In the Internet of Things (IoT) environment, the end-cloud collaborative architecture enables secure sharing and processing of massive data between the terminals and the cloud. It highlights establishing trusted transmission and computing mechanisms to ensure security over the data’s full lifecycle. However, privacy issues about illegal access and forgery of sensitive data are increasingly severe during the computation, storage, and distribution process, thus hindering the development of IoT. Although the bilateral access control methods for end-cloud collaboration enforce access control on user privilege and ensure data source credibility through authentication mechanisms, they struggle to balance forward security and communication cost, resulting in limited key updating efficiency and policy flexibility. To address these practical issues, this paper proposes a novel forward secure bilateral access control scheme named FSBiAC for end-cloud collaborative IoT, which draws on the idea of matchmaking encryption and puncturable encryption. Our scheme outsources a significant portion of puncture tasks to reduce local updating overhead, while the bi-directional match between policies and attributes ensures fine-grained bilateral access control. Detailed proofs demonstrate that FSBiAC achieves semantic security under selectively chosen plaintext attacks (IND-sCPA) and existential unforgeability under chosen message attacks (EUF-CMA). Simulation shows that FSBiAC realizes superior computation and storage overhead compared to the previous studies.

Pseudonym self-generation (PSG) is essential for Conditional Anonymous Authentication (CAA) in Vehicular Adhoc Networks (VANETs), enabling vehicles to autonomously create communication identities without centralized control. However, existing self-generation schemes face two problems: efficiently revoking malicious vehicles remains difficult, and hardware-independent solutions additionally struggle to verify the legitimacy of pseudonyms. To overcome these issues, we propose an efficient Revocable CAA scheme with Verifiable Self-generated Pseudonyms for VANETs (RCAAVSP). First, a Traceable Chameleon Hash (TCH) function is designed to implicit membership through TCH collision, enforcing verifiable and unlinkable pseudonym generation. And then a multi-parameter authentication mechanism leveraging dynamic accumulators, which achieves O(1)-complexity revocation via domain membership polynomial updates without system-wide reconfiguration. Formal security analysis demonstrates the semantic security of our proposed scheme under the random oracle model, with proven resilience against common attacks. Experimental evaluations demonstrate that RCAAVSP achieves a 76% relative improvement in pseudonym generation efficiency, while maintaining the overhead of anonymous authentication and malicious vehicle revocation at ms-level, providing a lightweight solution for secure VANET communication.

With the widespread adoption of UAV technology, the physical attacks targeting UAVs have become increasingly diverse, garnering growing attention. Physical attacks pose significant threats to the security of critical hardware within UAV systems, potentially leading to severe consequences such as crashes or unauthorized hijacking. Therefore, conducting in-depth research into physical attack methods on UAV systems not only provides theoretical support and strategic guidance for designing defense measures but also facilitates the optimization and tool-based application of existing attack techniques, paving new pathways for the development of anti-UAV technologies. This review begins with a systematic decomposition and detailed introduction of UAV systems from the perspective of hardware functional structures. Subsequently, it delves into vulnerabilities of UAV systems when facing physical attacks and provides a comprehensive review of existing physical attack methods. Particular attention is given to evaluating the effectiveness, technical characteristics, strengths, and limitations of these methods. Additionally, the review explores emerging physical attack techniques and the potential security threats posed by hardware extensions of UAVs in novel application domains. Furthermore, this review proposes a quantitative risk assessment framework for UAV security, systematically evaluating various physical attack methods based on attack cost, effectiveness, and likelihood. Finally, the review discusses future research directions in the domain of physical attacks on UAV systems, emphasizing the need to enhance existing technologies to strengthen anti-UAV capabilities and highlighting the importance of developing comprehensive defense strategies against physical attacks.

As Flying Ad Hoc Networks (FANETs) are highly vulnerable to security threats such as identity spoofing, session replay and man-in-the-middle attacks in open-air channels, it is crucial to design an authentication key agreement (AKA) scheme to ensure the security of unmanned aerial vehicle (UAV) swarm networking within FANETs. However, existing AKA schemes for FANETs often struggle to balance authentication efficiency and high dynamism within UAV swarms whilst meeting necessary security requirements. To address the issue, this paper proposes CUBAT-AKA (Collaborative UAV Batch Authentication and Tree-based Key Agreement), a lightweight UAV swarm authentication and key agreement scheme based on batch verification and a binary tree structure. The scheme constructs a secure and lightweight three-party authentication mechanism based on aggregated verification and the Chinese Remainder Theorem (CRT). By offloading computational tasks to the authentication center and aggregating authentication responses in batches, it significantly improves the efficiency of UAV access authentication in large-scale FANET scenarios. To address the dynamic nature of UAVs frequently joining and leaving clusters in FANETs, an improved binary tree-based key agreement method has been designed, reducing key update overhead to a logarithmic level and enabling lightweight session key distribution and updates for UAV clusters. Security analysis demonstrates that, under the random oracle model, CUBAT-AKA is resistant to eavesdropping, replay, man-in-the-middle, impersonation and collusion attacks, whilst ensuring forward and backward security during member changes. Performance analysis indicates that this scheme offers significant advantages over comparable solutions in terms of both UAV cluster access authentication efficiency and dynamic key agreement overhead.

