Search

The swift development of the Internet of Things (IoT) has accelerated digitalization across several industries, offering networked applications in fields such as security, home automation, logistics, and quality control. The growth of connected devices, on the other hand, raises worries about data breaches and security hazards. Because of IoT devices’ computational and energy limits, traditional cryptographic methods face issues. In this context, we emphasize the importance of our contribution to image encryption in IoT environments through the proposal of Multiple Map Chaos Based Image Encryption (MMCBIE), a novel method that leverages the power of multiple chaotic maps. MMCBIE uses multiple chaotic maps to construct a strong encryption framework that considers the inherent features of digital images. Our proposed method, MMCBIE, distinguishes itself by integrating multiple chaotic maps like Henon Chaotic Transform and 2D-Logistic Chaotic Transform in a novel combination, a unique approach that sets it apart from existing schemes. Compared to other chaotic-based encryption systems, this feature renders them practically indistinguishable from pure visual noise. Security evaluations and cryptanalysis confirm MMCBIE’s high-level security properties, indicating its superiority over existing image encryption techniques. MMCBIE demonstrated superior performance with NPCR (Number of Pixel Changing Rate) score of 99.603, UACI (Unified Average Changing Intensity) score of 32.8828, MSE (Mean Square Error) score of 6625.4198, RMSE (Root Mean Square Error) score of 80.0063, PSNR (Peak Signal to Noise Ratio) score of 10.2114, and other security analyses.

The edge devices will produce enormous quantities of data daily as the Industrial Internet of Things (IIoT) expands in scope. Still, most IIoT data is stored in data centers, making it challenging to transfer data between domains safely. Smart logistic products have dramatically changed due to the prevalence of decentralized edge computing and blockchain in the industry sector. To address the need to exchange data between logistics networks, we proposed a novel decentralized hierarchical attribute-based encryption (HABE) scheme combining edge computing and blockchain. To begin, we offer an IoT data encryption strategy in which edge devices can send data to a nearby cloud network for data processing while maintaining privacy. In addition, we developed a blockchain-integrated data-sharing scheme that makes it possible for users to share data via the use of edge and cloud storage. In particular, an IoT device incorporates an encryption-based authentication system to verify users’ access rights at the network’s periphery in a decentralized manner. Using HABE, we provide a blockchain-integrated architecture for the IoT that protects user privacy. The suggested design utilizes the edge and cloud network paradigms and HABE to maintain privacy and works well with smart logistics applications. The authentication time of the proposed model is reduced by 1.5 times compared with the centralized model. The analyses and experimental findings show that the proposed blockchain-integrated edge computing architecture is better than the existing schemes in terms of data sharing, data privacy, and security.

Autonomous vehicles (AVs) are getting popular because of their usage in a wide range of applications like delivery systems, self-driving taxis, and ambulances. AVs utilize the power of machine learning (ML) and deep learning (DL) algorithms to improve their self-driving learning experiences. The sudden surge in the number of AVs raises the need for distributed learning ecosystem to optimize their self-driving experiences at a rapid pace. Toward this goal, federated learning (FL) benefits, which can create a distributed learning environment for AVs. But, the traditional FL transfers the raw input data directly to a server, which leads to privacy concerns among the end-users. The concept of blockchain helps us to protect privacy, but it requires additional computational infrastructure. The extra infrastructure increases the operational cost for the company handling and maintaining the AVs. Motivated by this, in this paper, the authors introduced the concept of gradient encryption in FL, which preserves the users’ privacy without the additional computation requirements. The computational power present in the edge devices helps to fine-tune the local model and encrypt the input data to preserve privacy without any drop in performance. For performance evaluation, the authors have built a German traffic sign recognition system using a convolutional neural network (CNN) algorithm-based classification system and GeFL. The simulation process is carried out over a wide range of input parameters to analyze the performance at scale. Simulation results of GeFL outperform the conventional FL-based algorithms in terms of accuracy, i.e., 2% higher. Also, the amount of data transferred among the devices in the network is nearly three times less in GeFL compared to the traditional FL.

Increasingly, individuals and companies adopt a cloud service provider as a primary data and IT infrastructure platform. The remote access of the data inevitably brings the issue of trust. Data encryption is necessary to keep sensitive information secure and private on the cloud. Yet adversaries can still learn valuable information regarding encrypted data by observing data access patterns. To solve such problem, Oblivious RAMs (ORAMs) are proposed to completely hide access patterns. However, most ORAM constructions are expensive and not suitable to deploy in a database for supporting query processing over large data. Furthermore, an ORAM processes queries synchronously, hence, does not provide high throughput for concurrent query processing. In this article, we design a practical oblivious query processing framework to enable efficient query processing over a cloud database. In particular, we focus on processing multiple range and $k$ k NN queries asynchronously and concurrently with high throughput. The key idea is to integrate indices into ORAM which leverages a suite of optimization techniques (e.g., oblivious batch processing and caching). The effectiveness and efficiency of our oblivious query processing framework is demonstrated through extensive evaluations over large datasets. Our construction shows an order of magnitude speedup in comparison with other baselines. [ABSTRACT FROM AUTHOR]

We propose a novel computer architectural concept of instruction overloading to support block ciphers. Instead of adding new instructions, we extend only the execution of some existing instructions. The proposed method allows a central processing unit core to execute different operations for the same instructions, depending on the address of the data, similar to operator overloading in object-oriented languages. We first present an extension for the AES algorithm, then we demonstrate its enhanced applicability with two further extensions supporting multiple block ciphers and hardware masking. The first extension for AES is also applicable to add/AND-rotate-XOR-based block ciphers such as SIMON. The AES and SIMON encryption speed, on this extended core, is at least doubled and is significantly less affected by memory latency. In addition, the AES encryption code requires only 18% of the memory of the previous software implementation. The second extension can further support various block ciphers defined over GF(28), and the SM4 encryption speed is increased by at least 182%. The third extension provides correlation power analysis (CPA) resistance with a 66.6% area overhead but almost no speed overhead, whereas a typical software anti-CPA AES implementation requires at least hundreds of times the execution time. [ABSTRACT FROM AUTHOR]

