocation rely on trusted hardware or particular assumptions, which may hinder their adoption in practice. The advent of blockchain and decentralized cryptocurrencies provides an auspicious breakthrough paradigm to resolve the problem above. In this paper, we propose a blockchain-based solution to address contractual equivocation, which supports user-defined fine-grained policy-based equivocation. Specifically, users will be de-incentive if the statements they made breach the predefined access rules. The core of our solution is a newly introduced primitive named Policy-Authentication-Preventing Signature (PoAPS), which combined with a deposit mechanism allows a signer to make conflict statements corresponding to a policy to be penalized. We present a generic construction of PoAPS based on Policy-Based Verifiable Secret Sharing (PBVSS) and demonstrate its practicality via a concrete implementation in the blockchain. Compared with the existing solutions that only handle specific types of equivocation, our proposed approach is more generic and can be instantiated to deal with various kinds of equivocation.

Abstract Public key encryption with equality test (PKEET) can check whether two ciphertexts are encrypted from the same message or not without decryption. This attribute enables PKEET to be increasingly utilized in cloud storage, where users store their encrypted data on the cloud. In traditional PKEET, the tester is authorized by the data receiver to perform equality test on its ciphertexts. However, the tester can only test one ciphertext or all ciphertexts of one receiver with one authorization. It means that the receiver cannot adaptively authorize the test right of any number of ciphertexts to the tester. A trivial solution is authorizing one ciphertext each time and repeating multiple times. The corresponding size of trapdoor in this method is linear with the number of authorized ciphertexts. This will incur storage burden for the tester. To solve the aforementioned problem, we propose the concept of PKEET supporting partial authentication (PKEET-PA). We then instantiate the concept to a lightweight PKEET-PA, which achieves constant-size trapdoor. Besides, we prove the security of our PKEET-PA scheme against two types of adversaries. Compared with other PKEET schemes that can be used in trivial solution, our PKEET-PA is more efficient in receivers’ computation and has lower trapdoor size.

The primitive of proofs of ownership (PoWs) enables a prover to efficiently convince a verifier that he/she indeed owns a certain message in a knowledge-proof manner. As a result, it can prevent an adversary who only has a short information of the message from accessing the whole one. We argue that the existing PoWs based on Merkle hash tree and specific encodings are not much efficient if the size of message is sufficiently huge. In this paper, we first propose a new PoW protocol based on the chameleon hash function without key exposure. Interestingly, it is equivalent to having the prover compute a new collision of chameleon hashing as the proof in our construction. Therefore, the proposed protocol is much efficient since the computation and storage overhead of proof is independent of the size of the message. Moreover, we utilize the proposed PoWs to design a deduplication scheme over ciphertext.

The emergence of cloud infrastructure has significantly reduced the costs of hardware and software resources in computing infrastructure. To ensure security, the data is usually encrypted before it's outsourced to the cloud. Unlike searching and sharing the plain data, it is challenging to search and share the data after encryption. Nevertheless, it is a critical task for the cloud service provider as the users expect the cloud to conduct a quick search and return the result without losing data confidentiality. To overcome these problems, we propose a ciphertext-policy attribute-based mechanism with keyword search and data sharing (CPAB-KSDS) for encrypted cloud data. The proposed solution not only supports attribute-based keyword search but also enables attribute-based data sharing at the same time, which is in contrast to the existing solutions that only support either one of two features. Additionally, the keyword in our scheme can be updated during the sharing phase without interacting with the PKG. In this article, we describe the notion of CPAB-KSDS as well as its security model. Besides, we propose a concrete scheme and prove that it is against chosen ciphertext attack and chosen keyword attack secure in the random oracle model. Finally, the proposed construction is demonstrated practical and efficient in the performance and property comparison.

Monero provides a high level of anonymity for both users and their transactions. However, many criminal activities might be committed with the protection of anonymity in cryptocurrency transactions. Thus, user accountability (or traceability) is also important in Monero transactions, which is unfortunately lacking in the current literature. In this paper, we fill this gap by introducing a new cryptocurrency named Traceable Monero to balance the user anonymity and accountability. Our framework relies on a tracing authority, but is optimistic, in that it is only involved when investigations in certain transactions are required. We formalize the system model and security model of Traceable Monero. We present a detailed construction of Traceable Monero by overlaying Monero with two types of tracing mechanisms, tracing the one-time addresses with money flows and tracing the long-term addresses. We prove the security of Traceable Monero and implement a prototype of the system, which demonstrates that Traceable Monero incurs merely a very small overhead in generating and verifying a transaction compared to Monero transactions.

Personal e-health records (EHR) enable medical workers (e.g., doctors and nurses) to conveniently and quickly access each patient's medical history through the public cloud, which greatly facilitates patients' visits and makes telemedicine possible. Additionally, since EHR involve patients' personal privacy information, EHR holders would hesitate to directly outsource their data to cloud servers. A natural and favorite manner of conquering this issue is to encrypt these outsourced EHR such that only authorized medical workers can access them. Specifically, the ciphertext-policy attribute-based encryption (CP-ABE) supports fine-grained access over encrypted data and is considered to be a perfect solution of securely sharing EHR in the public cloud. In this paper, to strengthen the system security and meet the requirement of specific applications, we add functionalities of user revocation, secret key delegation and ciphertext update to the original ABE, and propose a revocable-storage hierarchical attribute-based encryption (RS-HABE) scheme, as the core building of establishing a framework for secure sharing of EHR in public cloud. The proposed RS-HABE scheme features of forward security (a revoked user can no longer access previously encrypted data) and backward security (a revoked user also cannot access subsequently encrypted data) simultaneously, and is proved to be selectively secure under a complexity assumption in bilinear groups, without random oracles. The theoretical analysis indicates that the proposed scheme surpasses existing similar works in terms of functionality and security, at the acceptable cost of computation overhead. Moreover, we implement the proposed scheme and present experiments to demonstrate its practicability.

With the ubiquity of mobile devices and rapid development of cloud computing, mobile cloud computing (MCC) has been considered as an essential computation setting to support complicated, scalable and flexible mobile applications by overcoming the physical limitations of mobile devices with the aid of cloud. In the MCC setting, since many mobile applications (e.g., map apps) interacting with cloud server and application server need to perform computation with the private data of users, it is important to realize secure computation for MCC. In this article, we propose an efficient server-aided secure two-party computation (2PC) protocol for MCC. This is the first work that considers collusion between a malicious garbled circuit evaluator and a semi-honest server while ensuring privacy and correctness. Also, it can guarantee fairness when collusion does not exist. The security analysis shows that our protocol can securely compute any function f(x, y) against different types of adversaries in the malicious model. Also, the experimental performance analysis shows that this work outperforms the previous works for at least 10 times with the same security level.

Thanks to its convenience and cost-savings feature, cloud computing ushers a new era. Yet its security and privacy issues must not be neglected. Private set intersection (PSI) is useful and important in many cloud computing applications, such as document similarity, genetic paternity and data mining. The cloud server performs intersection operations on two outsourced encrypted datasets of data owners. In the existing protocols, however, data owners cannot decide whether to use all or part of their encrypted data to compute the intersection, nor can they specify whom to compare with. In this paper, we introduce an enhanced notion of outsourced PSI, called authorized PSI (APSI), which supports flexible authorization and cross-type authorized comparison of datasets. To demonstrate this notion, we propose a concrete APSI protocol, and prove it to be secure in the random oracle model based on simple number-theoretic assumptions. Experimental results show that our APSI protocol has performance comparable with existing related outsourced PSI protocols.

