Private set intersection (PSI) is a fundamental cryptographic primitive, allowing two parties to calculate the intersection of their data sets without exposing additional private information. In cloud-based IoT system, IoT-enabled devices would like to outsource their data sets in their encrypted form to the cloud. In this scenario, how to delegate the set intersection computation over outsourced encrypted data sets to the cloud and how to achieve the fine-grained access control for PSI without divulging any additional information to the cloud are still open problems. With that in mind, in this work, we combine key-policy attribute-based encryption (KP-ABE) and PSI to introduce such a novel concept, called delegated key-policy attribute-based set intersection over outsourced encrypted data sets (KP-ABSI), to solve this problem. Then we propose a first concrete KP-ABSI scheme and analyze its efficiency.

In a multimedia cloud computing system, suppose all cloud users outsource their own data sets to the cloud in the encrypted form. Each outsourced set is associated with an access structure such that a valid data user, Bob, with the credentials satisfying the access structure is able to conduct computing over outsourced encrypted set (e.g., decryption or other kinds of computing function). Suppose Bob needs to compute the set intersection over a data owner Alice’s and his own outsourced encrypted sets. Bob’s simple solution is to download Alice’s and Bob’s outsourced encrypted sets, perform set intersection operation, and decrypt the set intersection ciphertexts. A better solution is for Bob to delegate the cloud to calculate the set intersection, without giving the cloud any ability in breaching the secrecy of the sets. To solve this problem, this work introduces a novel primitive called ciphertext-policy attribute-based encryption with outsourced set intersection for multimedia cloud computing. It is the first cryptographic algorithm supporting a fully outsourced encrypted storage, computation delegation, fine-grained authorization security for ciphertext-policy model, without relying on an online trusted authority or data owners, and multi-elements set, simultaneously. We construct a scheme that provably satisfies the desirable security properties, and analyze its efficiency.

To improve the security of the data on cloud storage, numbers of data integrity auditing schemes have been proposed in the past several years. However, there only a few schemes considered the security challenge that the user’s key is exposed unknowingly which is very likely to happen in real-life. To cope with the problem, we propose a public data integrity auditing scheme for cloud storage with efficient key updating. In our scheme, the user’s key is updated periodically to resist the risk of key exposure. Meanwhile, the authentication tags of blocks are updated simultaneously with the key updating so as to guarantee the data integrity can be verified normally. The algorithm of key updating in our scheme is very efficient which only needs a hash operation while previous schemes need two or three exponentiation operations. Moreover, the workload of tag updating is undertaken by cloud servers with a re-tag-key which reduces the burden of users and improves the efficiency of the scheme. The communication cost of the scheme is also reduced greatly, for instance, the information size in ‘re-key’ step is decreased from two group members to one. Furthermore, we give the formal security model of our scheme and prove the security under the CDH assumption. The experimental results show that our proposal is efficient and feasible.

Because of the movements of sensor nodes and unknown mobility pattern, how to ensure two communicating (static or mobile) nodes authenticate and share a pairwise key is important. In this paper, we propose a mutual-authenticated key distribution scheme based on physical unclonable functions (PUFs) for dynamic sensor networks. Compared with traditional key predistribution schemes, the proposal reduces the storage overhead and the key exposure risks and thereby improves the resilience against node capture attacks. Mutual authentication is provided by the PUF challenge-response mechanism. However, the PUF response is not transmitted in plain forms so as to resist the modelling attacks, which is vulnerable in some existing PUF-based schemes. We demonstrate the proposed scheme to improve the secure connectivity and other performances by analysis and experiments.

Modern network attacks are becoming stealthier and smarter. Attackers use encryption to cover up malicious traffic, which makes it really hard to detect. To solve this problem, this paper introduces a new model called Graph Convolutional Network with Multi-Head Attention (GCN-MHA). The goal of this model is to improve how we find and sort encrypted malicious traffic. First, we turn network traffic into a “graph”—this helps capture its structural and time-related features. Then, our GCN-MHA framework uses graph convolutional layers to learn spatial information. A multi-head attention mechanism helps it focus on the most important features. When tested on the ISCX-VPN2016 dataset, the model achieved an overall high accuracy of 98.79% and a recall rate of 99.24% under six categories of malicious traffic. We also performed cross-validation on two other datasets: USTC-TFC2016 and CIC-Darknet2020. These tests showed that the model has strong generalization ability on different data.

In big data analytics, Jaccard similarity is a widely used block for scalable similarity computation. It is broadly applied in the Internet of Things (IoT) applications, such as credit system, social networking, epidemic tracking, and so on. However, with the increasing privacy concerns of user’s sensitive data for IoT, it is intensively desirable and necessary to investigate privacy‐preserving Jaccard similarity computing over two users’ datasets. To boost the efficiency and enhance the security, we propose two methods to measure Jaccard similarity over private sets of two users under the assistance of an untrusted cloud server in this paper. Concretely, by leveraging an effective Min‐Hash algorithm on encrypted datasets, our protocols output an approximate similarity, which is very close to the exact value, without leaking any additional privacy to the cloud. Our first solution is under a semihonest cloud server, and our enhanced solution introduced the consistency-check mechanism to achieve verifiability in malicious model. For efficiency, the first solution only need about 6 minutes for billion‐element sets. Furthermore, as far as we know, the consistency-check mechanism is proposed for the first time to achieve an effective verifiable approximate similarity computation.