With an emerging development in transport technologies, many applications in vehicular environments access roadside unit (RSU) services for tasks offloading. These applications use different types of paid services (e.g., communication, WiFi, and computing nodes) for their execution. The vehicular fog cloud computing (VFCN) is a cooperative computing environment to handle vehicle applications' mobility and resource allocation. However, the aforementioned collaborative VFCN environment still suffers from mobility and security issues in the existing systems. To address the aforementioned issues, in this work we present a cost-efficient and secure VFCN which consists of a mobility-aware multi-scenario offloading phase (MAMSOP) to deal with the mobility and offloading costs. The objective of the work is to execute applications with minimum delays and costs in a secure way. For the security concern, we propose a security scheme based on fully-homomorphism encryption, which encrypts and decrypts data locally and involves computation on encrypted data rather than decrypting it into its original form. As most of the applications have deadline and mobility constraints, so we propose the fully polynomial-time approximation scheme (FPTAS) based search task scheduling (STS) to ensure the execution of all applications within their given constraints. The goal of STS-FPTAS is to determine the delay and cost-aware scheduling into knapsack-aware resources. The knapsack allows all tasks to be allocated to the available length of resources. The results show that the proposed work optimizes the costs by 40% compared to existing systems. [ABSTRACT FROM AUTHOR]

Nowadays, cloud-based storage systems play a vital role in IoT data storage, processing, and sharing. Despite its contribution, the current cloud-based architecture may cause severe data leakage or jeopardize user privacy. Meanwhile, the cloud-based architecture heavily relies on a trusted third-party auditor (TPA) and runs in a centralized control manner. However, the TPA may not be a completely trustworthy entity, and a single point of failure might cause the centralized system to collapse. Fortunately, with the advent of blockchain technology, the decentralized storage model has gained popularity. A decentralized storage system successfully eradicates the rule of TPA, solves the problem of a single point of failure, and has many advantages over a centralized control architecture, such as low storage prices and high throughput. This study offers a blockchain-based decentralized distributed storage and sharing scheme that provides end-to-end encryption and fine-grained access control. In our proposed IoTChain model, fine-grained permission is based on attribute-based access control (A-BAC) policy by employing the Ethereum blockchain as an auditable access control layer. Smart contracts are tailored for the IoTChain model, which combines the Ethereum blockchain and the interplanetary file system (IPFS). We used an advanced encryption standard (AES) for encryption and the elliptic curve Diffie-Hellman key exchange protocol for secret key sharing between data owners and users. Also, the proof-of-work (PoW) consensus mechanism is replaced with a proof-of-authority (PoA) to minimize system transaction cost and boost system throughput. Additionally, our solution has been tested on the Ethereum official test network Rinkeby, and the results demonstrate that our approach is realistic and economical on the IoT data.

With the advances of the fifth generation (5G) mobile communication technology, smart applications enhance the quality of daily life, the urban management by the government and the effective allocation of resources. Smart applications collect data through the Internet of Things, store massive data in the cloud server, and use cloud computing and deep learning to analyze the data, according to the data analysis results to guide human production and life. However, with the breakthrough of 6G technology, the amount of data applied is increasing, and the demand for privacy protection is becoming more prominent. Encrypting data using traditional cryptographic algorithms can solve the problem of privacy leakage, but it hampers the availability of the data. Searchable encryption is a special encryption structure with keyword search, which balances the availability and privacy of massive data. In this article, we analyze some typical security and privacy issues in 6G-based applications, discuss the solutions to these problems, and present a framework of 6G-based smart cities with searchable encryption, which provides a guarantee for the privacy and availability of smart city data (including ciphertext search, access control, etc.). We also propose a searchable encryption solution based on ciphertext-policy attribute-based encryption to solve the conflict between security and data availability of the smart cities as a specific scenario in order to demonstrate the contribution of cryptographic technologies such as public-key searchable encryption to the 6th generation mobile communication technology. [ABSTRACT FROM AUTHOR]

The Internet of Health Things (IoHT) is a medical concept that describes uniquely identifiable devices connected to the Internet that can communicate with each other. As one of the most important components of smart health monitoring and improvement systems, the IoHT presents numerous challenges, among which cybersecurity is a priority. As a well-received security solution to achieve fine-grained access control, ciphertext-policy weighted attribute-based encryption (CP-WABE) has the potential to ensure data security in the IoHT. However, many issues remain, such as inflexibility, poor computational capability, and insufficient storage efficiency in attributes comparison. To address these issues, we propose a novel access policy expression method using 0-1 coding technology. Based on this method, a flexible and efficient CP-WABE is constructed for the IoHT. Our scheme supports not only weighted attributes but also any form of comparison of weighted attributes. Furthermore, we use offline/online encryption and outsourced decryption technology to ensure that the scheme can run on an inefficient IoT terminal. Both theoretical and experimental analyses show that our scheme is more efficient and feasible than other schemes. Moreover, security analysis indicates that our scheme achieves security against a chosen-plaintext attack. [ABSTRACT FROM AUTHOR]

Cloud storage service has shown its great power and wide popularity which provides fundamental support for rapid development of cloud computing. However, due to management negligence and malicious attack, there still lie enormous security incidents that lead to quantities of sensitive data leakage at cloud storage layer. From the perspective of protecting cloud data confidentiality, this paper proposed a Cloud Secure Storage Mechanism named CSSM. To avoid data breach at the storage layer, CSSM integrated data dispersion and distributed storage to realize encrypted, chucked and distributed storage. In addition, CSSM adopted a hierarchical management approach and combined user password with secret sharing to prevent cryptographic materials leakage. The experimental results indicate that proposed mechanism is not only suitable for ensuring the data security at storage layer from leakage, but also can store huge amount of cloud data effectively without imposing too much time overhead. For example, when users upload/download 5G sized file with CSSM, it only takes 646seconds/269seconds, which is acceptable for users.

Block permutation and Co-XOR (BPCX) image encryption is a commonly used encryption method for reversible data hiding in the encryption domain, which can effectively improve the embedded capacity and the ability resisting the existing attacks including ciphertext-only attack and known plaintext attack (KPA). This paper proposes a KPA based on bit-block inversion and mean equivalent division (MED) to estimate the block permutation key of BPCX image encryption. Firstly, we divide an image block into the bit-block and point out that the maximum of the numbers of 0 bit and 1 bit of a bit-block before and after the Co-XOR encryption remains unchanged. And then two inversion rules of bit-block are defined to construct pseudo plain-ciphertext images to eliminate the influence of pixel value changes caused by Co-XOR encryption. Finally, the MED based KPA is designed to estimate the block permutation key sequence according to the pseudo plain-ciphertext images. The relationship between the key estimation accuracy and the number of known plain-ciphertext pairs, block size, and pseudo ciphertext are discussed. Experimental results show that even in the minimum block size ($2\times 2$), the average estimated correct rate of the block permutation sequence exceeds 40%. The block permutation key estimation accuracy is more than 50% when the block size is greater than $3\times 3$. Some improved encryption methods against the proposed KPA are also given. [ABSTRACT FROM AUTHOR]