The primitive of verifiable database (VDB) can enable a resource-limited client to securely outsource an encrypted database to an untrusted cloud server and the client could efficiently retrieve and update the data at will. Meanwhile, the client can undoubtedly detect any misbehavior by the server if the database has been tampered with. We argue that most of the existing VDB schemes can only support the updating operation of replacement, rather than other common updating operations such asinsertionanddeletion. Recently, the first publicly verifiable VDB schemes that supports all updating operations was proposed based on the idea of hierarchical vector commitment. However, one disadvantage of the proposed VDB scheme is that the computation and storage complexity increases linearly when the client continually inserts data records in the same index of the database. As a result, it remains an open problem how to construct an efficient (and publicly verifiable) VDB scheme that can support all updating operations regardless of the manner of insertion. In this paper, we first introduce a new primitive called committed invertible Bloom filter (CIBF) and utilize it to propose a new publicly verifiable VDB scheme that can support all kinds of updating operations. Additionally, the proposed construction is efficient regardless of the manner of updating operations and thus provides an affirmative answer to the above open problem.

As cloud storage has been widely adopted in various applications, how to protect data privacy while allowing efficient data search and retrieval in a distributed environment remains a challenging research problem. Existing searchable encryption schemes are still inadequate on desired functionality and security/privacy perspectives. Specifically, supporting multi-keyword search under the multi-user setting, hiding search pattern and access pattern, and resisting keyword guessing attacks (KGA) are the most challenging tasks. In this article, we present a new searchable encryption scheme that addresses the above problems simultaneously, which makes it practical to be adopted in distributed systems. It not only enables multi-keyword search over encrypted data under a multi-writer/multi-reader setting but also guarantees the data and search pattern privacy. To prevent KGA, our scheme adopts a multi-server architecture, which accelerates search response, shares the workload, and lowers the key leakage risk by allowing only authorized servers to jointly test whether a search token matches a stored ciphertext. A novel subset decision mechanism is also designed as the core technique underlying our scheme and can be further used in applications other than keyword search. Finally, we prove the security and evaluate the computational and communication efficiency of our scheme to demonstrate its practicality.

Existing test case prioritization (TCP) techniques have limitations when applied to real-world projects, because these techniques require certain information to be made available before they can be applied. For example, the family of input-based TCP techniques are based on test case values or test script strings; other techniques use test coverage, test history, program structure, or requirements information. Existing techniques also cannot guarantee to always be more effective than random prioritization (RP) that does not have any precondition. As a result, RP remains the most applicable and most fundamental TCP technique. This article proposes an extremely simple, effective, and efficient way to prioritize test cases through the introduction of a dispersity metric. Our technique is as applicable as RP. We conduct empirical studies using 43 different versions of 15 real-world projects. Empirical results show that our technique is more effective than RP. Our algorithm has a linear computational complexity and, therefore, provides a practical solution to the problem of prioritizing very large test suites (such as those containing hundreds of thousands, or millions, of test cases), where the execution time of conventional nonlinear prioritization algorithms can be prohibitive. Our technique also provides a practical solution to TCP when neither input-based nor execution-based techniques are applicable due to lack of information.

A procurement protocol is a protocol for a buyer to purchase digital goods at their prices from a vendor. A procurement protocol with privacy preservation can be achieved by priced oblivious transfer (POT). POT allows the buyer to obliviously procure items one by one. An adaptive POT protocol only consumes O(1) communication cost in each transaction, where all items are committed and encrypted before transactions. However, we found that the state-of-the-art adaptive POT protocol proposed by Rial et al. is less practical and does not meet real-world needs. It has to restrict to the one-buyer setting where all items are encrypted associated with one buyer's public key. For multiple buyers, the vendor must respectively encrypt all the same items for each buyer. Besides, it has to employ computationally expensive primitives such as zero-knowledge proof which imply inefficient computation operations. It is therefore unscalable and unsuitable in large-scale applications. In this paper, we propose an efficient adaptive priced oblivious transfer protocol to address the aforementioned problems. The proposed adaptive POT is built on top of a new cryptographic primitive, namely, adaptive set membership encryption (ASME). In our proposed protocol, all items are encrypted without the use of buyers' public keys and hence they can be used for universal buyers. Our protocol significantly reduces the transaction cost compared to existing schemes. For example, the communication in each transaction costs only 6 group elements compared to at least 141 group elements in Rial et al.'s protocol. The implementation shows that our protocol is efficient in terms of bandwidth and computational cost.

Filtering refers to an operation to determine whether the concerned data should be accepted and transferred, or be blocked and marked as a malicious traffic flow. It mitigates the inter-domain bandwidth overhead, local computational cost and storage cost for data identification. In many sensitive applications, the identity of the data provider needs to be hidden. This creates challenges how to filter the transmitted data packet with an encrypted form. It is non-trivial to hide this data provider's identity while enabling filtering, as the policy used as a matching criteria will need to determine whether the data needs to be transferred or not without knowing the origin of that data. In this work, we designPPFilter, a privacy-aware encrypted filtering mechanism which allows the filtering to be conducted without the need to know the identity of the data provider. PPFilter achieves the integrity protection of the data packets and the provider privacy Level 3. PPFilter is built on top of a novel notion calledidentity-based encryption with sender search (IESS), which supports anonymous sender identity in an encrypted searching. We present a provably secure IESS instantiation, and apply it to achieve a PPFilter protocol. PPFilter allows the data provider's identity to be hidden from both the transferred data and policy while enabling the filtering capability, which solves the aforementioned problem. The analysis and evaluation show that PPFilter maintains cost-reasonable filtering while preserving provider privacy, and hence it guarantees its practicality.

With the outbreak of e-mail message leakage events, such as the Hillary Clinton’s Email Controversy, privacy and security of sensitive e-mail information have become users’ primary concern. Encrypted email seems to be a viable solution for providing security, but it will greatly limit their operations. Public encryption with keyword search (PEKS) scheme is a popular technology to incorporate security protection and favorable operability functions together, which can play an important role in searching over encrypted email in a cloud server. In this paper, we propose a practical PEKS scheme named as public-key multi-keyword searchable encryption with hidden structures (PMSEHS). It could enable e-mail receivers to do the multi-keyword and boolean search in the large encrypted email database as fast as possible, without revealing more information to the cloud server. We also give comparative experiments, which demonstrate that our scheme has a higher efficiency in multi-keyword search for encrypted emails.

Transport Layer Security (TLS) is one of the most widely-used security protocols for the modern internet. However, TLS does not differentiate regular users from threat actors who want to evade detection through the privacy provided by TLS. For this reason, organizations have been increasingly interested in middlebox technology whereby encrypted TLS traffic can be filtered and inspected.

Public key encryption with equality test (PKEET) enables the testing whether two ciphertexts encrypt the same message. Identity-based encryption with equality test (IBEET) simplify the certificate management of PKEET, which leads to many potential applications such as in smart city applications or Wireless Body Area Networks. Lee et al. (ePrint 2016) proposed a generic construction of IBEET scheme in the standard model utilising a 3-level hierachy IBE together with a one-time signature scheme, which can be instantiated in lattice setting. Duong et al. (ProvSec 2019) proposed the first direct construction of IBEET in standard model from lattices. However, their scheme achieve CPA security only. In this paper, we improve the Duong et al.'s construction by proposing an IBEET in standard model which achieves CCA2 security and with smaller ciphertext and public key size.

Abstract Blind signatures are an important and useful tool in designing digital cash schemes and electronic voting protocols. Ring signatures on the other hand provide the anonymity of the signer within the ring of users. In order to fit to some real-life applications, it is useful to combine both protocols to create a blind ring signature scheme, which utilizes all of their features. In this paper, we propose, for the first time, a post-quantum blind ring signature scheme. Our scheme is constructed based on multivariate public key cryptography, which is one of the main candidates for post-quantum cryptography.

