The importance of tight security has been increasingly recognised in recent years, as it helps avoid the inflation of security parameters caused by reduction loss, thereby improving efficiency. However, achieving tight security also incurs additional overhead compared to traditional designs. As a result, the efficiency gains offered by tight reductions do not always fully outweigh the costs required to realise them. This trade-off has motivated considerable efforts to design practical schemes that achieve this property without sacrificing appreciable efficiency. In this work, we show this goal can be further advanced by leveraging the Algebraic Group Model (AGM). Our first contribution is a tightly secure digital signature scheme with multi-user security against adaptive corruptions. The construction is proven in the non-programmable ROM (NPROM) + AGM and can be viewed as a simplified variant of Appendix A of AOS02 [2]. Compared to the most efficient known scheme by Diemert et al. [12], our scheme achieves a tight reduction to the DL assumption (instead of DDH), reduces the public key size from 4 to 2 elements and the computational cost from 14 to 5 exponentiations. Building on this, we further present a pairing-free identity-based signature (IBS) scheme that also achieves tight EUF-ID-CMA security under the DL assumption. Compared to the only existing IBS with the same property by Loh et al. [29], our scheme reduces the signature size from 8 to 4 elements and the computational cost from 10 to 6 exponentiations. Moreover, our security proof is in the NPROM + AGM, in contrast to prior works proven in the ROM + AGM. These results demonstrate the practical feasibility of tightly secure signature schemes in real-world applications.

The Jiangmen Underground Neutrino Observatory (JUNO) collaboration has completed the construction of the 20,000-ton liquid scintillator detector and the associated muon veto detector system. To meet the physics objectives, the materials used in the detector must exhibit low radioactive contamination. The single-event rate in the fiducial volume (R < 17.2 m) of the scintillator is required to be approximately 7 Hz for energies above 0.7 MeV, resulting in an accidental coincidence background of about 1 event per day for reactor neutrino physics analyses. Since the beginning of the construction phase, we have screened the natural radioactivity content of thousands of materials, to select those that meet the design background budget. The radioactive impurity concentrations of the materials ultimately used in the JUNO detector are summarized in this paper. The construction of the entire detector and the subsequent filling of the liquid scintillator were completed in August 2025. From the initial data, the total count rate of natural radioactivity within the detector's fiducial volume has met the requirements and is sufficient to support the reactor antineutrino analysis.

The rapid growth of the Internet of Things (IoT) has exposed billions of interconnected, heterogeneous, and resource-constrained devices to increasingly sophisticated threats. To evaluate the readiness of current intrusion detection systems (IDSs), this study reviews 32 recent IoT-IDS proposals spanning conventional, machine-learning, deep-learning, and hybrid approaches. Each system is assessed against 10 criteria that reflect practical IoT requirements, including real-time performance, latency, lightweight design, detection accuracy, mitigation capabilities, integrated detection-and-mitigation workflows, adaptability, resilience to advanced attacks, validation in realistic environments, and scalability. The results indicate that although many approaches achieve high detection accuracy, most do not meet real-time and lightweight thresholds commonly cited in IoT deployment literature. Mitigation features are often absent, adaptability is rarely implemented, and 29 out of 32 studies rely solely on offline datasets, thereby limiting confidence in their robustness to deployment. Scalability remains the most significant limitation, as none of the reviewed IDSs have tested their performance under realistic multi-node or high-traffic conditions, even though scalability is critical for large IoT ecosystems. Overall, the review suggests that future IoT IDS research should move beyond accuracy-focused models and toward lightweight, adaptive, and autonomous solutions that incorporate mitigation, support real-time inference, and undergo standardized evaluations under real-world operating conditions.

