The diverse properties of wireless networks are fulfilled with the assistance of digital twin (DT), which utilizes a virtual model of the physical object (PO) to provide predictions and control decisions. However, the open wireless channels and key leakage of compromised entities (including DT and PO) pose significant security issues, highlighting the need for secure data transmission schemes. Meanwhile, it is impractical to directly apply the existing works and cryptographic primitives to DT-empowered wireless networks (DTWNs) due to the absence of a solution to capture the security requirements comprehensively. Moreover, the essential characteristics for protecting historical data cannot be met. Therefore, this paper proposes a security-enhanced data transmission scheme with fine-grained and flexible revocation by customizing a novel cryptographic primitive named forward-secure puncturable signed encryption (FS-PSE). Our scheme enables confidential data dissemination/acquisition between the physical and virtual space while ensuring authentication of the real-time information and feedback results. In addition, three revocation modes are defined. Based on these modes, the entities can flexibly revoke any decryption-&-signature, decryption, and signature capability in a fine-grained approach, thereby providing security protections for the historically transmitted data even though the entity is compromised. Moreover, our scheme is instantiated with a concrete FS-PSE construction and extended to support outsourced computing to improve efficiency. Finally, the formal security proof and performance evaluation demonstrate the security and practicality of our scheme.

In transportation 5.0, digital twin (DT) is considered a promising paradigm to integrate physical entities into cyber physical systems by collecting massive data. However, the open collection process and key exposure issues bring critical security challenges. Furthermore, applying the existing authentication schemes to data collection in transportation DT (TDT) systems encounters three deficiencies: 1) forward security for collected data can only be achieved at a coarse-grained level; 2) one or more additional trusted authorities are introduced, causing the robustness of TDT systems to be downgraded; 3) dynamic attribute updating and revocability of physical entities are rarely considered. Therefore, we propose a dual fine-grained authentication scheme (DFAS) in this paper. Our DFAS can not only ensure data integrity and authenticity but also enable fine-grained access control, namely, only registered physical entities with authorized attributes can generate valid signatures. Meanwhile, DFAS provides the key puncturing for physical entities to guarantee fine-grained forward security without relying on any trusted authority. In addition, a non-interactive attribute updating and revocation of malicious entities are realized in DFAS. Finally, the security analysis indicates that DFAS can deal with various security challenges for data collection in TDT systems. The performance evaluation demonstrates that DFAS is efficient and practical.

With the continuous development of digitization evolutions, vehicular digital twin networks (VDTNs) facilitate traffic data and optimization results to be exchanged between the vehicle and digital twin as well as shared among a group of digital twins. However, the data exchange and group sharing processes take place in real-time over public communication channels, which suffer from various security and privacy threats. Key agreement technologies are promising to enable secure data communications for entities, but the existing key agreement schemes generally fail to fulfill the requirements of synchronization, privacy, and entity management for VDTNs. Therefore, we propose a blockchain-assisted privacy-preserving and synchronized key agreement scheme for VDTNs. In the proposed scheme, the anonymous vehicle and digital twin can negotiate a secret session key in the case of synchronization to achieve secure data exchange. Meanwhile, digital twins are capable of utilizing synchronized state information to dynamically establish a common group encryption key but hold individual decryption keys, which guarantee the security of group sharing. Additionally, the proposed scheme is able to protect identity privacy and manage vehicles and digital twins with the assistance of blockchain and smart contract. The security analysis demonstrates that the proposed scheme provides security and privacy assurances for VDTNs. The performance evaluation indicates that it has excellent expressions in terms of efficiency, practicality, and smart contract consumption.

The Industrial Internet of Things (IIoT) has brought practical application value to many industries, where significant amounts of IIoT data and resources are outsourced to cloud server (CS) via diverse networks for data fusion, monitoring, sharing, and calculation analysis. Considering privacy, there is a need to execute the encryption operation on the data before outsourcing, while how to retrieve the encrypted data from CS becomes a thorny issue. Furthermore, the untrusted CS in charge of storing and searching the ciphertexts may return incorrect or incomplete search results for some interest. Verifiable public key searchable encryption (VPKSE) provides the ability to encrypt data, retrieve ciphertext, and verify search results simultaneously. However, the malicious behavior of CS has not been sufficiently considered in most existing schemes, that is, their verifiability only ensures the correctness of search results, neglecting completeness. In this paper, the verifiability of VPKSE is re-examined, and three verifiability levels are defined detailedly. On this basis, a blockchain-assisted verifiable certificated-based searchable encryption (BVCBSE) scheme for IIoT is put forward. The integration of blockchain and cryptographic accumulator ensures that an untrusted CS must return correct and complete search results, achieving the highest level of verifiability. In addition, security analysis demonstrates that BVCBSE can resist keyword guessing attack. Performance evaluation illustrates that BVCBSE is efficient and practical.