Abstract A tightly secure scheme has a reduction, where the reduction loss is a small constant. Identity-based signature (IBS) is an important cryptographic primitive, and tightly secure IBS schemes enjoy the advantage that the security parameter can be optimal to achieve a certain security level. General constructions of IBS schemes (Bellare, M., Namprempre, C., and Neven, G. (2004) Security Proofs for Identity-Based Identification and Signature Schemes. In Proc. EUROCRYPT 2004, May 2–6, pp. 268–286. Springer, Berlin, Interlaken, Switzerland; Galindo, D., Herranz, J., and Kiltz, E. (2006) On the Generic Construction of Identity-Based Signatures With Additional Properties. In Proceedings of ASIACRYPT 2006, December 3–7, pp. 178–193. Springer, Berlin, Shanghai, China) and their security have been extensively studied. However, the security is not tight and how to generally construct a tightly secure IBS scheme remains unknown. In this paper, we concentrate on the general constructions of IBS schemes. We first take an insight into previous constructions and analyze the reason why it cannot achieve tight security. To further study possible tightly secure constructions, we propose another general construction, which could be seen as a different framework of IBS schemes. Our construction requires two traditional signature schemes, whereas the construction by Bellare et al. uses one scheme in a two-round iteration. There are no additional operations in our general construction. Its main advantage is providing the possibility of achieving tight security for IBS schemes in the random oracle model. Combining two known signature schemes, we present an efficient IBS scheme with tight security as an example.

Abstract Hierarchical identity-based signature (HIBS) plays a core role in a large community as it significantly reduces the workload of the root private key generator. To make HIBS still available and secure in post-quantum era, constructing lattice-based schemes is a promising option. In this paper, we present an efficient HIBS scheme in polynomial rings. Although there are many lattice-based signatures proposed in recent years, to the best of our knowledge, our HIBS scheme is the first ring-based construction. In the center of our construction are two new algorithms to extend lattice trapdoors to higher dimensions, which are non-trivial and of independent interest. With these techniques, the security of the new scheme can be proved, assuming the hardness of the Ring-SIS problem. Since operations in the ring setting are much faster than those over integers and the new construction is the first ring-base HIBS scheme, our scheme is more efficient and practical in terms of computation and storage cost when comparing to the previous constructions.

Abstract Identity-based revocation system (IBRS) generates the ciphertext with a revoked identity list such that only the non-revoked identities can use their private keys to decrypt this ciphertext. IBRS can be efficiently applied in some practical applications, such as the pay-TV systems when the number of revoked identities are much less than the non-revoked ones. However, since IBRS is based on identity-based cryptography, it also suffers from the inherent key escrow problem where the private key generator (PKG) has full control of each user’s private key. As a consequence, it is hard to judge whether a pirated private key is generated by the PKG or the suspected user. There is no study on IBRS fulfilling accountability in literature to date. In this paper, we introduce the notion of accountable authority IBRS (A-IBRS), which provides accountability in IBRS schemes. In an A-IBRS, the aforementioned problem can be alleviated and resolved. Furthermore, a full black-box A-IBRS can distinguish the creator of a black box between the PKG and the associated user and the dishonest PKG is allowed to access the decryption results of the user private key. We formalize the definition and security models of the full black-box A-IBRS schemes. Then, we present a concrete full black-box A-IBRS scheme with constant-size master public key and private key. Finally, we prove the security of our scheme under the defined security models without random oracle.

Smart cities have experienced rapid development with the advances of information and communication technologies such as Internet of Things (IoT). To tackle the data storage issues raised by large-scale data generated by IoT devices, an increasing number of enterprises and individuals prefer to outsource their data to cloud, where data integrity becomes a concern to cloud users. A variety of provable data possession (PDP) protocols have been proposed for centralized cloud storage scenarios so far. However, a centralized cloud relies too much on the trust of the central servers and, thus, is prone to the single point of failure. In this article, we describe a blockchain-based PDP model to realize the decentralized outsourcing storage framework, and then present a concrete construction of decentralized PDP by using multireplica storage tricks. Moreover, our protocol provides dynamic operations for outsourced data and at the same time, guarantees the fairness of all parties involved. We provide a detailed security proof for the proposed protocol and deploy a smart contract for the protocols as well. We finally evaluate the algorithms and the implementation results demonstrate the practicability of the proposed protocol.

Equipped with mobile devices, people relied on location-based services (LBSs) can expediently and reasonably organize their activities. But location information may disclose people's sensitive information, such as interests and health status. Besides, the limited resources of mobile devices restrict the further development of LBSs. In this article, aiming at the fair meeting position determination service, we design a lightweight privacy-preserving solution. In our scheme, mobile users only need to submit service requests. A cloud server and a location services provider are responsible for service response, where the cloud server achieves most of the calculation, and the location services provider determines the fair meeting location based on the computational results of the cloud server and broadcasts it to mobile users. The proposed scheme adopts homomorphic encryptions and random permutation methods to preserve the location privacy of mobile users. The security analyses show that the proposed scheme is privacy preserving under our defined threat models. Besides, the presented solution only needs to calculate $n$ Euclidean distances, and hence, our scheme has linear computation and communication complexity.

With the help of patients' health data, e-healthcare providers can offer reliable data services for better medical treatment. For example, the clinical pathway provides optimal detailed guidance for the clinical treatment. However, the e-healthcare providers are incompetent with the huge volumes of e-healthcare data, and a popular and feasible solution is used to outsource the medical data to powerful cloud servers (CSs). Because the medical data are very sensitive yet the outsourced servers are not fully trusted, the straightforward execution of clinical pathway query service will inevitably bring huge privacy risks to patients' data. Apart from the privacy issues, the efficiency issues also need to be taken into consideration, such as the communication overhead and computational cost between servers and providers. Considering the above issues, this article proposes a privacy-preserving optimization of clinical pathway query scheme (PPO-CPQ) to achieve the secure clinical pathway query under e-healthcare CSs without revealing neither the private information of patients, such as name, gender, age, and physical index, nor the sensitive information of hospitals, such as treatment, medication, and expense. In our proposed scheme, it first designs secure and privacy-preserving several subprotocols, such as privacy-preserving comparison, privacy-preserving clinical comparison, privacy-preserving stage selection, and privacy-preserving stage update protocol, to ensure privacy in the e-healthcare system, then it adopts the greedy algorithm in a secure manner to perform the query and the min-heap technology to improve efficiency. The experimental result shows that our scheme is practical and efficient in terms of computational cost and communication overhead.

The Information and Communication Technology (ICT) has been used in wide range of applications, such as smart living, smart health and smart transportation. Among all these applications, smart home is most popular, in which the users/residents can control the operations of the various smart sensor devices from remote sites also. However, the smart devices and users communicate over an insecure communication channel, i.e., the Internet. There may be the possibility of various types of attacks, such as smart device capture attack, user, gateway node and smart device impersonation attacks and privileged-insider attack on a smart home network. An illegal user, in this case, can gain access over data sent by the smart devices. Most of the existing schemes reported in the literature for the remote user authentication in smart home environment are not secure with respect to the above specified attacks. Thus, there is need to design a secure remote user authentication scheme for a smart home network so that only authorized users can gain access to the smart devices. To mitigate the aforementioned isses, in this paper, we propose a new secure remote user authentication scheme for a smart home environment. The proposed scheme is efficient for resource-constrained smart devices with limited resources as it uses only one-way hash functions, bitwise XOR operations and symmetric encryptions/decryptions. The security of the scheme is proved using the rigorous formal security analysis under the widely-accepted Real-Or-Random (ROR) model. Moreover, the rigorous informal security analysis and formal security verification using the broadly-accepted Automated Validation of Internet Security Protocols and Applications (AVISPA) tool is also done. Finally, the practical demonstration of the proposed scheme is also performed using the widely-accepted NS-2 simulation.

