Federated learning is a distributed machine learning framework that allows multiple parties to collaboratively train a shared model without the need to share their original data with a central server. This approach minimizes the risk of data leakage and effectively addresses the challenge of isolated data silos. However, it necessitates multiple rounds of interactions to transmit models or gradients between the client and the server, leading to a significant communication cost and private data leakage. Consequently, some schemes compress the transmitted models or gradients through model pruning or knowledge distillation. However, they often overlook the privacy implications of compressed gradients or models, potentially resulting in privacy breaches. Additionally, they are susceptible to client disconnections, resulting in incomplete or delayed model updates. To address these challenges, this paper proposes Octopus, a robust and privacy-preserving scheme for compressed gradients in federated learning. Octopus employs Sketch to compress gradients and embeds masks for the compressed gradients, thereby safeguarding the gradients while concurrently reducing communication overhead. Moreover, we propose an anti-disconnection strategy to support model updates even in situations where some clients are disconnected. Lastly, we carry out comprehensive security and convergence analyses, along with extensive performance evaluations, demonstrating Octopus's robustness, stability, and efficiency over existing schemes.

Blockchain-enabled digital currency systems, referred to as blockchains for brevity, have become an important method for asset management. Additionally, numerous efforts have been made to facilitate asset swap between two different blockchains, further enhancing asset circulation. However, few works address the general scenario in which one trader swaps assets from$n_{1}$different blockchains with another trader using assets from$n_{2}$different blockchains, referred to as$n_{1} \sim n_{2}$swap. This paper proposes OSwap, the first$n_{1} \sim n_{2}$swap scheme that ensures atomicity without relying on synchronous blockchain communication. By leveraging third-party steps fromverifiable witness encryption based on threshold signatures(VweTS), OSwap allows privacy-conscious traders to swap assets independently, without interactive third-party involvement. It also integratesverifiable timed discrete logarithmschemes to support asset redemption under abnormal cases, maintaining atomicity and indistinguishability. We formally prove the security of OSwap under the universal composable framework with static corruption. We compare OSwap with the closest existing scheme for successful$n_{1} \sim n_{2}$swap, where the trader holding assets on$n_{1}$blockchains pays the counterparty holding assets on$n_{2}$blockchains first. The comparison demonstrates that OSwap reduces the number of required transactions from$2n_{1} + 2n_{2}$to$n_{1} + 2n_{2}$, while also supporting a broader range of signature types. Moreover, when fewer than 4 third parties are involved and both$n_{2}$and the threshold value in VweTS are set to 1, OSwap achieves lower running time cost.

While voiceprint authentication offers convenient user authentication and access control through voice feature recognition, a critical research gap remains: existing voiceprint authentication systems fail to simultaneously achieve sound security against replay, spoofing, and adversarial attacks, preserve voice privacy leakage, and satisfy usability demand. Previous efforts have struggled to balance these issues comprehensively. To bridge this gap, we present SeVoAuth, a cloud-based Voiceprint Authentication as a Service (VAaaS) system designed to provide privacy preservation, robust security, and enhanced usability. SeVoAuth stores a synthesized voiceprint of a user in the cloud during user registration, thereby safeguarding the privacy of the real voiceprint of the user. During user authentication, SeVoAuth applies a hash function to continuously transform features of the synthesized voiceprint, dynamically generating new verification targets for voiceprint feature mapping in each authentication session. This dynamic transformation approach effectively mitigates replay, spoofing, and adversarial attacks without requiring complex user interactions. We conduct a thorough analysis on the security and privacy of SeVoAuth and proceed to implement a prototype for performance evaluation through a series of user tests. Experimental results demonstrate that SeVoAuth outperforms cutting-edge approaches, achieving an average authentication accuracy of 99.47%, and an average Precise Detection Rate (PDR) of 98.35% against various attacks. SeVoAuth is evaluated as highly secure, efficient, and user-friendly across various circumstances.

Cross-chain transfer significantly enhances asset management among multiple blockchains. While existing cross-chain transfer schemes facilitate transferring asset ownership of users between a source blockchain and a target blockchain, they do not consider a complex scenario involvingmsource blockchains and one target blockchain (termedm∼1 cross-chain transfer). Furthermore, the variants of existing schemes for this scenario fail to concurrently achieve atomicity, unlinkability, and practical properties such as transaction aggregability, and non-collateralization, posing substantial limitations. To bridge this gap, we propose ShiftHub, the firstm∼1 cross-chain transfer scheme that simultaneously fulfills the above desired properties. ShiftHub guarantees atomicity and transaction aggregability by integratingexchange protocolswith a novelt-message-clustered redeem protocol. Unlinkability is achieved by additionally incorporating commonly used assumptions such as fixed-amount transfers, while the need for sender collateralization is eliminated by enabling the reuse of locked assets. Compatible with any blockchains that employadaptor signaturesorBLS signaturesfor transaction authentication, ShiftHub requires only signature verification and timelock functionalities on chain, ensuring near-universal blockchain compatibility. We formally prove the security of ShiftHub under static corruption using the universal composability framework. Extensive evaluation shows that ShiftHub offers superior performance over the existing scheme variant with the closest underlying protocols to ShiftHub, in terms of both off-chain and on-chain overhead, when completingm∼1 cross-chain transfer. Particularly, ShiftHub reduces the number of required transactions by (2m− 1)/3m.

Channel state information (CSI) is known to be crucial for both enhancing the transmission performance and ensuring physical-layer security (PLS) in wireless communication systems. To estimate a channel’s CSI, the transmitter (Tx) typically broadcasts a predetermined pilot signal, then the receiver (Rx) computes the channel coefficients based on the received pilot signal and returns the estimated CSI to the Tx. Most, if not all, of existing communication algorithms simply assume that the fed-back CSI is reliable/secure. However, in practice, a malicious terminal may send falsified CSI to the infrastructure, thus compromising the throughput and/or security of the communication over the channel. Although some researchers have already identified this vulnerability, demonstrated the feasibility of the CSI-forgery attacks, and designed countermeasures thereof, their methods either (i) are tailored to specific types of attacks, thus lacking generality, or (ii) require modifications to the pilot sequence and hence the protocol. To counter the CSI-forgery attacks and remove/mitigate the deficiencies of existing counter-measures, we first develop a comprehensive CSI-forgery model that can subsume the existing CSI-forgery attacks as special instances to facilitate the design of general countermeasures. Then, we propose a novel approach, called SecCSI, to detect potential CSI-forgery activities and identify their initiators using reconfigurable intelligent surface (RIS). SecCSI leverages the RIS to secretly and dynamically modify the wireless environment transparently to the receiver (Rx) in which the pilot signal is transmitted. The infrastructure can, therefore, detect any attempted manipulation of CSI by appropriately configuring the reflection coefficient matrix of the RIS, transmitting the pilot signal, and analyzing all CSI feedback. SecCSI can serve as a guard module for existing communication systems that simply accept the fed-back CSI without checking its trustworthiness. Our theoretical analysis, experimental and numerical evaluations have shown SecCSI to effectively detect the CSI-forgery attacks and identify the attacker.

The rapid evolution of unmanned aerial vehicles (UAVs) has positioned air-ground networks as vital infrastructures for diverse applications. However, the open channels of air-ground networks remain inherently vulnerable to persistent eavesdropping threats. While physical-layer key generation (PLKG) offers a lightweight security mechanism by leveraging channel reciprocity to extract shared secrets, the inherent mobility of UAVs introduces a paradoxical tradeoff. Increased channel randomness from dynamic flight patterns enhances security through entropy amplification but simultaneously disrupts channel reciprocity, leading to key mismatch between legitimate parties. Existing PLKG schemes struggle to maintain reliability in key generation due to static channel characteristics and synchronization overhead, limiting their practical deployment in air-ground networks. To resolve this conflict, we propose a Doppler shift key generation (DSKG) scheme that systematically regulates Doppler shifts through UAV trajectory design to derive secure keys. By formulating the problem as a Markov decision process, we develop a proximal policy optimization (PPO)-clip-based reinforcement learning algorithm to dynamically control UAV speed and steering angle, ensuring robust Doppler shift reciprocity while maximizing both key entropy and generation rate. Experimental results quantify the improvements of our scheme over benchmarks in maintaining high key unpredictability and generation efficiency. Furthermore, the analysis provides valuable insights into parameter impacts, confirming the practical viability of the DSKG scheme for securing air-ground communications.

Ambient backscatter communication (AmBC) has become an integral part of ubiquitous Internet of Things (IoT) applications due to its energy-harvesting capabilities and ultra-low- power consumption. However, the open wireless environment exposes AmBC systems to various attacks, and existing authentication methods cannot be implemented between resource-constrained backscatter devices (BDs) due to their high computational demands. To this end, this paper proposes PLCRA-BD, a novel physical layer challenge-response authentication scheme between BDs in AmBC that overcomes BDs’ limitations, supports high mobility, and performs robustly against impersonation and wireless attacks. It constructs embedded keys as physical layer fingerprints for lightweight identification and designs a joint transceiver that integrates BDs’ backscatter waveform with receiver functionality to mitigate interference from ambient RF signals by exploiting repeated patterns in orthogonal frequency division multiplexing (OFDM) symbols. Based on this, a challenge-response authentication procedure is introduced to enable low-complexity fingerprint exchange between two paired BDs leveraging channel coherence, while securing the exchange process using a random number and unpredictable channel fading. Additionally, we optimize the authentication procedure for high-mobility scenarios, completing exchanges within the channel coherence time to minimize the impact of dynamic channel fluctuations. Security analysis confirms its resistance against impersonation, eavesdropping, replay, and counterfeiting attacks. Extensive simulations validate its effectiveness in resource-constrained BDs, demonstrating high authentication accuracy across diverse channel conditions, robustness against multiple wireless attacks, and superior efficiency compared to traditional authentication schemes.

Passive eavesdropping compromises confidentiality in wireless networks, especially in resource-constrained environments where heavyweight cryptography is impractical. Physical layer security (PLS) exploits channel randomness and spatial selectivity to confine information to an intended receiver with modest overhead. However, typical PLS techniques, such as beamforming, artificial noise, and reconfigurable intelligent surfaces, often require additional active power or specialized deployment and rely on precise time synchronization and perfect CSI estimation, which limits their practicality. Meanwhile, the role of ambient backscatter devices (AmBDs) in potentially strengthening the legitimate channel while limiting eavesdroppers in generalized wireless network settings has not been fully investigated. To this end, we propose AmbShield, an AmBD-assisted PLS scheme that leverages naturally distributed AmBDs to simultaneously strengthen the legitimate channel and degrade eavesdroppers' reception without requiring extra transmit power and with minimal deployment overhead. In AmbShield, AmBDs are exploited as friendly jammers that randomly backscatter to create interference at eavesdroppers, and as passive relays that backscatter the desired signal to enhance the capacity of legitimate devices. We further develop a unified analytical framework that analyzes the exact probability density function (PDF) and cumulative distribution function (CDF) of legitimate and eavesdropper signal-to-interference-noise ratio (SINR), a closed-form secrecy outage probability (SOP), its high-SNR asymptote, and a secrecy diversity order (SDO). The analysis provides clear design guidelines on various practical system parameters to minimize SOP. Extensive experiments that include Monte Carlo simulations, theoretical derivations, and high-SNR asymptotic analysis demonstrate the security gains of AmbShield across diverse system parameters under imperfect synchronization and CSI estimation.

Blockchain oracles are essential for enabling smart contracts to access and interact with off-chain data, where its security and trustworthiness are crucial for preserving the overall reliability and integrity of blockchain-based systems. However, existing reputation-based blockchain oracles are vulnerable to Sybil and collusion attacks. To address these issues, trusted execution environments (TEEs) have been leveraged to construct blockchain oracles. While these TEE-enabled oracles provide resistance against the above attacks, they typically depend on a centralized Root of Trust (RoT), which introduces risks such as root key pre-provision risks and single points of failure. Moreover, they often struggle to maintain trust over time, making them unsuitable for application scenarios that require long-term guaranteed trust. In this paper, we propose EnduraTrust, a highly secure blockchain oracle network empowered by a decentralized Root of Trust (DRoT), which can overcome single points of failure, offer trust sustainability, minimize the security risk of root key pre-provision, and provide essential participation incentive. Concretely, it adopts Physically Unclonable Functions (PUFs) to generate device-specific root keys, eliminating the risks associated with centralized key pre-provision. To confront mobile attacks and ensure sustained trust, it employs an off-chain process to generate attestation reports, which are then verified onchain through a non-interactive protocol. This protocol ensures robust integrity verification for Individual Root of Trust (IRoT) nodes while minimizing latency and overhead. In addition, we design a fair and secure IRoT node selection algorithm to form a trustworthy oracle committee to offer oracle services, protecting against Sybil and collusion attacks to which existing oracles are prone. Particularly, we apply an incentive mechanism to encourage oracle node participation and reliable behavior. We validate EnduraTrust through formal security analysis and performance evaluation based on prototype implementation. Our results show that EnduraTrust enhances root key security, realizes decentralization, offers fair oracle node selection, ensures sustained trust, exhibits strong robustness, and provides participation incentive. It surpasses existing decentralized attestation schemes in multiple dimensions, including security, contract execution efficiency, attestation protocol performance, and scalability. Besides, its performance regarding oracle response aggregation and aggregated response verification confirming its effectiveness.

Integrated sensing and communication (ISAC) systems potentially encounter significant performance degradation in densely obstructed urban and non-line-of-sight scenarios, thus limiting their effectiveness in practical deployments. To deal with these challenges, this paper proposes a backscatter device (BD)-assisted ISAC system, which leverages passive BDs naturally distributed in underlying environments for performance enhancement. Specifically, the additional reflective signal paths provided by these ambient devices are exploited to enhance sensing accuracy and communication reliability, respectively. In this system, we define the Pareto boundary characterizing the trade-off between sensing mutual information (SMI) and communication rates to provide fundamental insights for its design. To derive the boundary, we formulate a performance optimization problem within an orthogonal frequency division multiplexing (OFDM) framework, by jointly optimizing time-frequency resource element (RE) allocation, transmit power management, and BD modulation decisions. To tackle the non-convexity of the problem, we decompose it into three subproblems, solved iteratively through a block coordinate descent (BCD) algorithm. Specifically, the RE subproblem is addressed using the successive convex approximation (SCA) method, the power subproblem is solved using an augmented Lagrangian combined water-filling method, and the BD modulation subproblem is tackled using semidefinite relaxation (SDR) methods. Additionally, we demonstrate the generality of the proposed system by showing its adaptability to bistatic ISAC scenarios and MIMO settings. Finally, extensive simulation results validate the effectiveness of the proposed system and its superior performance compared to existing state-of-the-art ISAC schemes.

Multi-view clustering (MVC) methods have garnered considerable attention within centralized data frameworks. However, real-world multi-view data are often collected and stored by different organizations, complicating the practical deployment of MVC and motivating the emergence of federated multi-view clustering (FMVC). Existing FMVC approaches typically necessitate post-processing to derive clustering labels and confront challenges in effectively exploring the complementary and consistent information across multi-view data residing in different entities. To address these limitations, we propose a novel framework termed Scalable Federated One-Step Multi-View Clustering with Tensorized Regularization (SFOMVC-TR). This framework facilitates one-step clustering at each client and employs tensor learning to capture consistent and complementary information through a centralized server. Additionally, it adopts anchor graphs to enhance clustering efficiency and scalability in high-dimensional data. By incorporating a Lp,q sparse regularization on the projection matrix, SFOMVC-TR enables the direct projection of anchors into clustering assignments to mitigate redundancy. A federated optimization framework is developed to support collaborative and privacy-preserving training under the coordination of the server. Extensive experiments on multiple datasets validate the privacy and effectiveness of our method.

Integrated sensing and communication (ISAC) has emerged as a key enabling technology for next-generation wireless networks, seamlessly combining communication and radar sensing functionalities by utilizing shared wireless resources. However, ISAC systems suffer from diminished sensing accuracy and compromised communication reliability in complex propagation environments, particularly in densely obstructed urban or non-line-of-sight scenarios. To cope with these issues, this paper proposes a novel backscatter device (BD)-assisted ISAC system where passive BDs are utilized to concurrently enhance sensing accuracy and communication reliability by providing additional signal-reflecting paths. Furthermore, a joint time-frequency-power resource optimization problem is formulated between sensing mutual information and communication capacity in an orthogonal frequency division multiplexing (OFDM) setting. Then, a Pareto boundary is characterized by solving this dual problem, providing clear insights into fundamental tradeoffs involved between sensing and communication. Specifically, we decompose the formulated optimization problem into two manageable subproblems and iteratively solve them through successive convex approximation (SCA) techniques with a block coordinate descent (BCD) algorithm to address the inherent non-convexity of the problem. Simulation results demonstrate the superior performance of the proposed BD-assisted ISAC system, showing substantial improvements in both sensing and communication metrics compared to state-of-the-art ISAC methods.

Ambient backscatter communication (AmBC) has become increasingly popular for facilitating ubiquitous Internet of Things (IoT) due to its ultra-low-power consumption and energy-harvesting capabilities. However, the open nature of wireless channels and the resource-limited devices in AmBC systems expose them to threats such as identity impersonation and wireless spoofing attacks. Recently, physical layer authentication (PLA) offered a lightweight solution to address the above security challenges by utilizing inherent wireless properties, like channel fading and signal patterns, as unique fingerprints to identify legitimate devices and distinguish them from attackers. Despite its promise, current research still lacks an effective PLA mechanism that can accurately authenticate backscatter devices (BDs) and defend against spoofing attacks in AmBC systems. This paper presents AmbAu, a two-stage PLA scheme designed to authenticate BDs by leveraging the signal correlation between an ambient source and the BD. In the initialization stage, the verifier extracts a complex covariance matrix from the downlink signals between the ambient source and the BD. This matrix is later used during the authentication stage to verify the BD's identity and detect spoofing attempts. Through security analysis, we demonstrate AmbAu's resilience against replay, relay, and counterfeiting attacks. Simulations under various conditions demonstrate AmbAu's accuracy, efficiency, and superior performance when compared to traditional PLA schemes.

Sliding cardinality estimation is crucial in many data analysis scenarios, e.g., detecting abnormal network behav-iors by monitoring unique connections in real time, detecting fraud in online transactions by monitoring unique user behavior patterns, and improving inventory management in supply chains by analyzing unique buyer behaviors. However, existing sliding cardinality estimation methods suffer from a cardinality barrel-down problem caused by unexpired item elimination in advance and item excessive removal, which remains unresolved so far. In this paper, we propose TardySketch, a sketch framework to make sliding cardinality estimation accurate and efficient by solving the above problem. The cornerstone of TardySketch is a Bidirectional Pointer-based Bitmap (BP-Bitmap), which stores the arrival sequence of items without timestamps. To prevent the premature elimination of unexpired items, we propose a Gap mechanism to enhance the accuracy of BP-Bitmap for identifying truly expired items through intermittent monitoring. To ensure an appropriate number of items are eliminated as the window moves, we design a Slow-Down mechanism to slacken the reset rate of bucket in BP- Bitmap to prevent over removal of items. Experimental results based on real-world datasets demonstrate that TardySketch significantly outperforms state-of-the-art methods, achieving a performance improvement of 5–40 times. The source code of TardySketch is available on GitHub.

This paper introduces a new dynamic networked trust model, the Random Neural Network Trust Model (RNNTM), which incorporates the dynamics of trust formation in a network through a sequence of “votes” from each entity regarding all other entities. The model assures fairness among entities through a fixed replenishment rate of “voting rights” for each entity, whose voting rights are reduced each time the entity votes. A positive vote received by an entity increases its voting rights and its trustworthiness, while a negative vote reduces its voting rights and also its trustworthiness, and a non-negative integer represents each entity’s instantaneous “trust value”. An important property of the RNNTM is that an entity cannot express its trust or distrust of the other entities, and hence affect their trust values, when its trust level is down to zero, so that untrustworthy entities are not allowed to express trust or distrust. After developing the theoretical characteristics for the RNNTM model, this paper details its use to evaluate the trust value of multiple entities in a network of Internet of Things (IoT) devices and gateways, where cyberattacks against the gateways, and messages that should be received from IoT devices at regular intervals, modify the parameters that express the trust or distrust between entities. To illustrate its use for a network of interaction gateways, servers and user equipment, several detailed time-dependent simulations of the RNNTM are conducted in the presence of cyberattacks.

In the field of intrusion detection systems, nonuniform class distribution in training datasets compromises the machine learning based detection mechanisms. Generative Adversarial Networks (GANs) offer promising solutions to address this problem. This paper employs a tailored Conditional Tabular GAN (CTGAN) to generate new data points aligned with the minority-class distribution. The experiments utilize the NF-v2-Bot-IoT dataset for performance evaluation. The results show that employing this tailored architecture to generate synthetic samples for the minority class of theft significantly increases the detection rate from 42% to impressive 99%. This highlights the efficacy of the tailored architecture in substantially enhancing the detection performance for skewed classes.

