Search

Mobile crowdsensing (MCS) systems typically struggle to address the challenge of data aggregation, incentive design, and privacy protection, simultaneously. However, existing solutions usually focus on one or, at most, two of these issues. To this end, this paper presents CROWD FA, a novel paradigm for privacy-preserving MCS through federated analytics (FA), which aims to achieve a well-rounded solution encompassing data aggregation, incentive design, and privacy protection. Specifically, inspired by FA, CROWD FA initiates an MCS computing paradigm that enables data aggregation and incentive design. Participants can perform aggregation operations on their local data, facilitated by CROWD FA, which supports various common data aggregation operations and bidding incentives. To address privacy concerns, CROWD FA relies solely on an efficient cryptographic primitive known as additive secret sharing to simultaneously achieve privacy-preserving data aggregation and privacy-preserving incentive. To instantiate CROWD FA, this paper presents a privacy-preserving data aggregation scheme (PRADA) based on CROWD FA, capable of supporting a range of data aggregation operations. Additionally, a CROWD FA-based privacy-preserving incentive mechanism (PRAED) is designed to ensure truthful and fair incentives for each participant, while maximizing their individual rewards. Theoretical analysis and experimental evaluations demonstrate that CROWD FA protects participants’ data and bid privacy while effectively aggregating sensing data. Notably, CROWD FA outperforms state-of-the-art approaches by achieving up to 22 times faster computation time. [ABSTRACT FROM AUTHOR]

Privacy-Preserving Federated Learning (PPFL) is an emerging secure distributed learning paradigm that aggregates user-trained local gradients into a federated model through a cryptographic protocol. Unfortunately, PPFL is vulnerable to model poisoning attacks launched by a Byzantine adversary, who crafts malicious local gradients to harm the accuracy of the federated model. To resist model poisoning attacks, existing defense strategies focus on identifying suspicious local gradients over plaintexts. However, the Byzantine adversary submits encrypted poisonous gradients to circumvent existing defense strategies in PPFL, resulting in encrypted model poisoning. To address the issue, in this paper we design a privacy-preserving defense strategy using two-trapdoor homomorphic encryption (referred to as ShieldFL), which can resist encrypted model poisoning without compromising privacy in PPFL. Specially, we first present the secure cosine similarity method aiming to measure the distance between two encrypted gradients. Then, we propose the Byzantine-tolerance aggregation using cosine similarity, which can achieve robustness for both Independently Identically Distribution (IID) and non-IID data. Extensive evaluations on three benchmark datasets (i.e., MNIST, KDDCup99, and Amazon) show that ShieldFL outperforms existing defense strategies. Especially, ShieldFL can achieve 30%-80% accuracy improvement to defend two state-of-the-art model poisoning attacks in both non-IID and IID settings. [ABSTRACT FROM AUTHOR]

The industrial Internet-of-things (IIoT) can be seen as the usage of Internet-of-things technologies in industries, which provides a way to improve the operational efficiency. An attribute-based signature (ABS) has been a very useful technique for services requiring anonymous authentication in practice, where a signer can sign a message over a set of attributes without disclosing any information about his/her identity, and a signature only attests to the fact that it is created by a signer with several attributes satisfying some claim predicate. However, an ABS scheme requires exponentiation and/or pairing operations in the signature generation and verification algorithms, and hence, it is quite expensive for resource-constrained devices like a sensor in the IIoT network to run an ABS scheme. To reduce the computational overheads for both signers and verifiers, it has been suggested to introduce a server to help with signature generation and verification, but existing results on the ABS with “server-aided computation” either suffer from the security issues or are not sufficiently efficient. In this paper, we consider server-aided ABS one step further, and propose a notion called server-aided ABS with revocation (SA-ABSR), which not only securely mitigates the workloads of users in generating and verifying signatures, but also enables user revocation by having the server immediately stop signature generations for revoked signers. We formally define the security model for SA-ABSR, present a concrete construction of SA-ABSR based on a standard ABS scheme, and prove its security under the defined security model. Also, we implement the proposed SA-ABSR scheme and the underlying standard ABS scheme to evaluate the performance, from which it is easy to see that the proposed SA-ABSR scheme is more efficient than its underlying ABS scheme. [ABSTRACT FROM AUTHOR]

From user point of view, password-based remote user authentication technique is one of the most convenient and easy-to-use mechanisms to provide necessary security on system access. As the number of computer crimes in modern cyberspace has increased dramatically, the robustness of password-based authentication schemes has been investigated by industries and organizations in recent years. In this paper, a well-designed password-based authentication protocol for multi-server communication environment, introduced by Hsiang and Shih, is evaluated. Our security analysis indicates that their scheme is insecure against session key disclosure, server spoofing attack, and replay attack and behavior denial. Copyright © 2010 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]