Each layer of nodes and communication networks in edge computing, from cloud to the end device (i.e, often considered as resource-constrained IoT devices), exhibits a different level of trust for each stakeholder - e.g., edge nodes may not be fully trusted by IoT devices and the cloud. Moreover, asymmetric nature of resources between layers makes it hard to establish a balance between security and performance - e.g., lightweight cryptography may degrade security level against untrusted nodes while heavyweight ones may not be feasible for the light-weight end devices. An advanced encryption scheme such as the Identity-Based Broadcast Encryption (IBBE) is a popular technique to reduce storage and communication overhead. However, IBBE requires heavy computation to the end devices and still does not fully satisfy the security requirements that exist in the layers of edge computing. This paper presents a new IBBE with outsourced partial decryption for hybrid security models that each layer in edge computing requires. It balances the computational overhead based on asymmetric nature that nodes in each layer have. Particularly, with new schemes, the ciphertext can be transformed from its initial format. The cloud encrypts their data for multiple end devices and store them in the edge nodes, but those interim nodes can blindly transform the ciphertext from the cloud into a form which (i) is decryptable by only an authorized end device, and (ii) imposes smaller decryption and data transmission burden to end devices, regardless of the number of recipients. Our security analysis shows that new schemes are selectively and adaptively secure. We implement our solution and show that new schemes reduce the communication overhead from an edge node to end devices and the computation overhead on the end devices, compared to the original IBBE schemes.

Abstract Certificateless public key cryptography (CL-PKC) promises a practical resolution in establishing practical schemes, since it addresses two fundamental issues, namely the necessity of requiring certificate managements in traditional public key infrastructure (PKI) and the key escrow problem in identity-based (ID-based) setting concurrently. Signcryption is an important primitive that provides the goals of both encryption and signature schemes as it is more efficient than encrypting and signing messages consecutively. Since the concept of certificateless signcryption (CL-SC) scheme was put forth by Barbosa and Farshim in 2008, many schemes have been proposed where most of them are provable in the random oracle model (ROM) and only a few number of them are provable in the standard model. Very recently, Luo and Wan (Wireless Personal Communication, 2018) proposed a very efficient CL-SC scheme in the standard model. Furthermore, they claimed that their scheme is not only more efficient than the previously proposed schemes in the standard model, but also it is the only scheme which benefits from known session-specific temporary information security (KSSTIS). Therefore, this scheme would indeed be very practical. The contributions of this paper are 2-fold. First, in contrast to the claim made by Luo and Wan, we show that unfortunately Luo and Wan made a significant error in the construction of their proposed scheme. While their main intention is indeed interesting and useful, the failure of their construction has indeed left a gap in the research literature. Hence, the second contribution of this paper is to fill this gap by proposing a CL-SC scheme with KSSTIS, which is provably secure in the standard model.

In a designated verifier signature (DVS) scheme, the validity of the signature can only be checked by a designated entity chosen by the signer. Furthermore, the designated entity cannot convince a third party that the signature is generated by the signer. A multi‐designated verifiers signature (MDVS) scheme is an extension of a DVS which includes multiple designated verifiers. To the best of the authors’ knowledge, there are two existing patterns for an MDVS scheme. In the first pattern, every verifier of the set of designated verifiers can check the validity of the signature independently. In the second pattern, the cooperation of all designated verifiers is required for checking the validity of the signature. In this study, the authors propose a generic new pattern for an MDVS scheme in which a threshold number of the set of designated verifiers can check the validity of the signature. They also present a concrete MDVS scheme with threshold verifiability in the standard model. Moreover, they compare their scheme with other existing MDVS schemes. Finally, they briefly explain scenarios in which the proposed pattern can be applicable.

We introduce the first deniable attribute-based key exchange (DABKE) framework that is resilient to impersonation attacks. We define the formal security models for DABKE framework, and propose a generic compiler that converts any attribute-based key exchanges into deniable ones. We prove that it can achieve session key security and user privacy in the standard model, and strong deniability in the simulation-based paradigm. In particular, the proposed generic compiler ensures: 1) a dishonest user cannot impersonate other user’s session participation in conversations since implicit authentication is used among authorized users; 2) an authorized user can plausibly deny his/her participation after secure conversations with others; 3) the strongest form of deniability is achieved using one-round communication between two authorized users.

Data integrity, a core security issue in reliable cloud storage, has received much attention. Data auditing protocols enable a verifier to efficiently check the integrity of the outsourced data without downloading the data. A key research challenge associated with existing designs of data auditing protocols is the complexity in key management. In this paper, we seek to address the complex key management challenge in cloud data integrity checking by introducing fuzzy identity-based auditing, the first in such an approach, to the best of our knowledge. More specifically, we present the primitive of fuzzy identity-based data auditing, where a user's identity can be viewed as a set of descriptive attributes. We formalize the system model and the security model for this new primitive. We then present a concrete construction of fuzzy identity-based auditing protocol by utilizing biometrics as the fuzzy identity. The new protocol offers the property of error-tolerance, namely, it binds with private key to one identity which can be used to verify the correctness of a response generated with another identity, if and only if both identities are sufficiently close. We prove the security of our protocol based on the computational Diffie-Hellman assumption and the discrete logarithm assumption in the selective-ID security model. Finally, we develop a prototype implementation of the protocol which demonstrates the practicality of the proposal.

With the increasing threat of cyber attacks, machine learning techniques have been researched extensively in the area of network intrusion detection. Such techniques can potentially provide a means for the real-time automated detection of attacks and abnormal traffic patterns. However, misclassification is a common problem in machine learning techniques for intrusion detection, and a lack of insight into why such misclassification occurs impedes the improvement of machine learning models. This paper presents an approach to visualizing network intrusion detection data in 3D. The purpose of this is to facilitate the understanding of network intrusion detection datasets using a visual representation to reflect the geometric relationship between various categories of network traffic. This can potentially provide useful insight to aid the design of machine learning techniques. This paper demonstrates the usefulness of the proposed 3D visualization approach by presenting results of experiments on commonly used network intrusion detection datasets.

In practice, adversaries may be able to acquire a part of private state of cryptographic system via side-channel attacks, on account of unexpected physical defects of cryptosystem, which is a serious threat to traditional cryptosystem that does not consider physical issues. Leakage-resilient cryptography was proposed to prevent adversaries from doing so. Unfortunately, there are few literatures in leakage-resilient signature. In this paper, we extend the framework of Dual-Form Signatures (DFSs) proposed by Gerbush et al. to the leakage setting, which provides a new path towards obtaining proofs under weaker assumptions. Applying this framework, we present a DFS scheme based on static assumptions with leakage bound (n−1−2c)logp2 where n is a positive integer greater than or equal to 2 and c is a fixed positive constant, which can be easily extended to the continual leakage model as well. Combining this result and the framework proposed by Huang et al., we can obtain identity-based signature schemes and certificateless signature schemes sharing the same leakage bound (n−1−2c)logp2⁠.

We present a new type of public-key encryption called Criteria-based Encryption (or CE, for short). Different from Attribute-based Encryption, in CE, we consider the access policies as criteria carrying different weights. A user must hold some cases (or answers) satisfying the criteria and have sufficient weights in order to successfully decrypt a message. We then propose two CE Schemes under different settings: the first scheme requires a user to have at least one case for a criterion specified by the encryptor in the access structure, while the second scheme requires a user to have all the cases for each criterion. We prove that both schemes are secure under the Decisional q-Bilinear Diffie Hellman Exponent assumption without random oracles. In addition, we also present two special CE schemes for the above two settings without considering the weight requirement. We show that under this special case CE schemes can be constructed much more efficiently.