As a novel distributed learning framework for protecting personal data privacy, federated learning has attained widespread attentions through sharing gradients among users without collecting their data. However, an untrusted cloud server may infer users' individual information from gradients and global model. In addition, it may even forge incorrect aggregated results to save resources. To deal with these issues, despite that the existing works can protect local model privacy and achieve verifiability of aggregated results, they are defective in protecting global model privacy, guaranteeing verifiablility if collusion attacks occur, and suffer from high computation cost. To further tackle the above challenges, we propose an efficient and verifiable secure aggregation scheme for federated learning, named EVSA. Concretely, we combine symmetric homomorphic encryption with a single mask to protect local model and global model privacy. Meanwhile, we adopt verifiable multi-secret sharing and generalized Pedersen commitment to achieve verifiability and prevent users from uploading incorrect shares. Furthermore, high model accuracy can be ensured even if some users go offline. Security analysis illustrates that our EVSA can enhance security of federated learning and realize desired security requirements. Performance evaluation displays that our EVSA is more practical than the previous schemes regarding computation and communication cost.

Vehicular social networks (VSNs), as the convergence of social networks and vehicular ad hoc networks, have brought many useful services to vehicle communication by collecting and sharing data between vehicles. In order to efficiently share data and satisfy the growing requirement of privacy protection, data owners typically encrypt and outsource the data to the cloud. Nevertheless, encryption undoubtedly reduces the availability of shared data, e.g., keyword search. Although a number of schemes supporting keyword search of shared data have been put forward, they still have issues with respect to security, functionality, and efficiency. In this paper, a server-assisted data sharing (SADS) system with support for conjunctive keyword search is presented. Specifically, to resist online keyword guessing attack, we devise an advanced keyword derivation mechanism to derive the keyword set, in which the conception of verifiable parallel oblivious unpredictable function is proposed to check whether the assisted server honestly responds to the derived keyword request. Moreover, the computation and communication costs of keyword trapdoor in SADS are constant. Concurrently, SADS achieves the anonymous data sharing and traceability of malicious vehicle data owner. The security of SADS is formally proved and analyzed. Performance evaluation also shows that our system is efficient and practical.

Vehicular ad hoc networks (VANETs), an increasingly significant technology in intelligent transportation systems, achieve information sharing, intelligent traffic flow control, and road condition prediction through data sharing between vehicles and other devices, enhancing traffic efficiency and driving safety. Nevertheless, there are still challenges to data sharing with respect to efficiency, flexibility, and security. In this paper, we build a flexible selective data sharing with fine-grained erasure (FSDS-FE) scheme in VANETs by introducing the novel cryptographic primitive called puncturable identity-based fine-grained proxy re-encryption and employing identity-based signature. In FSDS-FE, with the support for ciphertext transformation, the vehicles are able to flexibly share the outsourced traffic data with others. Different sharing content can be customized for various entities through fine-grained re-encryption to protect sensitive information. Furthermore, the outsourced traffic data could be erased in a fine-grained way by the vehicles. In order to optimize the efficiency and practicality of FSDS-FE, we construct an improved FSDS-FE scheme by designing a novel puncturable identity-based fine-grained broadcast proxy re-encryption with verifiable outsourced decryption scheme. Rigorous security analysis demonstrates that FSDS-FE can achieve the desired security requirements. The comprehensive performance evaluation shows that our schemes are efficient and practical enough in VANETs.

Vehicular digital twin networks (VDTNs) offer great opportunities for driver safety enhancements. By leveraging digital twin (DT) technology, VDTNs can collect and analyze traffic data to optimize driving routes, and allow the out-of-field vehicles to share traffic data via their DTs. However, the real-time data sharing process over a public channel raises concerns about security and privacy. Existing data sharing schemes cannot be directly adopted for VDTNs because they rarely consider dual (data and identity) privacy, synchronization, and flexibility, while also imposing a significant cost on resource-limited entities. To address these challenges, we propose a secure and flexible data sharing scheme with dual privacy protection for VDTNs. In the proposed scheme, a signature of knowledge protocol is developed for protecting the vehicle’s real identity and ensuring authentication, smart contract algorithms are designed to assist in realizing accountability, and a verification control mechanism is devised for allowing the vehicle to flexibly share the traffic data. Additionally, DT with consistent states is capable of removing sensitive information from the shared data, which guarantees synchronization and data privacy. The security analysis demonstrates that the proposed scheme is resilient against potential security threats in VDTNs. Furthermore, the performance evaluation indicates that the proposed scheme not only outperforms the state-of-the-art schemes but also achieves feasible blockchain consumption and data authentication delay.