Blockchain-enabled digital currency systems have typically operated in isolation, lacking necessary mechanisms for seamless interconnection. Consequently, transferring assets across distinct currency systems remains a complex challenge, with existing schemes often falling short in ensuring security, privacy, and practicality. This paper proposes P2C2T - a privacy-preserving cross-chain transfer scheme. It is the first scheme to address atomicity, unlinkability, indistinguishability, non-collateralization, and required functionalities across diverse currency systems. P2C2T is based on threshold anonymous atomic locks (TA2L), also proposed by us, serving as the cornerstone for guaranteeing atomic cross-chain transfer while obscuring the payment relationships between users. By combining TA2L with verifiable timed discrete logarithm schemes, P2C2T renders cross-chain transactions indistinguishable from regular intra-chain ones. Notably, P2C2T eliminates the collateralization of senders and imposes minimal requirements on underlying blockchains, specifically on the ability to verify signatures. We substantiate the security of TA2L based on a proposed cryptographic notion called threshold blind conditional signatures and demonstrate the security of P2C2T through necessary proofs. Additionally, we compare the performance of P2C2T with an existing scheme that has properties closest to P2C2T. The comparison reveals that P2C2T reduces overhead by at least 85.488% in terms of running time, communication cost, and storage cost when completing a cross-chain transfer. We further conduct cross-chain transfers and intra-chain payments using the Bitcoin testnet and Litecoin testnet to illustrate the privacy and practicality of P2C2T.

The rapid evolution of communication technologies and the emergence of sixth-generation (6G) networks have introduced unprecedented opportunities for ultra-reliable, low-latency, and energy-efficient communication. Integrating technologies like non-orthogonal multiple access (NOMA) and wireless powered communication networks (WPCNs) brings new challenges. These include energy constraints and increased security vulnerabilities. Traditional antenna systems and orthogonal multiple access schemes struggle to meet the increasing demands for performance and security in such environments. To address this gap, this paper investigates the impact of emerging fluid antenna systems (FAS) on the performance of physical layer security (PLS) in WPCNs. Specifically, we consider a scenario in which a transmitter, powered by a power beacon via an energy link, transmits confidential messages to legitimate FAS-aided users over information links while an external eavesdropper attempts to decode the transmitted signals. Additionally, users leverage the NOMA scheme, where the far user may also act as an internal eavesdropper. For the proposed model, we first derive the distributions of the equivalent channels at each node and subsequently obtain compact expressions for the secrecy outage probability (SOP) and average secrecy capacity (ASC), using the Gaussian quadrature methods. Our results reveal that incorporating the FAS for NOMA users, instead of the TAS, enhances the performance of the proposed secure WPCN.

This paper proposes a novel physical layer authentication (PLA) scheme for backscattering tag-to-tag networks (BTTNs), where aTalker Tag(TT) communicates passively with a Listener Tag (LT) in the presence of a potential adversary. Designed for ultra-low power tags without cryptographic capability, the proposed PLA leverages the unique voltage profiles generated by the tags’ energy harvesting and demodulation circuits to form physical-layer signatures for authentication. In addition, to enhance the reliability of voltage measurements, especially under weak signal conditions inherent within BTTNs, an indoor reconfigurable intelligent surface (RIS) is integrated to improve the received signal quality at LT. The proposed approach maintains a high authentication success rate even as the distance between TT and LT increases. A detailed security analysis demonstrates strong resilience against impersonation, man-in-the-middle, relay, and replay attacks, as long as the RIS controller remains secure. This robustness stems from the adversary’s inability to recreate the exact voltage profiles at LT, due to the inherent location-specific channel characteristics and the RIS-assisted signal shaping that the attacker cannot replicate. Furthermore, the simulation results confirm the effectiveness of the proposed RIS-assisted PLA, showing significant gains in authentication performance and secrecy capacity across diverse deployment scenarios.

The explosive growth of data has highlighted its critical role in driving economic growth through data marketplaces, which enable extensive data sharing and access to high-quality datasets. To support effective trading, signaling mechanisms provide participants with information about data products before transactions, enabling informed decisions and facilitating trading. However, due to the inherent free-duplication nature of data, commonly practiced signaling methods face a dilemma between privacy and reliability, undermining the effectiveness of signals in guiding decision-making. To address this, this paper explores the benefits and develops a non-TCP-based construction for a desirable signaling mechanism that simultaneously ensures privacy and reliability. We begin by formally defining the desirable utility signaling mechanism and proving its ability to prevent suboptimal decisions for both participants and facilitate informed data trading. To design a protocol to realize its functionality, we propose leveraging maliciously secure multi-party computation (MPC) to ensure the privacy and robustness of signal computation and introduce an MPC-based hash verification scheme to ensure input reliability. In multi-seller scenarios requiring fair data valuation, we further explore the design and optimization of the MPC-based KNN-Shapley method with improved efficiency. Rigorous experiments demonstrate the efficiency and practicality of our approach.

Sketch demonstrates good properties in spread estimation over network measurements, providing fast processing and accurate estimation under limited memory usage. However, most current methods remain limited to single-flow spread estimation, resulting in suboptimal performance when applied to range spread estimation that requires measuring the spread of a range of flows. In this paper, we propose LocalSketch, a novel sketch that achieves both high estimation accuracy and memory efficiency for range spread estimation with provable theoretical guarantees. LocalSketch has two key innovations: (1) local key aggregation within predefined ranges that eliminates duplicate spread information through locality correlation, and (2) adaptive counter sizing that dynamically allocates memory resources for large-spread ranges while maintaining compact representations for low-spread ranges. LocalSketch also features an efficient abnormal bucket detection mechanism by comparing identification sign, avoiding exhaustive bucket traversal during super range detection. Moreover, the main idea of LocalSketch can be adapted to existing plug-in spread counters, which has been experimentally proved. We provide a theoretical analysis of estimation accuracy and conduct comprehensive evaluations using real-world network traffic datasets. Experimental results demonstrate that LocalSketch outperforms state-of-the-art methods by achieving 76× higher estimation accuracy for range spread estimation, while showing 15× better accuracy and 39× faster detection speed for super range identification across all datasets.

Backscatter Communication (BC) is an innovative wireless communication technology that is characterized by energy harvesting capability, low cost, ultra-low power consumption, and ease of maintenance. Secure communications among a group of Backscatter Devices (BDs) are crucially important to facilitate its wide applications. However, current Group Key Generation (GKG) technologies in BC systems suffer from such problems as inadequate key consistency, low key generation efficiency, suboptimal key randomness, high key generation complexity, as well as lack of group key management to ensure backward and forward secrecy. In response, this paper proposes PosGKG, a position-based group key generation and management scheme with high key consistency, efficiency, and randomness, tailored for easy deployment in a BC system with low computation and communication complexity. PosGKG leverages position information to construct shared information between devices for GKG, thereby addressing over-reliance on channel reciprocity and enhancing group key consistency. In particular, PosGKG incorporates a dynamic update mechanism for private weight vectors of BDs that are used to obtain global positions for GKG, which guarantees that the generated group key retains a high degree of randomness, even in a static environment. PosGKG not only diminishes communication and computational complexities due to the adoption of randomly changed global positions as shared information for GKG but also exhibits enhanced security under various attacks, both passive and active ones. In addition, group key management is applied to guarantee the forward and backward secrecy of PosGKG, irrespective of the changes of the BC system. Theoretical analysis and comprehensive experiments with diverse configurations validate the performance of PosGKG in terms of communication and computational complexity, key generation efficiency, key consistency, robustness, security, and environmental feasibility, with demonstrated advantages over existing technologies.

Backscatter communication (BC) is a promising wireless communication technology due to its low cost, ultra-low power consumption, and ease of maintenance. However, the broadcasting and openness nature of BC by backscattering incident radio signals for message transformation introduces severe security threats, creating a bottleneck that hinders its further development. Mutual and handover authentication across multiple access points (APs) is essential to secure large-scale BC systems containing mobile backscatter devices (BDs). However, an effective scheme is still absent in the current literature. In this paper, we propose HABC, a mutual and handover authentication scheme designed to secure BC systems, which can resist various attacks. HABC leverages the physical layer feature channel impulse response (CIR) to authenticate BD. Using secret keys, the BD can verify the source of a received signal. When a BD transits from the coverage of a source AP to a target AP, HABC supports handover authentication through the control of a server based on BD location prediction to maintain continuous communications. Theoretical analysis and numerical experimental evaluation validate the satisfactory performance of HABC in terms of accuracy and robustness, as well as its superiority through comparison with cutting-edge related work.

With the increasing accessibility of drones, they have been warmly embraced across various sectors, especially in low-altitude logistics transportation. However, during drone delivery, legal drones dispatched by logistics companies are susceptible to malicious attacks, resulting in package theft or substitution. To address this, existing works focus on designing drone authentication to secure drone delivery. However, most of these methods require expensive specialized equipment, such as high-quality microphones and professional recording devices, resulting in high real-world application costs. In this paper, we propose DroneAudioID, a lightweight acoustic fingerprint-based drone authentication system that relies solely on common mobile devices. The basic idea is to employ acoustic fingerprints to authenticate different drones of the same model based on differences in fundamental frequency and harmonic components of drone audio. Specifically, the drone audio is recorded by a mobile device instead of sophisticated equipment. We apply wavelet transform to remove high-frequency noise during data preprocessing. Then, specialized filter banks are designed for feature extraction, leveraging the frequency characteristics of drone audio. Finally, we construct a Bi-Long Short-Term Memory (Bi-LSTM) with an Open-Max model for open-set classification. Extensive experiments are conducted on eight crafts drones of$DJI Mini2$, showing an authentication accuracy of 99.6%. A series of comprehensive experiments further validate DroneAudioID’s capability to defend against various attacks.

Backscatter communication (BC) enables resource-constrained backscatter devices (BDs) to communicate by reflecting signals from external radio frequency sources (RFSs), thereby avoiding active RF components, making it a cutting-edge technology for the ubiquitous Internet of Things (IoT). However, the open nature of BC makes it vulnerable to passive and active attacks, and existing methods fail to offer robust mutual authentication suitable for mobile BC systems while keeping a low computational overhead. To address this issue, we propose AuthScatter, an accurate, robust, and scalable physical-layer mutual authentication scheme between the RFS and multiple BDs by leveraging channel fading and random numbers as a one-time pad to protect the identity key exchange procedure during the authentication. Specifically, AuthScatter constructs shared identity keys as physical-layer fingerprints for efficient identification and employs a challenge-response authentication mechanism to enable secure key exchange between the RFS and the BD. In the authentication, the one-time pad effectively prevents eavesdropping, spoofing, replay, and counterfeiting attacks, while legitimate devices leverage channel reciprocity and random number knowledge to authenticate efficiently without channel estimation or complex processing. It is tailored for high-mobility scenarios by completing the exchange within the channel coherence time while incorporating a key-update mechanism to ensure sustained security in the long term. Additionally, it includes a re-authentication mechanism to enhance resistance against wireless attacks and a batch authentication framework leveraging time-division duplexing (TDD) to enable scalability in large-scale BC deployments. Comprehensive security analysis demonstrates the resistance of AuthScatter to various threats, including eavesdropping, identity spoofing, replay, and counterfeiting attacks. Extensive simulations further validate its high authentication accuracy across diverse channel conditions, robustness against various attack vectors, and scalability with a large number of BDs, highlighting its superiority over state-of-the-art schemes.

With the rapid development of wireless communication technologies, Internet of Things (IoT) has emerged as one of the most important application scenarios. Due to the high density of IoT devices and the limited spectrum resources, along with the miniaturization and sustainability requirements of these devices, the development of low-cost interference management (IM) methods has become crucial for widespread use of IoT. Interference has long been known to harm network performance. Since a desired signal can be distorted by interference, and thus be incorrectly decoded at the destination, we argue that interference can also be transformed intentionally to extract the desired data from interfering signal(s). Based on this observation, we proposeInterference ReCycling(IRC) for the IoT. Under IRC, a recycling signal is generated using the interference a victim IoT device is subjected to, and then sent by the device’s associated gateway. Under the influence of the recycling signal, the desired data of the interfered/victim IoT transmission-pair can be recovered from the interference at the IoT device. We also show that the interfered user’s spectral efficiency (SE) with IRC can be optimized further by properly distributing the transmit power used for the desired signal’s transmission and the recycling signal. We validate the feasibility of IRC by implementing the method on the Universal Software Radio Peripheral (USRP) platform. Our theoretical analysis, experimental and numerical evaluation have shown that the proposed IRC can fully exploit interference, and hence can significantly improve the SE of the victim IoT device compared to other existing IM methods.

Due to the broadcast nature of wireless communications, users' data transmitted wirelessly is susceptible to security/privacy threats. The conventional modulation scheme “loads” all of the user's transmitted information onto a physical signal. Then, as long as an adversary overhears and processes the signal, s/he may access the user's information, hence breaching communication privacy. To counter this threat, we proposeIRS-DMSC, aDistributed Modulation based Secure Communication(DMSC) scheme by exploitingIntelligent Reflecting Surface(IRS). Under IRS-DMSC, two sub-signals are employed to realize legitimate data transmission. Of these two signals, one is directly generated by the legitimate transmitter (Tx), while the other is obtained by modulating the phase of the direct signal and then reflecting it at the IRS in an indirect way. Both the direct and indirect signal components superimpose on each other at the legitimate receiver (Rx) to produce a waveform identical to that obtained under traditional centralized modulation (CM), so that the legitimate Rx can employ the conventional demodulation method to recover the desired data from the received signal. IRS-DMSC incorporates the characteristics of wireless channels into the modulation process, and hence can fully exploit the randomness of wireless channels to enhance transmission secrecy. However, due to the distribution and randomization of legitimate transmission, it becomes difficult or even impossible for an eavesdropper to wiretap the legitimate user's information. Furthermore, in order to address the problem of decoding error incurred by the difference of two physical channels' fading, we developRelative Phase Calibration(RPC) andConstellation Point Calibration(CPC), to improve decoding correctness at the legitimate Rx. Our method design, experiment, and simulation have shown the proposed IRS-DMSC to cripple the eavesdropper while maintaining good performance of the legitimate transmission.

With the rapid advancement of wireless communication technologies, interference has become a key impediment to the improvement of wireless data transmission performance. Traditional interference management (IM) suppresses or adjusts interference at the cost of additional communication resourceswithoutexploiting interference effectively. Especially when the interference is strong, simply eliminating it may be inefficient and costly. Moreover, wirelessly transmitted data is susceptible to threats such as eavesdropping, which also necessitates a thorough investigation. To address these issues cooperatively, we proposeOpportunistic Parasitic Communication with Asymmetric Demodulation(OPC-AD). In particular, we consider the interference experienced by the intended/target communication (i.e., parasitic) receiver (Rx) as the host signal. The target communication constructs a selection signal carrying parasitic indication information based on the data it intends to send and the data decoded by its Rx using asymmetric demodulation from the host signal, and then sends it to its Rx. This signal is used to instruct the parasitic Rx to extract the desired information from the host signal. OPC-AD allows for the exploitation of the interference (i.e., host signal) for data transmission to an interfered Rx. Using AD can also ensure the privacy of the host communication. Since the parasitic communication is concealed within the host signal, eavesdroppers cannot compromise the confidentiality of the parasitic transmission without precisely decoding the selection signal. Furthermore, considering more practical situations, such as non-zero delay/phase difference between the host signal and the selection signal, the implementation of the proposed method under various modulation schemes, and the enhancement of the probability of successful parasitism, we extend the OPC-AD design to cover a broader range of realistic scenarios. Our experimental results validate the applicability of OPC-AD, while our in-depth simulations demonstrate that parasitic communication can effectively thwart eavesdropping and achieve higher spectral efficiency (SE) than other existing IM methods, particularly in strong interference environments.

Within the 5G Service-Based Architecture (SBA), the prevalent centralized frameworks, particularly those managing public key certificates and Network Function (NF) services, face significant security and privacy vulnerabilities due to their reliance on centralized Certificate Authorities (CAs) and Network Repository Functions (NRFs). This centralization in current 5G standards poses two critical issues. One is the risk of single points of failure associated with CAs and NRFs. The other is a substantial risk of privacy leakage in cross-domain NF access authorization. These issues underscore the demand for decentralized NF management with enhanced security and privacy. However, existing related schemes still suffer from such drawbacks as poor security and privacy, low efficiency, and a lack of automation in the management of NF certificates. In this paper, we propose B5G-NFM, a pioneering Blockchain-based 5G Network Function Management scheme designed to bolster security and privacy. B5G-NFM integrates a blockchain middleware network function, a decentralized protocol for managing NF public key certificates, and a decentralized mechanism for NF service discovery coupled with a privacy-preserving NF access authorization protocol. Our thorough security and performance assessment verifies that B5G-NFM not only meets its security and privacy goals, but also aligns with efficiency demand, marking a substantial progress in strengthening 5G network infrastructure.

Backscatter communication (BC) represents a wireless communication technology that facilitates the transmission of data by low-power devices, referred to as backscatter devices (BDs), through the modulation or reflection of pre-existing wireless signals, typically sourced from an access point (AP). The advent of the Internet of Things (IoT) has garnered significant attention and witnessed the widespread adoption of BC, primarily due to its exceptional energy- efficiency characteristics. Nevertheless, the security of BC systems faces substantial threats when deployed in practical scenarios due to their inherent openness. Specifically, wireless BDs, which directly engage with users, are susceptible to detrimental consequences in the event of interactions with counterfeit wireless APs. Owing to their non-authenticated and unconditional reflection properties, BDs are vulnerable to spoofing attacks orchestrated by malicious APs. Moreover, their limited computing capabilities make it challenging to employ intricate cryptographic algorithms. To tackle these challenges, we introduce APAuth, a lightweight authentication scheme that leverages the power value of BD to establish AP authentication. In this scheme, BDs and APs share a confidential key and engage in negotiations to determine a key generation algorithm. Subsequently, the current stored power value of BD is utilized to calculate the power value that must be delivered to BD from AP. If the computed charging power value aligns with the value determined by the key generation algorithm, the AP successfully passes the authentication of BD. We perform a thorough theoretical analysis of the security aspects inherent in our proposed scheme. We further conduct numerical simulations to validate the practical viability and desired performance of APAuth in diverse real-world scenarios.

With the increasing number of wireless devices connecting to networks and sharing the same spectrum resources, interference has become a significant obstacle to improving network performance. Existing interference management (IM) methods treat interference as a negative factor and mainly focus on suppressing or eliminating its impact on desired transmissions. However, this often comes at the cost of consuming communication resources. Therefore, design of low-cost IM method that can exploit interference is of research importance. To achieve this goal, we leverage the cost-effectiveness and adaptable deployment capabilities of Intelligent Reflecting Surface (IRS) to propose an IRS Empowered Interference Utilization (IRS-IU) method to realize efficient desired data transmission. By appropriately designing the reflection coefficient of the IRS, a phase shift is introduced to the incident interference, allowing the reflecting interference to interact with its direct counterpart at the interfered receiver (Rx). As a result, the interfered Rx can retrieve its desired data from the mixed interference. In this way, IRS-IU can make full use of the interference to enhance the desired data transmission. Our theoretical analysis and simulation results show that the proposed method can significantly improve the spectral efficiency (SE) of the interfered communication-pair.

Speech recognition systems driven by Deep Neural Networks (DNNs) have revolutionized human-computer interaction through voice interfaces, which significantly facilitate our daily lives. However, the growing popularity of these systems also raises special concerns on their security, particularly regarding backdoor attacks. A backdoor attack inserts one or more hidden backdoors into a DNN model during its training process, such that it does not affect the model’s performance on benign inputs, but forces the model to produce an adversary-desired output if a specific trigger is present in the model input. Despite the initial success of current audio backdoor attacks, they suffer from the following limitations: (i) Most of them require sufficient knowledge, which limits their widespread adoption. (ii) They are not stealthy enough, thus easy to be detected by humans. (iii) Most of them cannot attack live speech, reducing their practicality. To address these problems, in this paper, we propose FlowMur, a stealthy and practical audio backdoor attack that can be launched with limited knowledge. FlowMur constructs an auxiliary dataset and a surrogate model to augment adversary knowledge. To achieve dynamicity, it formulates trigger generation as an optimization problem and optimizes the trigger over different attachment positions. To enhance stealthiness, we propose an adaptive data poisoning method according to Signal-to-Noise Ratio (SNR). Furthermore, ambient noise is incorporated into the process of trigger generation and data poisoning to make FlowMur robust to ambient noise and improve its practicality. Extensive experiments conducted on two datasets demonstrate that FlowMur achieves high attack performance in both digital and physical settings while remaining resilient to state-of- the-art defenses. In particular, a human study confirms that triggers generated by FlowMur are not easily detected by participants. The source code of FlowMur is publicly available at https://github.com/cristinalan/FlowMur.

Federated learning (FL) has effectively solved the dilemma of "data silos" and has been widely applied into various fields. However, in real-life, user data is often Not Independent and Identically Distributed (Non-IID), and eavesdroppers can still infer users’ private data from various parameters transmitted in FL. Nevertheless, few privacy-preserving FL schemes focus on data heterogeneity, and offline problem causes more accuracy loss under Non-IID. This paper introduces a multi-key homomorphic encryption algorithm to construct two privacy-preserving FL schemes based on FedProx and SCAFFOLD, namely EMKProx and EMKSCAF. The two schemes both incorporate an anti-offline mechanism and take diverse measures to mitigate Non-IID’s impact on convergence speed, where EMKProx inserts a proximal term into loss function which is more suitable for poor hardware condition and EMKSCAF adds control variate to meet higher model performance requirement. We give security analyses to prove their security. In addition, we conduct simulations and comparisons with FL schemes using other privacy protection mechanisms, which show that our schemes behave more efficient and gain higher accuracy than the others.