Group data sharing in cloud environments has become a hot topic in recent decades. With the popularity of cloud computing, how to achieve secure and efficient data sharing in cloud environments is an urgent problem to be solved. In addition, how to achieve both anonymity and traceability is also a challenge in the cloud for data sharing. This paper focuses on enabling data sharing and storage for the same group in the cloud with high security and efficiency in an anonymous manner. By leveraging the key agreement and the group signature, a novel traceable group data sharing scheme is proposed to support anonymous multiple users in public clouds. On the one hand, group members can communicate anonymously with respect to the group signature, and the real identities of members can be traced if necessary. On the other hand, a common conference key is derived based on the key agreement to enable group members to share and store their data securely. Note that a symmetric balanced incomplete block design is utilized for key generation, which substantially reduces the burden on members to derive a common conference key. Both theoretical and experimental analyses demonstrate that the proposed scheme is secure and efficient for group data sharing in cloud computing.

The industrial Internet of Things is flourishing, which is unprecedentedly driven by the rapid development of wireless sensor networks (WSNs) with the assistance of cloud computing. The new wave of technology will give rise to new risks to cyber security, particularly the data confidentiality in cloud-assisted WSNs (CWSNs). Searchable public-key encryption (SPE) is a promising method to address this problem. In theory, it allows sensors to upload public-key ciphertexts to the cloud, and the owner of these sensors can securely delegate a keyword search to the cloud and retrieve the intended data while maintaining data confidentiality. However, all existing and semantically secure SPE schemes have expensive costs in terms of generating ciphertexts and searching keywords. Hence, this paper proposes a lightweight SPE (LSPE) scheme with semantic security for CWSNs. LSPE reduces a large number of the computation-intensive operations that are adopted in previous works; thus, LSPE has search performance close to that of some practical searchable symmetric encryption schemes. In addition, LSPE saves considerable time and energy costs of sensors for generating ciphertexts. Finally, we experimentally test LSPE and compare the results with some previous works to quantitatively demonstrate the above advantages.

We introduce an efficient Key-Policy Attribute-Based Encryption (KP-ABE) scheme in prime order groups. Our scheme is semi-adaptively secure under the decisional linear assumption and supports a large universe of attributes and multi-use of attributes. Those properties are critical for real applications of KP-ABE schemes since they enable an efficient and flexible access control. Prior to our work, existing KP-ABE schemes with short ciphertexts were in composite order groups or utilized either Dual Pairing Vector Spaces (DPVS) or Dual System Groups (DSG) in prime order groups. However, those techniques brought an efficiency loss. In this work, we utilize a nested dual system encryption which is a variant of Waters' dual system encryption (Crypto' 09) to achieve semi-adaptively secure KP-ABE. As a result, we obtain a new scheme having better efficiency compared to existing schemes while it keeps a semi-adaptive security under the standard assumption. We implement our scheme and compare its efficiency with the previous best work.

Fuzzy extractor provides key generation from biometrics and other noisy data. The generated key is seamlessly usable for any cryptographic applications because its information entropy is sufficient for security. Biometric authentication offers natural and passwordless user authentication in various systems where fuzzy extractors can be used for biometric information security. Typically, a biometric system operates in two modes: verification and identification. However, existing fuzzy extractors does not support efficient user identification. In this paper, we propose a succinct fuzzy extractor scheme which enables efficient biometric identification as well as verification that it satisfies the security requirements. We show that the proposed scheme can be easily used in both verification and identification modes. To the best of our knowledge, we propose the first fuzzy extractor based biometric identification protocol. The proposed protocol is able to identify a user with constant computational cost rather than linear-time computation required by other fuzzy extractor schemes. We also provide security analysis of proposed schemes to show their security levels. The implementation shows that the performance of proposed identification protocol is constant and it is close to that of verification protocols.

Vehicular Ad Hoc Network (VANET) allows vehicles to exchange information about road and traffic conditions through wireless communications. Nevertheless, providing reliable and authenticated information without violating the user's privacy seems contradictory. In this paper, we propose an Anonymous Announcement System especially designed for Electric Vehicle (EV) in VANETs to achieve the aforementioned contradictory goals. We demonstrated the feasibility of the protocol with a prototype implementation on a suitable device and a network simulation with our protocol added on top of a normal VANET.

Lightweight devices such as smart cards and RFID tags have a very limited hardware resource, which could be too weak to cope with asymmetric-key cryptography. It would be desirable if the cryptographic algorithm could be optimized in order to better use hardware resources. In this paper, we demonstrate how identity-based encryption algorithms from bilinear pairing can be optimized so that hardware resources can be saved. We notice that the identity-based encryption algorithms from bilinear pairing in the literature must perform both elliptic curve group operations and multiplicative group operations, which consume a lot of hardware resources. We manage to eliminate the need of multiplicative group operations for encryption. This is a significant discovery since the hardware structure can be simplified for implementing pairing-based cryptography. Our experimental results show that our encryption algorithm saves up to 47 percent memory (27,239 RAM bits) in FPGA implementation.

When competing in eBay bidding, online games, or e-exams in embedded computing environments, people naturally face asynchronous starts from different computing devices, which is treated as a security risk of online contests. The security risks of online contests also include eavesdropping during data transmission without intended rights, and false starts by malicious competitors, which also means asynchrony in contests. Accordingly, online contests need security guarantees, especially on synchronization. In this article, for synchronic and secure starts in a contest, we update security requirements of confidentiality, anonymity, and synchrony, comparing the current work to our previous work. Based on the updated requirements, we propose a general framework for the Advanced Secure Synchronized Reading (ASSR) system, which can hold multiple contests simultaneously in the cloud. It is important to note that the system can ignore the impacts of heterogeneity among competitors. Considering the heterogeneity both on transmission and computing, we construct a novel Randomness-reused Identity Based Key Encapsulation Mechanism (RIBKEM) to support separable decapsulation, which can shorten both decryption delay and transmission delay with the best efforts. Finally, ASSR enhances synchronization achievement for contest starts with heterogeneous delays of competitors while satisfying other security requirements. As a complement, the analysis on the provable security of ASSR is given, as well as a further analysis on the achievement of synchronization.

Cross-client data deduplication has been widely used to eliminate redundant storage overhead in cloud storage system. Recently, Abadi et al. introduced the primitive of MLE2 with nice security properties for secure and efficient data deduplication. However, besides the computationally expensive noninteractive zero-knowledge proofs, their fully randomized scheme (R-MLE2) requires the inefficient equality-testing algorithm to identify all duplicate ciphertexts. Thus, an interesting challenging problem is how to reduce the overhead of R-MLE2 and propose an efficient construction for R-MLE2. In this paper, we introduce a new primitive called μR-MLE2, which gives a partial positive answer for this challenging problem. We propose two schemes: static scheme and dynamic scheme, where the latter one allows tree adjustment by increasing some computation cost. Our main trick is to use the interactive protocol based on static or dynamic decision trees. The advantage gained from it is, by interacting with clients, the server will reduce the time complexity of deduplication equality test from linear time to efficient logarithmic time over the whole data items in the database. The security analysis and the performance evaluation show that our schemes are Path-PRV-CDA2 secure and achieve several orders of magnitude higher performance for data equality test than R-MLE2 scheme when the number of data items is relatively large.