Due to the openness of communication methods in the Internet of Vehicles (IoV), its data transmission is vulnerable to attacks. Additionally, a vast amount of redundant data saturates the IoV's data space. How to ensure the security of transmitted information while achieving efficient data source identification is an important challenge facing the development of the IoV industry. Matching encryption technology holds promising research prospects for achieving data security and data source access control. This paper proposes an accountable attribute-based matching encryption for the IoV, addressing the lack of effective user tracking, revocation, and privacy protection mechanisms in existing attribute-based matching encryption techniques for practical scenarios of IoV data sharing. The scheme implements functionalities such as revocation, white-box tracking, and user privacy protection. We analyze the confidentiality, authenticity, and traceability of this scheme under a random oracle model. Additionally, performance analysis is conducted to demonstrate its practicality in real-world scenarios.

Most recently, Zhang et al. (2022) presented a verifiable data aggregation scheme for smart grids in IEEE Transactions on Dependable and Secure Computing. The authors claim that the privacy of the user's electricity data is preserved, and the control center can check whether the aggregator honestly computes the aggregated ciphertext. However, we indicate that Zhang et al.'s scheme fails to provide the properties of data privacy and aggregate correctness guarantee. Specifically, by offering concrete attacks, we illustrate that the adversary who has the ability to obtain the decryption key of control center can decrypt any user's ciphertext to get the detailed electricity data, and a misbehaved aggregator will not be detected when it does have some malicious behavior.

Proxy re-encryption, as a cryptographic primitive, allows an untrusted proxy to transform a ciphertext encrypted with the data owner’s public key to a ciphertext encrypted with the authorized user’s public key, without any knowledge of the underlying plaintext, which achieves the sharing of ciphertext data. As an identity-based cryptosystem, SM9 has been adopted as a Chinese national standard and an ISO/IEC international standard. However, the SM9 encryption algorithm can only achieve the function of data encryption without considering the ciphertext transformation. In this paper, based on SM9, we first propose an identity-based proxy re-encryption scheme (termed IBPRE-I). IBPRE-I has the same user secret key as SM9, so it can be effectively integrated with SM9-based systems. Security proof indicates that IBPRE-I achieves the ciphertext indistinguishability against selective identity and chosen plaintext attack, and the secret key leakage resistance against collusion attack in the random oracle model. Then, by extending the IBPRE-I scheme, we present our second scheme IBPRE-II to achieve the security under chosen ciphertext attack. Finally, the performance is evaluated and the results show that the proposed schemes are practical.

As a novel distributed learning framework for protecting personal data privacy, federated learning, (FL) has attained widespread attention through sharing gradients among users without collecting their data. However, an untrusted cloud server may infer users' individual information from gradients and global model. In addition, it may even forge incorrect aggregated results to save resources. To deal with these issues, despite that the existing works can protect local model privacy and achieve verifiability of aggregated results, they are defective in protecting global model privacy, guaranteeing verifiability if collusion attacks occur, and suffer from high computation cost. To further tackle the above challenges, a verifiable and collusion-resistant secure aggregation scheme for FL is proposed, named VCSA. Concretely, we combine symmetric homomorphic encryption with single masking to protect model privacy. Meanwhile, we adopt verifiable multi-secret sharing and generalized Pedersen commitment to achieve verifiability and prevent users from uploading incorrect shares. Furthermore, high model accuracy can be ensured even if some users go offline. Security analysis illustrates that our VCSA enhances the security of FL, realizes verifiability despite collusion attacks and robustness to dropout. Performance evaluation displays that our VCSA can reduce at least 28.27% and 79.15% regarding computation cost compared to existing schemes.

Digital Twin (DT) technology, by performing simulation, analysis, and prediction over the data mapped to digital space, can create a digital replica of the physical object. It can be combined with edge computing or cloud computing to provide broad vehicle-to-everything applications and improve the service quality of vehicular ad-hoc networks (VANETs). In this paper, DT technology and mobile edge computing are integrated into VANETs to introduce a framework of mobile digital twin edge network-driven VANETs (MDTEN-Driven VANETs). Moreover, facing the security and privacy challenges in the framework, we propose a synchronized privacy-preserving authentication (SPPA) scheme. In SPPA, we first design a synchronized anonymous certificateless aggregate signature (SA-CLAS) to achieve the authentication with time state synchronization and the privacy preservation of the real identity. Furthermore, to deal with malicious vehicles, we adopt blockchain technology and devise a smart contract algorithm to manage the public information of vehicles. The security analysis demonstrates that SA-CLAS is existentially unforgeable under adaptive chosen message attacks, and SPPA can satisfy the necessary security requirements. The performance evaluation shows the efficiency and practicality of SA-CLAS and SPPA. Besides, the designed smart contract is implemented in an Ethereum test network, which presents an acceptable blockchain consumption.