The Graph Attention Network (GAT), based on the foundational principles of Graph Neural Network (GNN), represents a significant advancement in the accurate representation and in-depth understanding of complex data structures. However, GAT can’t proficiently handle heterogeneous data, which negatively affects model performance. Existing solutions incur substantial computational overhead when addressing these challenges, compromising efficiency and impeding practical deployment. In this paper, we propose Zephyr to enable GAT to efficiently process heterogeneous data with high performance. In Zephyr, we introduce Dynamic Multi-matrix Design and Spatial Multi-activation Design to eliminate the effects of finiteness of matrix representation capability and difference in heterogeneous spaces. Remarkably, Zephyr shows superior capability in processing heterogeneous data while requiring minimal storage space. Through comprehensive simulations and comparisons with existing schemes, Zephyr demonstrates a substantial performance improvement, increasing accuracy by over 8% on heterogeneous datasets and enhancing fitting speed by approximately 20%. Moreover, with heterogeneous data, it maintains memory overhead below 1.05x and curtails time overhead to 70%.

Adversarial examples challenge PDF malware classifiers. Current defensive approaches offer partial robustness certification for specific attacks, but cannot defend against all adversarial attacks. In this paper, we propose CertRob, a PDF malware detection approach with certified adversarial robustness via randomization smoothing. We construct a comprehensive threat model to address various perturbations in both feature and problem spaces. We apply randomization smoothing training to malicious PDF classifiers, enhancing their robustness. We further optimize the threat model with feature constraints, narrowing the perturbation range and reducing training time. Furthermore, Shapley values prioritize important features during training, reducing randomization. We assess the smoothed PDF classifiers’ effectiveness against various attacks and their robustness certificates across different perturbation distances. Experiments based on the Contagio dataset confirm that CertRob shows strong robustness against both feature-space attacks and problem-space attacks compared to existing defensive approaches.

The rapid growth of mobile internet is driving the expansion of big data. The massive amount of data generated by mobile interconnections is stored on remote servers using Fiber Channel (FC) Storage Area Networks (SANs). Our literature study reveals that a significant portion of this data is either stored in plaintext or experiences reduced throughput when encryption devices are integrated into the network, posing potential security risks. To address the vulnerabilities of plaintext data storage and improve throughput performance, we design a high-performance data encryption device using advanced FPGA technology. Positioned between the server and the disk array, this encryption device secures the data written to the disk array. It achieves a data throughput rate of up to 11.21 Gbps by adopting high-performance hardware platform and designing pipeline-based data processing. It also improves the ability of data encryption device to resist side channel attack by designing diverse SM4 circuit consist of different S-boxes.

This paper studies the performance of a wire-less powered communication network (WPCN) under the non-orthogonal multiple access (NOMA) scheme, where users take advantage of an emerging fluid antenna system (FAS). More precisely, we consider a scenario where a transmitter is powered by a remote power beacon (PB) to send information to the planar NOMA FAS-equipped users through Rayleigh fading channels. After introducing the distribution of the equivalent channel coefficients to the users, we derive compact analytical expressions for the outage probability (OP) in order to evaluate the system performance. Additionally, we present asymptotic OP in the high signal-to-noise ratio (SNR) regime. Eventually, results reveal that deploying the FAS with only one activated port in NOMA users can significantly enhance the WPCN performance compared with using traditional antenna systems (TAS).

The rapid development of the Internet of Things (IoT) has led to the generation and perception of large amounts of data from IoT devices. These data are outsourced to the cloud for flexible sharing and deep analytics, which can significantly enhance IoT applications. But this raises privacy concerns for IoT devices. Attribute-based encryption is applied to realize fine-grained access control, which offers data owners control capability over their outsourced data. However, the centralized infrastructure is susceptible to the single-point-of-failure problem and may not be suitable for highly distributed IoT applications due to high latency. To overcome this issue, blockchain technology is introduced to realize a distributed infrastructure and provide robust data services. Owing to the innate transparency characteristic of blockchain, challenges associated with privacy are amplified. Therefore, this article presents an efficient and decentralized data access control (EDDAC) scheme that preserves attribute privacy. The scheme utilizes chameleon hash to implement attribute hiding, providing resistance against dictionary attacks. Additionally, it includes blockchain-based decryption tests that reduce the decryption overhead on clients through the application of inner product predicate encryption. Furthermore, our scheme employs Shamir secret sharing to achieve decentralized authorization based on blockchain, thereby reducing the trust-building overhead on authorization nodes. Finally, we provide proof of the adaptive security of the proposed scheme and demonstrate its effectiveness and advantages through simulations and comparisons with existing literature.

Federated Learning (FL) is widely used in various industries because it effectively addresses the predicament of isolated data island. However, eavesdroppers is capable of inferring user privacy from the gradients or models transmitted in FL. Homomorphic Encryption (HE) can be applied in FL to protect sensitive data owing to its computability over ciphertexts. However, traditional HE as a single-key system cannot prevent dishonest users from intercepting and decrypting the ciphertexts from cooperative users in FL. Guaranteeing privacy and efficiency in this multi-user scenario is still a challenging target. In this paper, we propose a secure and efficient Federated Learning scheme (SecFed) based on multi-key HE to preserve user privacy and delegate some operations to TEE to improve efficiency while ensuring security. Specifically, we design the first TEE-based multi-key HE cryptosystem (EMK-BFV) to support privacy-preserving FL and optimize operation efficiency. Furthermore, we provide an offline protection mechanism to ensure the normal operation of system with disconnected participants. Finally, we give their security proofs and show their efficiency and superiority through comprehensive simulations and comparisons with existing schemes. SecFed offers a 3x performance improvement over TEE-based scheme and a 2x performance improvement over HE-based solution.

Evaluating and sharing user equipment (UE) trust across multiple network domains can greatly support security and trust management of future integrated heterogeneous networks. But the dilemma between identity privacy preservation and trust evaluation efficacy causes a big challenge in pseudonym and trust value management. Most existing approaches either rely on a trusted third party (TTP) and non-collusive parties, or deploy trusted execution environments (TEEs). They cannot be applied directly into a trustless heterogeneous network environment, where network domains do not trust with each other and it is hard to setup a fully trusted party. In this article, we propose DePTVM, a decentralized pseudonym and trust value management scheme for integrated heterogeneous networks, where different network operators jointly maintain a list of$< $pseudonym, trust value$>$pairs by employing verifiable shuffling and trust obfuscation based on blockchain in order to support anonymous trust evaluation and ensure pseudonym unlinkability. We analyze DePTVM with respect to correctness, unforgeability, anonymity and unlinkability, and evaluate its performance through simulations. Experimental results show that trust synchronization can be achieved across domains within 9 seconds with our experimental settings and the time taken by the most complex operation (i.e., verifiable shuffling) of operator agent increases linearly with the scale of maintained list. Analysis and experimental results imply DePTVM's potential in practical applications.

Trust evaluation assesses trust relationships between entities and facilitates decision-making. Machine Learning (ML) shows great potential for trust evaluation owing to its learning capabilities. In recent years, Graph Neural Networks (GNNs), as a new ML paradigm, have demonstrated superiority in dealing with graph data. This has motivated researchers to explore their use in trust evaluation, as trust relationships among entities can be modeled as a graph. However, current trust evaluation methods that employ GNNs fail to fully satisfy the dynamic nature of trust, overlook the adverse effects of trust-related attacks, and cannot provide convincing explanations on evaluation results. To address these problems, we propose TrustGuard, a GNN-based accurate trust evaluation model that supports trust dynamicity, is robust against typical attacks, and provides explanations through visualization. Specifically, TrustGuard is designed with a layered architecture that contains a snapshot input layer, a spatial aggregation layer, a temporal aggregation layer, and a prediction layer. Among them, the spatial aggregation layer adopts a defense mechanism to robustly aggregate local trust, and the temporal aggregation layer applies an attention mechanism for effective learning of temporal patterns. Extensive experiments on two real-world datasets show that TrustGuard outperforms state-of-the-art GNN-based trust evaluation models with respect to trust prediction across single-timeslot and multi-timeslot, even in the presence of attacks. In addition, TrustGuard can explain its evaluation results by visualizing both spatial and temporal views.

The prosperity of blockchain technique has spawned numerous types of cryptocurrencies. However, a secure and privacy-preserving cryptocurrency exchange protocol that can support atomicity and unlinkability, and effectively resist various attacks is still missed in the literature. This paper proposes SPCEX, a secure and privacy-preserving cryptocurrency exchange protocol, which supports atomicity and unlinkability, as well as resists collusion attacks, front-running attacks and Sybil attacks without relying on any trust execution environments (TEEs). SPCEX employs a mixing protocol to conceal trader involvement and preserve their identity privacy. It applies a privacy-preserving comparison algorithm based on an improved homomorphic re-encryption scheme to match buy and sell orders secretly, thus resisting front-running attacks. In addition, we construct atomic transactions with smart contracts to protect tokens of honest traders. A collateral deposit mechanism is employed to deter collusive parties and penalize abnormal behaviors, which discourages collusion attacks and Sybil attacks. We analyze the security and privacy of SPCEX, and formally prove the security of the improved homomorphic re-encryption scheme. Through proof-of-concept implementation, we demonstrate its validity and reliability, and show its advanced performance by comparing it with a cutting-edge scheme.

Backscatter communication (BC) is an emerging radio technology for achieving sustainable wireless communications. However, the literature still lacks an effective secret group key generation scheme for safeguarding communications among multiple resource-constrained backscatter devices (BDs). In this paper, we propose a novel physical layer group key generation framework, BGKey, for securing backscatter communications among multiple BDs. BGKey contains three schemes: Centralized Group Key Generation (CGKG), Decentralized Group Key Generation (DGKG), and Decentralized Hierarchical Group Key Generation (DHGKG). Each scheme has its own advantages, applicable in different scenarios. We analyze the performance of BGKey schemes regarding computation and communication complexity and security under eavesdropping and three active attacks. We conduct extensive simulations with different system parameters to evaluate their performance. CGKG is the most efficient and accurate for generating a group key, but it depends on a trusted radio frequency source (RFS) and is the least secure under eavesdropping and three active attacks among three schemes. DGKG exhibits better security and higher key generation rate (KGR) against eavesdropping and three active attacks compared with CGKG. However, the bit disagreement ratio (BDR) of group key increases when the size of BD group increases. DHGKG dramatically enhances the performance of group key generation compared with DGKG and retains its excellent security against eavesdropping and three active attacks.

With the rapid development of wireless communication technologies, interference management (IM) and security/privacy in data transmission have become critically important. On one hand, due to the broadcast nature of wireless medium, the interference superimposed on the desired signal can destroy the integrity of data transmission. On the other hand, malicious receivers (Rxs) may eavesdrop a legitimate user’s transmission and thus breach the confidentiality of communication. To counter these threats, we propose a novel encoding method, called immunizing coding (iCoding), which handles both IM and physical-layer security simultaneously. By exploiting both channel state information (CSI) and data carried in the interference, an iCoded signal is generated and sent by the legitimate transmitter (Tx). The iCoded signal interacts with the interference at the desired/legitimate Rx, so that the intended data can be recovered without the influence of disturbance, i.e., immunity to interference. In addition, since the data carried in the iCoded signal which is obtained via encoding the desired data and interference cooperatively, is different from the original desired data, the eavesdropper cannot access unauthorized information by wiretapping the desired signal, thus achieving immunity to eavesdropping. Our theoretical analysis, experimental and numerical evaluation have shown iCoding to effectively manage interference while preventing potential eavesdropping, hence enhancing the legitimate user’s transmission and secrecy thereof.

Backscatter communication (BC) offers a promising power-efficient communication paradigm for wireless devices with constrained energy resources. However, the innate openness and broadcast characteristics of BC raise considerable security concerns. To address this, physical layer authentication has emerged as a primary solution to enable secure BC. To facilitate efficient authentication on multiple backscatter devices (BDs), batch authentication becomes essential. Nevertheless, existing schemes have not yet bridged the research gap regarding effective batch authentication on mobile BDs with high scalability support. This paper proposes BatchAuth, a physical layer batch authentication scheme designed to authenticate multiple BDs simultaneously by leveraging orthogonal frequency-division multiple access (OFDMA) technology. BatchAuth utilizes two factors, received signal strength (RSS) and multiple channel impulse responses (CIRs), to authenticate a group of BDs and leverages a channel correlation coefficient to offset performance loss and support BD dynamicity. What’s more, a backscatter waveform design facilitates an access point (AP) in estimating the CIRs from backscattered signals. Additionally, BatchAuth possesses the capability to detect and trace potential attackers by analyzing the specific characteristics of orthogonal subcarriers to facilitate countermeasure. In particular, BatchAuth demonstrates significant potential on scalability in large-scale BC systems and multiple-input multiple-output (MIMO) systems. Theoretical analysis on BatchAuth security and extensive simulations under various settings by comparing with cutting-edge schemes further validate its commendable performance with regard to accuracy, robustness, efficiency, and scalability.

A smart grid (SG) is an advanced electrical grid that enhances the efficiency and reliability of traditional power grids. Reconfigurable intelligent surfaces (RISs) have been recently proposed to enhance communication performance in the SG. However, the communication links between different SG components could suffer from eavesdropping and unauthorized access, which makes physical layer security (PLS) a promising solution for addressing these concerns. In this article, we focus on exploring the effect of applying RIS on enhancing the PLS performance of SG communications. Specifically, we consider an RIS with reflecting elements besides a smart meter, a neighborhood gateway (NG), and an eavesdropper to develop a smart environment in the SG to improve PLS performance in terms of secrecy outage probability (SOP) and average secrecy capacity (ASC). For this purpose, we first derive a probability density function and a cumulative distribution function for the signal-to-noise ratio (SNR) at both the NG and the eavesdropper. Then, we derive closed-form expressions of SOP and ASC to evaluate the impact of various system parameters on the secrecy performance of RIS-aided SG communications. Furthermore, considering the significance of system behavior under high-SNR conditions, we conduct an asymptotic analysis of the SOP and ASC. Finally, we apply the Monte Carlo simulation to validate the analytical results. Our results indicate that using the RIS can significantly enhance the secrecy performance of SG communications compared to the conventional SG scenarios without the RIS.

With the rapid deployment and wide use of mobile services and applications, more and more sensitive user information is being transmitted wirelessly. Due to the broadcast nature of wireless transmissions, they are exposed to all surrounding entities and thus vulnerable to eavesdropping. To counter this vulnerability, we propose a new physical-layer secure transmission scheme, called DDM-Sec, based on decomposed and distributed modulation (DDM). We show that a high-order modulation can be decomposed into multiple quadrature phase shift keying (QPSK) modulations, each of which can be further represented by two mutually orthogonal binary phase shift keying (BPSK) modulations. Therefore, traditional modulation can be realized by two cooperative transmitters (Txs), each generating a BPSK signal, in a distributed manner. The legitimate receiver (Rx) can decode the desired/intended information from the mixed two received BPSK signals while preventing the eavesdropper from accessing the legitimate user's information. DDM-Sec can effectively exploit the randomness of wireless channels to secure data transmission, enrich the spatial signatures of the legitimate user's transmission by employing two cooperative Txs, and then distribute the user's information to two transmissions so that none of the decomposed signals alone carry the legitimate user's full information. Moreover, due to random deployment of the two Txs and Rx, delay difference of the two transmissions is introduced. This can be further utilized to make eavesdropping difficult. Our theoretical analysis and simulation have shown that DDM-Sec can effectively prevent the eavesdropping, and hence guarantee the secrecy of the legitimate user's data transmission.

The proliferation of Internet-of-Things (IoT) technologies in modern smart society enables massive data exchange for offering intelligent services. It becomes essential to ensure secure communications while exchanging highly sensitive IoT data efficiently, which leads to high demands for lightweight models or algorithms with limited computation capability provided by individual IoT devices. In this study, a graph representation learning model, which seamlessly incorporates graph neural network (GNN) and knowledge distillation (KD) techniques, named reconstructed graph with global-local distillation (RG-GLD), is designed to realize the lightweight anomaly detection across IoT communication networks. In particular, a new graph network reconstruction strategy, which treats data communications as nodes in a directed graph while edges are then connected according to two specifically defined rules, is devised and applied to facilitate the graph representation learning in secure and efficient IoT communications. Both the structural and traffic features are then extracted from the graph data and flow data respectively, based on the graph attention network (GAT) and multilayer perceptron (MLP) techniques. These can benefit the GNN-based KD process in accordance with the more effective feature fusion and representation, considering both structural and data levels across the dynamic IoT networks. Furthermore, a lightweight local subgraph preservation mechanism improved by the graph attention mechanism and downsampling scheme to better utilize the topological information, and a so-called global information alignment defined based on the self-attention mechanism to effectively preserve the global information, are developed and incorporated in a refined graph attention based KD scheme. Compared with four different baseline methods, experiments and evaluations conducted based on two public datasets demonstrate the usefulness and effectiveness of our proposed model in improving the efficiency of knowledge transfer with higher classification accuracy but lower computational load, which can be deployed for lightweight anomaly detection in sustainable IoT computing environments.

With the increasing number of wireless devices connecting to networks and sharing spectrum resources, interference has become a major obstacle to improving network performance. Existing interference management (IM) methods treat interference as a negative factor and focus on suppressing or eliminating its impact on the transmission of intended signals. However, this often comes at the cost of consuming communication resources and degrading desired transmission performance. Therefore, the design of a cost-effective IM method that “exploits” interference is important. To achieve this goal, we proposeIntelligent Reflecting Surface Assisted Interference Exploitation(IRS-IE) to realize efficient desired data transmission. IRS-IE leverages the low-cost and adaptive deployment capabilities of IRS to gather and reflect interference towards the interfered receiver (Rx). By appropriately designing the reflection coefficient of IRS, a phase shift is introduced to the incident interference, allowing the reflected interference to interact with its direct counterpart at the interfered Rx. As a result, the interfered Rx can retrieve its desired data from the mixed interference. This way, IRS-IE can make use of the interference to facilitate the desired data transmission. Our theoretical analysis and simulation results show that IRS-IE significantly improves the spectral efficiency (SE) of the interfered communication pair over the other IM methods.

Due to the broadcast nature of wireless transmissions, they are exposed to all surrounding entities and thus vulnerable to eavesdropping. To counter this vulnerability, we propose a new physical-layer secure transmission scheme, called DDM-Sec, based on decomposed and distributed modulation (DDM). DDM-Sec realizes traditional QPSK modulation by using two cooperative transmitters (Txs), each generating a BPSK signal, in a distributed manner. The legitimate receiver (Rx) can decode the desired/intended information from the mixed received signal while preventing the eavesdropper from accessing the legitimate user's information. DDM-Sec can effectively exploit the randomness of wireless channels to encrypt data transmission, enrich the spatial signatures of the legitimate transmission by employing two cooperative Txs. Moreover, DDM-Sec distributes user's information to two transmissions so that none of the decomposed signals alone carry the legitimate user's full information. Our theoretical analysis, hardware experiment, and simulation have shown that DDM-Sec can effectively prevent the eavesdropping, and hence guarantee the secrecy of the legitimate user's data transmission.

With the maturity of the Internet of Things (IoT), many IoT applications have been popularized and promoted. As one of the IoT technology, backscatter communication (BC) has aroused research interest due to its low-cost and ultra-low power consumption characteristics. Due to their simple design and battery-less functionalities, backscatter devices (BDs) have been introduced as the main candidates for deploying in smart home networks (SHN). Although batch authentication in BC systems is crucial and efficient for SHN security, existing schemes have only focused on radio frequency identification (RFID) devices and no literature has given a general solution for BD batch authentication. In this paper, we propose a scheme named BatAu for authenticating batch BDs applied in SHN by extracting physical layer features in multiplexing signals. We conduct numerical simulations with various settings to show its desirable performance.

With the rapid development of the internet and the increasing demand for communication, customized routing has become one of the hot research topics in future network. In order to better meet various communication requirements, it is necessary to test and evaluate existing customized routing algorithms to optimize and explore better customized algorithms. However, existing research on customized routing simulation testing cannot provide a customized routing testbed that supports universality, stability, efficiency, and reliability to test and evaluate different customized routing algorithms. To address this issue, we proposes a testbed called CustTest. CustTest is designed based on Software Defined Network (SDN) and Network Simulator 3 (NS3), and consists of two sub platforms: a customized routing calculation platform and a customized routing simulation platform. The customized routing calculation platform is used to calculate customized routes and distribute routing tables. This platform can not only flexibly deploy different customized routing algorithms, but also calculate customized routes based on user needs and convert these routes into customized routing tables. The customized routing simulation platform can effectively evaluate the performance of different customized routing algorithms using statistical analysis tools in NS3. We ensure the stability, efficiency, and reliability of CustTest by adding a pool structure and daemons. In addition, we conduct functional and performance tests on CustTest to demonstrate its ability to effectively execute customized routing calculations and its excellent performance in high concurrency environments, as well as the effectiveness of testing the performance of different customized routing algorithms.

Blockchain has attracted more and more attention of academia, industry, and government in recent decades. Different usage demands have inspired various blockchain designs, forming different blockchain systems, which leads to information islands. Many cross-chain technologies have been proposed to link different blockchains together and expand the utility of blockchain. Nevertheless, the cross-chain technology is still in its infancy, which faces many problems that retard its wide application, for example, the issues related to security, privacy, and effectiveness. In order to further investigate cross-chain technologies, it is essential to understand its current state of arts. Although there are some surveys about cross-chain technologies driven by specific demands, the literature still lacks a comprehensive survey focusing on security, privacy, and effectiveness of cross-chain technologies. In this paper, we provide a review on existing cross-chain technologies based on a comprehensive set of criteria on security, privacy, and other performance. We first propose a blockchain interoperability architecture for the purpose of analyzing potential threats and problems regarding security, privacy, and effectiveness. We then summarize a set of criteria regarding these quality attributes. Next, we comprehensively review the representative works on cross-chain technologies according to a taxonomy based on applied types of techniques and cross-chain purposes. In each work review, we provide a serious discussion on its pros and cons by employing our proposed criteria. Finally, based on our review and analysis, we figure out a number of open issues and step ahead to direct future research directions on cross-chain technologies.