With the rapid development of cloud computing, cloud storage has been accepted by an increasing number of organizations and individuals, therein serving as a convenient and on-demand outsourcing application. However, upon losing local control of data, it becomes an urgent need for users to verify whether cloud service providers have stored their data securely. Hence, many researchers have devoted themselves to the design of auditing protocols directed at outsourced data. In this paper, we propose an efficient public auditing protocol with global and sampling blockless verification as well as batch auditing, where data dynamics are substantially more efficiently supported than is the case with the state of the art. Note that, the novel dynamic structure in our protocol consists of a doubly linked info table and a location array. Moreover, with such a structure, computational and communication overheads can be reduced substantially. Security analysis indicates that our protocol can achieve the desired properties. Moreover, numerical analysis and real-world experimental results demonstrate that the proposed protocol achieves a given efficiency in practice.

It is widely acknowledged that the collaborations with more users increase productivity. Secure cloud storage is a promising tool to enhance such a collaboration. Access control system can be enabled with attribute-based encryption. In this system, a user encrypts and uploads his/her data to the cloud with an access policy, such that only people who satisfy that access policy can decrypt the data. When a recipient would like to enable another person who is originally unauthorized by the original access policy, this recipient will need to extend the access policy by adding a new policy that includes the new person hence, the notion of extendable access control system. Admitting new users to access the uploaded data is an important requirement in enhancing collaborations. The main issue is with regards to the integrity protection during the process of extending the access policy. When a new access policy is added, the cloud has to be sure that the extended access policy remains guarding the same encrypted data as the original access policy, even though the cloud cannot decrypt this ciphertext, which is a challenging problem to solve. In this paper, we answer the above problem affirmatively by introducing an extendable access control system with Integrity Protection (EACSIP), which is suitable to enhance collaboration in the cloud. The construction of EACSIP is built on top of a novel cryptographic primitive, namely functional key encapsulation with equality testing. The security proof and the performance evaluation of EACSIP are provided in this paper.

Provable data possession (PDP) allows a user to outsource data with a guarantee that the integrity can be efficiently verified. Existing publicly verifiable PDP schemes require the user to perform expensive computations, such as modular exponentiations for processing data before outsourcing to the storage server, which is not desirable for weak users with limited computation resources. In this paper, we introduce and formalize an online/offline PDP (OOPDP) model, which divides the data processing procedure into offline and online phases. In OOPDP, most of the expensive computations for processing data are performed in the offline phase, and the online phase requires only lightweight computations like modular multiplications. We present a general OOPDP transformation framework which is applicable to PDP-related schemes with metadata aggregatability and public metadata expansibility. Following the framework, we present two efficient OOPDP instantiations. Technically, we present aggregatable vector Chemeleon hash functions which map a vector of values to a group element and play a central role in the OOPDP transformation. Theoretical and experimental analyses confirm that our technique is practical to speed-up PDP schemes.

Remote data integrity checking (RDIC) enables a data storage server, say a cloud server, to prove to a verifier that it is actually storing a data owner's data honestly. To date, a number of RDIC protocols have been proposed in the literature, but most of the constructions suffer from the issue of a complex key management, that is, they rely on the expensive public key infrastructure (PKI), which might hinder the deployment of RDIC in practice. In this paper, we propose a new construction of identity-based (ID-based) RDIC protocol by making use of key-homomorphic cryptographic primitive to reduce the system complexity and the cost for establishing and managing the public key authentication framework in PKI-based RDIC schemes. We formalize ID-based RDIC and its security model, including security against a malicious cloud server and zero knowledge privacy against a third party verifier. The proposed ID-based RDIC protocol leaks no information of the stored data to the verifier during the RDIC process. The new construction is proven secure against the malicious server in the generic group model and achieves zero knowledge privacy against a verifier. Extensive security analysis and implementation results demonstrate that the proposed protocol is provably secure and practical in the real-world applications.

In this paper, we present the notion of recipient-revocable identity-based broadcast encryption scheme. In this notion, a content provider will produce encrypted content and send them to a third party (which is a broadcaster). This third party will be able to revoke some identities from the ciphertext. We present a security model to capture these requirements, as well as a concrete construction. The ciphertext consists of k+3 group elements, assuming that the maximum number of revocation identities is k. That is, the ciphertext size is linear in the maximal size of R, where R is the revocation identity set. However, we say that the additional elements compared to that from an IBBE scheme are only for the revocation but not for decryption. Therefore, the ciphertext sent to the users for decryption will be of constant size (i.e.,3 group elements). Finally, we present the proof of security of our construction.

Proxy Re-Encryption (PRE) is a favorable primitive to realize a cryptographic cloud with secure and flexible data sharing mechanism. A number of PRE schemes with versatile capabilities have been proposed for different applications. The secure data sharing can be internally achieved in each PRE scheme. But no previous work can guarantee the secure data sharing among different PRE schemes in a general manner. Moreover, it is challenging to solve this problem due to huge differences among the existing PRE schemes in their algebraic systems and public-key types. To solve this problem more generally, this paper uniforms the definitions of the existing PRE and Public Key Encryption (PKE) schemes, and further uniforms their security definitions. Then taking any uniformly defined PRE scheme and any uniformly defined PKE scheme as two building blocks, this paper constructs a Generally Hybrid Proxy Re-Encryption (GHPRE) scheme with the idea of temporary public and private keys to achieve secure data sharing between these two underlying schemes. Since PKE is a more general definition than PRE, the proposed GHPRE scheme also is workable between any two PRE schemes. Moreover, the proposed GHPRE scheme can be transparently deployed even if the underlying PRE schemes are implementing.

Malicious web domains represent a big threat to web users' privacy and security. With so much freely available data on the Internet about web domains' popularity and performance, this study investigated the performance of well-known machine learning techniques used in conjunction with this type of online data to identify malicious web domains. Two datasets consisting of malware and phishing domains were collected to build and evaluate the machine learning classifiers. Five single classifiers and four ensemble classifiers were applied to distinguish malicious domains from benign ones. In addition, a binary particle swarm optimisation (BPSO) based feature selection method was used to improve the performance of single classifiers. Experimental results show that, based on the web domains' popularity and performance data features, the examined machine learning techniques can accurately identify malicious domains in different ways. Furthermore, the BPSO-based feature selection procedure is shown to be an effective way to improve the performance of classifiers.

A conditional proxy re-encryption (CPRE) scheme enables the proxy to convert a ciphertext from Alice to Bob, if the ciphertext satisfies one condition set by Alice. To improve the issue of more fine-grained on the condition set, Fang, Wang, Ge and Ren proposed a new primitive named Interactive conditional PRE with fine grain policy (ICPRE-FG) in 2011, and left an open problem on how to construct CCA-secure ICPRE-FG without random oracles. In this paper, we answer this open problem affirmatively by presenting a new construction of CCA-secure key-policy attribute-based PRE (KP-ABPRE) without random oracles. In this paper, we enhance the security model of Fang's ICPRE-FG scheme by allowing the adversary to make some extra queries, which do not help them win the game trivially. Finally, we present a CCA-secure KP-ABPRE without random oracles under the 3-weak decisional bilinear Diffie–Hellman inversion(3-wDBDHI) assumption.

In this paper, we propose a privacy-preserving reservation system for electric vehicles (EV) charging stations. Due to the short driving range of EV, frequent charging is necessary. A mechanism for charging station reservation for EV owners is desirable. Our proposed system allows the vehicle owner to reserve a number of charging stations along the intended route at different time-slots. Yet it is secure against misuse such that a user can only hold a limited number of reservations simultaneously. More importantly, our system can provide privacy for users. The charging station does not know the identity of the user who has reserved it. Thus location privacy can be protected. We demonstrate the practicality of our system with a prototype implementation on a smart phone. Finally, we also provide a security proof to show that our system is secure under well-known computational assumptions.

