Hierarchical computing architecture of cloud-edge-client (CEC) formed with the combination of cloud computing and edge computing can provide processing, storage and low-latency services close to end devices. To protect data privacy, federated learning (FL), as a novel intelligent edge computing framework with localized training mechanisms, has been integrated into edge computing to form a system called CEC-FL and is widely studied. However, they are susceptible to potential poisoning attacks. Existing poisoning attack methods are mostly explored by performing malicious operations on training samples or labels directly and implementing corresponding defense strategies: they are designed to ignore the label transferability and diverse attack environments and are not work against stealthy security threats, mainly because they do not take into account the inherent vulnerabilities of the attack environment. Yet few general defense schemes have been developed. In response to the above vulnerabilities, in this work, we explore a Barycenter Poisoning method with Label Transferability (BPoLT) initiated by malicious attackers, resulting in a dynamic attack capability on the CEC-FL system. To address poisoning attacks, we provide a two-phase defense algorithm Resisting Label Transferability Poisoning called ResLT-Pois to distinguish malicious attackers from benign participants. Extensive experimental results demonstrate that our scheme is feasible and effective in dealing with the vulnerability of the CEC-FL system.

The effective usage of healthcare data requires fine-grained and patient-centric access control. Existing systems often provide only static consent, lacking timely revocation, transparent auditing and compliance with privacy regulations such as GDPR. We propose a Blockchain-enabled Policy-Based Access Control (PBAC) framework to address these gaps. The framework supports patient-centric, auditable and privacy-preserving medical data sharing. The PBAC framework leverages smart contracts in Solidity to enforce dynamic consent and secure data access to ensure accountability through immutable transactions. The implementation was carried out on Hyperledger Besu, with benchmarking scripts developed in Python. Performance was evaluated under multiple consensus mechanisms like QBFT, IBFT2 and Clique considering latency, throughput, gas usage and resource consumption. Results demonstrate that the proposed PBAC system supports secure and GDPR aligned healthcare data sharing. The system also achieve a balanced trade-off between performance efficiency and patient autonomy.

Smart contracts, as self-executing agreements on blockchain platforms, promise to eliminate intermediaries and enhance transaction efficiency. However, their susceptibility to security vulnerabilities not only poses risks of substantial financial losses but also erodes trustworthiness in blockchain ecosystems, driving extensive research into enhancing both their security and trustworthiness. We provide a comprehensive review of the current state of smart contract assurance, covering the primary security threats and mitigation strategies throughout the contract lifecycle-from development to deployment, execution, and maintenance. It evaluates both established and advanced vulnerability detection techniques while exploring underexamined areas, including automated repair, secure execution environments, and defenses against malicious attacks. We further propose a framework to ensure the holistic security and trustworthiness of smart contracts, and discuss future directions for research and development, emphasizing the need to address both technical and regulatory challenges to promote widespread adoption.

Data sharing in multi-robot collaboration faces dual threats of privacy leakage and malicious attacks. Existing federated learning methods struggle to simultaneously address three major challenges: node trust evaluation, asynchronous heterogeneous training, and centralized trust risks [1] - [3]. This paper proposes Robot-FedTrust—a trusted federated learning framework for multi-robot collaboration. The framework constructs a TPCM-based multi-dimensional dynamic trust evaluation model, comprehensively measuring robot hardware status, behavioral compliance, and model contribution. It designs an edge-layered asynchronous aggregation mechanism that uses a staleness-aware function to adaptively adjust the weights of outdated models. A reputation-driven Byzantine fault-tolerant consensus mechanism replaces the central server to achieve decentralized model aggregation. Experimental results show that Robot-FedTrust achieves 84.6% model accuracy with 20% malicious nodes, outperforming FedAvg by 14.4 percentage points, while reducing communication overhead by 38.8%.

Federated Learning (FL) enables collaborative training of deep neural networks (DNNs) while preserving user data privacy. However, FL systems remain vulnerable to sophisticated poisoning attacks and face inherent privacy risks, particularly in cloud deployments. Existing defense mechanisms often exhibit limited efficacy against heterogeneous attack vectors, struggle with the complexities of non-Independently and Identically Distributed (non-IID) data, and necessitate careful trade-offs between model accuracy and security. This paper introduces ConfShield, a novel Dual-Stage Fusion Framework designed for robust and privacy-enhancing FL within cloud environments. ConfShield establishes a secure enclave using attested Confidential Virtual Machines (CVMs) to shield core FL processes from the cloud provider and ensure model confidentiality. The cornerstone of this defense is a systematic dual-stage fusion mechanism that uniquely integrates information from two distinct spaces: (1) the model parameter space, via layer-wise analysis against a publicly verifiable baseline model, and (2) the behavioral logit space, via scrutiny inspired by knowledge distillation against the same baseline on a clean, public evaluation dataset. Only models validated through this comprehensive fusion process are aggregated. Experimental results demonstrate ConfShield's pronounced efficacy against diverse poisoning attacks, including covert backdoors, across various data distributions and parameter configurations. ConfShield significantly reduces backdoor attack success rates (ASR) to below 20% and, under untargeted attacks, exhibits minimal convergence overhead, 1.05-1.33x the duration of insecure FL setups, underscoring its effectiveness as a robust, privacy-enhancing FL solution.

