Decentralizing multi-authority attribute-based encryption (ABE) has been adopted for solving problems arising from sharing confidential corporate data in cloud computing. For decentralizing multiauthority ABE systems that do not rely on a central authority, collusion resistance can be achieved using a global identifier. Therefore, identity needs to be managed globally, which results in the crucial problems of privacy and security. A scheme is developed that does not use a central authority to manage users and keys, and only simple trust relations need to be formed by sharing the public key between each attribute authority (AA). User identities are unique by combining a user's identity with the identity of the AA where the user is located. Once a key request needs to be made to an authority outside the domain, the request needs to be performed by the authority in the current domain rather than by the users, so, user identities remain private to the AA outside the domain, which will enhance privacy and security. In addition, the key issuing protocol between AA is simple as the result of the trust relationship of AA. Moreover, extensibility for authorities is also supported by the scheme presented in this paper. The scheme is based on composite order bilinear groups. A proof of security is presented that uses the dual system encryption methodology.

Nowadays, big data has become a hot research topic. It gives fresh impetus to the economic and social development. However, the huge value of big data also makes it the focus of attacks. Big data security incidents occur frequently in recent years. The security supervision capacities for big data do not match its important role. Data provenance which describes the origins of data and the process by which it arrived the current state, is an effective approach for data supervision. For the full use of provenance in big data supervision, a provenance model which defines the concepts used to represent the provenance types and relations is required to be built in advance, but current provenance models do not adapt to big data scenarios well. In this paper, we comprehensively consider the characteristics of big data and the requirements of data security supervision, extend the widely used provenance model PROV-DM by subtyping and new relation definition, and propose a big data provenance model (BDPM) for data supervision. BDPM model supports the provenance representation of various data types and diverse data processing modes to represent the entire data transformation process through different components in the big data system, and defines new relations to enrich provenance analysis functions. Based on BDPM model, we introduce the constraints that should be satisfied in the construction of valid provenance graph and present the data security supervision methods via provenance graph analysis. Finally, we evaluated the satisfiability of BDPM model through a case study.

When users upload their private data to the cloud, they lose control of the data stored in the cloud server. If the cloud system cannot provide an effective security mechanism to protect the data, the consequent data leakage issue will hinder the development of cloud computing. Conventional access control and encryption technologies cannot effectively control the propagation of tenant private data in the system. The mandatory one-way information flow control model is limited by the complexity of the cloud environment, and it is difficult to effectively protect private data stored in the cloud. To solve the above problems, this article proposes a tenant-led ciphertext information flow control method for cloud virtual machines. Through the design of a decentralized information flow control security policy, a secret-domain key management scheme, and a multi-ID-based threshold encryption scheme, the information flow control strategies of taint infection, secret-level reduction, and ability propagation are realized in a ciphertext form, which can effectively prevent malicious users inside and outside the system from illegally reading private data. The feasibility of this method is verified by a security proof and an experiment.

A remarkable characteristic of modern operating system is open, which means that we can download data or execute codes from any Internet sources whether they are trusted or not. As a consequence, there is a contradict situation when we want to use these data or codes as well as keep the system security. Despite decades of researches and experiences on this problem, it is still assumed as a great challenge. This paper presents a novel dynamic defense model (DDM) to reduce security risks brought by these suspicious data or codes for the open operating systems. DDM is a high-level security defense abstraction with four key minds: dynamic label marking, dynamic label tracking, dynamic label modulating, and run-time controlling. With these minds, DDM achieves the full, dynamic and real-time security protection in the whole life cycle of the operating system. We also practically implemented a prototype system named DDDroid on Android. We constructed a mixed experimental data set with 30 malware samples and 970 benign applications to test the defense effects of DDDroid. DDDroid detects 97% of the malware samples have malicious actions and blocks these actions with a negligible false positive on legal actions. We also demonstrated DDDroid is an effective system that prevents the sensitive data from being leaked by suspicious applications deliberately or by users unintentionally through some sample experiments. What’s more, with extensive evaluations, DDDroid is proved to be a system with low performance overhead and limited memory consumption.

The emergence of mobile edge computing (MEC) has facilitated the development of data caching technology, which enables application vendors to cache frequently used data on the edge servers close to the user, thereby providing low-latency data access services. However, in an unstable MEC environment, the multi-replica data cached by different edge servers is prone to corruption, making it crucial to verify the consistency of multi-replica data on different edge servers. Although the existing research realizes data integrity verification based on the cooperation of multiple edge servers, the integrity proof generated by multiple copies of data is the same, which has low verification efficiency and is vulnerable to attacks such as replay and replace. To address the above issues, based on homomorphic hash and sampling algorithms, this paper proposes an efficient and lightweight multi-replica integrity verification algorithm, which has significantly less storage cost and computational cost and can resist forgery and replay and replace attacks. Based on the verification algorithm, this paper further proposes a multi-replica edge data integrity collaborative audit scheme EDI-C based on the reputation model. EDI-C realizes the efficient collaborative audit of multiple edge servers in a distributed discrete environment through an incentive mechanism to avoid the trust problem of both sides caused by centralized audit. Also, it supports batch auditing of multiple copies of original data files at the same time through parallel processing and data block auditing technology, which not only significantly improves the verification efficiency but also realizes the accurate location and repair of corrupted data at the data block level. Finally, the security analyses and performance evaluation show the security and practicability of EDI-C. Compared with the representative schemes, the results show that EDI-C can ensure the integrity verification of cached data more efficiently in an MEC environment.

As a new and energetic realm of economic development, an innovative engine of social development, and a strategic tool for shaping national competitiveness, big data significantly effects peoples lives. However, improved social awareness of data value and vigorous development of big data platforms mean that big data security is increasingly hindering the promotion of big data applications. Meanwhile, as big data technology and framework continue to evolve, researchers still have different understandings of the core ideas and key features of big data security, and a unified big data security framework has yet to be established. Currently, determining the state-of-the-art of big data security technology is urgently needed to provide reference for research aimed at solving key big data security issues. Following a typical big data system technology framework, this review builds a novel big data security technology framework around big data security requirements. With this framework, state-of-the-art key big data security technologies are systematically summarized from three aspects: big data secure sharing and trusted services, big data platform security, and big data security supervision, which includes the main security mechanisms involved in big data business processes and system technology frameworks. Finally, big data security technologys core issues and development trends are summarized.