Internet of Things (IoT) aims to create a vast network with billions of things that can seamlessly create and exchange data, establishing intelligent interactions between people and objects around them. It is characterized with openness, heterogeneity, and dynamicity, which inevitably introduce severe security, privacy, and trust issues that hinder the widespread application of IoT. Trust management (TM) holds great promise in identifying malicious nodes, maintaining trust relationships, and enhancing system security. Traditional TM systems (TMSs) can be classified into centralized, semi-centralized, and distributed ones, all three of which suffer from critical challenges and thus are not sufficient for facilitating IoT development. Blockchain, as a disruptive technology, can help addressing the challenges of TM in IoT, thanks to its advanced features, such as decentralization, consistency, and tamper-proofing. As a result, blockchain-based TM (BC-TM) has been extensively studied in recent years to achieve decentralized TM in IoT. However, it still lacks a comprehensive survey on the current state of the arts. To fill this gap, in this article, we conduct a serious survey on BC-TM in IoT. We first propose a set of evaluation criteria that should be met by a TMS in IoT. Then, we propose a taxonomy of TMSs and continue with a thorough review on BC-TM in IoT by employing the proposed criteria. In the end, based on the review, a series of open issues are identified, and future research directions are suggested.

With the large-scale commercialization of 5G networks, Internet of Things (IoT) applications keep on emerging in recent years. Real-time environmental awareness is an essential part of various IoT applications, e.g., self-driving vehicles. Object detection plays a fundamental role in real-time environmental awareness, which is responsible for acquiring valuable object information from the environment automatically. Despite of the fast progress for object detection in general, small object detection still faces challenges. Because of the restricted scales, small objects are only capable of generating relatively week features after multiple convolutional layers, thus causing low detection accuracy. Existing schemes mostly focus on extracting rich multiscale features, e.g., generating high-resolution features through generative adversarial networks (GANs), or generating multiscale features through feature combination. Nevertheless, these schemes require complex network implementation, and usually suffer from high processing delay because of high-resolution images. To resolve the problems mentioned above, we propose an adaptive dynamic neural network (AD-RCNN) that consists of three fundamental improvements. We first propose a dynamic region proposal network to improve the quality of region proposals. We then introduce a visual attention scheme to generate features of regions. Finally, we put forward an adaptive dynamic training module to optimize final detection results. Experimental results demonstrate that AD-RCNN outperforms the state-of-the-art from the perspectives of mAP and frames per second (FPS). Specifically, at the resolution of 1024 of TT100K data set, AD-RCNN achieves 68.8% mAP, which outperforms the baseline Faster RCNN by 8.52%.

Fifth generation (5G) networks are highly heterogeneous, with ultradense base stations (BSs), due to the low penetration of millimeter waves and the availability of different access technologies. However, the continuous heterogeneity and densification of 5G networks pose great challenges to network security, especially for user mobility support. In the process of user handover between BSs or between different network domains, user access authentication and security session establishment are far riskier compared to 4G networks. On the one hand, the overhead of handover authentication increases significantly as handovers become more frequent in an ultradense network. On the other hand, the differentiation of security schemes in heterogeneous networks (HetNets) poses a big challenge to handover authentication. Successfully designing a secure, privacy preserving, and efficient handover authentication protocol for heterogeneous and ultradense 5G networks would substantially expand the prospects of future 5G network applications. Although numerous solutions (e.g., challenge-response-based, public key cryptography-based, physical-layer information-based, and blockchain-based solutions) have been proposed to solve the cross-domain handover authentication problem, most of them surfer from security and privacy vulnerabilities and unreasonable performance overhead. In this article, we propose XAuth, a secure and privacy-preserving authentication protocol for both intradomain and interdomain handover in 5G HetNets based on blockchain. The proposed protocol can achieve mutual authentication, key agreement between user equipment (UE) and target network, and is characterized by forward secrecy, backward secrecy, user anonymity, and conditional privacy preservation. Formal security analysis and comprehensive performance evaluation demonstrate the security and effectiveness of the proposed protocol.

Due to advancements in semiconductor technologies, Internet of Things (IoT) applications have penetrated into a wide spectrum of aspects of human lives. This widespread penetration is also thanks to significant contributions from many emerging technologies, e.g., artificial intelligence (AI) and blockchain[1],[2]. The fast development of AI technologies like deep learning is a promising approach for extracting accurate information from massive raw sensor data in IoT applications[3]. In addition, due to its tamper-proof characteristic and distributed nature, blockchain has received increasing attentions in emerging IoT applications to tackle security and privacy issues[4],[5]. AI and blockchain have become killer technologies to advance the fast development of IoT ecosystems with incredible growth, impact, and potential.

The high-speed mobile networks offer great potentials to many future intelligent applications, such as autonomous vehicles in smart transportation systems. Such networks provide the possibility to interconnect mobile devices to achieve fast knowledge sharing for efficient collaborative learning and operations, especially with the help of distributed machine learning, e.g., Federated Learning (FL), and modern digital technologies, e.g., Digital Twin (DT) systems. Typically, FL requires a fixed group of participants that have Independent and Identically Distributed (IID) data for accurate and stable model training, which is highly unlikely in real-world mobile network scenarios. In this paper, in order to facilitate the lightweight model training and real-time processing in high-speed mobile networks, we design and introduce an end-edge-cloud structured three-layer Federated Reinforcement Learning (FRL) framework, incorporated with an edge-cloud structured DT system. A dual-Reinforcement Learning (dual-RL) scheme is devised to support optimizations of client node selection and global aggregation frequency during FL via a cooperative decision-making strategy, which is assisted by a two-layer DT system deployed in the edge-cloud for real-time monitoring of mobile devices and environment changes. A model pruning and federated bidirectional distillation (Bi-distillation) mechanism is then developed locally for the lightweight model training, while a model splitting scheme with a lightweight data augmentation mechanism is developed globally to separately optimize the aggregation weights based on a splitted neural network structure (i.e., the encoder and classifier) in a more targeted manner, which can work together to effectively reduce the overall communication cost and improve the non-IID problem. Experiment and evaluation results compared with three baseline methods using two different real-world datasets demonstrate the usefulness and outstanding performance of our proposed FRL model in communication-efficient model training and non-IID issue alleviation for high-speed mobile network scenarios.

The proliferation in embedded and communication technologies made the concept of the Internet of Medical Things (IoMT) a reality. Individuals’ physical and physiological status can be constantly monitored, and numerous data can be collected through wearable and mobile devices. However, the silo of individual data brings limitations to existing machine learning approaches to correctly identify a user’s health status. Distributed machine learning paradigms, such as federated learning, offer a potential solution for privacy-preserving knowledge sharing without sending raw personal data. However, federated learning is vulnerable to harmful participants that can degrade the overall model quality by sharing low-quality data. Therefore, it is critical to select suitable participants to ensure the accuracy and efficiency of federated learning. In this article, a unique clustering-based approach is proposed to use social context data for participant selection. Different edge participant groups will be established, and group-specific federated learning will be performed. The models of various edge groups will be further aggregated to strengthen the robustness of the global model. The experimental results demonstrated that through participant selection, clustering-based hierarchical federated learning can achieve better results with less participants in two different IoMT applications for ECG and human motion monitoring. This shows the efficacy of the proposed method in improving federated learning performance and efficiency in various IoMT applications.

Calculating system damage caused by a cyberattack can help in understanding the impact and destructiveness of the attack to discover system security weaknesses. Thus, system damage calculations is important in the process of network offense–defense confrontation. However, there is little research on attack damage calculation. Current methods are unable to quantitatively evaluate the impact of an attack in a rational and accurate way. The lack of theoretical support and the complexity of both cyber systems and attacks bring tremendous challenges to attack damage calculations. In this paper, we propose a novel method called ADCaDeM to enable quantitative attack damage calculation based on a differential manifold. The damage is a negative utility produced by attack behaviors on an attacked object, which can be characterized and expressed by its attributes. We formally map the attack behaviors into a space constructed by the attributes of the attacked object in a mathematical way. Then, we propose an algorithm to construct these attributes as a differential manifold to represent their algebraic topological structure. According to the theory of tangent vectors and geodesics on the differential manifold, we can calculate attack behavioral utility in a physical way, such as computing the work done in physics. Regardless of the complexity of the dimensional structure of the attributes, the differential manifold structure can reasonably represent and calculate the damage caused by an attack. We simulate a data theft attack and a web penetration attack to test the performance of ADCaDeM and compare it with existing methods. Our experimental results illustrate ADCaDeM's advance in terms of rationality for calculating the damage caused by some typical cyberattacks.

Traditional data access control schemes only prevent unauthorized access to private data with a single owner. They are not suitable for application in a Multi-Level Data Processing (MLDP) scenario, where data are processed by a series of parties who also insert new data. Hence, the accumulated dataset should be protected through access control handled by hierarchically-structured parties who are at least partial data owners in MLDP. Existing multi-owner access control schemes mainly focus on controlling access to co-owned data of multiple entities with the equal ownership, but seldom investigates how to apply access control in MLDP. In this paper, we base the off-the-shelf Trusted Execution Environment (TEE), Intel SGX, to propose an Efficient and Secure Multi-owner Access Control scheme (ESMAC) for access authorization in MLDP. Moreover, to prevent unauthorized data disclosure by non-root data owners aiming to gain extra profits, we further introduce undercover polices to supervise their behaviors. Specifically, we design a data protection scheme based on game theory to decide the payoffs and punishments of honest and dishonest data owners, which motivates data owners to behave honestly when claiming ownership over data. Through comprehensive security analysis and performance evaluation, we demonstrate ESMAC's security and effectiveness.

Privacy preservation is highly expected in the Bitcoin Network. However, only applying pseudonyms cannot completely ensure anonymity/unlinkability between payers and payees. Current approaches mainly depend on a mixer service, which obfuscates payer-payee relationships of transactions. While the mixer service improves transaction privacy, it still suffers from some severe security threats (e.g., DoS attack and collusion attack), and does not support effective and reliable off-chain payment in a parallel mode. In this article, we propose a mixing protocol for the Bitcoin Network based on zero-knowledge proof, called SofitMix. It is the first mixing protocol that can effectively resist both the DoS attack and the collusion attack. It can also support a set of parallel off-chain payments in a reliable way no matter whether some payers abort a transaction. We analyze and prove SofitMix security following the Universal Composability model with regard to fair exchange, unlinkability, collusion-resistance, DoS-resistance and Sybil-resistance. Through a proof-of-concept implementation, we demonstrate its validity and fairness. We also show its advance on off-chain payment reliability and DoS attack resistance, compared to TumbleBit.

Data deduplication is a technique to eliminate duplicate data in order to save storage space and enlarge upload bandwidth, which has been applied by cloud storage systems. However, a cloud storage provider (CSP) may tamper user data or cheat users to pay unused storage for duplicate data that are only stored once. Although previous solutions adopt message-locked encryption along with Proof of Retrievability (PoR) to check the integrity of deduplicated encrypted data, they ignore proving the correctness of duplication check during data upload and require the same file to be derived into same verification tags, which suffers from brute-force attacks and restricts users from flexibly creating their own individual verification tags. In this paper, we propose a verifiable deduplication scheme called VeriDedup to address the above problems. It can guarantee the correctness of duplication check and support flexible tag generation for integrity check over encrypted data deduplication in an integrative way. Concretely, we propose a novel Tag-flexible Deduplication-supported Integrity Check Protocol (TDICP) based on Private Information Retrieval (PIR) by introducing a novel verification tag called${note\ set}$, which allows multiple users holding the same file to generate their individual verification tags and still supports tag deduplication at the CSP. Furthermore, we make the first attempt to guarantee the correctness of data duplication check by introducing a novel User Determined Duplication Check Protocol (UDDCP) based on Private Set Intersection (PSI), which can resist a CSP from providing a fake duplication check result to users. Security analysis shows the correctness and soundness of our scheme. Simulation studies based on real data show the efficacy and efficiency of our proposed scheme and its significant advantages over prior arts.

Voiceprint Authentication as a Service (VAaS) offers great convenience due to ubiquity, generality, and usability. Despite its attractiveness, it suffers from user voiceprint leakage over the air or at the cloud, which intrudes user voice privacy and retards its wide adoption. The literature still lacks an effective solution on this issue. Traditional methods based on cryptography are too complex to be practically deployed while other approaches distort user voiceprints, which hinders accurate user identification. In this article, we propose a leakage resilient user authentication cloud service with privacy preservation based on random personal voice challenges, named VOLERE (VOice LEakage REsilient). It applies a novel voiceprint synthesis method based on a Log Magnitude Approximate (LMA) vocal tract model to fuse original voices of different speaking modes in order to generate a synthesized voiceprint for authentication. Thus, raw voiceprints of users can be well protected. We implement VOLERE and conduct a series of user tests. Experimental results show sound performance of VOLERE regarding authentication accuracy, efficiency, stability, leakage resilience and user acceptance. In particular, its authentication accuracy is reasonably stable regardless user nationality, gender, age, elapsed time, and environment, as well as variance of speaking modes.

Ambient backscatter communication (AmBC) enables ultra-low-power communications by backscattering ambient radio frequency (RF) signals and harvesting energy simultaneously. It has emerged as a cutting-edge technology for supporting a variety of Internet of Things (IoT) applications. However, existing research lacks effective secret key sharing schemes for safeguarding communications between resource-constrained backscatter devices (BDs) in AmBC systems. In this paper, we present, Tri-Channel, a novel physical layer key generation scheme between two BDs by multiplying downlink signals and backscatter signals to obtain the information of a triangle channel as a shared random secret source for key generation. In particular, we analyze the security of our scheme under both passive and active attacks, concretely Eavesdropping Attack (EA), Control Channel Attack (CCA), Signal Manipulative Attack (SMA), and Untrusted RF-Source Attack (URSA). Through theoretical analysis and simulations by comparing with a traditional scheme (named Tradi-Channel), we found that our scheme consistently outperforms the Tradi-Channel under the EA and two active attacks (CCA and SMA). In addition, it shows better security performance under URSA, which is proposed based on the unauthenticated characteristic of BDs in Tri-Channel, even though URSA is more vital than SMA. Concretely, Tri-Channel’s secret key rate (SKR) outperforms Tradi-Channel’s under the above four passive and active attacks. This implies that our scheme is advanced in terms of both security and efficiency of key generation. Numerous extensive simulations further prove our theoretical analysis results.

Physics theory integrated machine learning models enhance the interpretability and performance of artificial intelligence (AI) techniques to real-world industrial applications, such as the fault detection and diagnosis (FDD) of air handling units (AHU). Traditional machine learning-based automated FDD model demonstrates a high classification accuracy with sufficient training data samples, however, suffers from physical interpretation of the machine learning models. In this article, a physical model integrated Wasserstain generative adversarial network (WGAN) model is presented for AHU FDD with a scenario of insufficient training data samples. The proposed solution tackles the real-world problem of AHU FDD and enhances the model interpretability significantly. A transformer-WGAN model is designed to further improve the proposed FDD framework. Experimental results show that the proposed method outperforms existing AHU FDD methods with imbalanced real-world training data samples.

Voiceprint authentication provides great convenience to users in many application scenarios. However, it easily suffers from spoofing attacks including speech synthesis, speech conversion, and speech replay. Liveness detection is an effective way to resist these attacks. But existing methods suffer from many disadvantages, such as extra deployment costs due to precise data collection, environmental disturbance, high computational overhead, and operational complexity. A uniform platform that can offer voiceprint authentication as a service (VAaS) over the cloud is also lacked. Hence, it is imperative to design an economic and effective method for liveness detection in voiceprint authentication. In this article, we propose a novel liveness detection method named LiVoAuth for voiceprint authentication. It applies a randomly generated vector sequence as liveness detection mode (LDM), corresponding to a random challenge code used for authentication. We implement LiVoAuth and conduct a series of user studies to evaluate its performance in terms of accuracy, stability, efficiency, security, and user acceptance. Experimental results demonstrate its advantages compared with cutting-edge methods

With the development of the Internet of Things (IoT) and 5G technologies, IoT devices deployed on roads are able to collect a large amount of traffic data at any time. Road networks can be easily constructed into a graph structure with spatial-temporal features, and how to use these spatial-temporal features for dynamic traffic flow forecasting has become a heated issue. Although existing studies bring in the consideration of periodicity to deal with spatial-temporal sequence dependence, the similarity of time-varying relationships among cross-spatial nodes has not been well discussed. In this paper, we propose a Graph Attention Network with Spatial-Temporal Clustering (GAT-STC), which considers the so-called recent-aware features and periodic-aware features, to improve the Graph Neural Network (GNN)-based traffic flow forecasting in Intelligent Transportation System (ITS). Specifically, for the recent-aware feature extraction, a distance-based Graph Attention Network (GAT) is improved and constructed to better utilize the hidden features of neighbor nodes within a reliable distance during the recent time interval, thus can effectively capture the dynamic changes in spatial feature representation. For the periodic-aware feature extraction, a spatial-temporal clustering algorithm, in which both features in terms of nodes’ current traffic states and similar trends in terms of their dynamic changes are taken into account, is developed and applied to achieve better learning efficiency. Experiments using three public traffic datasets demonstrate the higher accuracy and better efficiency of our proposed model for traffic flow forecasting, compared with five baseline methods in ITS.

Hardware-enabled enclaves have been applied to efficiently enforce data security and privacy protection in cloud database services. Such enclaved systems, however, are reported to suffer from I/O-size (also referred to as communication-volume)-based side-channel attacks. Albeit differentially private padding has been exploited to defend against these attacks as a principle method, it introduces a challenging bi-objective parametric query optimization (BPQO) problem and current solutions are still not satisfactory. Concretely, the goal in BPQO is to find a Pareto-optimal plan that makes a tradeoff between query performance and privacy loss; existing solutions are subjected to poor computational efficiency and high cloud resource waste. In this article, we propose a two-phase optimization algorithm called TPOA to solve the BPQO problem. TPOA incorporates two novel ideas:divide-and-conquerto separately handle parameters according to their types in optimization for dimensionality reduction;on-demand-optimizationto progressively build a set of necessary Pareto-optimal plans instead of seeking a complete set for saving resources. Besides, we introduce an acceleration mechanism in TPOA to improve its efficiency, which prunes the non-optimal candidate plans in advance. We theoretically prove the correctness of TPOA, numerically analyze its complexity, and formally give an end-to-end privacy analysis. Through a comprehensive evaluation on its efficiency by running baseline algorithms over synthetic and test-bed benchmarks, we can conclude that TPOA outperforms all benchmarked methods with an overall efficiency improvement of roughly two orders of magnitude; moreover, the acceleration mechanism speeds up TPOA by 10-200×.

Software vulnerabilities are easily propagated through code reuses, which pose dire threats to software system security. Automatic patch presence test offers an effective way to detect whether vulnerabilities have been patched, which is significant for large-scale software system maintenance. However, most existing approaches cannot handle binary codes. They suffer from low accuracy and poor efficiency. None of them are resilient to version gap, function size, and patch size. To tackle the above problems, we proposePatchDiscovery, a patch presence test approach to identify binary vulnerabilities by extracting key basic blocks of patch and vulnerability as their signatures for patch discovery. We propose an efficient and accurate basic block matching method over the normalized and simplified control flow graphs (CFGs) of a vulnerable function (VF) and its patched function (PF) to precisely locate a vulnerability and a patch. Then, we conduct fine-grained patch-level analysis on the patch and the vulnerability to gain their key basic blocks as the signatures of PF and VF for patch presence test. Concretely, the key basic blocks of PF and VF are separately searched in a target function (TF) to identify whether the TF is more similar to PF or VF, i.e., patched or not. Extensive experiments based on two real-world binary datasets that contain 524 common vulnerabilities and exposures (CVEs) with 11607 target functions reveal thatPatchDiscoveryis very effective and efficient. It achieves$92.2\%$F-measure and takes only 0.091s on average to test a target function. It is also resilient to version gap, patch size, and function size to a good extent. Moreover, it is outperforming the state-of-the-art works and has a much faster testing speed for large-scale patch detection. Moreover,PatchDiscoveryachieves good performance in firmware vulnerability discovery scenario.

Decentralized crowdsourcing removes the dependence on a trusted centralized platform based on blockchain and ensures system stability through the consensus of miners. The lack of centralized supervision requires all kinds of system nodes to voluntarily participate while their behaviors are profit-driven and unpredictable, thus introducing challenges to system performance. Moreover, the nodes in a decentralized crowdsourcing system inherently observe little information about the system status; therefore, it is difficult for them to discover and adopt theoretically optimal strategies. Current literature still lacks an effective mechanism to motivate the participation of all types of nodes. To this end, this paper employs a two-layer game model to simulate the interactions in the decentralized crowdsourcing system for investigating the participation willingness of different system nodes. Specifically, we apply a Stackelberg game to model the interactions of a crowdsourcing requester and other nodes, where the requester decides its reward policy and the others respond by selecting their roles to play. In addition, the interaction of the bounded rational other nodes is further represented as an evolutionary game. After analyzing the game model, we further design an incentive mechanism to maximize the requester utility while motivating other nodes to actively participate in the crowdsourcing. Through experimental simulations, we verify the effectiveness of the proposed incentive mechanism.

