Cloud computing enables enterprises and individuals to outsource and share their data. This way, cloud computing eliminates the heavy workload of local information infrastructure. Attribute-based encryption has become a promising solution for encrypted data access control in clouds due to the ability to achieve one-to-many encrypted data sharing. Revocation is a critical requirement for encrypted data access control systems. After outsourcing the encrypted attribute-based ciphertext to the cloud, the data owner may want to revoke some recipients that were authorized previously, which means that the outsourced attribute-based ciphertext needs to be updated to a new one that is under the revoked policy. The integrity issue arises when the revocation is executed. When a new ciphertext with the revoked access policy is generated by the cloud server, the data recipient cannot be sure that the newly generated ciphertext guarantees to be decrypted to the same plaintext as the originally encrypted data, since the cloud server is provided by a third party, which is not fully trusted. In this article, we consider a new security requirement for the revocable attribute-based encryption schemes: integrity. We introduce a formal definition and security model for the revocable attribute-based encryption with data integrity protection (RABE-DI). Then, we propose a concrete RABE-DI scheme and prove its confidentiality and integrity under the defined security model. Finally, we present an implementation result and provide performance evaluation which shows that our scheme is efficient and practical.

To manage outsourced encrypted data sharing in clouds, attribute-based proxy re-encryption (ABPRE) has become an elegant primitive. In ABPRE, a cloud server can transform an original recipient’s ciphertext to a new one of a shared user’s. As the transformation is computation consuming, a malicious cloud server may return an incorrect re-encrypted ciphertext to save its computation resources. Moreover, a shared user may accuse the cloud server of returning an incorrect re-encrypted ciphertext to refuse to pay the cost of using the cloud service. However, existing ABPRE schemes do not support a mechanism to achieve verifiability and fairness. In this article, a novel verifiable and fair attribute-based proxy re-encryption (VF-ABPRE) scheme is introduced to support verifiability and fairness. The verifiability enables a shared user to verify whether the re-encrypted ciphertext returned by the server is correct and the fairness ensures a cloud server escape from malicious accusation if it has indeed conducted the re-encryption operation honestly. Additionally, we conduct a performance experiment to show the efficiency and practicality of the new VF-ABPRE scheme.

Outsourcing the heavy decryption computation to a cloud service provider has been a promising solution for a resource-constrained mobile device to deploy an attribute-based encryption scheme. However, the current attribute based encryption with outsourced decryption schemes only enable the mobile device to verify whether the cloud service provider has returned a correct decryption result, they lack a mechanism to enable the cloud service provider to escape from a mobile device's wrong claim if it has returned a correct decryption result. This paper, for the first time, proposes an attribute based encryption with reliable outsourced decryption scheme using the blockchain smart contract. In the proposed scheme, not only can the mobile device verify whether the cloud service provider has returned a correct decryption result, but also the cloud service provider can escape from a wrong claim if the returned decryption result is correct. Moreover, our system achieves the fairness property, which means the cloud service provider can get the reward from the mobile device if and only if it has returned a correct decryption result. Finally, we conduct an implementation to demonstrate that the proposed scheme is practical and efficient.

The Internet of Things (IoT) has become ubiquitous and greatly affected peoples‘ daily lives. With the increasing development of IoT devices, the corresponding security issues are becoming more and more challenging. Such a severe security situation raises the following questions that need urgent attention: What are the primary security threats that IoT devices face currently‘ How do vendors and users deal with these threats‘ In this paper, we aim to answer these critical questions through a large-scale systematic study. Specifically, we perform a ten-month-long empirical study on the vulnerability of 1,362,906 IoT devices varying from six types. The results show sufficient evidence that N-days vulnerability is seriously endangering the IoT devices: 385,060 (28.25%) devices suffer from at least one N-days vulnerability. Moreover, 2,669 of these vulnerable devices may have been compromised by botnets. We further reveal the massive differences among five popular IoT search engines: Shodan, Censys, Zoomeye, Fofa and NTI. Besides, we measure the security of MQTT servers and identify that 12,740 (88%) MQTT servers have no password protection. Our analysis can serve as an important guideline for investigating the security of IoT devices, as well as advancing the development of a more secure environment for IoT systems.

The application of the Internet of Things (IoT) in medical field has brought unprecedented convenience to human beings. However, attackers can use device configuration vulnerabilities to hijack devices, control services, steal medical data, or make devices operate illegally. These restrictions have led to huge security risks for IoT, and have challenged the management of critical infrastructure services. Based on these problems, this paper proposes an anomaly detection system for detecting illegal behavior (DIB) in medical IoT environment. The DIB system can analyze data packets transmitted by medical IoT devices, learn operation rules by itself, and remind management personnel that the device is in an abnormal operation state to ensure the safety of control service. We further propose a model which is based on rough set (RS) theory and fuzzy core vector machine (FCVM) to improve the accuracy of DIB classification anomalies. Experimental results show that the R-FCVM is effective.

Cloud computing, which provides adequate storage and computation capability, has been a prevalent information infrastructure. Secure data sharing is a basic demand when data was outsourced to a cloud server. Attribute-based proxy re-encryption has been a promising approach that allows secure encrypted data sharing on clouds. With attribute-based proxy re-encryption, a delegator can designate a set of shared users through issuing a re-encryption key which will be used by the cloud server to transform the delegator's encrypted data to the shared users'. However, the existing attribute-based proxy re-encryption schemes lack a mechanism of revoking users from the sharing set which is critical for data sharing systems. Therefore, in this paper, we propose a concrete attribute-based proxy re-encryption with direct revocation mechanism (ABPRE-DR) for encrypted data sharing that enables the cloud server to directly revoke users from the original sharing set involved in the re-encryption key. We implemented the new schemes and evaluated its performance. The experimental results show that the proposed ABPRE-DR scheme is efficient and practical.