In mobile communication networks, when a user roams to and accesses a foreign network, the foreign operator needs to request the user’s subscription data from a centralized authentication server, which is managed by the user’s home operator. However, centralized authentication introduces single point of failure. Meanwhile, the real-time participation of the home operator and the trust relationship between the foreign operator and the home operator are difficult to guarantee. In this paper, by adopting blockchain and smart contracts, we propose a secure and efficient access control scheme of user subscription data in roaming scenarios. We further design a flexible user authentication scheme, which utilizes derivable tokens based on the proposed access control scheme. By using blockchain to store and manage user subscription data, access control can be decentralized without any trusted third party. Besides, by implementing automatic verification of access privilege through smart contracts, the limitation of the home operators’ real-time participation is eliminated. In addition, to further improve security and reduce the on-chain storage overhead, we optimize the data encryption and storage scheme utilizing threshold secret sharing. Our security and performance analysis show that the proposed user subscription data access control scheme for roaming service provides high-level security while causing acceptable time and storage overhead. [ABSTRACT FROM AUTHOR]

Smart home is an emerging form of the Internet of things (IoT), which provides a convenient and comfortable living environment for the smart home users. With the explosive growth of smart home information, people pay more attention to the privacy protection of smart home, including the choice of privacy and effective privacy protection scheme. This paper proposes a privacy protection scheme based on information hiding, the scheme guarantees the sensitive data transmitted securely. First, the smart home Real-time sensor data are classified into sensitive data and non-sensitive data through machine learning, the process can be controlled according to the user's preferences. Second, the sensitive data can be transmitted securely by ordinary channels using method of combination encryption with information hiding. Experiment results show that this scheme can help users to express their preferences to the privacy protection, changing the previous practice that users can only accept the privacy settings provided by the supplier. What's more, the scheme combines encryption with information hiding, providing a double guarantee for the sensitive data during they are transmitted on ordinary channels. Comparing to the previous practice of using encryption merely, this scheme greatly improves the security of data transmission and is more suitable for the real environment.

The commercialization of 5G has greatly promoted the development of medical Internet of Things (IoT). More medical devices connected to the Internet may further increase the communication power consumption. Meanwhile, privacy protection technique in cloud computing cannot match the rapid development of medical applications. Therefore, exploring secure, balanced and energy-efficient data transmission between medical devices and cloud servers is extremely challenging. This paper focuses on the security and energy consumption of medical electronic health record (EHR) data transmission and storage between cloud server and IoT device users. We build a secure energy-saving communication and encrypted storage model by adding secure energy-saving communication scheme and encryption algorithm to the traditional medical cloud model. Specifically, we propose a communication authentication algorithm MedGreen based on elliptic curve and bilinear pair. In the algorithm, the two communication parties can complete the key establishment and identity authentication only after one communication, which effectively balances the resource overhead of the key center and the user, and resists the Man-in-the-middle attack. Aiming at the characteristics of large repetition and high sensitivity of medical data, we present a secure data storage algorithm MedSecrecy based on Huffman compression and RC4. The algorithm not only maintains the RC4 encryption efficiency, reduces the amount of cipher text data, but also improves confidentiality, randomness and security of the key stream. Comprehensive analysis and simulations show that our system is secure, energy-saving and highly efficient for EHR.

The use of hardware encryption and new memory technologies such as phase change memory (PCM) are gaining popularity in a variety of server applications such as cloud systems. While PCM provides energy and density advantages over conventional DRAM memory, it faces endurance challenges. Such challenges are exacerbated when employing memory encryption as the stored data is essentially randomized, losing data similarity and reducing or eliminating the effectiveness of energy and endurance oriented encoding techniques. This results in increasing dynamic energy consumption and accelerated wear out. In this article, we propose CASTLE, a technique for in-memory encryption to leverage this encryption process to improve reliability in the presence of endurance faults. We also propose TOWERs for CASTLE that improve reliability as well as energy for encrypted data through a novel application of compression and encoding. CASTLE and TOWERs are compatible with error-correction codes (ECC) and error correction pointers (ECP), the standard for mitigating endurance faults in PCM. When combining CASTLE and TOWERS, we achieve an average lifetime improvement of over 45× compared to SECDED ECC, 7.1× compared to SECRET, and 3.6× compared to the leading partition-and-flip fault-tolerance approach (AEGIS) for the same area overhead. [ABSTRACT FROM AUTHOR]

In-network storage is recognized as a vital component of many emerging network architectures, which facilitates high-quality and efficient content-centric services. In this trend, providing content-based near-duplicate detection (NDD) services among in-network storage becomes naturally necessary for network traffic alleviation and resource optimization. However, due to the increasing attacking surfaces, storing data in the networked environment inevitably raises new concerns about user privacy exposure and unauthorized data access. Therefore, we aim to design a secure NDD service in the context of encrypted in-network storage. For efficiency, we first leverage the fingerprint techniques and locality-sensitive hashing to convert the problem of NDD into the keyword search. We then adopt an efficient multi-key searchable encryption scheme, which requires only one encrypted query from the user even the data are from multiple content providers encrypted with different keys. As simply combining the above methods does not appear to directly locate accurate results, we then devise a secure result refining scheme via Yao’s garbled circuits to avoid user-side post-processing. Furthermore, we enhance our design to address the potential malicious behavior of in-network servers. Extensive evaluations of real-world image dataset demonstrate that our design can achieve comparable accuracy to the plaintext with modest security overhead. [ABSTRACT FROM AUTHOR]

The compact size and high wavelength-selectivity of microring resonators (MRs) enable photonic networks-on-chip (PNoCs) to utilize dense-wavelength-division-multiplexing (DWDM) in their photonic waveguides, and as a result, attain high bandwidth on-chip data transfers. Unfortunately, a hardware Trojan (HT) in a PNoC can manipulate the electrical driving circuit of its MRs to cause the MRs to snoop data from the neighboring wavelength channels in a shared photonic waveguide, which introduces a serious security threat. This article presents a framework that utilizes process variation-based authentication signatures along with architecture-level enhancements to protect against data-snooping HT during unicast as well as multicast transfers in PNoCs. The evaluation results indicate that our framework can improve hardware security across various PNoC architectures with minimal overheads of up to 14.2% in average latency and of up to 14.6% in energy-delay-product (EDP). [ABSTRACT FROM AUTHOR]