The Jiangmen Underground Neutrino Observatory (JUNO) is a 20-kiloton liquid scintillator neutrino detector, located 650 meters (1800 m.w.e.) underground in Jiangmen, Guangdong, China. JUNO is primarily designed for reactor neutrino measurements and has been taking data since 2025. With the largest mass of its kind and an excellent energy resolution, JUNO is a leading observatory for high-precision measurements of MeV neutrinos. The standard global trigger system serves as the primary trigger for JUNO. We present a newly developed multi-messenger trigger system that extends the capabilities of the global trigger by providing a lower energy threshold and an independent monitoring capability. During the 2025 operation, it achieved an effective energy threshold of approximately 110 +/- 10 keV, providing a lower threshold configuration suitable for low-energy event analysis. The system shows the potential to further reduce the threshold to well below 100 keV. Based on the multi-messenger trigger system, an astrophysical monitor has been developed to receive and process external alerts from other messengers, such as gravitational-wave observations. A Transient Neutrino Burst Monitor is integrated to detect short-time-scale neutrino burst events and enables real-time monitoring of transient astrophysical phenomena. The system is sensitive to neutrino bursts from core-collapse supernovae within a distance of about 250 kpc.

Diverging assessment maintains a common question set for all students but varies the input data so that each student has a unique problem to solve. It is an approach in student assessment that offers a unique and authentic learning experience. Although such assessments have been implemented in computing courses, their effectiveness and students' perceptions in different contexts remain unexplored. In this paper, we investigate student perspectives on diverging assessment. We surveyed students in four courses across three different universities. Each surveyed student was enrolled in one of the four courses on networking, operation systems, digital forensics or ethical hacking. Each course featured at least one diverging assessment. The students' overall perceptions about diverging assessments and three different aspects of diverging assessment, namely authenticity, assessment-as-learning, and academic integrity, are surveyed, reported, and analyzed.

Policy-based chameleon hash (PCH) is a useful primitive in blockchain rewriting. It allows a party to compute a chameleon hash based on an access policy, and another party who possesses sufficient privileges satisfying the access policy to rewrite the hashed object. However, PCH lacks strong traceability. The chameleon trapdoor holder may abuse their rewriting privilege and maliciously rewrite the hashed object without being identified. In this paper, we introduce a new primitive called strongly traceable policy-based chameleon hash (STPCH for short). We first present a generic framework of STPCH. Then, we present a practical instantiation, show its practicality through implementation and evaluation analysis.

Policy-based chameleon hash functions have been widely proposed for its use in blockchain rewriting systems. They allow anyone to create a mutable transaction associated with an access policy, while an authorized user who possesses sufficient rewriting privileges from a trusted authority satisfying the access policy can rewrite the mutable transaction. However, existing chameleon hash functions lack certain fundamental security guarantees, including forward security and backward security. In this paper, we introduce a new primitive called forward/backward-secure policy-based chameleon hash (FB-PCH for short). We present a practical instantiation. We prove that the proposed scheme achieves forward/backward-secure collision-resistance, and show its practicality through implementation and evaluation analysis.

In this experience paper, we introduce the concept of 'diverging assessments', process-based assessments designed so that they become unique for each student while all students see a common skeleton. We present experiences with diverging assessments in the contexts of computer networks, operating systems, ethical hacking, and software development. All the given examples allow the use of generative-AI-based tools, are authentic, and are designed to generate learning opportunities that foster students' meta-cognition. Finally, we reflect upon these experiences in five different courses across four universities, showing how diverging assessments enhance students' learning while respecting academic integrity.

With the growing use of mobile devices, location-based services (LBS) are becoming increasingly popular. BLS deliver accurate services to individuals according to their geographical locations, but privacy issues have been the primary concerns of users. Privacy-preserving LBS (PPLBS) were proposed to protect location privacy, but there are still some problems: 1) a semi-trusted third party (STTP) is required to blur users’ locations; 2) both the computation and communication costs of generating a query are linear with the size of queried areas; 3) the schemes were not formally treated, in terms of definition, security model, security proof, etc. In this paper, to protect location privacy and improve query efficiency, an oblivious location-based services (OLBS) scheme is proposed. Our scheme captures the following features: 1) an STTP is not required; 2) users can query services without revealing their exact location information; 3) the service provider only knows the size of queried areas and nothing else; and 4) both the computation and communication costs of generating a query is constant, instead of linear with the size of queried areas. We formalise both the definition and security model of our OLBS scheme, and propose a concrete construction. Furthermore, the implementation is conducted to show its efficiency. The security of our scheme is reduced to well-known complexity assumptions. The novelty is to reduce the computation and communication costs of generating a query and enable the service provider to obliviously generate decrypt keys for queried services. This contributes to the growing work of formalising PPLBS schemes and improving query efficiency.