Cloud computing offers resource-constrained users big-volume data storage and energy-consuming complicated computation. However, owing to the lack of full trust in the cloud, the cloud users prefer privacy-preserving data computation with correctness verification. However, cryptography-based schemes introduce high computational costs to both the cloud and its users for verifiable computation with privacy preservation, which makes it difficult to support complicated computations in practice. Intel Software Guard Extensions (SGX) as a trusted execution environment is widely researched in various fields, and is regarded as a promising way to achieve efficient outsourced data computation with privacy preservation over the cloud. But we find two types of threats towards the computation with SGX: Disarranging Data-Related Code threat and Output Tampering and Misrouting threat. In this paper, we depict these threats using formal methods and propose an efficient and secure scheme to resist the threats and realize verifiable computation for Intel SGX. We prove the security and show the efficiency and correctness of our proposed scheme through theoretic analysis and extensive experiments. Furthermore, we compare our scheme with some cryptography-based schemes to show its high efficiency.

Learning-based sketches have been widely studied as an improvement of traditional sketches that achieves high efficiency in terms of both time and space. It uses a learning model to reveal and exploit underlying patterns of input data for helping traditional sketches obtain accurate frequency estimation with memory efficient. However, recent studies only focus on the performance improvement of learning-based sketches and pay little attention to security. The potential security problems can be easily exploited by an adversary to make learning-based sketches inaccurate. In this paper, we firstly explore the security issues of learning-based sketches with regard to estimation accuracy and memory overhead. Some adversarial scenarios of learning model and backup sketch are modeled according to the knowledge and capabilities of an adversary. Then, we propose four attacks to deceive learning-based sketch, namely counterfeit attack, targeted point attack, memory occupation attack, and blind increment attack. We conduct a series of experiments based on real-world datasets and verify that the proposed attacks highly degrade the performance of learning-based sketch even when the adversary knows nothing about it.

Software Side Channel Vulnerabilities (SSCVs) cause serious security threats, which introduces a big challenge to software development. With the sustaining growth of software complexity and scale, SSCV detection has become a tedious work. Existing methods suffer from efficiency, accuracy and generality problems, and ignore the detection of vulnerability variants. Applying machine learning is promising due to high efficiency and automation, but training an effective model is still an open issue due to the lack of side-channel vulnerability data. In this paper, we propose a novel two-stage SSCV detection method based on similarity calculation and deep learning. We target three types of vulnerability variants that have different degrees of similarity to original ones. The first detection stage applies Deterministic Finite Automata (DFA) and Trie tree to regularize software codes for detecting vulnerability Variants 1 and 2 through similarity calculation. The second stage uses Long Short-Term Memory and Neural Network Classifier (LSTM-NNClassifier) to discover vulnerability Variant 3. In addition, we offer a code augmentation method to construct a sufficient dataset to train the LSTM-NNClassifier for overcoming the problem of lacking training data. Extensive experiments based on real world data show the efficiency and accuracy of our detection method.

Voiceprint authentication is a promising approach for user authentication due to its low acquisition cost and non-contact characteristics. However, most of existing voiceprint authentication systems directly store user voiceprint templates in a database, without taking any effective measures to protect user privacy. Once the voiceprint templates in the database are leaked, user voice information becomes public, which brings severe security threats to the users and impact practical applications of a voiceprint authentication system. Few literature works study privacy-preserving voiceprint authentication although it is particularly needed. Most of existing solutions based on cryptography suffer from high computational costs. But usability of some efficient systems is poor due to additional interactions with users. To tackle the above issues, this paper proposes VoiceSketch, a privacy-preserving voiceprint authentication system based on a secure sketch to protect the privacy of user voiceprint templates with high usability. VoiceSketch does not store the voiceprint templates directly. Instead, it uses a secure sketch to correct errors between multiple voiceprint features of the same user and use cryptographic hash function to extract an authentication key from a user’s voiceprint template. We analyze the security of VoiceSketch based on secure sketch and hash function. We also implement VoiceSketch and design a series of experiments to verify its accuracy and effectiveness.

Mobile crowdsourcing (MCS) has become an effective data collection method due to its mobility, low cost, and flexibility. However, since centralized MCS confronts severe security and privacy risks in reality, many researchers are devoted to building a decentralized MCS system based on blockchain. Despite the effectiveness of these schemes, they fail to offer anonymous authentication on the trust of MCS nodes, although privacy is a main concern in MCS and trust plays an important role in a series of MCS activities, such as worker selection and truth discovery. Nevertheless, anonymous authentication on trust is not a trivial issue since trust evaluation usually conflicts with anonymity, which is a necessary privacy requirement in an open MCS environment. To tackle this problem, we leverage Intel software guard extension (SGX) and propose a scheme to anonymously authenticate trust with trustworthy trust evaluation in a blockchain-based MCS system. The scheme employs an SGX-enabled cloud server to periodically alter user public/private key pairs and mix newly altered keys among a number of faked keys in order to ensure unlinkability. Besides, we consider the unique features of MCS and work out a novel trust evaluation method by aggregating both subjective feedback and objective behaviors. Finally, we conduct several analyses and experiments to illustrate its security and efficiency.

The fifth-generation (5G) cellular network is expected to provide submeter positioning accuracy without draining the battery of user equipment (UE). As a solution, ultradense network (UDN) deployment and network-based positioning were proposed. However, the openness of UDN and the vulnerability of network devices [e.g., access nodes (ANs)] make it easy for attackers to poison such a positioning system. However, no existing work explores how to overcome this issue. This article concentrates on jamming and collusion attacks in the network-based positioning system. Specifically, we design a novel scheme that contains three functional modules to erase the influence of these attacks. A truth discovery module applies a clustering-based method aiming to generate the most approximate position value and find out suspicious signals. Based on neural network models, we further develop an attack detection module and an attack tracing module to perceive attacked UE and locate malicious or attacked ANs. Through simulation, we conduct extensive experiments to illustrate the effectiveness of our scheme. The result shows high detection and tracing accuracy with very simple neural network models, which also implies the potential of our proposed scheme in practical deployment.

Blockchain has been applied for decentralized crowdsourcing management by deploying a number of miners to reach a consensus on crowdsourced task allocation and payment decision. In a blockchain-based crowdsourcing system (BCS), incentive becomes essential to motivate the participation and cooperation of all system entities. However, existing literature scarcely investigates how to motivate heterogeneous crowdsourcers, workers, and miners simultaneously toward satisfying multiple objectives without the support of centralized management. In this article, we propose GAIMMO, a novel grade-driven auction-based incentive mechanism for BCS with multiple objectives in mind: crowdsourcer utility maximization, social welfare maximization, social grade maximization, and social cost minimization. Concretely, we propose a grade-based task sorting (GTS) algorithm to determine the service priority of heterogeneous crowdsourcers in order to motivate their cooperative behaviors, which consequently maximizes crowdsourcer utility when combining with the carefully designed utility functions of other system entities. We propose a grade-based utility function of workers and employ a hierarchical premium-based task assignment (PTA) algorithm to realize social welfare maximization, social grade maximization, and social cost minimization. We further propose a fixed-grade-sum and grade-based reward-sharing (FGSGRS) method to encourage fast block generation and motivate high-grade miners without damaging the profits of the crowdsourcers. We conduct simulation-based experiments to show the effectiveness and advance of our proposed incentive mechanism in stimulating the participation willingness of high-grade system entities and achieving the multiple objectives.

High-accuracy positioning has drawn huge attention with the potential in enhancing location-aware communications, intelligent transportation, and so on. The emergency of the fifth-generation (5G) technologies, such as device-to-device (D2D) communications, vehicle-to-vehicle (V2V) communications, and crowdsourcing networks is expected to help achieve highly accurate positioning. By employing nearby mobile terminals to estimate position cooperatively, these technologies can improve positioning accuracy effectively, especially in indoor and urban areas. Despite the benefit, the potential information disclosure in these positioning systems threatens the engagement of public participants (also known as reference points). The location of the reference points and their distances to a target point is quite sensitive since they can be easily used to locate the reference points once exposed. Though existing solutions based on Paillier homomorphic encryption have been proposed to preserve the privacy of distance information. The sensitivity of reference points’ locations is ignored. Additionally, the adoption of Paillier introduces a high computation cost, which is impractical in reality. To address the above problems, this article proposes two efficient protocols, named Pub-pos and Pri-pos. By leveraging matrix concatenation and multiplication, these two protocols can disguise the original sensitive data, including both distance and location information, into a random matrix while keeping a positioning result intact. We analyze the security strength, complexity, and optimal variable selection of the proposed protocols. Numerous experiments verify that our proposed protocols have significant efficiency improvement in both system and individual levels compared with a Paillier-based solution.

Analyzing non-labeled data is a major concern in the field of intrusion detection as the attack clusters are continuously evolving which are unknown for the system. Many studies have been conducted on different techniques such as clustering to solve this issue. Consequently, in this paper the clustering techniques are applied based on the packets’ similarity to categorize unknown traffic. After clustering is done by the proposed architecture, the security investigator analyzes one packet from each cluster (instead of thousands of packets) and generalize the result of analysis to all packets belonging to the cluster. The proposed architecture, namely Associated Density Based Clustering (ADBC) applies multiple unsupervised algorithms and a co-association matrix to detect attack clusters of any shape as long as they have density-connected elements. Furthermore, the architecture automatically determines the best number of clusters in order to categorize non-labeled data. The performance of proposed architecture is evaluated based on the various metrics, while its generalization capability is tested with three publicly available datasets.

Speaker recognition has become very popular in many application scenarios, such as smart homes and smart assistants, due to ease of use for remote control and economic-friendly features. The rapid development of SRSs is inseparable from the advancement of machine learning, especially neural networks. However, previous work has shown that machine learning models are vulnerable to adversarial attacks in the image domain, which inspired researchers to explore adversarial attacks and defenses in Speaker Recognition Systems (SRS). Unfortunately, existing literature lacks a thorough review of this topic. In this paper, we fill this gap by performing a comprehensive survey on adversarial attacks and defenses in SRSs. We first introduce the basics of SRSs and concepts related to adversarial attacks. Then, we propose two sets of criteria to evaluate the performance of attack methods and defense methods in SRSs, respectively. After that, we provide taxonomies of existing attack methods and defense methods, and further review them by employing our proposed criteria. Finally, based on our review, we find some open issues and further specify a number of future directions to motivate the research of SRSs security.

The rapid advancement of cloud computing has promoted the development of cloud storage services. One of the biggest concerns of cloud users is whether the completeness and recoverability of data can be guaranteed when cloud servers encounter problems. Only when the integrity of data is fully guaranteed can users consume cloud storage with confidence, especially in a complicated cloud environment with multiple clouds. However, the literature still lacks a thorough survey on cloud data integrity auditing for both single copy and multiple replicas. In this article, we survey and compare existing auditing schemes for single copy and multiple replicas based on a set of criteria. Based on our review and analysis, we discuss open issues, potential applications and future directions in the field of the integrity auditing in the cloud, including the implications of such trendy topics as merging blockchain and edge computing into data integrity auditing.

Security-related data collection is an essential part for attack detection and security measurement in Mobile Ad Hoc Networks (MANETs). A detection node (i.e., collector) should discover available routes to a collection node for data collection and collect security-related data during route discovery for determining reliable routes. However, few studies provide incentives for security-related data collection in MANETs. In this article, we propose B4SDC, a blockchain system for security-related data collection in MANETs. Through controlling the scale of Route REQuest (RREQ) forwarding in route discovery, the collector can constrain its payment and simultaneously make each forwarder of control information (namely RREQs and Route REPlies, in short RREPs) obtain rewards as much as possible to ensure fairness. At the same time, B4SDC avoids collusion attacks with cooperative receipt reporting, and spoofing attacks by adopting a secure digital signature. Based on a novel Proof-of-Stake consensus mechanism by accumulating stakes through message forwarding, B4SDC not only provides incentives for all participating nodes, but also avoids forking and ensures high efficiency and real decentralization. We analyze B4SDC in terms of incentives and security, and evaluate its performance through simulations. The thorough analysis and experimental results show the efficacy and effectiveness of B4SDC.

Learning a proper distance for clustering from prior knowledge falls into the realm of semisupervised fuzzy clustering. Although most existing learning methods take prior knowledge (e.g., pairwise constraints) into account, they pay little attention to local knowledge of data, which, however, can be utilized to optimize the distance. In this article, we propose a novel distance learning method, which learns from the Group-level information, for semisupervised fuzzing clustering. We first present a new format of constraint information, called Group-level constraints, by elevating the pairwise constraints (must-links and cannot-links) from point level to Group level. The Groups, generated around data points contained in the pairwise constraints, carry not only the local information of data (the relation between close data points) but also more background information under some given limited prior knowledge. Then, we propose a novel method to learn a distance by using the Group-level constraints, namely, Group-based distance learning, in order to optimize the performance of fuzzy clustering. The distance learning process aims to pull must-link Groups as close as possible while pushing cannot-link Groups as far as possible. We formulate the learning process with the weights of constraints by invoking some linear and nonlinear transformations. The linear Group-based distance learning method is realized by means of semidefinite programming, and the nonlinear learning method is realized by using the neural network, which can explicitly provide nonlinear mappings. Experimental results based on both synthetic and real-world datasets show that the proposed methods yield much better performance compared to other distance learning methods using pairwise constraints.

Facing big network traffic data, effective data compression becomes crucially important and urgently needed for estimating host cardinalities and identifying super hosts. However, the current literature confronts several challenges: incapability of simultaneously measuring various types of host cardinalities and inability to efficiently reconstruct super host addresses. To address these challenges, in this article, we propose a novel sketch data structure, named SuperSketch, to simultaneously measure multiple types of host cardinalities with the purpose of efficiently identifying super hosts. SuperSketch has two significant characteristics: multi-dimensionality and reversibility. The multi-dimensionality makes SuperSketch capable of simultaneously measuring Source Cardinality, Destination Cardinality, and Destination Port Cardinality. The reversibility allows SuperSketch to accurately and quickly reconstruct the original addresses of super hosts once they are identified. We conduct both theoretical analysis and performance evaluation based on real-world network traffic. Experimental results show that SuperSketch achieves outstanding performance for multi-cardinality measurement, super host identification, and host address reconstruction.

Super host refers to the host that has a high cardinality or exhibits a big change in a network. Facing big-volume network traffic, sketches have been widely applied to identify super hosts in an efficient and accurate way. However, most sketches cannot flexibly balance memory usage and accuracy in host cardinality estimation. Setting an inappropriate counter size for a sketch could either lead to inaccurate host cardinality estimation or cause memory waste. In order to solve this issue, we propose a novel extensible and reversible sketch, named ExtendedSketch, to achieve accurate super host identification with high memory efficiency. The core idea of ExtendedSketch is to monitor low-cardinality hosts with small-sized counters while dynamically extending the size of counters when monitoring high-cardinality hosts by applying an adaptive extension strategy. Such the strategy can adaptively increase counter size according to network traffic status at runtime, which not only ensures the accuracy of high-cardinality host estimation but also avoids unnecessary memory consumption. We perform theoretical analysis and conduct a series of experimental evaluations on ExtendedSketch based on real world network traffic. Experimental results show that under same memory usage, compared to the state-of-the-art, ExtendedSketch achieves$1.4{ \sim }7.5$times smaller error rate in estimating host cardinality with$1.9{ \sim }26.7$times better accuracy on super host identification and$95 {\sim }2^{15}$times faster speed on abnormal address reconstruction. Its advance in accuracy and efficiency demonstrates the practical significance of ExtendedSketch for super host identification.

Backscatter communication (BC) enables ultra-low-power communications and allows devices to harvest energy simultaneously. But its practical deployment faces severe security threats caused by its nature of openness and broadcast. Authenticating backscatter devices (BDs) is treated as the first line of defense. However, complex cryptographic approaches are not desirable due to the limited computation capability of BDs. Existing physical layer authentication schemes cannot effectively support BD mobility, multiple attacker identification and attacker location tracing in an integrated way. To tackle these problems, this paper proposes BCAuth, a multi-stage authentication and attack tracing scheme based on the physical spatial information of BDs to realize enhanced BD authentication security for both static and mobile BDs. After initial authentication based on BD identity with its position information registration, preemptive authentication and re-authentication are performed according to spatial correlation of backscattered signal source locations associated with the BD. By exploiting clustering-based analysis on spacial information, BCAuth is capable of determining the number of attackers and localizing their positions. In addition, we propose a reciprocal channel-based method for BD re-authentication with better authentication performance than the clustering-based method for mobile BDs when the BDs is able to measure received signal strength (RSS), which also enables mutual authentication. We theoretically analyze BCAuth security and conduct extensive numerical simulations with various settings to show its desirable performance.

With the emergence of various convolutional neural network (CNN)-based applications and the rapid growth of CNN model scale, the resource-constricted end devices can hardly deploy CNN-based applications. Current work optimizes the CNN model on edge servers and deploys the optimized model on devices in an edge computing environment. However, most of them only optimize the resource consumption within or across models solely, whereas neglecting the other side. In this article, we propose a novel CNN-based resource optimization approach (CroApp) that not only optimizes the resource consumption within the CNN model but also pays attention to resource optimization across the applications. Specifically, we adopt model compression as the “inner-model” optimization method, as well as computation sharing as the “intermodel” optimization method. First, during “inner-model” optimization, the CroApp prunes unnecessary parameters within the model on edge servers to reduce the scale of the model. Then, during “intermodel” optimization, the CroApp trains a set of shareable models based on the pruned model and sends these shareable models to end devices. Finally, the CroApp adaptively adjusts the shared models to reduce resource consumption. The experimental results show that the CroApp outperforms the state-of-the-art approaches in terms of resource reduction, scalability, and application performance.

Smart manufacturing aims to support highly customizable production processes. Therefore, the associated machine intelligence needs to be quickly adaptable to new products, processes, and applications with limited training data while preserving data privacy. In this article, a new federated transfer learning framework, federated transfer learning for cross-domain prediction, is proposed to address the challenges of data scarcity and data privacy faced by most machine learning approaches in modern smart manufacturing with cross-domain applications. The framework architecture consists of a central server and several groups of smart devices, where each group handles a different application. The existing applications can share their knowledge through the central server as base models, while new applications can convert a base model to their target-domain models with limited application-specific data using a transfer learning technique. Meanwhile, the federated learning scheme is deployed within a group to further enhance the accuracy of the application-specific model. The integrated framework allows model sharing across the central server and different smart devices without exposing any raw data and, hence, protects the data privacy. Two public datasets, COCO and PETS2009, which represent the source and target applications, are employed for evaluations. The simulation results show that the proposed method outperforms two state-of-the-art machine learning approaches by achieving better learning efficiency and accuracy.

As the sensitivity of position, the privacy protection in both 5G positioning and its further application in location-based services (LBSs) has been paid special attention and studied. Solutions based on k-anonymity, homomorphic encryption, and secure multi-party computation have been proposed. However, these solutions either require a trusted third party or incur heavy overheads. Besides, there still lacks an integrated solution that can protect privacy for both positioning and LBS provision. Based on Intel SGX, this article proposes a novel light-weight scheme that can protect privacy in both 5G positioning and its further applications in LBS provision in an integrated way. Through secret sharing, the proposed scheme can also support multiple location-based service providers without frequent key exchange. We seriously analyze the security of our scheme. Based on scheme implementation, its efficiency is proved through the performance evaluation conducted over a real-world database.

Wirelessly powered backscatter communications (WPBC) is an emerging technology for providing continuous energy and ultra-low power communications. Despite some progress in WPBC systems, resource allocation for multiple devices towards secure backscatter communications (BC) and efficient-energy harvesting (EH) requests a deep-insight investigation. In this paper, we consider a WPBC system in which a full-duplex access point (AP) transmits multi-sinewave signals to power backscatter devices (BDs) and injects artificial noise (AN) to secure their backscatter transmissions. To maximize the minimum harvested energy and ensure fairness and security of all BDs, we formulate an optimization problem by jointly considering the backscatter time, power splitting ratio between multi-sinewave and AN, and signal power allocation. For a single-BD system, we characterize the achievable secrecy rate-energy region with a non-linear energy harvester and propose two algorithms to solve an energy maximization problem. We then analyze the effect of multi-sinewave and AN signals on BD’s secrecy rate and harvested energy through simulations and proof-of-concept experiments. For a multi-BD system, we propose an iterative algorithm by leveraging block successive upper-bound minimization (BSUM) techniques to solve the non-convex problem of fair resource allocation and show its convergence and complexity. Numerical results show the proposed algorithm achieves optimal and equitable harvested energy for all BDs with satisfying the security constraint.

Device-to-Device (D2D) cooperative location verification allows a device to verify its location with the help of neighbouring devices. It is especially handy in location-based services where location verification is essential. However, the exposure of device location during verification rises a big privacy risk for participants since they have to send their real-time locations to unknown verifiers holding anonymous identities. Thus, a privacy-preserving solution is urgently needed to provide verification without location disclosure. Traditional solutions based on Paillier and garbled circuits can solve the problem but also introduce high cost. Based on order-preserving encryption, we propose an efficient protocol with high-security guarantee to address this issue. Apart from rigorous security proof, complexity analysis and extensive experiments are also conducted to evaluate the proposed solution. The results compared with related work show that order-preserving encryption based mechanism achieves the best balance with regards to privacy, utility and performance requirements.