Ensuring data confidentiality in a vehicular ad hoc network (VANET) is an increasingly important issue. Message confidentiality, user privacy and access control are the most important problems that affect services provided by VANETs. However, access control that addresses data downloads while preserving users' privacy remains an open problem. Based on a set of attributes, the ciphertext-policy attribute-based encryption (CP-ABE) algorithm proposes a party data encryption/decryption mechanism for shared data; consequently, the algorithm has become a popular solution for data-sharing access control. However, the current CP-ABE schemes are still infeasible for VANETs because these schemes use a single authority and inefficient encryption/decryption and ignore revocation mechanisms. Here, over CP-ABE with revocation, we introduce an identity-based scheme that achieves secure data sharing in VANETs. To reduce the computation load for in-vehicle on-board units (OBUs), we outsource computationally intensive encryption and decryption operations to cloud compute nodes. Attributes are decentralized and managed by application service providers that provide services to vehicles based on subscriptions. Comprehensive experimental results and security analysis show that our scheme achieves fine-grained access control while preserving user privacy. Through implementation, performance analysis demonstrates that our scheme is suitable for VANETs. [ABSTRACT FROM AUTHOR]

The public key infrastructure (PKi) has been widely adopted to create, manage, distribute, store and revoke digital certificates, which plays an important role in bootstrapping secure communications. A PKi system authenticates entities with the corresponding public keys and it lays the security foundation for public-key cryptosystems in public-key encryption and digital signatures. However, traditional PKi systems suffer from security breaches, such as single-point-offailure and man-in-the-middle attacks due to the existence of a centralized certificate authority. in this article, we review the traditional centralized PKi system as well as the subjected security concerns, and then we propose possible solutions to address these issues with the emerging blockchain technology. Two frameworks are presented where blockchain is utilized as a public bulletin board or trusted majority. We implement the functions to evaluate the off-chain time costs and on-chain gas costs of the proposal, which demonstrate the feasibility and practicality of the proposal. [ABSTRACT FROM AUTHOR]

Outsourcing data to a third-party cloud provider has become quite common with the increasing use of cloud computing. This brings convenience, as well as the concern for data security and privacy. It is believed that data encryption alone is often not enough to protect users’ privacy from the cloud provider. According to previous work, the sequence of storage locations accessed by the client can leak up to 90% of the sensitive information, even with data encrypted. In this context, Oblivious RAM (ORAM) is proposed. ORAM algorithms allow the client to hide its access pattern from the service provider while introducing a lot of extra operations. Among all the prototypes, Path ORAM is one of the most promising designs. However, there are still redundant memory accesses that can be removed without harming the security of traditional ORAM as we observed. We came up with three optimization techniques, including path merging, ORAM request scheduling, and merging aware caching. We also propose a prefetching technique to further decreasing the access overhead. Moreover, we also illustrate the compatibility of Fork Path and some state-of-the-art Path ORAM optimizations. Compared to traditional Path ORAM approaches, our Fork Path ORAM can reduce overall performance overhead and power consumption of memory system by 65% and 44%, while the design overhead is trivial. [ABSTRACT FROM AUTHOR]

Currently, Internet of Things (IoT) as an essential infrastructure proposed for industries and different applications has been popularly applied to different domains, such as healthcare and smart farming, for helping people to do something, aiming to improve our living environments. LoRaWAN, as a Long-Range Wide Area Network specification recommended by the LoRa Alliance, is a low power and long distance communication protocol suitable for IoT environments. This protocol adopts a widely used data encryption method, i.e., Advanced Encryption Standard (AES), developed based on powerful algebra operations and multiple encryption cycles to ensure its communication security. LoRaWAN reduces communication power by setting different transmission latencies for different end-devices; however, AES does not take into account its end device's encryption power. In this paper, a high secure but low-power consumption communication scheme for the LoRaWAN, named the Secure Low Power Communication (SeLPC) method, is proposed to further reduce end-devices' data encryption power by reducing encryption cycles of AES. In the SeLPC, encryption key and D-Box update procedure is presented to enhance security level and simplify the AES encryption process so that the power consumption can be further lowered. Comparing with the traditional AES, the analysis results show that the SeLPC can minimize the encryption power up to 26.2%. The SeLPC can also resist three attacks, including known-key, replay, and eavesdropping attacks and is practically helpful for use in LoRaWAN IoT environments.

In remote rural areas without continuous Internet connectivity, it is hard to envisage the use of mHealth applications for remote patient monitoring. In such areas, patients need to travel long distances to reach the nearest health center. In this article, we propose an approach that solves this problem by transmitting mHealth monitoring data, collected using IoT sensors, using DTN. Thus, buses or other vehicles acting as data mules transmit the mHealth data from remote rural areas to a medical center or hospital in the nearest urban area. The proposed approach includes methods to preserve the security of the data through encryption and secure key exchange, and to authenticate the patients through appropriate hashing of selected information. It allows preserving the privacy of the patients, and it takes into account the intermittent nature of the network by adding redundancy to avoid data loss. [ABSTRACT FROM AUTHOR]

Smart power grids are being enhanced by adding a communication infrastructure to improve their reliability, sustainability, and efficiency. Despite all of these significant advantages, their open communication architecture and connectivity renders the power systems’ vulnerability to a range of cyberattacks. This article proposes a novel resilient control system for load frequency control (LFC) system under false data injection (FDI) attacks. It is common to use encryption in data transfer links as the first layer of defending mechanism; here, we propose a second defense layer that can jointly detect and mitigate FDI attacks on power systems. In this article, we propose a new anomaly detection technique that consists of a Luenberger observer and an artificial neural network (ANN). Since FDI attacks can happen rapidly, the observer structure is enhanced by the extended Kalman filter to improve the ANN ability for online detection and estimation. The resilient controller is designed based on the attack estimation, which can eliminate the need for control reconfiguration. The resiliency of the proposed design against FDI attacks is tested on the LFC system. The simulation results clearly show that the proposed control system can successfully detect anomalies and compensate for their adverse effects. [ABSTRACT FROM AUTHOR]

Cloud computing is a model for convenient, on-demand network access to virtualized environments of configurable computing resources. It is challenging to search data encrypted and stored in cloud storage servers. Searchable encryption enables data users to search on ciphertext without leaking any information about keywords and the plaintext of the data. Currently, a number of searchable encryption schemes have been proposed, but most of them provide unlimited search privileges to data users, which is not desirable in certain scenarios. In this paper, we propose a new construction of searchable encryption with fine-grained access control by using key-policy attribute-based cryptography to generate trapdoors to support AND, OR and threshold gates. The main idea is that the data owner encrypts the index keywords according to the specified access policy. The data user can generate a trapdoor to search on data, if and only if the attributes of the data user satisfy the access policy. We provide formal security proofs for the scheme, including the indistinguishability of ciphertexts and the indistinguishability of trapdoors, which are used to resist the chosen keyword attack and the keyword guessing attack of external adversaries. Comprehensive security analysis and implementation results show that the proposed scheme is provably secure and feasible in real-world applications. [ABSTRACT FROM AUTHOR]

