Search

Abstract Electronic health record (EHR) cloud system, as a primary tool driving the informatization of medical data, have positively impacted both doctors and patients by providing accurate and complete patient information. However, ensuring the security of EHR cloud system remains a critical issue. Some patients require regular remote medical services, and controlling access to medical data involving patient privacy during specific times is essential. Timed-release encryption (TRE) technology enables the sender to preset a future time T at which the data can be decrypted and accessed. It is a cryptographic primitive with time-dependent properties. Currently, mainstream TRE schemes are based on non-interactive single time server methods. However, if the single time server is attacked or corrupted, it is easy to directly threaten the security applications of TRE. Although some research schemes “distribute” the single time server into multiple ones, they still cannot resist the single point of failure problem. To address this issue, we propose a multiple time servers TRE scheme based on Shamir secret sharing and another variant derived from it. In our proposed schemes, the data receiver does not need to interact with the time servers; instead, they only need to obtain the time trapdoors that exceed or equal the preset threshold value for decryption, which ensures the identity privacy of the data sender and tolerates partial downtime or other failures of some time servers, significantly improving TRE reliability. Security analysis indicates that our proposed schemes demonstrate data confidentiality, verifiability, anti-advance decryption, and robust decryption with multiple time trapdoors, making them more practical. Efficiency analysis indicates that although our schemes have slightly higher computational costs than most efficient existing TRE schemes, such differences are insignificant from a practical application perspective.

Abstract Timed-release encryption (TRE) is a cryptographic primitive that can control the decryption time and has significant application value in time-sensitive scenarios. To solve the reliability issue of nodes in existing TRE anonymous interaction schemes, we propose a blockchain-based TRE protocol for anonymous query time trapdoors. In our protocol, the recipient divides the encrypted trapdoor request information into n ciphertext fragments using secret sharing technology near the decryption time, and employs the idea of onion routing to perform layer-by-layer encryption, creating onion-type data transmitted through middlemen selected from the smart contract. After receiving the ciphertext fragments, the time server integrates them to obtain the trapdoor request information and returns the corresponding time trapdoor to the recipient. This allows the recipient to query any time trapdoor anonymously. Our protocol provides a normative design for the smart contract and specific constraints on the participants’ behavior. Compared with the related anonymous query trapdoor schemes, our protocol improves the probability of successful queries. Security analysis shows that our protocol can resist release-ahead attack, interruption attack, eavesdropping attack, and replacement attack. Performance analysis shows that our protocol outperforms related protocols regarding anonymity, efficiency, and flexibility, achieving highly efficient anonymous interactions. Finally, we conducted an experiment in the Ethereum Rinkeby test network. For the settings of ciphertext fragment number $$n=3$$ n = 3 and ciphertext fragment threshold $$t=2$$ t = 2 , the gas consumption for a user to execute the contract was $5.66, which was higher than the contract cost of related schemes, but the contract execution cost was within an acceptable range.

The proliferation of Internet of Things (IoT) rapidly increases the possiblities of Simple Service Discovery Protocol (SSDP) reflection attacks. Most DDoS attack defence strategies deploy only to a certain type of devices in the attack chain,and need to detect attacks in advance, and the detection of DDoS attacks often uses heavy algorithms consuming lots of computing resources. This paper proposes a comprehensive DDoS attack defence approach which combines broad learning and a set of defence strategies against SSDP attacks, called Broad Learning based Comprehensive Defence (BLCD). The defence strategies work along the attack chain, starting from attack sources to victims. It defends against attacks without detecting attacks or identifying the roles of IoT devices in SSDP reflection attacks. BLCD also detects suspicious traffic at bots, service providers and victims by using broad learning, and the detection results are used as the basis for automatically deploying defence strategies which can significantly reduce DDoS packets. For evaluations, we thoroughly analyze attack traffic when deploying BLCD to different defence locations. Experiments show that BLCD can reduce the number of packets received at the victim to 39 without affecting the standard SSDP service, and detect malicious packets with an accuracy of 99.99%.