Software reuse, especially partial reuse, poses legal and security threats to software development. Since its source codes are usually unavailable, software reuse is hard to be detected with interpretation. On the other hand, current approaches suffer from poor detection accuracy and efficiency, far from satisfying practical demands. To tackle these problems, in this paper, we propose ISRD, an interpretation-enabled software reuse detection approach based on a multi-level birthmark model that contains function level, basic block level, and instruction level. To overcome obfuscation caused by cross-compilation, we represent function semantics with Minimum Branch Path (MBP) and perform normalization to extract core semantics of instructions. For efficiently detecting reused functions, a process for "intent search based on anchor recognition" is designed to speed up reuse detection. It uses strict instruction match and identical library call invocation check to find anchor functions (in short anchors) and then traverses neighbors of the anchors to explore potentially matched function pairs. Extensive experiments based on two real-world binary datasets reveal that ISRD is interpretable, effective, and efficient, which achieves 97.2% precision and 94.8% recall. Moreover, it is resilient to cross-compilation, outperforming state-of-the-art approaches.

Ambient backscatter communication (AmBC), which enables energy harvesting and ultra-low-power communication by utilizing ambient radio frequency (RF) signals, has emerged as a cutting-edge technology to realize numerous Internet of Things (IoT) applications. However, the current literature lacks efficient secret key sharing solutions for resource-limited devices in AmBC systems to protect the backscatter communications, especially for private data transmission. Thus, we propose a novel physical layer key generation scheme between backscatter devices (BDs) by exploiting received superposed ambient signals. Based on the repeated patterns (i.e., cyclic prefix in OFDM symbols) in ambient RF signals, we present a joint transceiver design of BD backscatter waveform and BD receiver to extract the downlink signal and the backscatter signal from the superposed signals. By multiplying the downlink signal and the backscatter signal, we can actually obtain the triangle channel information as a shared random secret source for key generation. Besides, we study the trade-off between the rate of secret key generation and harvested energy by modeling it as a joint optimization problem. Finally, extensive numerical simulations are provided to evaluate the key generation performance, energy harvesting performance, and their trade-offs under various system settings.

As cloud computing reshapes the global IT industry, an increasing number of business owners have outsourced their datasets to third-party cloud service providers (CSP), which in turn answer data queries from end users on their behalf. A well known security challenge in data outsourcing is that the CSP cannot be fully trusted, which may return inauthentic or unsound query results for various reasons. This paper considers top-k selection queries, an important type of queries widely used in practice. In a top-k selection query, a user specifies a scoring function and asks for the k objects with the highest scores. Despite several recent efforts, existing solutions can only support a limited range of scoring functions with explicit forms known in advance. This paper presents three novel schemes that allow a user to verify the integrity and soundness of any top-k selection query result returned by an untrusted CSP. The first two schemes support monotone scoring functions, and the third scheme supports scoring functions comprised of both monotonically non-decreasing and non-increasing subscoring functions. Detailed simulation studies using a real dataset confirm the efficacy and efficiency of the proposed schemes and their significant advantages over prior solutions.

Attention-based techniques have been successfully used for rating image quality, and have been widely employed for set-based face recognition. Nevertheless, for video face recognition, where the base convolutional neural network (CNN) trained on large-scale data already provides discriminative features, fusing features with only predicted quality scores to generate representation are likely to cause duplicate sample dominant problem, and degrade performance correspondingly. To resolve the problem mentioned above, we propose a redundancy removing aggregation network (RRAN) for video face recognition. Compared with other quality-aware aggregation schemes, RRAN can take advantage of similarity information to tackle the noise introduced by redundant video frames. By leveraging metric learning, RRAN introduces a distance calibration scheme to align distance distributions of negative pairs of different video representations, which improves the accuracy under a uniform threshold. A series of experiments is conducted on multiple realistic data sets to evaluate the performance of RRAN, including YouTube Faces, IJB-A, and IJB-C. In comprehensive experiments, we demonstrate that our method can diminish the overall influence of poor quality components with large proportion in the video and further improve the overall recognition performance with individual difference. Specifically, RRAN achieves a 96.84% accuracy on YouTube Face, outperforming all existing aggregation schemes.

The next-generation mobile cellular communication and networking system (5G) is highly flexible and heterogeneous. It integrates different types of networks, such as 4G legacy networks, Internet of Things (IoT), vehicular ad hoc network (VANET), and wireless local access network (WLAN) to form a heterogeneous network. This easily results in continual vertical handovers between different networks. On the other hand, substantial deployment of small/micro base stations (BSs) brings frequent horizontal handovers within a network. The continual handovers among BSs and various networks expose mobile equipment (ME) to the risk of security and privacy threats. So far, many security and privacy mechanisms have been proposed to ensure secure handover either vertically or horizontally in 5G networks. Nevertheless, there still lacks a thorough survey to summarize recent advances and explore open issues although handover security and privacy are crucial to 5G. In this article, we summarize security and privacy requirements in handovers to resist potential attacks. Following these requirements as the evaluation criteria, we review secure and privacy-preserving handover schemes by categorizing them into two scenarios, i.e., vertical handover and horizontal handover. As for the vertical handover, we review related work from three classes, i.e., handovers within Third-Generation Partnership Project (3GPP) networks, between 3GPP and non-3GPP networks, and between non-3GPP networks. Concerning horizontal handovers, we review related work from two classes, i.e., intramobile service controller (MSC) and inter-MSC handover. Meanwhile, we analyze and compare the technical means and performance of these works in order to uncover open issues and inspire future research directions.

Along with the rapid development of cloud computing, IoT, and AI technologies, cloud video surveillance (CVS) has become a hotly discussed topic, especially when facing the requirement of real-time analysis in smart applications. Object detection usually plays an important role for environment monitoring and activity tracking in surveillance system. The emerging edge-cloud computing paradigm provides us an opportunity to deal with the continuously generated huge amount of surveillance data in an on-site manner across IoT systems. However, the detection performance is still far away from satisfactions due to the complex surveilling environment. In this study, we focus on the multitarget detection for real-time surveillance in smart IoT systems. A newly designed deep neural network model called A-YONet, which is constructed by combining the advantages of YOLO and MTCNN, is proposed to be deployed in an end-edge-cloud surveillance system, in order to realize the lightweight training and feature learning with limited computing sources. An intelligent detection algorithm is then developed based on a preadjusting scheme of anchor box and a multilevel feature fusion mechanism. Experiments and evaluations using two data sets, including one public data set and one homemade data set obtained in a real surveillance system, demonstrate the effectiveness of our proposed method in enhancing training efficiency and detection precision, especially for multitarget detection in smart IoT application developments.

Cyber-physical-social big data concern heterogeneous, multiaspect, large-volume data generated in cyber-physical-social systems (CPSS). Orthogonal tensor SVD (OTSVD) has emerged as a powerful tool to reduce cyber-physical-social big data. In this work, we propose an improved secure high-order-Lanczos based OTSVD for cyber-physical-social big data reduction in clouds. Specifically, to take advantage of the parallel processing capability of cloud computing, the improved secure high-order Lanczos algorithm is derived by restructuring the original high-order Lanczos algorithm such that only one synchronization point per iteration is required. To protect data privacy, the improved secure high-order-Lanczos based OTSVD employs homomorphic encryption integrated with batching technique, and garbled circuits, and makes all computations of the OTSVD algorithm in clouds come true. To our knowledge, this is the first study to efficiently tackle big data reduction in clouds in a privacy-preserving manner. Finally, we prove that our improved approach is secure in semi-trusted model. And we evaluate the proposed improved secure OTSVD on real datasets. The results show that our proposed improved secure approach is efficient and scalable for cyber-physical-social big data reduction.

Pervasive Social Networking (PSN) supports online and instant social activities with the support of heterogeneous networks. Since reciprocal activities among both familiar/unfamiliar strangers and acquaintances are quite common in PSN, it is essential to offer trust information to PSN users. Past work normally evaluates trust based on a centralized party, which is not feasible due to the dynamic changes of PSN topology and its specific characteristics. The literature still lacks a decentralized trust evaluation scheme in PSN. In this article, we propose a novel blockchain-based decentralized system for trust evaluation in PSN, called Social-Chain. Considering mobile devices normally lack computing resources to process cryptographic puzzle calculation, we design a lightweight consensus mechanism based on Proof-of-Trust (PoT), which remarkably improves system effectivity compared with other blockchain systems. Serious security analysis and experimental results further illustrate the security and efficiency of Social-Chain for being feasibly applied into PSN.

The guarantee of social stability comes from many aspects of life, and image information security as one of them is being subjected to various malicious attacks. As a means of information attack, image splicing forgery refers to copying some areas of an image to another image to hide the traces of the original information and leads to grave consequences. Image splicing forgery is extremely complex since the attributes of the two images subjected to the pasting and copying operations are greatly different. In order to solve the issue mentioned above, we propose a method by applying a neural learning network controlled by multiple scales (MCNL-Net) based on U-Net to identify whether an image has been tampered and to locate the tampered regions. Firstly, the learning capacity of MCNL-Net is enhanced by the combination of a residual propagation module and a residual feedback module. An ingenious strategy is designed to control the size of local receptive field in each building block of MCNL-Net. The strategy makes MCNL-Net able to achieve properties and superiorities of multi-scale structure and learn specified features. For further improving the detection performance of MCNL-Net, a block attention mechanism is proposed to control the advanced degree of the input information in each building block. In addition, a MaxBlurPool method is applied into image splicing forgery detection for the first time, preserving the shift-equivariance of a convolutional neural network. Through experiments, we demonstrate that MCNL-Net can achieve more promising results and offer stronger robustness than the state-of-the-art splicing forgery detection methods.

Due to the concern on cloud security, digital encryption is applied before outsourcing data to the cloud for utilization. This introduces a challenge about how to efficiently perform queries over ciphertexts. Crypto-based solutions currently suffer from limited operation support, high computational complexity, weak generality, and poor verifiability. An alternative method that utilizes hardware-assisted Trusted Execution Environment (TEE), i.e., Intel SGX, has emerged to offer high computational efficiency, generality and flexibility. However, SGX-based solutions lack support on multi-user query control and suffer from security compromises caused by untrustworthy TEE function invocation, e.g., key revocation failure, incorrect query results, and sensitive information leakage. In this article, we leverage SGX and propose a secure and efficient SQL-style query framework named QShield. Notably, we propose a novel lightweight secret sharing scheme in QShield to enable multi-user query control; it effectively circumvents key revocation and avoids cumbersome remote attestation for authentication. We further embed a trust-proof mechanism into QShield to guarantee the trustworthiness of TEE function invocation; it ensures the correctness of query results and alleviates side-channel attacks. Through formal security analysis, proof-of-concept implementation and performance evaluation, we show that QShield can securely query over outsourced data with high efficiency and scalable multi-user support.

Encrypted data deduplication, along with different preferences in data access control, brings the birth of hybrid encrypted cloud data deduplication (H-DEDU for short). However, whether H-DEDU can be successfully deployed in practice has not been seriously investigated. Obviously, the adoption of H-DEDU depends on whether it can bring economic benefits to all stakeholders. But existing economic models of cloud storage fail to support H-DEDU due to complicated interactions among stakeholders. In this article, we establish a formal economic model of H-DEDU by formulating the utilities of all involved stakeholders, i.e., data holders, data owners, and Cloud Storage Providers (CSPs). Then, we construct a multi-stage Stackelberg game, which consists of Holder Participation Game, Owner Online Game, and CSP Pricing Game, to capture the interactions among all system stakeholders. We further analyze the conditions of the existence of a sub-game perfect Nash Equilibrium and propose a gradient-based algorithm to help the stakeholders choose near-optimal strategies. Extensive experiments show the feasibility of the proposed algorithm in achieving the Nash Equilibrium of the Stackelberg game. Additionally, we investigate the effects of parameters related to CSP, data owners and data holders on H-DEDU adoption. Our study advises all stakeholders the best strategies to adopt H-DEDU.

Cyber-physical-social systems (CPSS) are revolutionizing the relationships between humans, computers, and things. Outsourcing computation to the cloud can offer resources-constrained enterprises and consumers sustainable computing in CPSS. However, ensuring the security of data in such an outsourced environment remains a research challenge. Principal eigentensor computation has emerged as a powerful tool dealing with multidimensional cyber-physical-social systems data. In this paper, we present two novel secure principal eigentensor computation (SPEC) schemes for sustainable CPSS. To the best of our knowledge, this is the first effort to address SPEC over encrypted data in the cloud without the interaction need between multiple users and cloud. More specifically, we leverage cloud server and trusted hardware component to design a collaborative cloud model. Using the model, we propose (1) a basic SPEC scheme based on homomorphic computing and (2) an efficient SPEC scheme that combines the advantages of homomorphic computing and garbled circuits, and exploits packing technology to reduce computational cost. Finally, we theoretically and empirically analyze the security and efficiency of our SPEC schemes. Findings demonstrate that the proposed schemes provide a secure and efficient way of outsourcing computation for CPSS. In addition, from the cloud user's perspective, our proposal is lightweight.

Wireless networks are usually deployed to cover more overlapping areas, experiencing severe interferences and hence making interference management essential for their viability. Interference alignment (IA) is an effective way of interference management and has thus received significant attention. With IA, at least one degree-of-freedom (DoF) should be used to place the aligned interferences. However, when multiple interferences are from one identical transmitter and to a common destination, IA is not applicable under a one-DoF cost constraint. If these interfering signals are aligned in the same direction at the interfered receiver, they will also overlap with each other at their intended receiver, thus becoming indistinguishable. Moreover, IA is realized by adjusting the spatial feature of disturbance, hence incurring co-channel interference to the interfering transmission-pair’s own communication. To solve this problem, we proposecooperative IA. Instead of adjusting the spatial characteristics of all interferences, we aim to achieve IA by adjusting interferences’ strength along with one or none interference’s signature, based on the interactions among multiple wireless disturbances. We propose two cooperative IA schemes: cooperative IA with space-power adjustment and cooperative IA with power adjustment. With the first method, the overall effect of all interferences is aligned in the orthogonal direction with respect to the desired signal at the interfered receiver. This method modifies the direction of one interference with a properly designed precoding vector and the strength of all interferences via power allocation. Under the second scheme, the strength of all interfering signals is modified so that the overall effect of multiple interferences is orthogonal to the desired transmission while guaranteeing the orthogonality among the interfering signals at their intended receiver. Our theoretical analysis and in-depth simulation have shown that the proposed schemes can effectively manage multiple interferences from an identical source while achieving good performance of the interfering transmission-pair.

Cloud computing allows users to outsource massive amounts of data to a cloud server for storage and analysis, which breaks the bottleneck of limited local resources. However, it makes user data exposed and possibly be accessed by unauthorized entities. Owing to privacy concern, users are inclined to upload encrypted data to a cloud server, but encryption limits operations over original data and affects access to a processing result. Though lots of schemes have been proposed to achieve some basic operations over encrypted data, it still lacks the research on the dot product of encrypted vectors. In this paper, we propose two privacy-preserving dot product schemes based on a dual server model, which can flexibly support single-user access and multiuser access to a final data processing result. Furthermore, we extend them to achieve privacy-preserving Support Vector Machine (SVM) prediction algorithm. Finally, we give security analysis of our proposed schemes and demonstrate their availability and practicality through simulation and comparison with existing works.

Edge computing has been widely adopted in many systems, thanks for its advantages to offer low latency and alleviate heavy request loads from end users. Its integration with indoor positioning is one of promising research topics. Different from a traditional positioning system where a user normally query remotely deployed positioning services provided by a Location Information Service Provider (LIS), LIS will outsource its service to an edge device, and the user can obtain the service by directly accessing the edge device in an edge computing-based system. Though the benefits from edge computing, there is still some open issues for service outsourcing. One of them is how to ensure that the outsourced service is executed honestly by the edge device. However, the current literature has not yet seriously studied this issue with a feasible solution. In this paper, we design a verification scheme to solve this open problem for indoor positioning based on edge computing. By injecting some specially designed dataset into a trained machine learning based positioning model, the functionality of outsourced model on edge devices can be verified through this dataset with regard to its prediction accuracy from outsourced model. The verification is successful only when the prediction accuracy can pass a threshold. In experiments, we provide extensive empirical evidence using state-of-the-art positioning models based on real-world datasets to prove the effectiveness of our proposed scheme and meanwhile investigate the effects caused by different factors.

Security-related data collection is an essential part for attack detection and security measurement in Mobile Ad Hoc Networks (MANETs). Due to no fixed infrastructure of MANETs, a detection node playing as a collector should discover available routes to a collection node for data collection. Notably, route discovery suffers from many attacks (e.g., wormhole attack), thus the detection node should also collect securityrelated data during route discovery and analyze these data for determining reliable routes. However, few literatures provide incentives for security-related data collection in MANETs, and thus the detection node might not collect sufficient data, which greatly impacts the accuracy of attack detection and security measurement. In this paper, we propose B4SDC, a blockchain system for security-related data collection in MANETs. Through controlling the scale of RREQ forwarding in route discovery, the collector can constrain its payment and simultaneously make each forwarder of control information (namely RREQs and RREPs) obtain rewards as much as possible to ensure fairness. At the same time, B4SDC avoids collusion attacks with cooperative receipt reporting, and spoofing attacks by adopting a secure digital signature. Based on a novel Proof-of-Stake consensus mechanism by accumulating stakes through message forwarding, B4SDC not only provides incentives for all participating nodes, but also avoids forking and ensures high efficiency and real decentralization at the same time. We analyze B4SDC in terms of incentives and security, and evaluate its performance through simulations. The thorough analysis and experimental results show the efficacy and effectiveness of B4SDC.

5G mobile networks are expected to be much bigger in size, faster in speeds and better in scalability, providing varied services to different users and businesses in contrast to previous networks. 5G will also help enabling new business models and use cases. “Network Slicing” is a driving architectural concept for multi-tenancy. Network Slicing enables Mobile Network Operators (MNOs) to deploy different services over shared physical infrastructure, increasing inter-operator resource sharing. As 5G is still in its nascent, inter operator cooperation is an area that requires immediate attention of research. Traditional inter operator trust relationship models cannot fully comprehend the needs of 5G networks. In this paper, we propose an Intel SGX based multi-MNO cooperation scheme for trusted, dynamic and efficient network slice sharing in order to support inter-operator trustworthy collaboration. Furthermore, we developed a Proof of Concept of our proposed scheme using Intel SGX, flask framework and Docker containers. The obtained results indicate the applicability of the proposed scheme with little effect on performance.

Software plagiarism seriously impedes the healthy development of open source software. To fight against code obfuscation and inherent non-determinism of thread scheduling applied against software plagiarism detection, we proposed a new dynamic birthmark called DYnamic Key Instruction Sequence (DYKIS) and a framework called Thread-oblivious dynamic Birthmark (TOB) for the purpose of reviving the existing birthmarks and a thread-aware dynamic birthmark called Thread-related System call Birthmark (TreSB). Though many approaches have been proposed for software plagiarism detection, they are still limited to satisfy the following highly desired requirements: the applicability to handle binary, the capability to detect partial plagiarism, the resiliency to code obfuscation, the interpretability on detection results, and the scalability to process large-scale software. In this position paper, we discuss and outline the research opportunities and challenges in the field of software plagiarism detection in order to stimulate brilliant innovations and direct our future research efforts.