The combination of Deep Learning (DL) and Federated Learning (FL) makes it a popular paradigm to train powerful models securely on large-scale data in a distributed way. However, current solutions face challenges such as significant communication overheads for clients with limited resources, potential privacy risks arising from FL's distributed nature, and the inability to maintain model accuracy without loss under high compression ratios. To solve these issues, we propose a lightweight Communication-efficient and Privacy-preserving FL scheme CPFL by designing Cyclic Segmented Compressive Sensing (CSCS) and using efficient Symmetric Homomorphic Encryption (SHE), which greatly reduces the number of transmitted model weights without sacrificing model accuracy. Formal analysis shows the security of CPFL against known-plaintext attacks and ensures model convergence. Extensive experiments demonstrate that CPFL achieves remarkable model accuracy under more than 200 & times; compression ratio, and even reduces the communication cost by 99.5% compared with previous solutions.

With the advancement of smart terminals and communication technologies, the emergence of heterogeneous Service Subscribers (SSs) and diverse sensing demands has facilitated the development of multi-platform Mobile CrowdSensing (MCS) scenarios. However, unlike traditional single-platform scenarios, Mobile Users' (MUs) bidding privacy is hard to protect in multi platform MCS. Additionally, the privacy disclosure issue of SSs has not been well addressed. To tackle these issues, in this paper, we propose a bilateral, auction-based scheme to preserve bidding privacy in multi-platform MCS, thereby protecting the interests of both SSs and MUs. Specifically, since SSs and MUs strategically choose one another to maximize their utility, we construct the corresponding selection processes for both sides by taking advantage of auction pricing theory. We firstly design a user-oriented forward auction that integrates the 0-1 knapsack problem with the Paillier encryption algorithm to protect the bidding information of both SSs and MUs. Then, we employ the Chinese Remainder Theorem (CRT) to design a reverse auction that hides the bidding behaviors of MUs. Theoretical analysis demonstrates that our scheme can protect the bidding privacy of both parties while ensuring economic robustness. Extensive experiments on a real dataset demonstrate that, compared with existing works, our scheme enables both SSs and MUs to achieve satisfactory utility while maintaining low computational overhead.

Boosted by the explosive development of the Internet of Things (IoT) technology, the Internet of Vehicles (IoV) has become mature. Various and heterogeneous devices are increasingly included in IoV, which greatly facilitates people's lives, from navigation, charging, refueling, and other aspects. However, numerous devices in the IoV also bring serious security problems. Communications between vehicle entities and service entities are always exposed to powerful adversaries who can eavesdrop, intercept, and tamper communication messages. Besides, users' personal information faces leakage risks that seriously threaten people's life security (either passengers or pedestrians). Authentication and key agreement schemes for IoV are neither able to resist quantum attacks nor communication efficient. Therefore, in this paper, we propose a lattice-based anonymous certificateless authentication and key agreement scheme, PQACLA, for secure communication between vehicular entities and service entities. The PQACLA scheme leverages pseudonym identity technology and conditional malicious tracking to realize and guarantee the vehicle entities' anonymity and untraceability. Adopting provable security, the PQACLA scheme is proved secure under the random oracle model. Its security is also verified using the Scyther formal tool and informal security analysis. Compared to relative schemes, the PQACLA scheme behaves better, as its communication cost and computation cost are well balanced in total.