Abstract Cryptographic technology can effectively defend against malicious attackers to attack sensitive and private information. The core of cryptographic technology is cryptographic algorithm, and the cryptographic algorithm identification is the premise of in-depth analysis of cryptography. In the cryptanalysis of unknown cryptographic algorithm, the primary task is to identify the cryptographic algorithm used in the encryption and then carry out targeted analysis. With the rapid growth of Internet data, the increasing complexity of communication environment, and the increasing number of cryptographic algorithms, the single-layer identification scheme of cryptographic algorithm faces great challenges in terms of identification ability and stability. To solve these problems, on the basis of existing identification schemes, this paper proposes a new cluster division scheme CMSSBAM-cluster, and then proposes a multi-layer composite identification scheme of cryptographic algorithm using a composite structure. The scheme adopts the method of cluster division and single division to identify various cryptographic algorithms. Based on the idea of ensemble, the scheme uses the hybrid random forest and logistic regression (HRFLR) model for training, and conducts research on a data set consisting of 1700 ciphertext files encrypted by 17 cryptographic algorithms. In addition, two ensemble learning models, hybrid gradient boosting decision tree and logistic regression (HGBDTLR) model and hybrid k-neighbors and random forest (HKNNRF) model are used as controls to conduct controlled experiments in this paper. The experimental results show that multi-layer composite identification scheme of cryptographic algorithm based on HRFLR model has an accuracy rate close to 100% in the cluster division stage, and the identification results are higher than those of the other two models in both the cluster division and single division stages. In the last layer of cluster division, the identification accuracy of ECB and CBC encryption modes in block cryptosystem is significantly higher than that of the other two classification models by 35.2% and 36.1%. In single division, the identification accuracy is higher than HGBDTLR with a maximum of 9.8%, and higher than HKNNRF with a maximum of 7.5%. At the same time, the scheme proposed in this paper has significantly improved the identification effect compared with the single division identification accuracy of 17 cryptosystem directly and the 17 classification accuracy of 5.9% compared with random classification, which indicates that multi-layer composite identification scheme of cryptographic algorithm based on HRFLR model has significant advantages in the accuracy of identifying multiple cryptographic algorithms.

Abstract Many time-sensitive scenarios need to decrypt data at a specified time. The timed-release encryption (TRE) primitive can meet this requirement. However, in the single-time server TRE model, there is a single point of failure problem. Therefore, we propose a tamper-resistant timed secure data transmission protocol based on smart contracts. Firstly, by decomposing the ciphertext into ciphertext fragments, the amount of deposit that a single middleman needs to submit is reduced. Secondly, it provides the system with security redundancy that changes with the decomposition mode. Thirdly, the sender is required to submit the hash value of each ciphertext fragment to the blockchain network at the same time as sending data, so that the receiver can quickly verify the authenticity of the ciphertext to resist substitution attack. Security analysis shows that the proposed protocol model can resist interruption attacks, release-ahead attacks and replacement attacks. Finally, we conduct a monetary cost test on the Ethereum’s Rinkeby test network. The results show that our running cost is almost double compared with the existing similar scheme, but it is still very low and almost negligible compared with the value of the content and the expected profits it brings.

Compared with paper-based voting, electronic voting not only has advantages in storage and transmission, but also can solve the security problems that exist in traditional voting. However, in practice, most electronic voting faces the risk of voting failure due to malicious voting by voters or ballot tampering by attackers. To solve this problem, this article proposes an electronic voting scheme based on homomorphic encryption and decentralization, which uses the Paillier homomorphic encryption method to ensure that the voting results are not leaked until the election is over. In addition, the scheme applies signatures and two layers of encryption to the ballots. First, the ballot is homomorphically encrypted using the homomorphic public key; then, the voter uses the private key to sign the ballot; and finally, the ballot is encrypted using the public key of the counting center. By signing the ballots and encrypting them in two layers, the security of the ballots in the transmission process and the establishment of the decentralized scheme are guaranteed. The security analysis shows that the proposed scheme can guarantee the completeness, verifiability, anonymity, and uniqueness of the electronic voting scheme. The performance analysis shows that the computational efficiency of the proposed scheme is improved by about 66.7% compared with the Fan et al. scheme (https://doi.org/10.1016/j.future.2019.10.016).

It is effective to balance data security and storage efficiency for setting different levels of security protection for data based on popularity in encrypted deduplication systems.Existing schemes all need introduce a trusted third-party for recording data popularity, while the third party is prone to a single point of failure and efficiency bottleneck.To address this problem, a popularity-based encrypted deduplication scheme without third-party servers was proposed, which accurately recorded the data popularity based on the Count-Min sketch algorithm and Merkle Puzzles protocol, and achieved encrypted deduplication of unpopular data through the sPAKE protocols performed among users.Security analysis and experimental evaluation show that the proposed scheme is secure and efficient.

Rekeying is a good way to protect against key exposure.Most of the existing encrypted deduplication systems are implemented based on message-locked-encryption, in which multiple users with the identical data share the same encryption key.When a user updates keys, that update must be followed by all other data owners, which will incur large computational and communicational overheads.To solve this problem, an AONT-and-NTRU-based rekeying scheme was proposed, a variant of AONT was designed to solve the synchronization problem of multi-user rekeying, and a proxy re-encryption algorithm based on NTRU was introduced to reduce the communicational overhead for the system and computational overhead for clients during rekeying.The efficiency analysis and experimental results show that the proposed scheme has better encryption and decryption efficiency than existing schemes and the time cost of rekeying is significantly reduced.

