The Internet of things (IoT) changed our lives with a huge amounts of data production. Due to source-limited IoT devices, one of the best ways to process the data is the cloud storage. However, a series of security and privacy issues arise, such as illegal data access, data tampering and privacy leak. Though symmetric encryption can guarantee the data confidentiality, it cannot realize fine-grained data sharing and searching. The keyword-based searchable attribute-based encryption (KSABE) can achieve the data confidentiality and fine-grained access control. More importantly, it realizes keyword-based search for data users. However, the heavy decryption computation burden and the management of massive user keys appear when implement ABE schemes to IoT. Therefore, this paper proposes a blockchain-aided searchable attribute-based encryption (BC-SABE) with efficient revocation and decryption. Where the traditional centralized server is replaced with a decentralized blockchain system being in charge of the threshold parameter generation, key management and user revocation. All revocation tasks are done by the blockchain and it is on longer necessary for ciphertext re-encryption and key update. Moreover, users utilize the coalition blockchain to generate partial tokens. Besides, the cloud server contained in our scheme not only stores the massive encrypted data, but also performs search and pre-decryption for users who only require one exponentiation in the group G to decrypt fully. Security analyses prove that our scheme realizes the security under the chosen plaintext attack and the chosen keyword attack. Simulations show that the decryption and token generation cost of our scheme are preferable.

IoT-based E-commerce is a new business model that relies on autonomous transaction management on IoT-devices. The management system towards IoT-based E-commerce demands autonomy, lightweight and legitimacy. As blockchain is an innovative technology that is competent in governing the decentralized network, we adopt it to design the autonomous transaction management system on IoT E-commerce. However current blockchain solutions, most namely cryptocurrencies, have fatal drawbacks of non-supervisability and huge computational overhead, and hence cannot be directly applied on IoT-based E-commerce. In this paper, we propose NormaChain, a blockchain-based normalized autonomous transaction settlement system for IoT-based E-commerce. By designing a special three-layer sharding blockchain network, we can significantly increase transaction efficiency and system scalability. Additionally, by designing an innovative decentralized public key searchable encryption scheme (Decentralized PEKS scheme), we can uncover illegal and criminal transactions and achieve crime traceability. Our new DPEKS scheme cryptographically eliminates the dependence of a trusted central authority in the original PEKS scheme and instead expands it to a fully decentralized governance, which distributes the supervision power equally among all parties. More importantly, by proving NormaChain is secure against chosen ciphertext attacks (CCA) and against the stealing of the secret key, we show that NormaChain prevents a legitimate user’s privacy from being violated by banks, supervisors or malicious adversaries. Finally, we deliver the NormaChain system with design details and full implementations. Experiments show that the average transaction-per-second (TPS) on IoT devices is around 113, and the supervision accuracy is 100% when proper target illegal keywords are provided.

One of the best ways to deal with the massive data generated by the Internet of things (IoT) is storing them in the cloud. However outsourced storage raises some security and privacy issues such as data leaking and illegal access. The attribute-based signcryption (ABSC) is one of the most promising approaches which can ensure the confidentiality and authenticity of data simultaneously. Nonetheless, it not only inherits the fine-grained access control but also the heavy computational cost which is intolerable for most resource-limited IoT devices. In this paper, we propose LH-ABSC, a lightweight ABSC scheme which adopts ciphertext-policy encryption (CPABE) and key-policy attribute-based signature (KPABS). CPABS leads the decision-making that who can decrypt to the data owners directly. Meanwhile, the signature is related with data owners’ attribute set which can be used to testify the authenticity of data. In particular, LH-ABSC has constant signature size and satisfies public verification which is deeply important for IoT devices. Moreover, LH-ABSC outsources most computing overhead to fog nodes including signature, verify and decryption. Comprehensive theoretical analyses such as confidentiality, unforgeability and verifiability are provided. Also, the selective chosen ciphertext security, the selective chosen message security and signers anonymity are achieved.

In modern society, social networks play an important role for online users. However, one unignorable problem behind the booming of the services is privacy issues. At the same time, neural networks have been swiftly developed in recent years, and are proven to be very effective in inference attacks. This paper proposes a new framework for inference attacks in social networks, which smartly integrates and modifies the existing state-of-the-art Convolutional Neural Network (CNN) models. As a result, the framework can fit wider applicable scenarios for inference attacks no matter whether a user has a legit profile image or not. Moreover, the framework is able to boost the existing high-accuracy CNN for sensitive information prediction. In addition to the framework, the paper also shows the detailed configuration of Fully Connected Neural Networks (FCNNs) for inference attacks. This part is usually missing in the existing studies. Furthermore, traditional machine learning algorithms are implemented to compare the results from the constructed FCNN. Last but not least, this paper also discusses that applying Differential Privacy (DP) can effectively undermine the accuracy of inference attacks in social networks.

Health-related Internet of Things (IoT) devices are becoming more popular in recent years. On the one hand, users can access information of their health conditions more conveniently; on the other hand, they are exposed to new security risks. In this paper, we presented, to the best of our knowledge, the first in-depth security analysis on home-use electroencephalography (EEG) IoT devices. Our key contributions are twofold. First, we reverse-engineered the home-use EEG system framework via which we identified the design and implementation flaws. By exploiting these flaws, we developed two sets of novel easy-to-exploit PoC attacks, which consist of four remote attacks and one proximate attack. In a remote attack, an attacker can steal a user's brain wave data through a carefully crafted program while in the proximate attack, the attacker can steal a victim's brain wave data over-the-air without accessing the victim's device on any sense when he is close to the victim. As a result, all the 156 brain-computer interface (BCI) apps in the NeuroSky App store are vulnerable to the proximate attack. We also discovered that all the 31 free apps in the NeuroSky App store are vulnerable to at least one remote attack. Second, we proposed a novel deep learning model of a joint recurrent convolutional neural network (RCNN) to infer a user's activities based on the reduced-featured EEG data stolen from the home-use EEG IoT devices, and our evaluation over the real-world EEG data indicates that the inference accuracy of the proposed RCNN is can reach 70.55%.