The Internet of Vehicles (IoV) generates massive sensitive perception data, typically managed by manufacturer-specific domains. While encryption with domain-specific parameters protects confidentiality, many IoV applications require secure cross-domain data sharing to access complementary information, and expressive keyword search for efficient access. However, existing Attribute-Based Keyword Search (ABKS) schemes are designed for single-domain settings, and thus cannot address heterogeneous key management or provide traceability without a universally trusted authority. To address these issues, we propose TCroS, a traceable cross-domain data sharing scheme that generalizes CP-ABE via proxy re-encryption mechanism, enabling ciphertexts generated in one domain to be securely transformed for authorized requesters in another. To provide traceability, TCroS embeds requester identities into decryption keys using Boneh-Boyen signatures, allowing any party (rather than the universally trusted authority) to trace the source of a leaked key. We further extend TCroS to TCroSS, which incorporates privacy-preserving expressive keyword search supporting Boolean queries, thereby enabling efficient retrieval of authorized data while resisting keyword guessing attacks. Formal security analysis proves that our schemes achieve IND-SCPA and IND-SCKA security. Experimental results demonstrate their practicality, showing that cross-domain sharing can be realized with computation and storage overheads comparable to single-domain setting.

In the evolution of Intelligent Transportation Systems (ITS), autonomous vehicle platoon has emerged as a pivotal technology, where platoon followers periodically transmit critical information (such as speed and acceleration) to the platoon leader to maintain coordination and synchronization within the formation. Heterogeneous signcryption has garnered significant attention as a mean to ensure secure data transmission in environments characterized by diverse natures of vehicles. However, existing heterogeneous signcryption schemes fail to provide forward privacy and incur significant computational overhead during unsigncryption. To address these challenges, we propose an efficient heterogeneous signcryption scheme with forward privacy (HSCFP) for vehicular platoon communication. First, based on Elliptic Curve Cryptosystem (ECC), we introduce a heterogeneous signcryption framework that transitions data from Identity-based Cryptosystem (IBC) to Public Key Infrastructure (PKI), enabling seamless communication across cryptosystems. Next, we design an incremental update mechanism based on Updatable Public Key Encryption (UPKE) and Hashed EIGamal, ensuring the long-term security of historical communications. Additionally, we design a batch verification algorithm that significantly accelerates the unsigncryption process when dealing with multiple ciphertexts. Finally, we provide a rigorous security analysis of HSCFP under the random oracle model, and extensive experimental results demonstrate our scheme enhances unsign-cryption efficiency by over 60% compared to existing solutions.

As a typical crowdsourcing service in the healthcare field, medical crowdsourcing allocates tasks to large-scale professionals via edge-cloud collaborative platforms. It provides patients with health consultations and treatment plans. Nevertheless, it is non-trivial to achieve fine-grained access control for medical tasks, fine-grained trusted identification for task requesters, and flexible task selection for medical providers. Furthermore, current access control solutions cannot prevent improper access to medical tasks throughout the full lifecycle, thus making them susceptible to historical and future data breaches. To this end, this paper proposes a privacy-preserving Attribute-Based Matchmaking Encryption scheme called MatFBMC that ensures both forward and backward secrecy. It offloads massive puncture operations to the crowdsourcing platform, thereby reducing the client key rotation overhead while ensuring forward secrecy. Meanwhile, this scheme ensures backward secrecy through the embedding of the time epoch, thereby realizing lightweight privilege revocation. Furthermore, the bi-directional matches between access/identification policies and the two parties’ attributes are employed to achieve bilateral fine-grained access control. We provide security proofs for semantic security against selective Chosen Plaintext Attack and existential unforgeability under Chosen Message Attack. Based on the Java Pairing-Based Cryptographic Library and real-world medical datasets, simulations display better computational and storage performance compared to the state-of-the-art works.

Unmanned Aerial Vehicles (UAVs) swarms for emergency missions require data sharing and storage, yet node failures remain a critical threat. Blockchain has been introduced into UAV networks to mitigate such failures and enhance data reliability. While blockchain boosts data reliability, traditional lightweight storage approaches may result in data unavailability. Error-correcting coding enabled lightweight blockchain is a promising solution. However, it lacks a targeted design for data with varying access frequencies, and still consumes some unnecessary storage space. Meanwhile, it suffers from low data access efficiency and is unable to meet the real-time requirements of UAVs. To solve the problem, this paper presents a hierarchical and intelligent blockchain data storage scheme named Hi-Chain that improves both storage capability and access efficiency. First, we design an adaptive Reed-Solomon encoding storage algorithm for data with different access frequencies to improve the storage capacity of the UAV network. Second, we propose an intelligent cache replacement algorithm to replace and keep real-time access data, ensuring the UAVs' real-time collaboration. In essence, Hi-Chain distinguishes itself from prior studies by uniquely adopting frequency-based hierarchical encoding and integrating intelligent caching to accelerate real-time data access. Experimental results demonstrate that Hi-Chain outperforms existing methods, reducing storage overhead by 64.95%, increasing storable blocks by 185.42%, maintaining 100.00% access success under moderate network disconnections, and reducing access delay by 12.65%.