With the rapid development of hardware and software technologies, an increasing number of mobile devices, eg, smartphones and tablets get connected to the Internet, which results in a large proportion of traffic attributed to mobile devices.1 The mobile users have therefore increasingly high demands to access the Internet with guaranteed Quality-of-Experience.2, 3 Software-Defined Networking (SDN)4, 5 is an emerging network architecture where network control is decoupled from data forwarding and provides a powerful tool for fine-grained network management. The SDN-based network virtualization techniques have been widely used by Internet Service Providers to facilitate the service delivery with such performance guarantees, where network routers and switches are dynamically coordinated under the SDN APIs in wired networks.6 With the rapid advancement of wireless network technologies, many last mile connections go for wireless. However, the SDN-based wireless network virtualization is not straightforward. Many research challenges still need to be resolved before practical large-scale deployment. The accepted eight papers in this special issue are devoted to addressing the state-of-the-art technologies related to SDN, wireless network, network virtualization, security issues, and performance improvements. These papers can be organized under the following key themes: trust model and management, SDN security, and network performance optimization. The contributions of these papers are outlined below. There are two accepted papers aiming at establishing frameworks for trust models, management, and methodologies. The paper “A Trust Management Framework for Software-Defined Network Applications” proposed a trust management framework for SDN applications.7 It evaluates the applications' trust values according to their impact on the network performance. With the prototype system based on a floodlight controller, the framework is shown to be accurate and effective. Different from the above work, the paper “Graph Encryption for All-path Queries”8 aimed at providing the ability to store sensitive graph data to untrusted servers. A searchable symmetric encryption scheme is proposed to support all-path queries. The proposed scheme is proved to be able to adaptively semantically secure in the semihost settings. The scheme can be widely applied in the network virtualisation as graph data structures are commonly used to represent the topology of substrate and virtual networks. Security is one of the most important topics in SDNs. There is one accepted paper in this issue focusing on this topic. The paper “A Comprehensive Survey of Security Threats and Their Mitigation Techniques for Next-Generation SDN Controllers”9 provided a comprehensive survey of the security threats and corresponding mitigation techniques for SDN controllers. In this survey, a detailed classification for various security attacks on the control plane has been provided. Besides, the latest corresponding mitigation techniques are also presented and summarized. Based on the survey, future directions on a number of security issues such as policy violation and malware injection are discussed. DDoS attack is one of the most popular and threatening attacks for SDNs. Two accepted works are focused on this specific topic and have made contributions from different aspects. In the paper “An Intelligent Trust Model for Hybrid DDoS Detection in Software Defined Networks”,10 a trust evaluation and management model for hybrid DDoS detection in SDNs is proposed, where the extreme learning machine is applied. The proposed model can monitor the trust values of the OpenFlow switches in real time and thus can respond to different types of DDoS attacks. The model provides a more efficient alternative for DDoS detection in SDNs. The paper “Machine Learning Algorithms to Detect DDoS Attacks in SDN”11 managed to exploit different kinds of machine learning algorithms to avoid three kinds of DDoS attacks (controller attack, flow table attack, and bandwidth attack). Compared to the above work on trust model, this paper deals with the problem in a different way and considers more kinds of attacks. SDN and NFV have attracted increasing research attentions in recent years. The various network resources, traffic patterns, user demands, and protocol policies have significant impact on the network performance, which makes the performance optimization a challenging problem. The paper “The Optimization of Virtual Resource Allocation in Cloud Computing Based on RBPSO”12 considered the task requirements from different users to manage virtual machines. A novel algorithm with resampled binary particle swarm optimization is proposed. Compared with the existing works, the efficiency of the proposed algorithm is improved, the population diversity is maintained, and redundant calculations are reduced. The paper “Traffic Modeling and Performance Evaluation of SDN-Based NB-IoT Access Network”13 specifically considered the impact of network traffic in the SDN-based Narrowband Internet of Things (NB-IoT) network. SDN-enabled NB-IoT is discussed in this paper. Besides, the network performance is evaluated and modeled using various network parameters in the NB-IoT networks. The analysis and simulation results can be used in the SDN controller to dynamically allocate resources and make network management decisions to satisfy different performance requirements of NB-IoT applications. The paper “LBBESA: An Efficient Software-Defined Networking Load-Balancing Scheme Based on Elevator Scheduling Algorithm”14 dealt with the problem of load balancing in SDNs, based on the elevator scheduling algorithm. According to the real-time measurement of the server loads, the regional elevator allocation is applied to coordinate the connection of the clients' requests. The throughput and scalability are improved. The articles presented in this special issue have provided insights in fields related to SDN, wireless networks, network virtualization, and network security, including the trust models and methodologies, SDN DDoS attacks, and performance optimization for various SDN-enabled networks. We wish the readers can benefit from the insights of these papers and contribute to these rapidly growing areas. We would like to express our deep thanks to the Editor-in-Chief, Professor Geoffrey Fox, for providing us with the opportunity to host this special issue in Concurrency and Computation: Practice and Experience. We also thank all the authors who submitted their papers. Last but not least, we thank the thoughtful work of the many reviewers who have provided invaluable evaluations and recommendations.

Summary The emergence of software‐defined network (SDN) has brought unprecedented innovation to current networks. SDN's two most notable features are decoupling and programmability. Decoupling makes network management centralized in a control plane. Meanwhile, having benefitted from the programmable characteristic of SDN, new functions of networking can be easily realized. However, these features also introduce new security issues to SDN. Through the programming interface provided by SDN, software engineers can easily develop network applications to generate networking policies for SDN's control planes for the purpose of guiding network routing. However, it is hard to guarantee the security and quality of these new applications. Malicious or low‐quality applications could damage a whole network. To solve this problem, we propose a novel trust management framework for SDN applications in this paper. It can evaluate applications' trust values based on their impact on the network performance (such as time delay, packet loss rate, throughput, etc). These trust values further play a decisive role for managing and selecting applications in SDN. We evaluate this framework's performance through a prototype system implemented based on a floodlight controller. The experimental results show the accuracy and effectiveness of our design.

As a development of the next generation of mobile communication networks and systems (5G), the Third-Generation Partnership Project (3GPP) committee has standardized a new 5G authentication and key-agreement (5G-AKA) protocol to ensure the access security of a mobile equipment. However, there are still some security vulnerabilities in the 5G-AKA protocol, and there is no authentication protocol proposed for massive device concurrent connection by the 3GPP working groups. In this article, we propose a novel lightweight and secure access authentication scheme named lightweight secure access authentication (LSAA) that contains two lightweight extended Chebyshev chaotic maps-based access authentication protocols for two types of 3GPP standard mobile devices: 1) common user equipment (UE) and 2) massive machine-type communication (mMTC) devices. Our proposed protocols can achieve several security functionalities, including mutual authentication, session-key establishment, identity privacy protection, and perfect forward/backward secrecy (PFS/PBS). In addition, the proposed protocols are lightweight in nature compared with the 5G-AKA. In order to comprehensively and accurately evaluate LSAA, we carry out formal security analysis by employing two formal verification tools Proverif and Scyther, and informal security analysis on the proposed protocols. We further evaluate the performance of the proposed protocols with regard to authentication signaling cost, authentication communication cost, authentication computational cost, and authentication storage cost. The security evaluation and performance analysis results show that our proposed protocols can provide advanced security and high efficiency.

With the rapid development of the Internet, cloud storage has penetrated into every aspect of human society. However, cloud data disclosure happens more and more frequently, which makes cloud data security and privacy protection impact wide adoption of cloud storage. Control cloud data access based on reputation by introducing a Reputation Center (RC) was proposed and demonstrated to secure cloud data effectively in [9] . But the acceptance of such a system by cloud users and Cloud Service Providers (CSPs) is crucial for its practical deployment and final success. In this paper, we investigate the acceptance of a cloud data access control system based on reputation using Game Theory. Due to the existence of dishonest CSPs, there exists a social reputation dilemma among CSPs, which seriously impedes the popularity of cloud storage. To encourage users to use cloud storage and suppress collusion between CSPs and data requesters, a repeated public-goods game is built up by applying a compensation mechanism to improve the utilities of cloud users and a punishment mechanism based on reputation to incent honest behaviors. Theoretical analysis and simulation results show the effectiveness of the compensation and punishment mechanisms to increase cloud storage rate and restrain dishonest system entities.

Cloud computing provides an efficient and convenient platform for cloud users to store, process and control their data. Cloud overcomes the bottlenecks of resource-constrained user devices and greatly releases their storage and computing burdens. However, due to the lack of full trust in cloud service providers, the cloud users generally prefer to outsource their sensitive data in an encrypted form, which, however, seriously complicates data processing, analysis, as well as access control. Homomorphic encryption (HE) as a single key system cannot flexibly control data sharing and access after encrypted data processing. How to realize various computations over encrypted data in an efficient way and at the same time flexibly control the access to data processing results has been an important challenging issue. In this paper, we propose a privacy-preserving data processing scheme with flexible access control. With the cooperation of a data service provider (DSP) and a computation party (CP), our scheme, based on Paillier's partial homomorphic encryption (PHE), realizes seven basic operations, i.e., Addition, Subtraction, Multiplication, Sign Acquisition, Absolute, Comparison, and Equality Test, over outsourced encrypted data. In addition, our scheme, based on the homomorphism of attribute-based encryption (ABE), is also designed to support flexible access control over processing results of encrypted data. We further prove the security of our scheme and demonstrate its efficiency and advantages through simulations and comparisons with existing work.

Blockchain is an emerging technology that has widespread applications, such as those relating to Internet of Things (IoT) and Industrial IoT (IIoT). While there are many (potential) applications of blockchain in IIoT (the focus of this special issue), there are a number of ongoing challenges. For example, blockchain technology provides a solution to ensure a trust relationship without a centralized entity. However, such technology is still under development and suffers from a number of limitations and challenges during implementation, such as computational costs (e.g., mining), security (e.g., attacks such as distributed denial-of-service attacks, and theft of content). In an IIoT application, such as smart cities, Industry 4.0, and in military and battlefield context (also referred to as Internet of battlefield things and Internet of Military Things), there are more factors that need to be taken into consideration in the design of blockchain-based solutions. Therefore, in the following sections we will describe the advances presented in the editorial accepted in this special issue, designed to address different security and privacy challenges associated with the deployment of blockchain-based solutions in an IIoT setting.

For the industrial Internet of Things (IIoT), public-key encryption with keyword search (PEKS) is a type of applicable and promising encryption technique to maintain the data stored in clouds secure and searchable. To further improve the efficiency of searching, it is popular to introduce edge computing near the IIoT as the substitute for a cloud. However, the straightforward collaboration of the two techniques performs negatively in latency-sensitive applications since the sluggish encryption of PEKS by IIoT devices negates the instant reaction of edges. To meet this challenge, in this article, we exploit the capability of the edge-cloud architecture and propose a lightweight-designed scheme called edge-aided searchable public-key encryption (ESPE). It allows IIoT devices to delegate their costly cryptographic operations to the nearby edge for fast computing and guarantees that all outsourced ciphertexts are semantically secure. Consequently, ESPE accelerates the corresponding ciphertext procedures on edges and saves over 70% encryption cost of an IIoT device.

The four papers in this special section focus on the use of blockchain in the healthcare field. With the development of society, health has received increasing attentions. The development of science and technology has also promoted the protection of health. In recent years, the rapid development of computing and networking technologies has improved the ability to collect, measure, and analyze health-related data, and thus tremendous opportunities have opened up for healthcare computing. Meanwhile, these technologies have also brought new challenges and issues.

Cloud computing offers various services based on outsourced data by utilizing its huge volume of resources and great computation capability. However, it also makes users lose full control over their data. To avoid the leakage of user data privacy, encrypted data are preferred to be uploaded and stored in the cloud, which unfortunately complicates data analysis and access control. In particular, few existing works consider the fine-grained access control over the computational results from ciphertexts. Though our previous work proposed a framework to support several basic computations (such as addition, multiplication and comparison) with flexible access control, privacy-preserving division calculations over encrypted data, as a crucial operation in many statistical processes and machine learning algorithms, is neglected. In this paper, we propose four privacy-preserving division computation schemes with flexible access control to fill this gap, which can adapt to various application scenarios. Furthermore, we extend a division scheme over encrypted integers to support privacy-preserving division over multiple data types including fixed-point numbers and fractional numbers. Finally, we give their security proof and show their efficiency and superiority through comprehensive simulations and comparisons with existing work.

Abstract Internet of Things (IoT), as a typical representation of cyberization, enables the interconnection of physical things and the Internet, which provides intelligent and advanced services for industrial production and human lives. However, it also brings new challenges to IoT applications due to heterogeneity, complexity and dynamic nature of IoT. Especially, it is difficult to determine the sources of specified data, which is vulnerable to inserted attacks raised by different parties during data transmission and processing. In order to solve these issues, data provenance is introduced, which records data origins and the history of data generation and processing, thus possible to track the sources and reasons of any problems. Though some related researches have been proposed, the literature still lacks a comprehensive survey on data provenance in IoT. In this paper, we first propose a number of design requirements of data provenance in IoT by analyzing the features of IoT data and applications. Then, we provide a deep-insight review on existing schemes of IoT data provenance and employ the requirements to discuss their pros and cons. Finally, we summarize a number of open issues to direct future research.

Abstract The unprecedented proliferation of mobile smart devices has propelled a promising computing paradigm, Mobile Crowd Sensing (MCS), where people share surrounding insight or personal data with others. As a fast, easy, and cost-effective way to address large-scale societal problems, MCS is widely applied into many fields, e.g., environment monitoring, map construction, public safety, etc. Despite the popularity, the risk of sensitive information disclosure in MCS poses a serious threat to the participants and limits its further development in privacy-sensitive fields. Thus, the research on privacy protection in MCS becomes important and urgent. This paper targets the privacy issues of MCS and conducts a comprehensive literature research on it by providing a thorough survey. We first introduce a typical system structure of MCS, summarize its characteristics, propose essential requirements on privacy on the basis of a threat model. Then, we survey existing solutions on privacy protection and evaluate their performances by employing the proposed requirements. In essence, we classify the privacy protection schemes into four categories with regard to identity privacy, data privacy, attribute privacy, and task privacy. Besides, we review the achievements on privacy-preserving incentives in MCS from four viewpoints of incentive measures: credit incentive, auction incentive, currency incentive, and reputation incentive. Finally, we point out some open issues and propose future research directions based on the findings from our survey.

With the fast development of Internet of Things, huge volume of data is being collected from various sensors and devices, aggregated at gateways, and processed in the cloud. Due to privacy concern, data are usually encrypted before being outsourced to the cloud. However, encryption seriously impedes both computation over the data and sharing of the computation results. Computing maximum and minimum among a data set are two of the most basic operations in machine learning and data mining algorithms. In this paper, we study how to compute maximum and minimum over encrypted data and control the access to the computation result in a privacy-preserving manner. We present four schemes to realize privacy-preserving maximum and minimum computations with flexible access control that can adapt to various application scenarios. We further analyze their security and show their efficiency through extensive evaluations and comparisons with existing work.

In this paper, we consider a wireless powered backscatter communication (WPBC) network in which a full-duplex access point (AP) simultaneously transmits information and energy signals by injecting artificial noise (AN) to secure the backscatter transmission from multiple backscatter devices (BDs). To maximize the minimum throughput and ensure fairness and security, we formulate an optimization problem by jointly considering the power splitting ratio between dedicated information signals and AN, backscatter time and signal power allocation among multiple BDs. For a single BD network, we obtain a closed-form solution and evaluate its validity through proof-of-concept experiments. For the general case with multiple BDs, we present an iterative algorithm by leveraging block coordinate descent (BCD) and successive convex approximation optimization to solve a non-convex problem incurred in WPBC. We further show the convergence of the proposed algorithm and analyze its complexity. Finally, extensive simulation results show that the proposed algorithm achieves an optimal and equitable throughput for all BDs, and our work provides a good perspective of resource allocation to improve the performance of WPBC networks.

A number of information and resource sharing systems arise and become popular with the rapid development of communication technologies and mobile smart devices. The interactions between humans and machines are intense and their synergistic reactions have attracted special attention for the reason of forming so called Human–Machine Networks (HMN). HMNs refer to these networks where humans and machines work together to provide synergistic effects on their payoffs. Game theory, which can capture the interactions among players dexterously, has been widely used in solving various problems in HMN systems from the view of economics. In this paper, we extensively review the literature about game theoretical methods in HMNs, in particular focusing on its typical systems such as crowdsourcing, an elemental HMN and Internet of Things (IoT), a hybrid HMN, as well as Bitcoin. We propose a series of requirements to evaluate existing work. For reviewing and analyzing each system, we specify application purposes, players, strategies, game models and equilibria based on our proposed requirements. In the sequel, we identify a number of common and distinct open issues in HMNs and point out future research directions.

Internet of Things (IoT) has been developed rapidly to make our life easier. In many IoT applications (e.g., smart homes, healthcare, etc.), all the IoT devices should be synchronized in time. However, some malicious nodes located in the IoT network can influence the time synchronization, which may interrupt the IoT system and lead to serious accidents. Therefore, it is critical and challenging to guarantee the accuracy and consistency of time during the time synchronization among all the IoT devices. In this paper, we propose a blockchain-based scheme to assure the security during time synchronization in IoT. Specifically, a publicly verifiable ledger is utilized to record and broadcast time, which can minimize many attacks from external environments. The use of multiple time sources can avoid the vulnerabilities caused by the centralized generation of accurate time. Moreover, the decentralized structure of this scheme has the advantage of adapting the changes of network topology. By employing an improved practical Byzantine fault tolerance consensus mechanism, time synchronization can be implemented efficiently. At last, the analysis results show that our proposed scheme can achieve the desired security with high efficiency.

Internet of Things (IoT) is a new paradigm that involves the interconnection of thousands of devices and home appliances. Due to the scarcity of the spectrum suitable for wireless electromagnetic transmission, many communication systems and devices are close to each other, or even overlapping in spectrum, thus incurring complicated interference situations. Therefore, interference in IoT is worthy of thorough investigation and should be well addressed. There have been numerous interference management (IM) proposals at the interfering transmitter or the interfered transmitter/receiver separately or cooperatively. Moreover, the existing IM schemes rely mainly on the use of channel state information (CSI). However, in some communication scenarios, the option to adjust the interferer is not available, and, in the case of downlink transmission, it is always difficult or even impossible for the interfered receiver to acquire necessary information for IM. Based on the above observations, we first propose a novel IM technique, called interference steering (IS). By making use of both CSI with respect to and data carried in the interfering signal, IS generates a signal to modify the spatial feature of the original interference, so that the steered interference at the interfered receiver is orthogonal to its intended signal. We then apply IS to a wireless local area network (WLAN)-based IoT in which the same frequency band is reused by adjacent basic service sets (BSSs) with overlapping areas. With IS, multiple nearby access points (APs) could simultaneously transmit data on the same channel to their mobile stations (STAs), thus enhancing spectrum reuse. Our in-depth simulation results show that IS significantly improves network SE over existing IM schemes.

Internet of Things (IoT) is gaining increasing popularity. Overwhelming volumes of data are generated by IoT devices. Those data after analytics provide significant information that could greatly benefit IoT applications. Different from traditional applications, IoT applications, such as environmental monitoring, smart navigation, and smart healthcare come with new requirements, such as mobility, real-time response, and location awareness. However, traditional cloud computing paradigm cannot satisfy these demands due to centralized processing and being far away from local devices. Hence, edge computing was introduced to perform data processing and storage in the edge of networks, which is closer to data sources than cloud computing, thus efficient and location-aware. Unfortunately, edge computing brings new security and privacy challenges when applied to data analytics. The literature still lacks a thorough review on the recent advances in secure data analytics in edge computing. In this paper, we first introduce the concept and features of edge computing, and then propose a number of requirements for its secure data analytics by analyzing potential security threats in edge computing. Furthermore, we give a comprehensive review on the pros and cons of the existing works on data analytics in edge computing based on our proposed requirements. Based on our literature survey, we highlight current open issues and propose future research directions.

Wireless sensor network (WSN) is an indispensible part of Internet of Things that has been applied in many fields to monitor environments and collect data from surroundings. However, WSNs are highly susceptible to attacks due to its unique characteristics: large-scale, self-organization, dynamic topology, and constrained resources. A number of systems have been proposed to effectively detect varieties of attacks in WSNs. However, most previous surveys on WSN attacks focus on detection methods for only one or two types of attacks and lack detailed performance analysis. Additionally, the literature lacks comprehensive studies on security-related data (in short security data) collection in WSNs. In this paper, we first provide an overview of WSNs and classify the attacks in WSNs based on protocol stack layers. For the purpose of WSN security measurement, we then research attack detection methods of eleven mainstream attacks. We extract security data that play an important role for detecting security anomaly toward security measurement. We further elaborate the advantages and disadvantages of the existing detection methods based on a number of evaluation criteria. Finally, we highlight a number of open problems in this paper field based on our thorough survey and conclude this paper with possible future research directions.

The huge economic loss resulting from network attacks and intrusions has led to an intensive study on network security. The network security is usually reflected by some relevant data that can be collected in a network system. By learning and analyzing such data, which are called security-related data, we can detect the intrusions to the network system and further measure its security level. Clearly, the first step of detecting network intrusions is to collect security-related data. However, in the context of 5G and big data, there are a number of challenges in collecting these data due to the heterogeneity of network and ever-growing amount of data. Therefore, traditional data collection methods cannot be applied in the next generation network systems directly, especially for security-related data. This paper presents the design and implementation of an adaptive security-related data collector based on network context in heterogeneous networks. The proposed collector solves the issue of heterogeneity of network system by designing a Security-related Data Description Language (SDDL) to instruct security related data collection in various networking contexts. It also applies adaptive sampling algorithms to reduce the amount of collected data. Furthermore, performance evaluation based on a prototype implementation shows the effectiveness of the adaptive security-related data collector in terms of a number of pre-defined design requirements.

has gone through a rapid development in today's internet connected world.With the wide application of the booming technologies such as the Internet of ings (IoT) and the cloud computing, huge amount of data are generated and collected.While the data can be used to better serve the corresponding business needs, they also pose big challenges for the cyber security and privacy protection.It becomes very di cult if not impossible to discover the malicious behavior among the big data in real time.us, this gives rise to the cyber security solutions which are driven by AI-based technologies, such as machine learning, statistical inference, big data analysis, deep learning, and so on.AIdriven cyber security analytics has already found its applications in the next generation rewall which includes the automatic intrusion detection system, encrypted tra c classi cation, malicious software detection, and so on.In the area of cryptography, AI-driven solution starts to help the researchers optimize the algorithm design and can largely reduce the cryptanalysis e ort such as searching the di erential trails which is crucial in di erential cryptanalysis.

Cloud storage as one of the most important services of cloud computing helps cloud users break the bottleneck of restricted resources and expand their storage without upgrading their devices. In order to guarantee the security and privacy of cloud users, data are always outsourced in an encrypted form. However, encrypted data could incur much waste of cloud storage and complicate data sharing among authorized users. We are still facing challenges on encrypted data storage and management with deduplication. Traditional deduplication schemes always focus on specific application scenarios, in which the deduplication is completely controlled by either data owners or cloud servers. They cannot flexibly satisfy various demands of data owners according to the level of data sensitivity. In this paper, we propose a heterogeneous data storage management scheme, which flexibly offers both deduplication management and access control at the same time across multiple Cloud Service Providers (CSPs). We evaluate its performance with security analysis, comparison and implementation. The results show its security, effectiveness and efficiency towards potential practical usage.