With the rapid advancements in machine learning as well as an increase in the awareness of privacy issues, federated learning has emerged to be an important paradigm as it greatly reduces the amount of data that need to be directly shared as part of the learning process. However, recently federated learning has been shown to be susceptible to gradient inversion attacks, where an adversary can compromise privacy by recreating the data that lead to a particular client's update. In this paper, we propose a new algorithm, SecAdam, to mitigate such emerging gradient inversion attacks and enable the clients to perform adaptive gradient based training in a federated setting while retaining client gradient privacy. We have given theoretical proofs for these properties as well as providing extensive practical experimental results, which we have carried out on five different datasets using two different neural network architectures. The results from these experiments demonstrate the effectiveness of our proposed algorithm. The code used to implement our algorithm, the different experiments and their analysis are available at https://github.com/codymlewis/SecOpt.

Ring signature allows a signer to generate a signature on behalf of a set of public keys, while a verifier can verify the signature without identifying who the actual signer is. In Crypto 2021, Yuen et al. proposed a new type of ring signature scheme called DualRing. However, it lacks forward security. The security of DualRing cannot be guaranteed if the signer's secret key is compromised. To address this problem, we introduce forward-secure DualRing, in which a signer can periodically update their secret key using a "split-and-combine" method. A practical instantiation of our scheme enjoys a logarithmic complexity in signature size and key size. Implementation and evaluation further validate the practicality of our proposed scheme.

In this paper, we introduce the first generic framework of policy-based remote user authentication from multiple biometrics. The proposed framework allows an authorized user to remotely authenticate herself to an authentication server using her multiple biometrics, which enhances both the security and usability of user authentications. The authentication server approves a user's authentication request if and only if the user's multiple biometrics satisfies an authentication policy. In particular, the authentication policy can be dynamically updated to satisfy different security and usability requirements in practice. We implement an instantiation of the proposed framework and report its performance under various authentication policies.

Trust management systems (TMSs) play an important role in Internet of Things (IoT) by providing a means of finding whether a given device can provide a service to a satisfactory level, and for identifying potentially malicious devices in the network. Context awareness extends trust models by allowing a trustor to filter and aggregate evidence by their relevance to the current situation. Context awareness is important in the formulation of trust in IoT networks due to their heterogeneity and due to the dynamic changes in the capabilities of IoT devices. In this article, we have proposed a new type of attack on context-aware trust models for IoT systems, context-based attacks. In this attack, an adversary manipulates the context to impact a target group of IoT devices, while other devices in nontargeted groups are not even aware of the attack. We have demonstrated the effectiveness of this new type of attack on seven previously proposed trust models through practical simulations and theoretical proofs. This article also proposes a new TMS that can mitigate such context-based attacks.

Policy-based chameleon hash is a useful primitive for blockchain rewriting systems. It allows a user to create a mutable transaction associated with an access policy, whereas a modifier who possesses sufficient rewriting privileges from a trusted authority satisfying the access policy can rewrite the mutable transaction. However, it lacks a revocation mechanism. The modifiers can always rewrite the mutable transactions even if their given rewriting privileges are compromised. In this work, we introduce revocable policy-based chameleon. The property of revocation allows some modifiers’ rewriting privileges to be revoked, regardless of whether their rewriting privileges are compromised or not.

Sharing data securely and efficiently has been identified as an issue in IoT-based smart systems such as smart cities, smart agriculture, smart health, etc. A large number of IoT devices are used in these smart systems and they produce a large amount of data. IoT devices generally have limited storage and processing capabilities, and configuring any security techniques on these devices is a challenge. In this paper, we propose a novel device identity management approach for blockchain-based IoT systems that provides data security in two ways. Firstly, a lightweight time-based identification protocol that uses hub identification for validating data. Secondly, data storage is augmented with an effective blockchain application for providing easy access and immutability for data sharing among multiple parties. Our initial prototype implementation shows that: our identity management approach can be implemented in large scale settings, our system can be effectively implemented in blockchain platforms, and our performance evaluation result shows that the prototype fulfills system requirements adequately.