Privacy-preserving spatial range query allows users to obtain valid data based on specific spatial attributes or geographical location while ensuring privacy. However, many existing Privacy-Preserving Spatial Range Query (PSRQ) schemes generally face the problems of low query efficiency and insufficient security when dealing with large-scale mobile cloud data sets, and it is difficult to resist Indistinguishability under Chosen-Plaintext Attack (IND-CPA). To solve these challenges, we first propose an Efficient and Secure Spatial Range Query scheme (ESSRQ), which is based on a dual mobile cloud architecture by integrating Geohash algorithm, Circular Shift Coalesce Zero-Sum Garbled Bloom Filter (CSC-ZGBF) and Symmetric Homomorphic Encryption (SHE), achieving a constant search complexity. However, ESSRQ cannot protect the access patterns, where the cloud server still has the potential to infer attacks based on the index position and even obtain plaintext queries. On this basis, we further propose an extended scheme ESSRQ-PIR, which introduces Private Information Retrieval (PIR) into single mobile cloud-based architecture, effectively prevents the leakage of access patterns, enhances the security of ESSRQ and can also realize efficient query on large-scale cloud datasets. Formal security analysis proves that our proposed schemes are secure against IND-CPA, and extensive experiments demonstrate that our schemes improve the query efficiency by up to nearly 20 times when compared with previous solutions. These features make the proposed schemes particularly suitable for privacy-preserving spatial queries in mobile cloud computing environments.

To address the limitations of existing trajectory privacy protection methods, which generally neglect users’ personalized privacy requirements and suffer from utility degradation under traditional noise-injection mechanisms, a personalized dynamic privacy trajectory protection based on the Laplace mechanism was proposed. First, a fuzzy sensitivity quantification model was developed to characterize the semantic sensitivity of each location point by jointly considering spatial contextual features and individual privacy preferences, thereby enabling personalized sensitivity assessment. Then, a dynamic privacy budget allocation strategy was designed to distribute privacy budgets according to the sensitivity levels of trajectory points, upon which the Laplace mechanism was applied to generate adaptive perturbations. This enabled stronger protection for highly sensitive regions while maintaining higher data fidelity for low-sensitivity areas. Experimental results show that, compared with representative differential privacy-based trajectory perturbation methods, the proposed approach achieved superior privacy preservation performance and significantly enhanced the utility of perturbed trajectory data.

Low Earth Orbit (LEO) mega-constellations promise seamless global service, yet satellites racing overhead force handovers every few minutes, disrupting service for billions of users worldwide. Current systems maintain exclusive single-path connections despite modern phased arrays’ ability to track multiple satellites simultaneously, accepting these disruptions as unavoidable and merely minimizing instead of eliminating them. We propose PMPS (Predictive Multi-Path Scheduling), designed to achieve handover-free satellite communications through proactive continuous multi-path service. PMPS eliminates the reactive single-path service interruption through three integrated designs: (i) introducing multiplicative composite weights combining visibility time, signal quality, and capacity factors orchestrates continuous traffic redistribution, ensuring gradual and seamless packet migration across all active satellites. (ii) proving optimal multi-satellite packet scheduling is NP-complete, then developing polynomial-time approximation algorithms achieves provably near-optimal performance within real-time constraints. (iii) eliminating obstruction-induced packet loss through anticipatory selective redundancy protects vulnerable connections. As satellites approach the horizon becoming vulnerable to obstruction, their declining weights have shifted most traffic to higher satellites. Redundantly transmitting only the minimal remaining packets through stable satellites ensures zero loss if obstruction occurs. Evaluation on Starlink and OneWeb constellations demonstrates PMPS enables handover-free LEO communications with minimal redundancy overhead.

Trajectory data is a crucial resource for analyzing individual behavioral patterns and spatial dynamics. However, directly collecting trajectory data easily lead to privacy leakage issues. Therefore, the mainstream trajectory collection methods use Local Differential Privacy (LDP) to protect trajectory privacy, but they are still suffering from low data utility due to directional discretization and excessive allocation of privacy budget. To address these problems, we propose a basic Direction-Guided Perturbation (DGP) scheme for trajectory, while satisfing ε-LDP. Specifically, we utilize the inherent information of trajectory to perturb each trajectory point sequentially and restrict the perturbation region through the direction between adjacent points. To enhance the trajectory utility, we further extend DGP by introducing a radius to constraint the perturbation region, namely R-DGP. By calculating the maximum distance of each trajectory, R-DGP precisely restricts the perturbation range of each trajectory point to enhance response accuracy for data analysis tasks. Finally, we conduct extensive experiments on real world and synthetic datasets to compare our proposed schemes with state-of-the-art methods. The results show that our schemes reduce the mean normalized error by an average of 20% on four datasets under the same privacy requirement.