In this paper, we point out some faulty instantiations of threshold ring signatures (TRS) based on the threshold proof-of-knowledge (TPoK) protocol. Although a TRS can be regarded as the non-interactive version of the TPoK, the computational domains of the variables should be carefully chosen. We show that by choosing some inappropriate domains, two such instantiations suffer from forgery and anonymity attacks. Our attacks rely on algebraic techniques which involve solving some particular instances of the well-known subset sum problem. While we focus our attacks on two particular instantiations of the TRS, they are generic and are applicable to other schemes with the same choice of domains or a similar structure. We believe this paper can act as an important security remark on the design of future TRS schemes.

Ring signatures enable a user to anonymously sign a message on behalf of group of users. In this study, the authors propose the first ring signature scheme whose size is O (log 2 N ), where N is the number of users in the ring. They achieve this result by improving Chandran et al .’s ring signature scheme presented at the International Colloquium on Automata, Languages and Programming 2007. Their scheme uses a common reference string and non‐interactive zero‐knowledge proofs. The security of their scheme is proven without requiring random oracles.

Abstract Mobile e‐Health Network (MHN) is an emerging cloud‐aided networking application across the entire range of functions involved in e‐Health systems. It is important to establish secure channels between users because the data transmitted in MHNs are private, for example, personal electronic healthcare records. It is of great significance to employ key management mechanism and encrypt the data before transmitting in MHNs. However, secure key management is challenging in MHNs because of its highly dynamic and large‐scale nature. In this paper, we first model MHNs and formalize a hierarchical network architecture mirroring the administrative hierarchy and dynamic autonomy in MHNs in the real world. We next present a virtual MHN architecture with only three levels yet suitable to realistic MHNs with arbitrary hierarchical levels. By exploiting the virtual architecture, we propose an efficient authenticated key exchange framework to secure MHNs. We realize a scalable authenticated key exchange scheme with a dedicated variant of a recent hierarchical identity‐based signature and the well‐known Diffie–Hellman key exchange protocol. Theoretical analyses and experimental results show that scalable authenticated key exchange is secure and scalable and hence is practical to secure MHNs. Copyright © 2015 John Wiley & Sons, Ltd.

Abstract Attribute‐based keyword search (ABKS) was proposed to enable a third party to search encrypted keywords without compromising the security of the original data. Because it can express flexible access policy, ABKS has attracted a lot of attention. Existing ABKS schemes mainly focused on the expression of access structures, while the computation cost and communication cost are linear with the number of required attributes. Therefore, existing ABKS schemes are unsuitable to the devices that have constrained space and computing power, such as smart phone and tablet. In this paper, an ABKS with constant‐size ciphertext scheme is proposed. The proposed scheme captures the following nice features: (1) The index encryption algorithm has constant computation cost; (2) the searchable ciphertexts are constant size; (3) the trapdoors for keywords are constant size; and (4) the test algorithm has constant computation cost. To the best of our knowledge, it is the first time that an ABKS with constant‐size ciphertext scheme is proposed. Copyright © 2016 John Wiley & Sons, Ltd.

In this paper, we propose a two-factor data security protection mechanism with factor revocability for cloud storage system. Our system allows a sender to send an encrypted message to a receiver through a cloud storage server. The sender only needs to know the identity of the receiver but no other information (such as its public key or its certificate). The receiver needs to possess two things in order to decrypt the ciphertext. The first thing is his/her secret key stored in the computer. The second thing is a unique personal security device which connects to the computer. It is impossible to decrypt the ciphertext without either piece. More importantly, once the security device is stolen or lost, this device is revoked. It cannot be used to decrypt any ciphertext. This can be done by the cloud server which will immediately execute some algorithms to change the existing ciphertext to be un-decryptable by this device. This process is completely transparent to the sender. Furthermore, the cloud server cannot decrypt any ciphertext at any time. The security and efficiency analysis show that our system is not only secure but also practical.

We introduce a new encryption notion called distance-based encryption (DBE) to apply biometrics in identity-based encryption. In this notion, a ciphertext encrypted with a vector and a threshold value can be decrypted with a private key of another vector, if and only if the distance between these two vectors is less than or equal to the threshold value. The adopted distance measurement is called Mahalanobis distance, which is a generalization of Euclidean distance. This novel distance is a useful recognition approach in the pattern recognition and image processing community. The primary application of this new encryption notion is to incorporate biometric identities, such as face, as the public identity in an identity-based encryption. In such an application, usually the input biometric identity associated with a private key will not be exactly the same as the input biometric identity in the encryption phase, even though they are from the same user. The introduced DBE addresses this problem well as the decryption condition does not require identities to be identical but having small distance. The closest encryption notion to DBE is the fuzzy identity-based encryption, but it measures biometric identities using a different distance called an overlap distance (a variant of Hamming distance) that is not widely accepted by the pattern recognition community, due to its long binary representations. In this paper, we study this new encryption notion and its constructions. We show how to generically and efficiently construct such a DBE from an inner product encryption (IPE) with reasonable size of private keys and ciphertexts. We also propose a new IPE scheme with the shortest private key to build DBE, namely, the need for a short private key. Finally, we study the encryption efficiency of DBE by splitting our IPE encryption algorithm into offline and online algorithms.

We propose two new ciphertext policy attribute-based encryption (CP-ABE) schemes where the access policy is defined by AND-gate with wildcard. In the first scheme, we present a new technique that uses only one group element to represent an attribute, while the existing ABE schemes of the same type need to use three different group elements to represent an attribute for the three possible values (namely, positive, negative, and wildcard). Our new technique leads to a new CP-ABE scheme with constant ciphertext size, which, however, cannot hide the access policy used for encryption. The main contribution of this paper is to propose a new CP-ABE scheme with the property of hidden access policy by extending the technique we used in the construction of our first scheme. In particular, we show a way to bridge ABE based on AND-gate with wildcard with inner product encryption and then use the latter to achieve the goal of hidden access policy. We prove that our second scheme is secure under the standard decisional linear and decisional bilinear Diffie-Hellman assumptions.

Recently, a practical public integrity auditing scheme supporting multiuser data modification (IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, DOI 10.1109/TIFS.2015.2423264) was proposed. Although the protocol was claimed secure, in this paper, we show that the proposal fails to achievesoundness, the most essential property that an auditing scheme should provide. Specifically, we show that a cloud server can collude with a revoked user to deceive a third-party auditor (TPA) that a stored file keeps virgin even when the entire file has been deleted.

With the increasing development of pervasive computing and wireless bandwidth communication, more mobile devices are used to access sensitive data stored in remote servers. In such applications, a practical issue emerges such as how to exploit the sufficient resource of a server so that the file owners can enforce fine-grained access control over the remotely stored files, while enable resource-limited mobile devices to easily access the protected data, especially if the storage server maintained by a third party is untrusted. This challenge mainly arises from the asymmetric capacity among the participants, i.e., the capacity limited mobile devices and the resource abundant server (and file owners equipped with fixed computers). To meet the security requirements in mobile access to sensitive data, we propose a new encryption paradigm, referred to as asymmetric cross-cryptosystem re-encryption (ACCRE) by leveraging the asymmetric capacity of the participants. In ACCRE, relatively light-weight identity-based encryption (IBE) is deployed in mobile devices, while resource-consuming but versatile identity-based broadcast encryption (IBBE) is deployed in servers and fixed computers of the file owners. The core of ACCRE is a novel ciphertext conversion mechanism that allows an authorized proxy to convert a complicated IBBE ciphertext into a simple IBE ciphertext affordable to mobile devices, without leaking any sensitive information to the proxy. Following this paradigm, we propose an efficient ACCRE scheme with its security formally reduced to the security of the underlying IBE and IBBE schemes. Thorough theoretical analyses and extensive experiments confirm that the scheme takes very small cost for mobile devices to access encrypted data and is practical to secure mobile computing applications.