Decentralized Federated Learning (DFL) enables collaborative training in decentralized network environments through peer-to-peer communication. However, in practical network deployments, the wide-sense network topology for communication is often constrained by security policies and network management rules in addition to physical connectivity. Under such network topology constraints, physically connected neighbors may not be semantically suitable collaborators, and data heterogeneity can further amplify semantic conflicts in neighborhood collaboration. We refer to this inconsistency between physical connectivity and semantic collaboration suitability as the topology-semantic mismatch. To address this problem, we propose DFedPSC, a prototype-guided semantic collaboration method that adopts a novel two-stage approach of neighborhood semantic learning and semantic calibration to achieve effective DFL in topology-constrained networks. It does not rely on topology reconstruction or additional communication links. Instead, it models semantic relationships among clients within the currently available network neighborhood through prototypes, thereby adaptively enhancing useful information from semantically consistent neighbors while suppressing conflicting information. Specifically, Neighborhood Semantic Contrastive Learning promotes cross-client intra-class feature alignment through semantic affinity prototypes, while Neighborhood Calibration Regularization uses calibration prototypes to mitigate optimization bias caused by class imbalance and restricted neighborhood views. Theoretical analysis proves the convergence of DFedPSC under general non-convex settings. Experimental results show that DFedPSC outperforms existing DFL methods addressing heterogeneous data distributions and network topologies, demonstrating its effectiveness and adaptability for Federated Learning in decentralized network environments.

Federated Learning allows multiple clients to train local models and aggregate them on the server side. The client is invisible to the shared global model generated by the server, which provides an opportunity for malicious attackers to utilize the inherent vulnerability of federated learning to initiate data leakage attacks. Existing attack techniques are largely client-based and focus on inferring model parameters directly, but do not work for server-based attacks, mainly due to differences in their ability to generalize attacks. Yet few robust data leakage attacks toward federated learning vulnerability have been developed on the server side. To address the above problem, we propose MOFDRNet, a Multi-Objective Fake Data Regression Network model that integrates the loss function and multiple metrics strategies. The key idea is to deploy a malicious attack model on the server with the purpose of generating fake data and labels and continuously approximating the shared gradients between clients and the server, thereby recovering clients' private data. Experimental results demonstrate that the MOFDRNet model has significant advantages in implementing data leakage attacks. Finally, we also discuss the differential privacy defense approach in this study.

Medical data sharing offers clinical organizations a more comprehensive view of patient medical histories, ultimately improving patient care. Integrating access control into healthcare systems further enhances data security and privacy by empowering individuals through a Dynamic Consent Management System (DCMS). However, issues such as unauthorized access and misuse of personal records often remain unaddressed by privacy legislation alone. Although regulations like the EU's General Data Protection Regulation (GDPR) mandate informed consent, ambiguities in these rules can make compliance challenging. In response, this paper proposes a Privacy-by-Design (PbD) enabled DCMS aimed at granting data subjects (DS) greater control over their information. The proof-of-concept solution is a user-friendly, web-based platform that illustrates the interactions among key stakeholders (data subjects, data requesters, and data controllers), details consent policies, and demonstrates privacy-by-design principles. Users can customize their level of consent at any time, choosing to grant, revoke, enable, or disable permissions as needed. A brief case study, design results, and comparative analyses are presented to demonstrate the system's efficacy. By leveraging PbD, this solution seeks to address critical gaps in data privacy and ensure regulatory compliance.

Electronic health record transmission and storage involve sensitive information, requiring robust security measures to ensure access is limited to authorized personnel. In the existing state of the art, there is a growing need for efficient access control approaches for the secure accessibility of patient health data by sustainable electronic health records. Locking medical data in a healthcare center forms information isolation; thus, setting up healthcare data exchange platforms is a driving force behind electronic healthcare centers. The healthcare entities access rights like subject, controller, and requester are defined and regulated by access control policies as defined by the General Data Protection Regulation (GDPR). In this work, we have introduced a blend of policy-based access control (PBAC) system backed by blockchain technology, where smart contracts govern the intrinsic part of security and privacy. As a result, any Subject can know at any time who currently has the right to access his data. The PBAC grants access to electronic health records based on predefined policies. Our proposed PBAC approach employs policies in which the subject, controller, and requester can grant access, revoke access, and check logs and actions made in a particular healthcare system. Smart contracts dynamically enforce access control policies and manage access permissions, ensuring that sensitive data is available only to authorized users. Delineating the proposed access control system and comparing it to other systems demonstrates that our approach is more adaptable to various healthcare data protection scenarios where there is a need to share sensitive data simultaneously and a robust need to safeguard the rights of the involved entities.