Parent-identifying schemes provide a way to identify causes from effects for some information systems, such as digital fingerprinting and group testing. In this paper, we consider the combinatorial structures for parent-identifying schemes. First, we establish an equivalent relationship between the parent-identifying schemes and forbidden configurations. Based on this relationship, we derive the probabilistic existence lower bounds for two related combinatorial structures, that is, $t$ -parent-identifying set systems ($t$ -IPPS) and $t$ -multimedia parent-identifying codes ($t$ -MIPPC), which are used in broadcast encryption and multimedia fingerprinting, respectively. The probabilistic lower bound for the maximum size of a $t$ -IPPS has the asymptotically optimal order of magnitude in many cases, and that for $t$ -MIPPC provides the asymptotically optimal code rate when $t=2$ and the best known asymptotic code rate when $t\ge 3$. Furthermore, we analyze the structure of 2-IPPS and prove some bounds for certain cases. [ABSTRACT FROM AUTHOR]

To accommodate massive digital data, distributed data stores have become the main solution for cloud services. Among others, key-value stores are widely adopted due to their superior performance. But with the rapid growth of cloud storage, there are growing concerns about data privacy. In this paper, we design and build EncKV, an encrypted and distributed key-value store with rich query support. First, EncKV partitions data records with secondary attributes into a set of encrypted key-value pairs to hide relations between data values. Second, EncKV uses the latest cryptographic techniques for searching on encrypted data, i.e., searchable symmetric encryption (SSE) and order-revealing encryption (ORE) to support secure exact-match and range-match queries, respectively. It further employs a framework for encrypted and distributed indexes supporting query processing in parallel. To address inference attacks on ORE, EncKV is equipped with an enhanced ORE scheme with reduced leakage. For practical considerations, EncKV also enables secure system scaling in a minimally intrusive way. We complete the prototype implementation and deploy it on Amazon Cloud. Experimental results confirm that EncKV preserves the efficiency and scalability of distributed key-value stores. [ABSTRACT FROM AUTHOR]

Big graphs, such as user interactions in social networks and customer rating matrices in collaborative filters, possess great values for both businesses and research. They are not only big but often keep evolving, which requires a large amount of computing resources to maintain. With the wide deployment of public cloud resources, owners of big graphs may want to use cloud resources to obtain storage and computation scalability. However, privacy and ownership of the graphs in the cloud has become a major concern. In this paper, we study privacy-preserving algorithms for one of the important graph analysis techniques—graph spectral analysis for outsourced graph in the cloud. The core operation: eigendecomposition of large matrix is also important to many data mining algorithms. We consider a cloud-centric framework with three collaborative parties: data contributors, data owner, and cloud provider. Graphs are represented as matrices such as adjacency matrix and Laplacian matrix, the elements of which are encrypted and submitted by distributed contributors. The data owner then interacts with the cloud-side programs to conduct spectral analysis, while protecting data privacy from the honest-but-curious cloud provider. For a $N\times N$N×N graph matrix, we aim to design algorithms with the cloud handling expensive storage and computation in $O(N^2)$O(N2) complexity, while data owner and data contributors' algorithms take only $O(N)$O(N). To achieve this goal, we develop the privacy-preserving versions of the two approximate eigendecomposition algorithms: the Lanczos algorithm and the Nyström algorithm, considering two encryption methods: additive homomorphic encryption (AHE) methods and somewhat homomorphic encryption (SHE) methods. Both dense and sparse matrices are studied, while sparse matrices also involve a differentially private data submission protocol to allow the trade-off between data sparsity and privacy. Experimental results show that the Nyströ algorithm with sparse encoding can dramatically reduce data owners' costs. SHE-based methods have lower computational time while AHE-based methods have lower communication/storage costs. [ABSTRACT FROM AUTHOR]

Industrial Ethernet is a technology widely spread in factory floors and critical infrastructures where a high amount of data need to be collected and transported. Fiber optic networks at gigabit rates fit well with that type of environment, where speed, system performance, and reliability are critical. In this paper, a new encryption method for high-speed optical communications suitable for such kinds of networks is proposed. This new encryption method consists of a symmetric streaming encryption of the 8b/10b data flow at physical coding sublayer level. It is carried out thanks to a format preserving encryption block cipher working in CTR (counter) mode. The overall system has been simulated and implemented in a field programmable gate array. Thanks to experimental results, it can be concluded that it is possible to cipher traffic at this physical level in a secure way. In addition, no overhead is introduced during encryption, getting minimum latency and maximum throughput. [ABSTRACT FROM AUTHOR]

In recent years, malware with strong concealment uses encrypted protocol to evade detection. Thus, encrypted traffic identification can help security analysts to be more effective in narrowing down those encrypted network traffic. Existing methods are protocol independent, such as statistical-based and machine-learning-based approaches. Statistical-based approaches, however, are confined to payload length and machine-learning-based approaches have a low recognition rate for encrypted traffic using undisclosed protocols. In this paper, we proposed a heuristic statistical testing (HST) approach that combines both statistics and machine learning and has been proved to alleviate their respective deficiencies. We manually selected four randomness tests to extract small payload features for machine learning to improve real-time performances. We also proposed a simple handshake skipping method called HST-R to increase the classification accuracy. We compared our approach with other identification approaches on a testing dataset consisting of traffic that uses two known, two undisclosed, and one custom cryptographic protocols. Experimental results showed that HST-R performs better than other traditional coding-based, entropy-based, and ML-based approaches. We also showed that our handshake skipping method could generalize better for unknown cryptographic protocols. Finally, we also conducted experimental comparisons among different classification algorithms. The results showed that C4.5, with our method, has the highest identification accuracy for secure sockets layer and secure shell traffic. [ABSTRACT FROM AUTHOR]

Scan attacks exploit facilities offered by scan chains to retrieve embedded secret data, in particular, secret keys used by the device for data encryption/decryption in mission mode. This paper presents a scan attack countermeasure based on the encryption of the data written to or read from the scan chains. The secret-key management system already embedded in the device is used to provide appropriate keys for encryption of data flowing on the scan chains. The goal of the proposed solution is to counteract the scan-related security threats while preserving test and diagnosis efficiency provided by conventional design-for-testability techniques, as well as to allow debugging capabilities in mission mode. The proposed solution can deal with both stuck-at and transition-faults test schemes as well as single and multiple scan chain configurations using test data compression schemes. We will show that the proposed scheme provides expected test/diagnostic and debug facilities as classical scan design with marginal impacts on area, test time and design flows, while successfully preventing control and observation of data flowing in the scan chains by unauthorized users. [ABSTRACT FROM AUTHOR]