The Snowden incident illustrates that an adversary may launch an algorithm substitution attack (ASA) by tampering with the algorithms of protocol participants to obtain users' secret information. A measure against ASA is to equip the protocol participants with cryptographic reverse firewalls (CRF). Public key encryption with keyword search (PEKS) as a cryptographic primitive allows users to search encrypted file in cloud servers while ensuring the security of the original file. The existing CRF constructions for PEKS does not consider the trust level of CRFs, leaving honest-but-curious CRF to deal with trapdoors that should be sent in the secure channels, which brings new security risks. This paper firstly introduces the notion of malleable designated tester public key encryption with keyword search (M-DPEKS). Based on M-DPEKS, we propose the generic construction of public key encryption with keyword search with cryptographic reverse firewalls to overcome the privacy leakage issue in cloud storage. Security proof indicates the generic construction is secure against ASA. Lastly, we instantiate the generic construction with a concrete M-DPEKS scheme and analyze the computation cost and communication overhead to evaluate the efficiency.

In the cloud storage environment, users can store their data on cloud servers to save local storage resources and also share data with other users through cloud servers. Nevertheless, the outsourced data in cloud is vulnerable to tampering or loss due to software or hardware failures, hacker attacks, and other unforeseen issues. Public auditing technique have been developed to safeguard the integrity of the outsourced data. In addition, outsourced data typically contains users' sensitive information like their names and ages, which are likely to be unavoidably exposed to cloud servers and other users. To tackle the aforementioned issues, a certificateless public auditing scheme with sensitive information hiding (CPAS-SIH) for data sharing is presented in this paper, which introduces a third-party sanitizer to sanitize the data blocks encompassing sensitive information in outsourced data and converts their tags into the valid ones for sanitized data blocks. Meanwhile, an extended double linked list information table is utilized to enable data dynamic operations, including the data blocks modification, insertion, as well as deletion. The security analysis demonstrates that CPAS-SIH satisfies unforgeability, auditing soundness, immutability, and data privacy preservation. The performance evaluation indicates that CPAS-SIH is efficient and practical.

Aiming at the problem of privacy protection of drivers and parking owners in the smart parking sharing scheme, an efficient conditional privacy-preserving scheme for smart parking sharing is proposed in this paper. Specifically, the scheme uses self-updating dynamic pseudonym to protect the identity privacy of drivers and parking owners, and reduces the cost of drivers and parking owners interacting with trusted authority to obtain temporary public and private keys. In addition, when a dispute arises between a driver and cloud server or between a parking owner and cloud server, a trusted authority can reveal the identity of the driver and parking owner. Security analysis shows that based on DL assumption, the scheme can meet anonymous authentication, data confidentiality and traceability. The performance evaluation reflects that the proposed scheme is efficient and practical.

As the rapid proliferation of Internet of Things (IoT) and edge computing, large amounts of data are needed to be stored and transmitted in the online storage system. Data deduplication can be adopted to improve communication efficiency and minimize storage space. However, in edge computing, data deduplication brings security and functionality requirements that are still unsatisfied. Most existing schemes are vulnerable to brute-force attacks and single-point attacks. Moreover, they impose a heavy burden on resource-constrained edge nodes and do not support cross-domain deduplication. Blockchain is a promising technology because the programmable smart contract can be utilized to perform cross-domain deduplication and guarantee the traceability of data. In this article, an efficient dynamic cross-domain deduplication scheme in blockchain-enabled edge computing is proposed to solve the above problems. Specifically, the smart contract is employed to assist cross-domain deduplication, which also can reduce the storage pressure of edge nodes. Meanwhile, a hash proof system-based oblivious pseudorandom function is created to reduce the time cost of key generation and achieve the security requirements of resistance to brute-force attacks and single-point attacks. The technology of accumulators is adopted to achieve Proofs of Ownership (PoO), which can prevent duplicate-faking attacks. The security analysis demonstrates that the proposed scheme has a higher security level. The performance evaluation shows that the proposed scheme significantly reduces computation cost and communication overhead, compared with other existing schemes. The smart contract is implemented in the Ethereum test network (i.e., Rinkeby), which shows acceptable gas cost even the functions are called frequently.