Internet of Things (IoT) is an increasingly popular technology that enables physical devices, vehicles, home appliances, etc. to communicate and even inter-operate with one another. It has been widely used in industrial production and social applications including smart home, healthcare, and industrial automation. While bringing unprecedented convenience, accessibility, and efficiency, IoT has caused acute security and privacy threats in recent years. There are increasing research works to ease these threats, but many problems remain open. To better understand the essential reasons of new IoT threats and the challenges in current research, this survey first proposes the concept of “IoT features”. Then, we discuss the security and privacy effects of eight IoT features including the threats they cause, existing solutions to threats and research challenges yet to be solved. To help researchers follow the up-to-date works in this field, this paper finally illustrates the developing trend of IoT security research and reveals how IoT features affect existing security research by investigating most existing research works related to IoT security from 2013 to 2017.

Federated learning can combine a large number of scattered user groups and train models collaboratively without uploading data sets, so as to avoid the server collecting user sensitive data. However, the model of federated learning will expose the training set information of users, and the uneven amount of data owned by users in multiple users’ scenarios will lead to the inefficiency of training. In this paper, we propose a privacy-preserving federated learning scheme in fog computing. Acting as a participant, each fog node is enabled to collect Internet of Things (IoT) device data and complete the learning task in our scheme. Such design effectively improves the low training efficiency and model accuracy caused by the uneven distribution of data and the large gap of computing power. We enable IoT device data to satisfy ε-differential privacy to resist data attacks and leverage the combination of blinding and Paillier homomorphic encryption against model attacks, which realize the security aggregation of model parameters. In addition, we formally verified our scheme can not only guarantee both data security and model security, but completely resist collusion attacks launched by multiple malicious entities. Our experiments based on the Fashion-MNIST dataset prove that our scheme is highly efficient in practice.

Today, cloud storage becomes one of the critical services, because users can easily modify and share data with others in cloud. However, the integrity of shared cloud data is vulnerable to inevitable hardware faults, software failures or human errors. To ensure the integrity of the shared data, some schemes have been designed to allow public verifiers (i.e., third party auditors) to efficiently audit data integrity without retrieving the entire users’ data from cloud. Unfortunately, public auditing on the integrity of shared data may reveal data owners’ sensitive information to the third party auditor. In this paper, we propose a new privacy-aware public auditing mechanism for shared cloud data by constructing a homomorphic verifiable group signature. Unlike the existing solutions, our scheme requires at least t group managers to recover a trace key cooperatively, which eliminates the abuse of single-authority power and provides non-frameability. Moreover, our scheme ensures that group users can trace data changes through designated binary tree; and can recover the latest correct data block when the current data block is damaged. In addition, the formal security analysis and experimental results indicate that our scheme is provably secure and efficient.

An Internet of Things (IoT) system generally contains thousands of heterogeneous devices which often operate in swarms -large, dynamic, and self-organizing networks. Remote attestation is an important cornerstone for the security of these IoT swarms, as it ensures the software integrity of swarm devices and protects them from attacks. However, current attestation schemes suffer from single point of failure verifier. In this paper, we propose ESDRA, an efficient and secure distributed remote attestation scheme for IoT swarms. We present the first many-to-one attestation scheme for device swarms, which reduces the possibility of single point of failure verifier. Moreover, we utilize distributed attestation to verify the integrity of each node and apply accusation mechanism to report the invaded nodes, which makes ESDRA much easier to feedback the certain compromised nodes and reduces the run-time of attestation. We analyze the security of ESDRA and do some simulation experiments to show its practicality and efficiency. Especially, ESDRA can significantly reduce the attestation time and has a better performance in the energy consumption comparing with list-based attestation schemes.

To improve data availability and durability, cloud users would like to store multiple copies of their original files at servers. The multi-copy auditing technique is proposed to provide users with the assurance that multiple copies are actually stored in the cloud. However, most multi-replica solutions rely on Public Key Infrastructure (PKI), which entails heavy overhead of certificate computation and management. In this paper, we propose an efficient multi-copy dynamic integrity auditing scheme by employing certificateless signatures (named MDSS), which gets rid of expensive certificate management overhead and avoids the key escrow problem in identity-based signatures. Specifically, we improve the classic Merkle Hash Tree (MHT) to achieve batch updates for multi-copy storage, which allows the communication overhead incurred for dynamics to be independent of the replica number. To meet the flexible storage requirement, we propose a variable replica number storage strategy, allowing users to determine the replica number for each block. Based on the fact that auditors may frame Cloud Storage Servers (CSSs), we use signature verification to prevent malicious auditors from framing honest CSSs. Finally, security analysis proves that our proposal is secure in the random oracle model. Analysis and simulation results show that our proposal is more efficient than current state-of-the-art schemes.

The decentralized exchange (DEX) leverages smart contracts to trade digital assets for users on the blockchain. Developers usually develop several smart contracts into one project, implementing complex logic functions and multiple transaction operations. However, the interaction among these contracts poses challenges for developers analyzing the state logic. Due to the complex state logic in DEX projects, many critical state derailment defects have emerged in recent years. In this article, we conduct the first systematic study of state derailment defects in DEX. We define five categories of state derailment defects and provide detailed analyses of them. Furthermore, we propose a novel deep learning-based framework S tateGuard for detecting state derailment defects in DEX smart contracts. It leverages a smart contract deconstructor to deconstruct the contract into an abstract syntax tree (AST), from which five categories of dependency features are extracted. Next, it implements a graph optimizer to process the structured data. At last, the optimized data is analyzed by graph convolutional networks to identify potential state derailment defects. We evaluated S tateGuard through a dataset of 46 DEX projects containing 5671 smart contracts, and it achieved 94.25% F1-score. In addition, in a comparison experiment with state-of-the-art, S tateGuard leads the F1-score by 6.29%. To further verify its practicality, we used S tateGuard to audit real-world contracts and successfully authenticated multiple novel common vulnerabilities and exposures.