Yoking-proofs show an interesting application in Radio Frequency Identification (RFID) that a verifier can check whether two tags are simultaneously scanned by a reader. We consider a scenario that multi-group of tags can be proved to be scanned simultaneously. Grouping-proof, which is an extension of yoking-proofs, allows multiple tags to be proved together, while existing protocols cannot support multiple groups. In this paper, we introduce a novel concept called "yoking-group proofs". Additionally, we propose an anonymous yoking-proof protocol and an anonymous yoking-group proof protocol and prove their security in Universal Composability framework.

Electric Vehicle (EV) infrastructure is relatively new in many countries. Due to the recency of an EV infrastructure, it is important to carry out a series of testing programs. Furthermore, authenticity for collection of data is necessary for testing programs in order to provide accurate results. At the same time, user privacy should not cease since tracing one's daily logistic movements or behaviour from the EV testing programs means breaching one's privacy. In this paper, we propose a novel solution PEVTS for enabling both data authenticity and user privacy concurrently. Our proposed system provides great flexibility to the authority to choose any arbitrary set of authenticated users for testing in every time period. At the same time, it provides anonymity for all participating users. Yet it can trace any vehicle within a time period for statistical purpose. We give a detailed description of our system. We also implement the prototype of our system to show its practicality.

The notions of identity-based multi-proxy signature, proxy multi-signature and multi-proxy multi-signature have been proposed to facilitate public key certificate management of these kinds of signatures by merely employing signer's identities in place of the public keys and their certificates. In the literature, most identity-based multi-proxy signature, proxy multi-signature and multi-proxy multi-signature schemes are based on bilinear pairings. Without incorporating bilinear pairings, Tiwari and Padhye proposed an identity-based proxy multi-signature scheme in 2011. Subsequently, an identity-based multi-proxy multi-signature scheme was proposed by Tiwari et al. in 2012. First, we review identity-based (multi)-proxy multi-signature schemes without bilinear pairings and show that unfortunately, they are insecure in their security models. Secondly, we propose an identity-based multi-proxy multi-signature scheme without bilinear pairings, where identity-based multi-proxy signature and proxy multi-signature schemes are its special cases. Then, we prove that they are secure under Rivest, Shamir and Adleman (RSA) assumption in the random oracle model by presenting a new Forking Lemma. The proposal and its special cases are the first identity-based multi-proxy signature, proxy multi-signature and multi-proxy multi-signature from RSA assumption.

A proxy re-encryption (PRE) allows a data owner to delegate the decryption rights of some encrypted data stored on the cloud without revealing the data to an honest-but-curious cloud service provider (i.e. the PRE proxy). Furthermore, the data owner can offload most of the computational operations to the cloud service provider and hence, using PRE for encrypted cloud data sharing can be very effective even for data owners using limited resource devices (e.g. mobile devices). However, PRE schemes only enables data owners to delegate the decryption rights of all their encrypted data. A more practical notion is a conditional PRE (CPRE) that allows us to specify under what condition the decryption of an encrypted data can be delegated, for example, only sharing all the encrypted files under a directory called ‘public’. In this paper, we provide an affirmative result on the long-standing question of building a full chosen-ciphertext attacks (CCA)-secure CPRE system in the standard model and for the first time, we show that a class of Hierarchical Identity-Based Encryption (HIBE) schemes can be transferred to building a CCA-secure CPRE in the standard model. We also list out some concrete HIBE schemes which fall into this class, e.g., Lewko-Waters HIBE. All existing CCA-secure PRE schemes in the standard model are not conditional while all existing CPRE schemes are either not CCA secure or not in the standard model. By instantiating our generic HIBE-based transformation, we show that an efficient and concrete CPRE scheme which is both CCA secure in the standard model and conditional can be built.

The problem to allow two parties (say Alice and Bob) to sign an electronic contract online fairly is an interesting problem and it has been studied for a long time. Optimistic fair exchange (OFE) is an efficient remedy to this problem, which incorporates a semi-trusted third party called arbitrator, who will be called in to resolve a dispute during an exchange between Alice and Bob. It should be noted that the arbitrator is not required to be fully trusted, or else such an entity may not be available in practice. To reduce the trust level of the arbitrator, the requirement that the arbitrator should not be able to produce a full signature without the signer's content has been proposed in literature. Nevertheless, we observe that the existing OFE models do not capture the realistic situation that the arbitrator itself should not be able to generate a partial signature on a new message. This requirement is essential since we only put a partial trust towards the arbitrator, but on the other hand, we also assume that the arbitrator will not do such a forgery. Therefore, to reflect this situation, we propose an enhanced model of OFE that explicitly captures this requirement. We demonstrate the difference between our enhanced model and the existing chosen-key model through a concrete OFE scheme that serves as a counterexample. Since our model is strictly stronger than the existing model, we investigate the security of the existing schemes in our enhanced model. Interestingly, we show that OFE schemes based on verifiably encrypted signature and those based on ring signature can remain secure in our enhanced model given slight modifications to the primitives.

Delegation of signing is a working way common in office automation work, and is also an important approach to establish trust. Proxy signature is an important cryptographic primitive for delegating signing powers and it has found many real-world applications. The existing proxy signature schemes from factorization assumption are either insecure or inefficient. In this paper, we propose a novel, efficient and provably secure proxy signature scheme from factorization. Our construction makes use of a factorization-based key exposure-free chameleon hash function in the delegation phase and the proxy signer needs only to find a collision to a chameleon hash value to generate a valid proxy signature. As a result, our scheme is highly efficient in terms of the computation of a proxy signature. We also provide a formal security proof by classifying the adversaries into three categories. Comparisons demonstrate that the new scheme outperforms the known ones in terms of security, computational efficiency and the length of the public key.

SUMMARY Ciphertext‐policy attribute‐based proxy re‐encryption (CP‐ABPRE) extends the traditional Proxy Re‐Encryption (PRE) by allowing a semi‐trusted proxy to transform a ciphertext under an access policy to another ciphertext with the same plaintext under a new access policy (i.e., attribute‐based re‐encryption). The proxy, however, learns nothing about the underlying plaintext. CP‐ABPRE has many real world applications, such as fine‐grained access control in cloud storage systems and medical records sharing among different hospitals. All the existing CP‐ABPRE schemes are leaving chosen‐ciphertext attack (CCA) security as an interesting open problem. This paper, for the first time, proposes a new CP‐ABPRE scheme to tackle the problem. The new scheme supports attribute‐based re‐encryption with any monotonic access structures. Despite being constructed in the random oracle model, our scheme can be proven CCA secure under the decisional q‐parallel bilinear Diffie–Hellman exponent assumption. Copyright © 2014 John Wiley & Sons, Ltd.

Abstract Proxy ring (anonymous proxy) signatures allow an entity to delegate its signing capability to a group of entities (proxy group) such that only one of the members in the proxy group can generate a proxy signature on behalf of the delegator, while privacy of the proxy signer is protected. Identity‐based versions of proxy ring signatures employ identity strings in place of randomly generated public keys. Our contribution is twofold. First, we formalize a security model foridentity‐basedproxy ring signatures. We note that there exists no formal security model foridentity‐basedproxy ring signatures prior to our work. Second, we presentthe firstprovably secureidentity‐basedproxy ring signature scheme using a new paradigm called sequential aggregation. The construction is proved secure, under the one‐wayness assumption of RSA, in the random oracle model by presenting a new forking lemma. We should highlight that the proxy key exposure attack cannot be applied to our scheme. Further, in contrast to the existing schemes that are based on pairings, our scheme is based on RSA; therefore, it outperforms the existing schemes in terms of efficiency and practicality. Copyright © 2014 John Wiley & Sons, Ltd.