High Efficiency Video Coding (HEVC) encryption, which has been proposed to encrypt intra prediction modes (structural information), transform coefficients (texture information), and motion related codewords (motion information), has received considerable attention recently. However, there is still the issue of efficiency when HEVC encryption is applied in the Internet of Multimedia Things (IoMT). Aiming at this challenge, in this paper, we propose a new low-overhead HEVC encryption scheme for energy-constrained IoMT. Concretely, the proposed scheme adjusts the selection of the aforementioned syntax elements to be encrypted according to the structure, texture, and motion energy present in each frame. It works as follows. The energy levels of quantized coefficients and motion vectors are calculated and compared with adaptive threshold values to classify the energy level in each video frame. When there is a high energy frame in the video, all the syntax elements are encrypted. When there is a low energy frame, alternate syntax elements are encrypted for achieving low encryption overhead. Moreover, in the case of transform coefficients, to withstand the interpolation attack, alternate coefficients are encrypted after correlating the frame with its neighboring coefficients. Extensive experiments were conducted, and the results demonstrate that the proposed scheme efficiently reduces the encryption overhead with low impact on the security level, making it suitable for IoMT. [ABSTRACT FROM AUTHOR]

The low-entropy masking scheme (LEMS) is a cost-security tradeoff solution that ensures a certain level of security with much lower overheads than a full-entropy masking scheme (FEMS). However, most existing LEMSs are based on a look-up-table (LUT) and limited to the first-order, which is vulnerable to classical higher-order correlation power analysis (CPA) attack and other special types of attack (e.g., collision attack). This paper proposes a new type of LEMS for a block cipher in which the S-box consists of power functions and an affine function. First, a low masking-complexity algorithm for evaluating S-boxes is developed by fully utilizing the property of a hybrid addition-chain (AC) named LUT-AC. Next, an LEMS for block ciphers is proposed. This LEMS provides two different masking modes to realize various cost-security tradeoff schemes. Due to the “masked invariant property” of the LUT-AC, the masking complexity of the proposed LEMS is equal to ${O}$ (${d}$), whereas under FEMS it is equal to ${O}$ (${d}^{{2}}$). Compared with existing LEMSs, the proposed LEMS has following advantages: higher security in terms of the masking entropy; resistance against collision attacks; and scalability to higher-order schemes. Per the proposed algorithm, an architecture without any nonlinear multiplication for evaluating AES is developed by replacing the LUT with seven scalar multiplications. The different LEMSs based on this architecture are developed. Their area overheads are evaluated by implementing different schemes in 65 nm CMOS process. The security of the first-order LEMS with rotation mode is verified by performing CPA on the SAKURA-G FPGA board. From the experimental success rates, it shows that the proposed first-order LEMS can resist CPA without revealing the correct subkey for up to 100 000 power traces, whereas the unprotected scheme is broken at 1100 traces. [ABSTRACT FROM AUTHOR]

Password recovery tools are needed to recover lost and forgotten passwords so as to regain access to valuable information. As the process of password recovery can be extremely compute-intensive, hardware accelerators are often needed to expedite the recovery process. This paper thus presents a high performance, energy-efficient accelerator built upon modern hybrid CPU-FPGA SoC devices. The proposed password recovery accelerator relies on the development of a set of intellectual property (IP) cores for implementing variety of encryption algorithms with vastly different characteristics and complexities. To keep the resource requirements of each IP core running on a resource-strapped FPGA to the minimum, while achieving the highest throughput possible, the most performance critical computational hash functions are mapped to the FPGA with two specific optimization techniques, namely the fixed message padding for hashing and loop transformation for deep pipelining. The proposed password recovery accelerator implements a non-blocking deep pipeline design that does not incur any data and structural hazards, which is made possible by applying a task scheduling scheme through the use of block RAMs. Synchronization between tasks that are mapped to run separately on CPU and FPGA is achieved through task reordering and a communication protocol for maximum parallelism and low overhead. The proposed design is evaluated on Xilinx XC7Z030-3 device, and it is compared much favorably with other known implementations. The proposed hardware accelerator design is found 12.5 and 3.1 times more resource-efficient than the pure FPGA-based password recovery accelerators for TrueCrypt and WPA-2, respectively. The proposed implementation also shows more than 200 percent improvement in energy efficiency over a state-of-the-art implementation on NVIDIA GTX 750 Ti GPU. [ABSTRACT FROM AUTHOR]

For nonvolatile main memory (NVMM), both security and endurance are important. However, the diffusion property of memory encryption renders existing bit-level write reduction techniques ineffective. This paper proposes DeWrite, a line-level write reduction technique to enhance the endurance and performance of secure NVMM. Moreover, DeWrite leverages a new encryption technique, i.e., hash mode encryption, and exploits opportunistic parallelism between encryption and deduplication operations to efficiently synergize deduplication and encryption for space and time savings. [ABSTRACT FROM AUTHOR]

As a significant business paradigm, many online information platforms have emerged to satisfy society's needs for person-specific data, where a service provider collects raw data from data contributors, and then offers value-added data services to data consumers. However, in the data trading layer, the data consumers face a pressing problem, i.e., how to verify whether the service provider has truthfully collected and processed data? Furthermore, the data contributors are usually unwilling to reveal their sensitive personal data and real identities to the data consumers. In this paper, we propose TPDM, which efficiently integratesTruthfulness andPrivacy preservation inDataMarkets. TPDM is structured internally in an Encrypt-then-Sign fashion, using partially homomorphic encryption and identity-based signature. It simultaneously facilitates batch verification, data processing, and outcome verification, while maintaining identity preservation and data confidentiality. We also instantiate TPDM with a profile matching service and a data distribution service, and extensively evaluate their performances on Yahoo! Music ratings dataset and 2009 RECS dataset, respectively. Our analysis and evaluation results reveal that TPDM achieves several desirable properties, while incurring low computation and communication overheads when supporting large-scale data markets. [ABSTRACT FROM AUTHOR]

Nowadays, machine learning is becoming a new paradigm for mining hidden knowledge in big data. The collection and manipulation of big data not only create considerable values, but also raise serious privacy concerns. To protect the huge amount of potentially sensitive data, a straightforward approach is to encrypt data with specialized cryptographic tools. However, it is challenging to utilize or operate on encrypted data, especially to perform machine learning algorithms. In this paper, we investigate the problem of training high quality word vectors over large-scale encrypted data (from distributed data owners) with the privacy-preserving collaborative neural network learning algorithms. We leverage and also design a suite of arithmetic primitives (e.g., multiplication, fixed-point representation, sigmoid function computation, etc.) on encrypted data, served as components of our construction. We theoretically analyze the security and efficiency of our proposed construction, and conduct extensive experiments on representative real-world datasets to verify its practicality and effectiveness. [ABSTRACT FROM AUTHOR]