Cryptographic algorithm identification, which refers to analyzing and identifying the encryption algorithm used in cryptographic system, is of great significance to cryptanalysis. In order to improve the accuracy of identification work, this article proposes a new ensemble learning-based model named hybrid k-nearest neighbor and random forest (HKNNRF), and constructs a block cipher algorithm identification scheme. In the ciphertext-only scenario, we use NIST randomness test methods to extract ciphertext features, and carry out binary-classification and five-classification experiments on the block cipher algorithms using proposed scheme. Experiments show that when the ciphertext size and other experimental conditions are the same, compared with the baselines, the HKNNRF model has higher classification accuracy. Specifically, the average binary-classification identification accuracy of HKNNRF is 69.5%, which is 13%, 12.5%, and 10% higher than the single-layer support vector machine (SVM), k-nearest neighbor (KNN), and random forest (RF) respectively. The five-classification identification accuracy can reach 34%, which is higher than the 21% accuracy of KNN, the 22% accuracy of RF and the 23% accuracy of SVM respectively under the same experimental conditions.

To improve the practicability of homomorphic encryption in the application of multi-user cloud computing, a NTRU-based multi-key homomorphic proxy re-encryption (MKH-PRE) scheme was constructed.Firstly, a new form of NTRU-based multi-key ciphertext was proposed based on the idea of ciphertext extension, and the corresponding homomorphic operations and relinearization procedure were designed on the basis of this new ciphertext form, so that a NTRU-based multi-key homomorphic encryption (MKHE) scheme which supported distributed decryption was constructed.Then, resorting to the idea of key switching, the re-encryption key and re-encryption procedure were put forward such that the functionality of proxy re-encryption (PRE) was integrated to this new NTRU-based MKHE scheme.The MKH-PRE scheme preserved the properties of MKHE and PRE, and had a better performance on the client side.The scheme was applied to the privacy-preserving problems in federated learning and an experiment of the application was carried out.The results demonstrate that the accuracy of learning is scarcely affected by the encryption procedure and the computational overhead of this MKH-PRE scheme is acceptable.

In order to reduce the risk of data privacy leakage in the process of outsourced clustering, a privacy protection scheme of DBSCAN clustering based on homomorphic encryption was proposed.In order to encrypt the float data in the actual scene, three data preprocessing methods for different data accuracy were given, and a policy for choosing a proper data preprocessing method based on data characteristics, accuracy and computational cost was also proposed.For the ciphertext comparison operation that was not supported by homomorphic encryption, a protocol between the client and the cloud server was designed to realize the function of ciphertext comparison.Theoretical analysis and experimental results show that the proposed scheme can ensure the security of data privacy, and has a higher clustering accuracy rate and lower time overhead.

To solve the problem that convergent encryption was commonly used in existing encrypted deduplication systems in cloud storage and data owner couldn’t effectively enforce access control on their outsourced data,an encrypted deduplication system was proposed to support access control functions such as identity authentication,authorization deduplication and the update of access control policy.The outsourced data was only deduplicated with the authorized users,and the unauthorized users couldn’t obtain any data information.CP-ABE and the partition of the ElGamal private key were used to update the access control policy of data.Self-control objects was used to encapsulate user’s data and its access policy,providing authentication for data visitors and ensuring the access control policies enforced effectively.Security analysis and simulation results demonstrate that the proposed system enables data access control and executes efficiently.

Aiming at the problems of incomplete edge coverage,insufficient uses of edge coverage information and valid bytes information in AFL (American fuzz lop),a novel method was proposed.Firstly,a new seed selection algorithm was introduced,which could completely cover all edges discovered in one cycle.Secondly,the paths were scored according to the frequency of edges,to adjust the number of tests for each seed.Finally,more mutations were crafted on the valid bytes of AFL.Based on the method above,a new fuzzing tool named efuzz was implemented.Experiment results demonstrate that efuzz outperforms AFL and AFLFast in the edge coverage,with the increases of 5% and 9% respectively.In the LAVA-M dataset,efuzz found more vulnerabilities than AFL.Moreever,in real world applications efuzz has found three new security bugs with CVEs assigned.The method can effectively improve the edge coverage and vulnerability detection ability of fuzzer.