Pervasive Social Networking (PSN) intends to support instant social activities in a pervasive way at any time and anywhere. In order to protect crucial social activities, ensure communication dependability, and enhance user privacy, securing pervasive social communications becomes especially important. However, neither centralized nor distributed solutions can protect PSN communications as expected. How to automatically control data access in a trustworthy and efficient way is an important security issue. In this article, we propose a scheme to guarantee communication data security in PSN based on two dimensions of trust in a flexible manner on the basis of Key-Policy Attribute-Based Encryption (KP-ABE). Its advantages and performance are justified and evaluated through extensive analysis on security, computation complexity, communication cost, scalability, and flexibility, as well as scheme implementation. In addition, we develop a demo system based on Android mobile devices to test our scheme in practice. The results demonstrate its efficiency and effectiveness. Comparison with our previous work based on CP-ABE (Yan and Wang 2017) further shows its feasibility to be applied to PSN.

Duplicated data storage wastes memory resources and brings extra data-management load and cost to cloud service providers (CSPs). Various feasible schemes to deduplicate encrypted cloud data have been reported. However, their successful deployment in practice depends on whether all system players or stakeholders are willing to accept and execute them in a cooperative way, which was scarcely investigated in the previous literature. In this paper, we employ a noncooperative game to model the interactions in a client-side server-controlled deduplication scheme (S-DEDU) and construct an incentive mechanism based on payment discount to motivate its final acceptance. The experimental results based on a real-world dataset demonstrate the individual rationality, incentive compatibility, profitability, and robustness of our incentive mechanism.

Device-to-Device (D2D) communications have been regarded as an advanced technology for the next generation mobile communication networks and wireless systems (5G). It is essential to secure D2D communication data for resisting malicious attacks. However, secure D2D communications among mobile devices have not been well solved. By paying attention to the important role of trust in securing D2D communications, in this paper, we propose a scheme using either a General Trust (GT) level issued by a core network or a Local Trust (LT) level evaluated by a device or both to control D2D communication data access by applying Attribute-Based Encryption (ABE). This scheme realizes secure data communications among mobile devices under the legacy system model of Long-Term Evolution (LTE). Performance analysis and evaluation demonstrate that the proposed scheme is effective with regard to security, computation complexity, communication cost, flexibility and scalability.

With the popularity of sensor-rich mobile devices (e.g., smart phones and wearable devices), mobile crowdsourcing (MCS) has emerged as an effective method for data collection and processing. Compared with traditional wireless sensor networking, MCS holds many advantages such as mobility, scalability, cost-efficiency, and human intelligence. However, MCS still faces many challenges with regard to security, privacy, and trust. This paper provides a survey of these challenges and discusses potential solutions. We analyze the characteristics of MCS, identify its security threats, and outline essential requirements on a secure, privacy-preserving, and trustworthy MCS system. Further, we review existing solutions based on these requirements and compare their pros and cons. Finally, we point out open issues and propose some future research directions.

The recent proliferation of mobile devices such as smartphones and wearable devices has given rise to crowdsourcing Internet of Things (IoT) applications, such as urban mobility monitoring, virtual/augmented reality, smart city management, and indoor floor plan reconstruction and mapping. Various data collected by mobile devices with small or big volumes can be further processed, analyzed, and mined in order to support multifarious promising services with intelligence.

Networks have dramatically changed our daily life and infiltrated all aspects of human society. At the same time when we enjoy the convenience and benefits brought by the networks, we also suffer from a great amount of intelligent attacks and malicious intrusions. As a fundamental procedure of network security measurement, network data collection executes real time network monitoring, supports network performance evaluation, assists network billing, and helps traffic testing and filtering. Thus, it plays a crucial and essential role for dealing with network intrusion detection and unwanted traffic control. But an adaptive and effective data collection mechanism that can be pervasively applied into heterogeneous networks is still lacked. The literature we have hunted rarely comments and compares the performance of existing data collection mechanisms. In this paper, we conduct a survey on existing data collection methods, mechanisms and architectures. According to a number of proposed assessment criteria, we evaluate the performance of existing data collection mechanisms and summarize their characteristics. Furthermore, we figure out some open issues based our investigation and forecast future research directions.

Rapid progress of networking technologies leads to an exponential growth in the number of unauthorized or malicious network actions. As a component of defense-in-depth, Network Intrusion Detection System (NIDS) has been expected to detect malicious behaviors. Currently, NIDSs are implemented by various classification techniques, but these techniques are not advanced enough to accurately detect complex or synthetic attacks, especially in the situation of facing massive high-dimensional data. Besides, the inherent defects of NIDSs, namely, high false alarm rate and low detection rate, have not been effectively solved. In order to solve these problems, data fusion (DF) has been applied into network intrusion detection and has achieved good results. However, the literature still lacks thorough analysis and evaluation on data fusion techniques in the field of intrusion detection. Therefore, it is necessary to conduct a comprehensive review on them. In this article, we focus on DF techniques for network intrusion detection and propose a specific definition to describe it. We review the recent advances of DF techniques and propose a series of criteria to compare their performance. Finally, based on the results of the literature review, a number of open issues and future research directions are proposed at the end of this work.

Non peer reviewed

Device-to-Device (D2D) communications play a key role in the next generation mobile communication networks and wireless systems (5G) and the Internet of Things ecosystem. D2D group communications are significant for group based services. In spite of its benefits, new application scenarios and new system architecture expose the D2D group communications to unique security threats. Although there are numerous studies on security and privacy in two-user D2D communications, a lack of solutions on secure and privacy-preserving D2D group communications would restrict their wide usage. In this paper, we propose two privacy-preserving authentication and key Agreement protocols (PPAKA-HAMC and PPAKA-IBS) to guarantee secure and anonymous D2D group communications. In our protocols, a group of D2D users mutually authenticate with each other without leaking their identity information while negotiate a common D2D group session key for secure communications in a D2D session. Formal security analysis and comprehensive performance evaluation show security and effectivity of our protocols.

Deep learning, as the most important architecture of current computational intelligence, achieves super performance to predict the cloud workload for industry informatics. However, it is a nontrivial task to train a deep learning model efficiently since the deep learning model often includes a great number of parameters. In this paper, an efficient deep learning model based on the canonical polyadic decomposition is proposed to predict the cloud workload for industry informatics. In the proposed model, the parameters are compressed significantly by converting the weight matrices to the canonical polyadic format. Furthermore, an efficient learning algorithm is designed to train the parameters. Finally, the proposed efficient deep learning model is applied to the workload prediction of virtual machines on cloud. Experiments are conducted on the datasets collected from PlanetLab to validate the performance of the proposed model by comparing with other machine-learning-based approaches for workload prediction of virtual machines. Results indicate that the proposed model achieves a higher training efficiency and workload prediction accuracy than state-of-the-art machine-learning-based approaches, proving the potential of the proposed model to provide predictive services for industry informatics.

Cloud computing offers a new way of services and has become a popular service platform. Storing user data at a cloud data center greatly releases storage burden of user devices and brings access convenience. Due to distrust in cloud service providers, users generally store their crucial data in an encrypted form. But in many cases, the data need to be accessed by other entities for fulfilling an expected service, e.g., an eHealth service. How to control personal data access at cloud is a critical issue. Various application scenarios request flexible control on cloud data access based on data owner policies and application demands. Either data owners or some trusted third parties or both should flexibly participate in this control. However, existing work hasn't yet investigated an effective and flexible solution to satisfy this demand. On the other hand, trust plays an important role in data sharing. It helps overcoming uncertainty and avoiding potential risks. But literature still lacks a practical solution to control cloud data access based on trust and reputation. In this paper, we propose a scheme to control data access in cloud computing based on trust evaluated by the data owner and/or reputations generated by a number of reputation centers in a flexible manner by applying Attribue-Based Encryption and Proxy Re-Encryption. We integrate the concept of context-aware trust and reputation evaluation into a cryptographic system in order to support various control scenarios and strategies. The security and performance of our scheme are evaluated and justified through extensive analysis, security proof, comparison and implementation. The results show the efficiency, flexibility and effectiveness of our scheme for data access control in cloud computing.

The 5th generation wireless system 5G will support Internet of Things IoT by increasing the interconnectivity of electronic devices to support a variety of new and promising networked applications such as the home of the future, environmental monitoring networks, and infrastructure management systems. The potential benefits of the IoT are as profound as they are diverse. However, the benefits of the IoT come with some significant challenges. Not the least of these is that the increased interconnectivity integral to an IoT network increases its vulnerability to malevolent attacks. There is still no proven methodology for the design of security frameworks with device authentication and access control. This paper attempts to address this problem through the development of a prototype security framework with robust and transparent security protection. This includes an investigation into the security requirements of three different characteristic IoT scenarios concretely, body IoT, home IoT, and hotel IoT, a design of new authentication mechanisms, and an access control subsystem with fine-grained roles and risk indicators. Our prototype security framework gives us an insight into some of the major difficulties of IoT security as well as providing some feasible solutions. Copyright © 2015 John Wiley & Sons, Ltd.

With the great success of the second-generation wireless telephone technology and the third-generation mobile telecommunications technology, and the fast development of the fourth-generation mobile telecommunications technology, the phase of fifth-generation mobile networks or fifth-generation wireless systems (5G) is coming. In this article, we indicate the open research issues of 5G security and trust in the context of virtualized networking and software-defined networking. We further propose a framework of security and trust focusing on solving 5G network security issues. The proposed framework applies adaptive trust evaluation and management technologies and sustainable trusted computing technologies to ensure computing platform trust and achieve software-defined network security. It adopts cloud computing to securely deploy various trustworthy security services over the virtualized networks. We analyze that the framework can support and satisfy all security requirements specified in standardization. We also suggest future research work according to the proposed framework and discuss the advantages of our framework in terms of practical deployment. Copyright © 2015 John Wiley & Sons, Ltd.

Cloud computing offers a new way of service provision by re-arranging various resources over the Internet. The most important and popular cloud service is data storage. In order to preserve the privacy of data holders, data are often stored in cloud in an encrypted form. However, encrypted data introduce new challenges for cloud data deduplication, which becomes crucial for big data storage and processing in cloud. Traditional deduplication schemes cannot work on encrypted data. Existing solutions of encrypted data deduplication suffer from security weakness. They cannot flexibly support data access control and revocation. Therefore, few of them can be readily deployed in practice. In this paper, we propose a scheme to deduplicate encrypted data stored in cloud based on ownership challenge and proxy re-encryption. It integrates cloud data deduplication with access control. We evaluate its performance based on extensive analysis and computer simulations. The results show the superior efficiency and effectiveness of the scheme for potential practical deployment, especially for big data deduplication in cloud storage.

Multimedia has been exponentially increasing as the biggest big data, which consist of video clips, images, and audio files. Processing and analyzing them on a cloud data center have become a preferred solution that can utilize the large pool of cloud resources to address the problems caused by the tremendous amount of unstructured multimedia data. However, there exist many challenges in processing multimedia big data on a cloud data center, such as multimedia data representation approach, an efficient networking model, and an estimation method for traffic patterns. The primary purpose of this article is to develop a novel tensor-based software-defined networking model on a cloud data center for multimedia big-data computation and communication. First, an overview of the proposed framework is provided, in which the functions of the representative modules are briefly illustrated. Then, three models,—forwarding tensor, control tensor, and transition tensor—are proposed for management of networking devices and prediction of network traffic patterns. Finally, two algorithms about single-mode and multimode tensor eigen-decomposition are developed, and the incremental method is employed for efficiently updating the generated eigen-vector and eigen-tensor. Experimental results reveal that the proposed framework is feasible and efficient to handle multimedia big data on a cloud data center.

H.264/SVC (Scalable Video Coding) codestreams, which consist of a single base layer and multiple enhancement layers, are designed for quality, spatial, and temporal scalabilities. They can be transmitted over networks of different bandwidths and seamlessly accessed by various terminal devices. With a huge amount of video surveillance and various devices becoming an integral part of the security infrastructure, the industry is currently starting to use the SVC standard to process digital video for surveillance applications such that clients with different network bandwidth connections and display capabilities can seamlessly access various SVC surveillance (sub)codestreams. In order to guarantee the trustworthiness and integrity of received SVC codestreams, engineers and researchers have proposed several authentication schemes to protect video data. However, existing algorithms cannot simultaneously satisfy both efficiency and robustness for SVC surveillance codestreams. Hence, in this article, a highly efficient and robust authentication scheme, named TrustSSV (Trust Scalable Surveillance Video), is proposed. Based on quality/spatial scalable characteristics of SVC codestreams, TrustSSV combines cryptographic and content-based authentication techniques to authenticate the base layer and enhancement layers, respectively. Based on temporal scalable characteristics of surveillance codestreams, TrustSSV extracts, updates, and authenticates foreground features for each access unit dynamically with background model support. Using SVC test sequences, our experimental results indicate that the scheme is able to distinguish between content-preserving and content-changing manipulations and to pinpoint tampered locations. Compared with existing schemes, the proposed scheme incurs very small computation and communication costs.

No abstract available.

The networks of intelligent building are usually consist of a great number of smart devices. Since many smart devices only support on-site configuration and upgrade, and communication between devices could be observed and even altered by attackers, efficiency and security are two key concerns in maintaining and managing the devices used in intelligent building networks. In this paper, the authors apply the technology of software defined networking to satisfy the requirement for efficiency in intelligent building networks. More specific, a protocol stack in smart devices that support OpenFlow is designed. In addition, the authors designed the lightweight security mechanism with two foundation protocols and a full protocol that uses the foundation protocols as example. Performance and session key establishment for the security mechanism are also discussed.

Pervasive social networking (PSN) supports instant social activities anywhere and at any time with the support of heterogeneous networks. In order to preserve privacy and achieve trustworthy PSN, anonymous authentication on node trust is expected in PSN. However, the literature still lacks serious studies on this issue. In this paper, we propose an anonymous authentication scheme for authenticating both pseudonyms and trust levels to support trustworthy PSN with privacy preservation. The scheme achieves secure anonymous authentication with anonymity and conditional traceability on the basis of a trusted authority (TA). By applying a back-up solution, it can guarantee communications among nodes for an extended time period even when the TA is not available. In addition, the use of batch-signature verification further reduces the cost of authenticity verification of a large number of messages. Performance analysis and evaluation further prove that the proposed scheme is effective with regard to privacy preservation, computation complexity, communication cost, flexibility, reliability, and scalability.

Pervasive social networking (PSN) supports online and instant social activities and communications in a universal and pervasive manner on the basis of heterogeneous networks. However, at the same time, when mobile users expect useful and valuable contents via PSN, they may also receive unwanted, unexpected, or even malicious contents. These contents may intrude user devices, occupy device memories, and irritate mobile users. Unwanted content control in PSN has become a crucial issue that impacts the success of PSN usage. Nowadays, the literature still lacks a robust and generic unwanted content control system that can be practically applied. In this article, we present the design and implementation of PSNController, an unwanted content control system in PSN based on trust management. We evaluate the system performance under a variety of intrusions and attacks. The result shows the system is effective with regard to accuracy, efficiency, and robustness. It can control unwanted contents in PSN according to trust evaluation. We further study user acceptance on PSNController prototype system based on a small-scale user study. We receive sound user feedback on PSNController with regard to perceived ease of use, perceived usefulness, interface design, playfulness, and acceptance attitude.

Trustworthy personal data access control at a semi-trusted or distrusted Cloud Service Provider (CSP) is a practical issue although cloud computing has widely developed. Many existing solutions suffer from high computation and communication costs, and are impractical to deploy in reality due to usability issue. With the rapid growth and popularity of mobile social networking, trust relationships in different contexts can be assessed based on mobile social networking activities, behaviors and experiences. Obviously, such trust cues extracted from social networking are helpful in automatically managing personal data access at the cloud with sound usability. In this paper, we propose a scheme to secure personal data access at CSP according to trust assessed in mobile social networking. Security and performance evaluations show the efficiency and effectiveness of our scheme for practical adoption.

A body sensor network (BSN) is typically a wearable wireless sensor network. Security protection is critical to BSNs, since they collect sensitive personal information. Generally speaking, security protection of BSN relies on identity (ID) and key distribution protocols. Most existing protocols are designed to run in general wireless sensor networks, and are not suitable for BSNs. After carefully examining the characteristics of BSNs, the authors propose human interactive empirical channel‐based security protocols, which include an elliptic curve Diffie–Hellman version of symmetric hash commitment before knowledge protocol and an elliptic curve Diffie–Hellman version of hash commitment before knowledge protocol. Using these protocols, dynamically distributing keys and IDs become possible. As opposite to present solutions, these protocols do not need any pre‐deployment of keys or secrets. Therefore compromised and expired keys or IDs can be easily changed. These protocols exploit human users as temporary trusted third parties. The authors, thus, show that the human interactive channels can help them to design secure BSNs.

Fashionable technology is becoming a trend in HCI design. It extends the traditional understanding of HCI by emphasizing on the aesthetic element. Pervasive social communications are instant social activities through communications based on mobile elements. This paper investigates how to use the fashionable technology in pervasive social communications. It presents the design and preliminary prototype of Gemini, a fashionable bag for pervasive social communications. The social acceptance of Gemini design is also explored through a small-scale user study.

At the same time as the Internet provides a lot of social value, it is bogged down by unwanted traffic, which is malicious, harmful or unexpected for its receiver. This paper proposes an unwanted traffic control solution through hybrid trust management. It can control unwanted traffic from its source to destinations according to trust evaluation at a Global Trust Operator and traffic and behavior analysis at hosts. Thus, it can support unwanted traffic control in both a distributed and centralized manner and in both a defensive and offensive way. Simulation based evaluation shows that the solution is effective with regard to botnet intrusion, malicious attack of ISP and DDoS intrusion via reflectors.

Pervasive social communications are instant social activities through communications based on mobile elements, e.g., via mobile ad hoc networks. Meanwhile, fashionable technology is becoming a trend in Human-Computer Interaction (HCI) design. It extends the traditional understanding of HCI by emphasizing aesthetic element. This paper investigates how to use fashionable technology in pervasive social communications. It presents a novel approach to realize secure recognition for pervasive face-to-face social communications based on MANET, local connectivity and fashionable technology. The social acceptance of this inter-disciplinary approach is explored through a small-scale user study.

A Mobile Ad Hoc Network (MANET) is becoming a practical platform for pervasive social networking. People chat with each other via MANET for instant social activities. How to help mobile users to build up trust in such an environment is becoming an important issue. We develop a reputation system for pervasive social networking. We implement it by applying Nokia N900 smartphones as MANET nodes based on a distributed energy-efficient social networking platform. Our system can indicate each user's local reputation during chatting. It also provides detailed reputation information and supports on-chat voting and afterwards voting. This demo paper introduces the system design and its principal functionalities.

People's life has been totally changed by the fast growth of Internet. It provides an incentive platform for many killer services and applications. However, it also offers an easy channel to distribute various contents that could be unwanted by users. This paper proposes a generic unwanted traffic control solution through global trust management. It can control unwanted traffic from its source to destinations according to trust evaluation. Simulation based evaluation shows that the solution is effective with regard to accuracy, efficiency and robustness against a number of malicious attacks.

Trust plays an important role in human-computer interaction. It helps people overcome risk and uncertainty. With the rapid growth of computer and networking technology, human-computer trust has been paid attention to. This paper studies the factors that influence the trust in human-computer interaction, i.e., the construct of human-computer trust interaction (HCTI). Based on a literature survey, we propose a research model of human-computer trust interaction that contains three root constructs: interaction intention, computer system trust and communication trust. Meanwhile, we design a measurement scale to verify it in the future.

Trust helps users overcome perceptions of uncertainty and engages in usage. It plays an important role in human- computer interaction. This position paper studies the theoretical issues in the study of trust in Human-Computer Interaction (HCI). We propose a construct of human-computer trust interaction (HCTI) through theoretical studies. It contains two root constructs: interaction intention and computer system trust, each of which is consistent of a number of sub-constructs.

Mobile Internet enables mobile users to access Internet services through mobile networks. Currently, cellular networks are converging with various wireless networks, e.g., WLAN, MANET, which forms a heterogeneous mobile environment. In such environment, it has been a big challenge for mobile operators and mobile service providers to offer seamless roaming and services among the networks. Previous work on solving the problem falls in specific network circumstance, which cannot be easily and widely applied in the heterogeneous environment. In this paper, we foresee the future of mobile networks into mobile cloud environment. Thus, we propose a generic and flexible solution based on cloud computing technology that can achieve various benefits, such as robustness, high availability, and so on. We present the architecture and procedures for building up the trusted identity management to achieve seamless roaming.

Trust plays an important role in software systems, especially component-based systems in which components or their environments vary. This paper introduces an autonomic trust management solution for a component-based software system. We propose an adaptive trust control model to specify, evaluate, establish, and ensure the trust relationships among system entities. This model concerns the quality attributes of the entity and a number of trust control modes supported by the system. In particular, its parameters can be adaptively adjusted based on runtime trust assessment in order to reflect real system context and situation. Based on this model, we further develop a number of algorithms that can be adopted by a trust management framework for autonomic management of trust during component execution. We verify the algorithms' feasibility through simulations and demonstrate the effectiveness and benefits of our solution. We also discuss the issues for successful deployment of our solution in a component software platform.