Hybrid deployment of containers with different kernel types offers a novel solution for cloud service providers. While extensive research has been conducted on shared kernel containers, the security risks associated with diverse kernel types in hybrid deployment scenarios present more complex challenges. Establishing trusted relationships from hardware to containers for hybrid deployment has become a primary concern. Additional challenges include the lack of measurement and communication methods for independent kernel containers and insufficient dynamic measurement capabilities for containers. To address these issues, we propose a novel approach of achieving secure hybrid deployment of containers through the provision of trusted assurance in three layers: container infrastructure, container application environment, and container runtime. We propose the corresponding measurement schemes for each trust layer. Through functional verification and performance evaluation, we demonstrate that our architecture exhibits improved feasibility and effectiveness.

Due to the limitations of the times, the von Neumann computer system failed to consider the modern security environment, and the computing structure lacked independent protective components based on hardware trusted roots. A trusted terminal architecture based on the Chinese national standard GB/T 40650-2021 trusted platform control module (TPCM) trusted root was proposed. A dual architecture was adopted to implement a progressive parallel trusted execution environment architecture based on trusted roots, solving the problems of terminal device source, platform execution environment, and terminal device trusted management from the perspectives of hardware trusted root chips and underlying basic software. The method ensured that the TPCM trusted root chip of the terminal device and the tested basic components were powered on first, completing the trusted measurement of the CPU execution environment, and controlling the CPU power and device initialization configuration, gradually performing trusted diffusion during the computer startup process. It can achieve reliable and trustworthy network applications while ensuring the security and trustworthiness of the device itself, realizing the privacy, security protection, and network security of device data.

This paper proposes a method for implementing a trusted execution environment for a computing platform based on Trusted Platform Control Module (TPCM). The method is based on a dual-architecture, which maintains the original design of the device and introduces TPCM as root of trust to measure the trustworthiness of the platform's execution environment. With the integration of control implementation, this method can fundamentally address the issue of untrustworthiness in the platform's execution environment. By ensuring the trustworthiness and integrity of the boot environment, the method dynamically checks and confirms the boot and execution environment in real-time through the implanted TPCM trusted agent, ultimately achieving a full lifecycle trustworthy measurement and protection of the execution environment for big data computing platforms.

With the rapid development of network technology, the number and variety of malware have been increasing, posing a significant challenge in the field of network security.However, existing single-feature malware detection methods have proven inadequate in representing sample information effectively.Moreover, multi-feature detection approaches also face limitations in feature fusion, resulting in an inability to learn and comprehend the complex relationships within and between features.These limitations ultimately lead to subpar detection results.To address these issues, a malware detection method called MFAGM was proposed, which focused on multimodal feature fusion.By processing the .asm and .bytes files of the dataset, three key features belonging to two types (opcode statistics sequences, API sequences, and grey-scale image features) were successfully extracted.This comprehensive characterization of sample information from multiple perspectives aimed to improve detection accuracy.In order to enhance the fusion of these multimodal features, a feature fusion module called SA-JGmu was designed.This module utilized the self-attention mechanism to capture internal dependencies between features.It also leveraged the gating mechanism to enhance interactivity among different features.Additionally, weight-jumping links were introduced to further optimize the representational capabilities of the model.Experimental results on the Microsoft malware classification challenge dataset demonstrate that MFAGM achieves higher accuracy and F1 scores compared to other methods in the task of malware detection.

Federated learning has gained popularity as it enables collaborative training without sharing local data. Despite its advantages, federated learning requires sharing the model parameters during model aggregation which poses security risks. In addition, existing secure federated learning frameworks cannot meet all the requirements of resource-constrained IoT devices and non-independent and identically distributed (non-IID) setting. This paper proposes a novel secure and robust federated learning framework (SRFL) with trusted execution environments (TEEs). The framework provides security and robustness for federated learning on IoT devices under non-IID data by leveraging TEEs to safeguard sensitive model components from being leaked. Simultaneously, we introduce a shared representation training approach to enhance the accuracy and security under non-IID setting. Furthermore, a multi-model robust aggregation method using membership degree is proposed to enhance robustness. This method uses membership degree generated by soft clustering to categorize clients for better aggregation performance. Additionally, we evaluate SRFL in a simulation environment, confirming that it improves accuracy by 5%–30% over FedAVG in non-IID setting and protects the model from membership inference attack and Byzantine attack. It also reduces backdoor attack success rate by 4%–10% more compared to other robust aggregation algorithms.