This paper addresses the fundamental problem of finding persistent items and estimating the number of times each persistent item occurred in a given data stream during a given period of time at any given observation point. We propose a novel scheme, PIE, that can not only accurately identify each persistent item with a probability greater than any desired false negative rate (FNR), but can also accurately estimate the number of occurrences of each persistent item. The key idea of PIE is that it uses Raptor codes to encode the ID of each item that appears at the observation point during a measurement period and stores only a few bits of the encoded ID in the memory. The item that is persistent occurs in enough measurement periods that enough encoded bits for the ID can be retrieved from the observation point to decode them correctly and get the ID of the persistent item. To estimate the number of occurrences of any given persistent item, PIE uses maximum likelihood estimation-based statistical techniques on the information already recorded during the measurement periods. We implemented and evaluated PIE using three real network traffic traces and compared its performance with three prior schemes. Our results show that PIE not only achieves the desire FNR in every scenario, its average FNR can be 19.5 times smaller than the FNR of the adapted prior scheme. Our results also show that PIE achieves any desired success probability in estimating the number of occurrences of persistent items. [ABSTRACT FROM AUTHOR]

As one of the promising information-centric networking (ICN) architectures, NDN has attracted tremendous research attention and effort in the past decade. In particular, security and privacy remain significant concerns and challenges due to the fact that most of the traditional cryptographic primitives are no longer suitable for NDN architecture. For example, the traditional cryptographic primitives aim to secure point-to-point communications, always requiring explicit descriptions of to where or whom the data packets are intended, while network addressing or locating in NDN becomes implicit. To deal with such issues, the recently developed cryptographic primitives such as ABE have been applied to NDN. Also, to efficiently solve the trust-roots problem and seamlessly deploy cryptographic infrastructures, the concept of SDN has been introduced to NDN as well. This tutorial is devoted to exploring the interesting integration between NDN, ABE, and SDN. [ABSTRACT FROM AUTHOR]

As an alternative to complex cryptographic techniques, PLS is emerging as a promising paradigm to protect wireless communication systems from eavesdropping attacks by exploiting the physical characteristics of the wireless channels. Among various PLS approaches, the one based on cooperative communication is favorable and has received a lot of interest from the research community. Although PLS schemes with half-duplex relays have been extensively researched, the issue of PLS in cooperative systems with full-duplex (FD) relays is far from being comprehensively understood. In this article, we first present the state of the art on PLS approaches proposed for FD cooperative systems. We then provide a case study in which a source-based jamming scheme is proposed to enhance the secrecy performance of a cooperative system with an untrusted FD relay. Finally, we outline several interesting yet challenging future research problems in this topic. [ABSTRACT FROM AUTHOR]

IEC 62351-6 standard stipulates the use of digital signatures for ensuring integrity and authenticity in IEC 61850 Generic Object-Oriented Substation Events (GOOSE) message exchanges. Yet, it does not specify any method for ensuring confidentiality in GOOSE messages. With rapid growth of IEC 61850 from substation automation to power management domain, sensitive data that requires privacy is carried over GOOSE messages. In this letter, a novel method employing Authenticated Encryption with Associated Data (AEAD) algorithms is proposed to achieve both confidentiality and integrity of GOOSE messages. Further, lab tests are run to observe the timing performance and applicability of these algorithms to GOOSE messages with strict timing requirements. [ABSTRACT FROM AUTHOR]

In most existing localization schemes, location information leakage is inevitable, since both the locations of the target and the anchors will be revealed to the entity that conducts location estimation. A malicious entity may destroy the localization infrastructure or attack the target or anchors based on the revealed locations. Therefore, location privacy preservation in localization is of great significance. This paper investigates the privacy preservation problem in localization using time difference of arrival (TDOA) under the assumptions of safe internode communication and an honest-but-curious model. Adopting the privacy-preserving summation method, we propose two privacy-preserving localization protocols for two scenarios, where the TDOA measurements are, respectively, obtained by the target and the anchors. The proposed protocols do not utilize any encryption method, and can hide the locations of both the target and the anchors by limiting the available information to other nodes. The localization performance, sufficient conditions for privacy preservation, and computation and communication complexities of the proposed protocols are theoretically analyzed. Through simulation and numerical results, we show that the proposed protocols can implement location privacy preservation without degrading the localization performance. [ABSTRACT FROM AUTHOR]

In this paper, we propose an energy-efficient reconfigurable platform for in-memory processing based on novel four-terminal spin Hall effect-driven domain wall motion devices that could be employed as both nonvolatile memory cell and in-memory logic unit. The proposed designs lead to unity of memory and logic. The device to system level simulation results show that, with 28% area increase in memory structure, the proposed in-memory processing platform achieves a write energy ~15.6 fJ/bit with 79% reduction compared to that of SOT-MRAM counterpart while keeping the identical 1 ns writing speed. In addition, the proposed in-memory logic scheme improves the operating energy by 61.3%, as compared with the recent nonvolatile in-memory logic designs. An extensive reliability analysis is also performed over the proposed circuits. We employ advanced encryption standard (AES) algorithm as a case study to elucidate the efficiency of the proposed platform at application level. Simulation results exhibit that the proposed platform can show up to 75.7% and 30.4% lower energy consumption compared to CMOS-ASIC and recent pipelined domain wall (DW) AES implementations, respectively. In addition, the AES energy-delay product can show 15.1% and 6.1% improvements compared to the DW-AES and CMOS-ASIC implementations, respectively. [ABSTRACT FROM AUTHOR]

The unlimited growth in the amount of multimedia content has shifted the global infrastructure to the cloud-based multimedia hosting. However, the high probability of security breaches of the content is increasing demand for secure solutions toward this end. One such feasible solution is to encrypt the content to unreadable form before outsourcing to the cloud-based servers. In this paper, the media information, specifically the video content is distributed into multiple random shares based on the permutation ordered binary number system. The information remains fully concealed without any leakage at the cloud servers. Even if the attacks endanger the integrity of the information, the proposed scheme is enriched with the capability of chalking out accurately the altered pixels. These tampered regions are subsequently reflected in the reconstructed video frames obtained at authentic entity end possessing the secret keys required to build back the original content. Moreover, the proposed scheme is capable of detecting temporal attacks on the video frames by employing sequence-based authentication bits. The robustness of the proposed scheme has been validated under different attack scenarios and the scheme is found to be performing satisfactorily well. [ABSTRACT FROM AUTHOR]