Over emerging communication technologies, phishing emails, particularly those exhibiting Advanced Persistent Threat (APT)-style characteristics, often closely resemble legitimate messages, making reliable detection difficult for existing email security systems, especially on borderline cases with low prediction confidence. While modern deep learning models achieve strong overall performance, their decisions on such ambiguous emails remain unreliable.To solve this problem, we propose LRAF, a Large Language Model (LLM)-Assisted Risk-Attribute Framework that enhances phishing email detection by selectively incorporating LLMs. For emails with uncertain predictions, LRAF invokes an LLM to extract structured semantic risk attributes, which are integrated with the base detector’s confidence through a lightweight rescoring model to refine the final binary decision. Experiments show that LRAF consistently outperforms traditional machine learning methods, fine-tuned Transformer models, and direct LLM-based classifiers. Notably, LRAF achieves substantial gains on hard-to-classify emails, with up to a 19.9% absolute improvement in F1-score. By focusing additional analysis on uncertain cases, LRAF provides a practical and decision-oriented solution for improving detection reliability while helping mitigate alert fatigue in real-world security operations in communication infrastructures.

To address the limitations of existing trajectory privacy protection methods, which generally neglect users’ personalized privacy requirements and suffer from utility degradation under traditional noise-injection mechanisms, a personalized dynamic trajectory privacy protection method based on the Laplace mechanism was proposed. First, a fuzzy sensitivity quantification model was developed to characterize the semantic sensitivity of each location point by jointly considering spatial contextual features and individual privacy preferences, thereby enabling personalized sensitivity assessment. Then, a dynamic privacy budget allocation strategy was designed to distribute privacy budgets according to the sensitivity levels of trajectory points, upon which the Laplace mechanism was applied to generate adaptive perturbations. This enabled stronger protection for highly sensitive regions while maintaining higher data fidelity for low-sensitivity areas. Experimental results show that, compared with representative differential privacy-based trajectory perturbation methods, the proposed method achieves superior privacy preservation performance and significantly enhances the utility of perturbed trajectory data.

With the widespread use of encrypted spatial data, many range query schemes emerge to address potential security risks caused by access pattern leakage. However, most existing schemes rely on a dual-server model to hide access patterns and often involve complex spatial relation judgments during range comparisons, leading to low query efficiency. To address these issues, we propose a novel Fast and Access Hidden Range Query (FAHRQ) scheme. First, we introduce an efficient range membership verification technique based on Bloom filters and Lagrange interpolation function, combine homomorphic encryption to ensure the confidentiality of spatial data and the computational flexibility of related operations, and realize the access pattern hidden under single server. Then, we construct an index using R-tree and employ Bloom filters and prefix 0-1 encoding to accelerate the minimum bounding rectangle intersection judgment, enabling secure and efficient range queries over encrypted spatial data while maintaining retrieval accuracy. Finally, we give a formal security analysis to show that our scheme achieves access pattern hidden while protecting data security, and conduct extensive experiments to demonstrate that our scheme improves query efficiency by 5-7 x compared to existing schemes.

Vehicular Ad Hoc Networks (VANETs) are the cornerstone of intelligent transportation systems and autonomous driving. Vehicle-to-road communication, as one of the core services, faces increasing risks of privacy breaches. Signcryption technology effectively ensures secure information transmission. However, existing signcryption schemes still have deficiencies in terms of transmission robustness and identity privacy protection. To solve these issues, this paper proposes a Robust Identity-based Signcryption scheme (RIBSC) for VANETs. In RIBSC, we first design an area session key distribution mechanism based on Chinese Residual Theorem (CRT), which can dynamically revoke the decryption ability of malicious Roadside Units (RSUs) in real time. Only RSUs approved by Trusted Detection Center (TDC) can obtain a valid session private key by conducting one modular operation. We then utilize the traceable pseudonym mechanism to protect the identity privacy of vehicles and RSUs, which can track their true identities when illegal activities occur. We finally provide a rigorous security proof under the random oracle model, and demonstrate the performance advantages of RIBSC through extensive experiments. More attractively, the session information is fixed at only 148 bytes, regardless of the number of RSUs.