Federated Learning (FL), a secure and emerging distributed learning paradigm, has garnered significant interest in the Internet of Things (IoT) domain. However, it remains vulnerable to adversaries who may compromise privacy and integrity. Previous studies on privacy-preserving FL (PPFL) have demonstrated limitations in client model personalization and resistance to poisoning attacks, including Byzantine and backdoor attacks. In response, we propose a novel PPFL framework, FedRectify, that employs a personalized dual-layer approach through the deployment of Trusted Execution Environments and an interactive training strategy. This strategy facilitates the learning of personalized client features via private and shared layers. Furthermore, to improve model’s robustness to poisoning attacks, we introduce a novel aggregation method that employs clustering to filter out outlier model parameters and robust regression to assess the confidence of cluster members, thereby rectifying poisoned parameters. We theoretically prove the convergence of FedRectify and empirically validate its performance through extensive experiments. The results demonstrate that FedRectify converges 1.47-2.63 times faster than state-of-the-art methods when countering Byzantine attacks. Moreover, it can rapidly reduce the attack success rate to a low level between 10% and 40% in subsequent rounds when confronting bursty backdoor attacks.

Cloud-edge architecture is an emerging technology that aims to meet the growing demands of intelligent applications. To address the issues of machine learning privacy leakages and benefiting from imbalanced data distribution, federated learning has been widely applied. Nevertheless, they present inherent vulnerabilities that make them vulnerable to poisoning attacks. Existing defense techniques are largely attack-rigid: they are designed to recognize client properties or model updates directly, aimed at specific attack scenarios or rules, but may not work well for critical feature patterns or flexible attack methods, mainly due to the potential influence of redundant features and model performance on defense. Yet few flexible defense methods have been developed. In this paper, we propose FlexibleFL, a flexible defense method against poisoning attacks in cloud-edge federated learning system (CEFL). The key idea of FlexibleFL is to evaluate the quality of uploaded model parameters and further determine the contribution of participants through an optimal threshold selection strategy. Based on these differences, FlexibleFL can thus implement penalties to potential attackers in a way that involves assigning the updated federated model. Extensive results demonstrate that our method has significant advantages in countering poisoning attacks in IID and Non-IID scenarios, and can effectively protect CEFL systems.

In the cloud environment, the virtual computing node has become the dominant form of cloud services used by users. Hence, it is increasingly critical to guarantee the trusted operation of the virtual computing node's operating system (VCNOS). However, previous schemes suffer a lot, such as insufficient consideration of the comprehensive of the measured objects, ignoring the dynamic of trusted, and the trusted measurement mechanisms rarely consider their security. Thus, a three-dimensional dynamic trusted measurement model SABDTM, which integrates the integrity measurement of kernel static data, trusted evaluation of operating system behavior (OSB), and the feedback trust of interacting nodes, is proposed. First, SABDTM divided OSB into multiple atomic behaviors and introduced the Bayesian decision theory to predict trusted expectations of OSBs. Second, the feedback trust of interacting nodes is considered to improve the comprehensiveness of the trusted measurement and evaluate its value based on the Euclidean distance function to reduce the impact of inaccurate feedback from malicious nodes. Subsequently, we set the appropriate weight for trusted measurement values of different moments based on Induced Ordered Weighted Averaging to accurately portray the actual state of VCNOS. Moreover, we designed a lightweight and independent subsystem to perform the trusted measurement, which guarantees the security of the measurement service. The security of our model is proved rigorously based on the non-interference theory. Finally, the experiments and comparative analysis demonstrated our model has better functionality and superiority.

The mobile cellular network provides internet connectivity for heterogeneous Internet of Things (IoT) devices.The cellular network consists of several towers installed at appropriate locations within a smart city.These cellular towers can be utilized for various tasks, such as e-healthcare systems, smart city surveillance, traffic monitoring, infrastructure surveillance, or sidewalk checking.Security is a primary concern in data broadcasting, particularly authentication, because the strength of a cellular network's signal is much higher frequency than the associated one, and their frequencies can sometimes be aligned, posing a significant challenge.As a result, that requires attention, and without information authentication, such a barrier cannot be removed.So, we design a secure and efficient information authentication scheme for IoT-enabled devices to mitigate the flaws in the e-healthcare system.The proposed protocol security shall check formally using the Real-or-Random (ROR) model, simulated using ProVerif2.03,and informally using pragmatic discussion.In comparison, the performance phenomenon shall tackle by the already result available in the MIRACL cryptographic lab.