This paper initiates a systematic methodology for real-time chaos-based video encryption and decryption communications on the system design and algorithm analysis. The proposed system design and algorithm analysis have been validated on an FPGA hardware platform via Verilog Hardware Description Language (Verilog HDL). Based on the fundamental anti-control principles of dynamical systems, a 6-D real domain chaotic system is designed, and then the corresponding Verilog HDL algorithm is developed. The proposed Verilog HDL algorithm is utilized to design a real-time chaos-based secure video communication system, with a generalized design principle derived, which is implemented on an FPGA hardware platform equipped with an XUP Virtex-II chip. Following this line, the designed working mechanism is demonstrated by hardware experiments. The security performance is tested using the TESTU01 statistical test suites, the differential analysis, and the sensitivity of key parameters mismatch. Both theoretical analysis and experimental results validate the feasibility and reliability of the proposed system. [ABSTRACT FROM AUTHOR]

Large integer multiplication has been widely used in fully homomorphic encryption (FHE). Implementing feasible large integer multiplication hardware is thus critical for accelerating the FHE evaluation process. In this paper, a novel and efficient operand reduction scheme is proposed to reduce the area requirement of radix-r butterfly units. We also extend the single-port, merged-bank memory structure to the design of number theoretic transform (NTT) and inverse NTT (INTT) for further area minimization. In addition, an efficient memory addressing scheme is developed to support both NTT/INTT and resolving carries computations. Experimental results reveal that significant area reductions can be achieved for the targeted 786432- and 1179648-bit NTT-based multipliers designed using the proposed schemes in comparison with the related works. Moreover, the two multiplications can be accomplished in 0.196 and 2.21 ms, respectively, based on 90-nm CMOS technology. The low-complexity feature of the proposed large integer multiplier designs is thus obtained without sacrificing the time performance. [ABSTRACT FROM AUTHOR]

Optical network security is attracting increasing research attention, as loss of confidentiality of data transferred through an optical network could impact a huge number of users and services. Data encryption is an effective way to enhance optical network security. In particular, QKD is being investigated as a secure mechanism to provide keys for data encryption at the endpoints of an optical network. In a QKD-enabled optical network, apart from TDChs, two additional channels, called QSChs and PIChs, are required to support secure key synchronization. How to allocate network resources to QSChs, PIChs, and TDChs is emerging as a novel problem for the design of a security-guaranteed optical network. This article addresses the resource allocation problem in optical networks secured by QKD. We first discuss a possible architecture for a QKD-enabled optical network, where an SDN controller is in charge of allocating the three types of channels (TDCh, QSCh, and PICh) over different wavelengths exploiting WDM. To save wavelength resources, we propose to adopt OTDM to allocate multiple QSChs and PIChs over the same wavelength. An RWTA algorithm is designed to allocate wavelength and time slot resources for the three types of channels. Different security levels are included in the RWTA algorithm by considering different key updating periods (i.e., the period after which the secure key between two endpoints has to be updated). Illustrative simulation results show the effects of different security-level configuration schemes on resource allocation. [ABSTRACT FROM AUTHOR]

Searchable Symmetric Encryption (SSE) has been widely studied in cloud storage, which allows cloud services to directly search over encrypted data. Most SSE schemes only work with honest-but-curious cloud services that do not deviate from the prescribed protocols. However, this assumption does not always hold in practice due to the untrusted nature in storage outsourcing. To alleviate the issue, there have been studies on Verifiable Searchable Symmetric Encryption (VSSE), which functions against malicious cloud services by enabling results verification. But to our best knowledge, existing VSSE schemes exhibit very limited applicability, such as only supporting static database, demanding specific SSE constructions, or only working in the single-user model. In this paper, we propose GSSE, the first generic verifiable SSE scheme in the single-owner multiple-user model, which provides verifiability for any SSE schemes and further supports data updates. To generically support result verification, we first decouple the proof index in GSSE from SSE. We then leverage Merkle Patricia Tree (MPT) and Incremental Hash to build the proof index with data update support. We also develop a timestamp-chain for data freshness maintenance across multiple users. Rigorous analysis and experimental evaluations show that GSSE is secure and introduces small overhead for result verification. [ABSTRACT FROM AUTHOR]

To eliminate redundant transfers over WAN links and improve network efficiency, middleboxes have been deployed at ingress/egress. These middleboxes can operate on individual packets and are application layer protocol transparent. They can identify and remove duplicated byte strings on the fly. However, with the increasing use of HTTPS, current redundancy elimination (RE) solution can no longer work without violating end-to-end privacy. In this paper, we present RE over encrypted traffic (REET), the first middlebox-based system that supports both intra-user and inter-user packet-level RE directly over encrypted traffic. REET realizes this by using a novel protocol with limited overhead and protects end users from honest-but-curious middleboxes. We implement REET and show its performance for both end users and middleboxes using several hundred gigabytes of network traffic traces collected from a large U.S. university. [ABSTRACT FROM AUTHOR]

Dynamic networks naturally appear in a multitude of applications from different fields. Analyzing and exploring dynamic networks in order to understand and detect patterns and phenomena is challenging, fostering the development of new methodologies, particularly in the field of visual analytics. In this work, we propose a novel visual analytics methodology for dynamic networks, which relies on the spectral graph wavelet theory. We enable the automatic analysis of a signal defined on the nodes of the network, making viable the robust detection of network properties. Specifically, we use a fast approximation of a graph wavelet transform to derive a set of wavelet coefficients, which are then used to identify activity patterns on large networks, including their temporal recurrence. The coefficients naturally encode the spatial and temporal variations of the signal, leading to an efficient and meaningful representation. This methodology allows for the exploration of the structural evolution of the network and their patterns over time. The effectiveness of our approach is demonstrated using usage scenarios and comparisons involving real dynamic networks. [ABSTRACT FROM AUTHOR]

Many visualizations, including word clouds, cartographic labels, and word trees, encode data within the sizes of fonts. While font size can be an intuitive dimension for the viewer, using it as an encoding can introduce factors that may bias the perception of the underlying values. Viewers might conflate the size of a word's font with a word's length, the number of letters it contains, or with the larger or smaller heights of particular characters (‘o’ versus ‘p’ versus ‘b’). We present a collection of empirical studies showing that such factors—which are irrelevant to the encoded values—can indeed influence comparative judgements of font size, though less than conventional wisdom might suggest. We highlight the largest potential biases, and describe a strategy to mitigate them. [ABSTRACT FROM AUTHOR]