As an important application of the Internet-of-Things, many remote monitoring systems adopt a device-to-cloud network paradigm. In a remote patient monitoring (RPM) case, various resource-constrained devices are used to measure the health conditions of a target patient in a distant non-clinical environment and the collected data are sent to the cloud backend of an authorized health care service for processing and decision making. As the measurements involve private patient information, access control and trustworthy processing of the confidential data become very important. Software-based solutions that adopt advanced cryptographic tools, such as attribute-based encryption and fully homomorphic encryption, can address the problem, but they also impose substantial computation overhead on both client and server sides. In this work, we deviate from the conventional software-based solutions and propose a secure and efficient remote monitoring framework, called SRM, using the latest hardware-based trustworthy computing technology, such as Intel SGX. In addition, we present a robust and lightweight “heartbeat” protocol to handle notoriously difficult key revocation problem. We implemented a prototype of the framework for SRM and show that SRM can protect user data privacy against unauthorized parties, with minimum performance cost compared to existing software-based solutions.

Container placement (CP) is a nontrivial problem in Container as a Service (CaaS). Many works in the literature solve it by using linear server energy-consumption models. However, the solutions of using a linear model makes different CPs indistinguishable with regard to energy consumption in a homogeneous host environment that has a same amount of active hosts. As such, these solutions are energy inefficient. In this paper, we demonstrate that an energy-saving gain can be achieved by optimizing the placement of containers under a nonlinear energy consumption model. Specifically, we leverage a strategy based on genetic algorithm (GA) to search the optimal solution. Unfortunately, the conventional GA incurs performance degradation when the virtual machine (VM) resource utilization is high. In order to solve this problem, we propose an improved genetic algorithm called IGA for efficiently searching the optimal CP solution by introducing two different exchange mutation operations and constructing a function as the control parameter to selectively control the usage of the two operations. Extensive experiments are carried out under different settings, and their results show that our strategy is better than the existing CP strategies, i.e., spread and binpack, on energy efficiency target. In addition, the introduced IGA is experimentally proved to be more effective compared with the First Fit, Particle Swarm Optimization (PSO) algorithm and conventional GA. Moreover, the results validate that our proposed strategy can search new CP solutions with better fitness and alleviate the performance degradation caused by the conventional GA when the VM resource utilization is high.

Due to the concern on cloud security, digital encryption is applied before outsourcing data to the cloud for utilization. This introduces a challenge about how to efficiently perform queries over ciphertexts. Crypto-based solutions currently suffer from limited operation support, high computational complexity, weak generality, and poor verifiability. An alternative method that utilizes hardware-assisted Trusted Execution Environment (TEE), i.e., Intel SGX, has emerged to offer high computational efficiency, generality and flexibility. However, SGX based solutions lack support on multi-user query control and suffer from security compromises caused by untrustworthy TEE function invocation, e.g., key revocation failure, incorrect query results, and sensitive information leakage. In this paper, we leverage SGX and propose a secure and efficient SQL-style query framework named QShield. Notably, we propose a novel lightweight secret sharing scheme in QShield to enable multi-user query control; it effectively circumvents key revocation and avoids cumbersome remote attestation for authentication. We further embed a trust-proof mechanism into QShield to guarantee the trustworthiness of TEE function invocation; it ensures the correctness of query results and alleviates side-channel attacks. Through formal security analysis, proof-of-concept implementation and performance evaluation, we show that QShield can securely query over outsourced data with high efficiency and scalable multi-user support.