IoT devices often collect data and store the data in the cloud for sharing and further processing. A natural solution for secure access is directly using the device owner?s identity as the private key to generate a signature for data authentication. However this will simultaneously expose this identity. Attribute based signature (ABS), which takes the signer?s attributes instead of his/her identity as the private key, can realize data authentication while preserving the signer?s identity privacy. In ABS, there are multiple authorities that issue different private keys for signers based on their various attributes, and a central authority is usually established to manage all these attribute authorities. However, one security concern is that if the central authority is compromised, the whole system will be broken. In this paper, we present an outsourced decentralized multi-authority attribute based signature (ODMA-ABS) scheme. The proposed ODMAABS achieves attribute privacy and stronger authority-corruption resistance than existing multi-authority attribute based signature schemes. In addition, the overhead to generate a signature is further reduced by outsourcing expensive computation to a signing cloud server. We provide extensive security analysis and experimental simulation of the proposed scheme. We also propose an access control scheme that is based on ODMA-ABS.

The cloud storage auditing with deduplication is able to verify the integrity of data stored in the cloud while the cloud needs to keep only a single copy of duplicated file. To the best of our knowledge, all of the existing cloud storage auditing schemes with deduplication are vulnerable to brute-force dictionary attacks, which incurs the leakage of user privacy. In this paper, we focus on a new aspect of being against brute-force dictionary attacks on cloud storage auditing. We propose a cloud storage auditing scheme with deduplication supporting strong privacy protection, in which the privacy of user's file would not be disclosed to the cloud and other parties when this user's file is predictable or from a small space. In the proposed scheme, we design a novel method to generate the file index for duplicate check, and use a new strategy to generate the key for file encryption. In addition, the user only needs to perform lightweight computation to generate data authenticators, verify cloud data integrity, and retrieve the file from the cloud. The security proof and the performance evaluation demonstrate that the proposed scheme achieves desirable security and efficiency.

Remote data integrity auditing, as a key technology for cloud storage, allows verifier to check cloud data integrity without downloading entire file from cloud server (CS). In practice, user might only concern the integrity of the files containing the specific keyword and would like to perform data dynamic operations on data. In this paper, we construct a practical keyword-based remote data integrity auditing scheme supporting full data dynamics. In such a scheme, a novel construction called keyword tag is designed. Using the keyword tag, TPA is able to simultaneously check whether CS correctly keeps all files containing the specific keyword. TPA can detect CS's misbehaviors once CS does not keep these files correctly. Furthermore, our scheme supports full data dynamics, including file-level updates and block-level updates. The keyword tag is updated when the user performs the file-level updates. To support block-level updates, we introduce an index switcher set to maintain the relationship between the block index and the authenticator index. We can avoid the recalculation of the authenticators by using authenticator indexes to generate authenticators. After cloud data are updated, data integrity still can be guaranteed. Security analysis and experimental results show that our scheme is provably secure and efficient.

With a large number of devices and a wealth of user data sets, the Internet of Things (IoT) has become a great host for federated learning (FL). At the same time, the massive amount of user data in IoT results in desperate demand for privacy preserving. The onion router (Tor) is a promising method to solve the privacy issue in IoT-based FL by user anonymity. However, IoT devices’ resource is too limited to execute the cryptographic operations in Tor. Moreover, network traffics in Tor can be easily controlled by malicious routers with a fake high self-reported bandwidth. In this article, taking advantage of the Tor, we will introduce an anonymous FL framework in IoT called FedTor. To decrease the cryptographic cost in conventional Tor, we propose a lightweight shared key generation scheme for resource-limited IoT devices. Furthermore, we use the difference between the self-reported bandwidth and the bandwidth observed from others to measure the reputation of onion routers. A reputation-based router selection (RBRS) scheme is then brought up to defend traffic control from malicious routers. We conducted extensive simulations to compare FedTor with related works. The results show that the RBRS scheme can decrease the malicious rate of onion routers and the lightweight shared key has a cost advantage over other schemes.

Data integrity auditing with data deduplication allows the cloud to store only one copy of the identical file while ensuring the integrity of outsourced data. To facilitate flexible updates of outsourced data, data integrity auditing schemes supporting data dynamics and deduplication have been proposed. However, existing schemes either impose significant computation and communication burden to achieve data dynamics while ensuring data integrity and deduplication, or incur substantial computation overhead during the phases of authenticator generation and auditing. To address the above problems, in this paper, we construct a secure deduplication and efficient data integrity auditing scheme with data dynamics for cloud storage (DIADD). We design a lightweight authenticator structure to produce data authenticators for data integrity auditing, which can achieve authenticator deduplication and greatly reduce the computation overhead in the authenticator generation phase. Additionally, the time-consuming operations can be eliminated in the auditing phase. To enhance the efficiency of data dynamics, we employ the multi-set hash function technology to produce the file tags. This allows data owners to compute a new file tag without needing to recover the entire original file when performing dynamic operations. Furthermore, security analysis and experimental results demonstrate that DIADD is both secure and efficient.

We propose a privacy-preserving machine learning scheme based on the cloud-edge–end architecture to address issues like weak computing power of Internet of Things (IoT) terminals, poor communication quality, and heavy cloud server burdens in traditional frameworks. Edge servers aggregate and forward terminal data, relieving terminals of heavy communication tasks and undertaking part of the computing tasks, which reduces the burden on cloud servers and improves system response speed. For privacy protection, we flexibly use homomorphic encryption and secret sharing techniques, and dynamically add differential privacy noise to resist member inference attacks. Task allocation is coordinated between different layers to optimize computing overhead. Shallow model training is performed on edge servers using homomorphic encryption, while deep model training is conducted on cloud servers using secret sharing. To achieve the conversion from homomorphic ciphertext to secret sharing shares, we design a distributed decryption protocol. Experimental results show our scheme reduces computation overhead by 20%–30% compared to existing privacy-preserving machine learning schemes based on the cloud-edge–end framework, while maintaining privacy protection throughout all stages.