The Jiangmen Underground Neutrino Observatory (JUNO) will build the world's largest liquid scintillator detector to study neutrinos from various sources. The 20 kilo tonne (kton) liquid scintillator will be stored in a 0.6 kton acrylic sphere with 35.4 m diameter due to the good light transparency, chemical compatibility and low radioactivity of acrylic. The concentration of U/Th in acrylic is required to be less than 1 ppt (10(-12) g/g) to achieve a low radioactive background in the fiducial volume of the JUNO detector. The mass production of acrylic has started, and the quality control requires a fast and reliable radioassay on U/Th in acrylic. We have developed a practical method of measuring U/Th in acrylic to sub-ppt level using the Inductively Coupled Plasma Mass Spectrometer (ICP-MS). The U/Th in acrylic can be concentrated by vaporizing acrylic in a class 100 environment, and the residue will be collected and sent to ICP-MS for measuring U/Th. All the other chemical operation is done in a class 100 clean room, and the ICP-MS measurement is done in a class 1000 clean room. The recovery efficiency is studied by adding the natural nonexistent nuclei Th-229 and U-233 as the tracers. The resulting method detection limit with 99% confidence can reach 0.04/0.09 ppt U-238/Th-232 in acrylic with (77.5 +/- 3.4)% and (73.6 +/- 4.1)% recovery efficiency. This equipment and method can not only be used for the quality control of JUNO acrylic, but also be further optimized for the radioassay on other materials with extremely low radioactivity, such as ultra-pure water and liquid scintillator.

Trust models play an important role in Internet of Things (IoT) as it provides a means of finding whether a given device can provide a service to a satisfactory level as well as a means for identifying potentially malicious devices in the network. Context awareness in trust models allows a trustor to filter and aggregate evidence by their relevance to the current situation. Context awareness is important in the formulation of trust in IoT networks due to their heterogeneity and due to the dynamic changes in the capabilities of IoT devices. In this paper,we have proposed a new type of context-based attack on context aware trust models for IoT systems. An adversary is able to manipulate the context and impact a target group of IoT devices, while other devices in non-targeted groups are not even aware of the attack. We have demonstrated the effectiveness of this new type of attack on six previously proposed trust models. Through practical simulations and theoretical proofs, we show that the adversaries can launch such context-based attacks against a targeted group of IoT devices in the network. The paper also proposes a new trust management system that can mitigate such context-based attacks.

Internet of Things (IoT) comprises of networked computing devices that can sense and even actuate. It has been widely used in many applications such as smart cities, smart factories, supply chains, smart grid, and precision health. One of the key challenges in practice is to find a suitable lightweight authentication protocol with concerns of security, performance, compatibility, and usability for resource-constrained IoT devices. Due to the lack of security standards for such IoT devices, it is challenging to choose a suitable authentication protocol in practice. For example, many lightweight authentication protocols provide theoretical security analyses, but practical feasibility is not discussed. The integration between a new protocol and the existing standards is non-trivial. It is hence important to develop a novel paradigm for comparing and selecting lightweight authentication protocols considering both theoretical and practical factors. In this paper, we first show the importance and challenges of finding suitable lightweight authentication protocols. Then, we demonstrate how such a paradigm can be built with DTLS, describing a methodology of selecting a protocol and integrating with industry-standard libraries. In our demonstration, the protocol implementation is conducted not only on resource-constrained devices but also based on OpenSSL libraries. The result shows the feasibility, though with difficulties, to integrate a strong security protocol with the existing standards.

Machine learning is becoming increasingly popular in modern technology and has been adopted in various application areas. However, researchers have demonstrated that machine learning models are vulnerable to adversarial examples in their inputs, which has given rise to a field of research known as adversarial machine learning. Potential adversarial attacks include methods of poisoning datasets by perturbing input samples to mislead machine learning models into producing undesirable results. While such perturbations are often subtle and imperceptible from the perspective of a human, they can greatly affect the performance of machine learning models. This paper presents two methods of verifying the visual fidelity of image-based datasets by using QR codes to detect perturbations in the data. In the first method, a verification string is stored for each image in a dataset. These verification strings can be used to determine whether or not an image in the dataset has been perturbed. In the second method, only a single verification string is stored and can be used to verify whether an entire dataset is intact.