Since the major of information security was established in 2001,the knowledge and ability system of cyber security talents to meet demands of the society and the corresponding talent cultivating mode have always been concerned.Based on the social requirements,the basic knowledge and ability requirements of cyber security talents were analyzed,and consequently regard inter-disciplinary talents as an important demand of cyber security industry.Taking as an example the double degree class of information security and law of Nankai university,the cultivating mode of inter-disciplinary talents of information security and law was introduced,in order to provide reference for the construction of China's cyber security talent cultivating mode.

In response to the rapid growth of credit-investigation data, data redundancy among credit-investigation agencies, privacy leakages of credit-investigation data subjects, and data security risks have been reported. This study proposes a privacy-protection scheme for a credit-investigation system based on blockchain technology, which realizes the secure sharing of credit-investigation data among multiple entities such as credit-investigation users, credit-investigation agencies, and cloud service providers. This scheme is based on blockchain technology to solve the problem of islanding of credit-investigation data and is based on zero-knowledge-proof technology, which works by submitting a proof to the smart contract to achieve anonymous identity authentication, ensuring that the identity privacy of credit-investigation users is not disclosed; this scheme is also based on searchable-symmetric-encryption technology to realize the retrieval of the ciphertext of the credit-investigation data. A security analysis showed that this scheme guarantees the confidentiality, the availability, the tamper-proofability, and the ciphertext searchability of credit-investigation data, as well as the fairness and anonymity of identity authentication in the credit-investigation data query. An efficiency analysis showed that, compared with similar identity-authentication schemes, the proof key of this scheme is smaller, and the verification time is shorter. Compared with similar ciphertext-retrieval schemes, the time for this scheme to generate indexes and trapdoors and return search results is significantly shorter.

In recent years, the Internet of Things (IoT) has found wide application and attracted much attention. Since most of the end-terminals in IoT have limited capabilities for storage and computing, it has become a trend to outsource the data from local to cloud computing. To further reduce the communication bandwidth and storage space, data deduplication has been widely adopted to eliminate the redundant data. However, since data collected in IoT are sensitive and closely related to users’ personal information, the privacy protection of users’ information becomes a challenge. As the channels, like the wireless channels between the terminals and the cloud servers in IoT, are public and the cloud servers are not fully trusted, data have to be encrypted before being uploaded to the cloud. However, encryption makes the performance of deduplication by the cloud server difficult because the ciphertext will be different even if the underlying plaintext is identical. In this paper, we build a centralized privacy-preserving duplicate removal storage system, which supports both file-level and block-level deduplication. In order to avoid the leakage of statistical information of data, Intel Software Guard Extensions (SGX) technology is utilized to protect the deduplication process on the cloud server. The results of the experimental analysis demonstrate that the new scheme can significantly improve the deduplication efficiency and enhance the security. It is envisioned that the duplicated removal system with privacy preservation will be of great use in the centralized storage environment of IoT.

In order to improve the security, ease of use and flexibility of software products, this paper proposes a software cloud authorized protection mechanism based on specific time encryption. This mechanism sends the encrypted and packed executable file to the cloud server, so that only legitimate users can unpack, decrypt and run the software in the cloud within a specific time interval. On this basis, this article gives a formal definition of the solution model and constructs a specific implementation solution based on the random oracle model. Security analysis shows that this solution can not only prevent attackers from using cloud servers and time servers to illegally obtain software usage rights, but also reduce time overhead and costs, thereby effectively protecting the legitimate rights and interests of developers and users. [ABSTRACT FROM AUTHOR]

Deep learning is a significant research field in today's society, especially in the field of artificial intelligence. To gain a more comprehensive understanding of the current state of research in the field of deep learning and to identify areas of intense interest, this paper uses Citespace for research and learning, samples 1863 articles from the Web of Science (WoS) core dataset, which spans the years 2017 to 2023, and adopts the methods of co-occurrence analysis, keyword burst analysis, and co-citation analysis. Information visualization is used to conduct bibliometric analysis, examining keywords, research institutions, authors, and countries. The analysis demonstrates a significant increase in the literature record from 2017 to 2022, followed by a decline from 2022 to 2023. The research on deep learning spans various fields, including computer science, engineering, and telecommunications, which are considered crucial areas of study. China, the USA, and England are leading the way in the field of deep learning research. These countries have established extensive cooperative relationships with many countries, with research institutions and authors playing a vital role in the cooperative network. The current theoretical research hotspots of deep learning mainly include "convolutional neural networks", "neural networks", "models", "classification", etc. The focus of research in deep learning has shifted from theoretical research to practical applications. It is now being applied in various areas, such as deep reinforcement learning, bearing fault, and semi-supervised learning. In the future, deep learning technology will be applied to more cuttingedge technologies. [ABSTRACT FROM AUTHOR]