High-Confidence Computing最新文献

Smart grid enhances the intelligence of the traditional power grid, which allows sharing varied data such as consumer, production, or energy with service consumers. Due to the untrustworthy networks, there exist potential security threats (e.g., unauthorized access and modification, malicious data theft) hindering the development of smart grid. While several access control schemes have been proposed for smart grid to achieve sensitive data protection and fine-grained identity management, most of them cannot satisfy the requirements of decentralizing smart grid environment and suffer from key escrow problems. In addition, some existing solutions cannot achieve dynamic user management for lacking the privilege revocation mechanism. In this paper, we propose a decentralizing access control system with user revocation to relieve the above problems. We design a new multiple-authority attribute-based encryption (MABE) scheme to keep data confidentiality and adapt decentralizing smart grid applications. We also compare our proposal with the similar solution from both security and performance. The comparing results show that our access control system can achieve a trade-off among confidentiality, authentication, distribution and efficiency in smart grid.

In the past few years, graphics processing units (GPUs) have become an indispensable part of modern computer systems, not only for graphics rendering but also for intensive parallel computing. Given that many tasks running on GPUs contain sensitive information, security concerns have been raised, especially about potential GPU information leakage. Previous works have shown such concerns by showing that attackers can use GPU memory allocations or performance counters to measure victim side effects. However, such an attack has a critical drawback that it requires a victim to install desktop applications or mobile apps yielding it uneasy to be deployed in the real world. In this paper, we solve this drawback by proposing a novel GPU-based side-channel Geo-Privacy inference attack on the WebGL framework, namely, GLINT (stands for Geo-Location Inference Attack). GLINT merely utilizes a lightweight browser extension to measure the time elapsed to render a sequence of frames on well-known map websites, e.g., Google Maps, or Baidu Maps. The measured stream of time series is then employed to infer geologically privacy-sensitive information, such as a search on a specific location. Upon retrieving the stream, we propose a novel online segmentation algorithm for streaming data to determine the start and end points of privacy-sensitive time series. We then combine the DTW algorithm and KNN algorithm on these series to conclude the final inference on a user’s geo-location privacy.

We conducted real-world experiments to testify our attack. The experiments show that GeoInfer can correctly infer more than 83% of user searches regardless of the locations and map websites, meaning that our Geo-Privacy inference attack is accurate, practical, and robust. To counter this attack, we implemented a defense strategy based on Differential Privacy to hinder obtaining accurate rendering data. We found that this defense mechanism managed to reduce the average accuracy of the attack model by more than 70%, indicating that the attack was no longer effective. We have fully implemented GLINT and open-sourced it for future follow-up research.

With the development of Internet technology, secure storage and secure sharing of data have become increasingly important. Traditional data sharing schemes exist a series of problems including lack of security and low efficiency. In this paper, we construct a secure and efficient data sharing scheme based on threshold Paillier algorithm and blockchain technology, which achieves secure data storage and sharing without a third-party institution. Firstly, we propose a $(t,l)$ threshold Paillier blockchain data sharing scheme, which effectively prevents decryption failures caused by the loss of a single node’s private key. Secondly, we propose a combined on-chain and off-chain data storage scheme, we store the ciphertext on the cloud server and the ciphertext hash value on the blockchain, which not only ensures the integrity of the data but also solves the storage limitation problem on the blockchain. Finally, we use the simulation paradigm to prove the security of the scheme in the semi-honest model. The discussion results of the comparison and the analysis of performance show that the blockchain data security sharing scheme proposed in this paper has lower computational overhead and higher security than other similar schemes.

Compressed sensing (CS) has been successfully applied to realize image reconstruction. Neural networks have been introduced to the CS of images to exploit the prior known support information, which can improve the reconstruction quality. Capsule Network (Caps Net) is the latest achievement in neural networks, and can well represent the instantiation parameters of a specific type of entity or part of an object. This study aims to propose a Caps Net with a novel dynamic routing to embed the information within the CS framework. The output of the network represents the probability that the index of the nonzero entry exists on the support of the signal of interest. To lead the dynamic routing to the most likely index, a group of prediction vectors is designed determined by the information. Furthermore, the results of experiments on imaging signals are taken for a comparation of the performances among different algorithms. It is concluded that the proposed capsule network (Caps Net) creates higher reconstruction quality at nearly the same time with traditional Caps Net.

KNN set similarity search is a foundational operation in various realistic applications in cloud computing. However, for security consideration, sensitive data will always be encrypted before uploading to the cloud servers, which makes the search processing a challenging task. In this paper, we focus on the problem of KNN set similarity search over the encrypted datasets. We use Yao’s garbled circuits and secret sharing as underlying tools. To achieve better querying efficiency, we construct a secure R-Tree index structure based on a novel secure grouping protocol, which enables grouping appropriate private values in an oblivious way. Along with several elaborately designed secure arithmetic subroutines, we propose an efficient secure and verifiable KNN set similarity search framework over outsourced clouds. Theoretically, we analyze the complexity of our schemes in detail, and prove the security in the presence of semi-honest adversaries. Finally, we evaluate the performance and feasibility of our proposed methods by extensive experiments.

Spatial information network is a kind of satellite network with high speed node movement and fast dynamic topology change. With the increasing number of low-orbit satellites, the research on the subnets topology and dynamic optimization of space information networks has become an important direction to study the destructibility of spatial information network. In this paper, two common objective functions in inter-satellite link assignment, network observation position and network communication factor are studied, and a multi-objective optimization model is constructed. Depth first search, simulated annealing, NSGA-II and adaptive optimization simulated annealing were used to analyze and solve the model. By comparing the solving efficiency of the model through simulation experiments, the difference of the results caused by the four algorithms is verified.

In vehicular ad hoc networks (VANET), the cross-domain identity authentication of users is very important for the development of VANET due to the large cross-domain mobility of vehicle users. The Public Key Infrastructure (PKI) system is often used to solve the identity authentication and security trust problems faced by VANET. However, the PKI system has challenges such as too centralized Authority of Certification Authority (CA), frequent cross-domain access to certificate interactions and high authentication volume, leading to high certificate management costs, complex cross-domain authentication paths, easy privacy leakage, and overburdened networks. To address these problems, this paper proposes a lightweight blockchain-based PKI identity management and authentication architecture that uses smart contracts to reduce the heavy burden caused by CAs directly managing the life cycle of digital certificates. On this basis, a trust chain based on smart contracts is designed to replace the traditional CA trust chain to meet the general cross-domain requirements, to effectively avoid the communication pressure caused by a mass of certificate transmissions. For the cross-domain scenario with higher privacy and security requirements the identity attribute authentication service is provided directly while protecting privacy by using the Merkle tree to anchor identity attribute data on and off the blockchain chain. Finally, the proposed scheme was comprehensively analyzed in terms of cost, time consumption and security.

The Multi-receiver Encryption (MRE) scheme can meet the secure data transmission requirements in multicast and broadcast scenarios. To meet compliance, critical information infrastructure in China should be protected with Chinese national commercial cryptographic algorithms. Designing an MRE scheme based on Elliptic Curve Cryptography (ECC) is one of the current design methods with better flexibility and performance. However, the research on MRE schemes based on SM2 elliptic curve public-key cryptography is still in a blank state. This paper proposes a Certificateless SM2-based Multi-receiver Encryption (CL-SM2-MRE) scheme. We prove the security of the CL-SM2-MRE scheme under the Random Oracle Model (ROM) and analyze the performance.

Speech recognition (SR) systems based on deep neural networks are increasingly widespread in smart devices. However, they are vulnerable to human-imperceptible adversarial attacks, which cause the SR to generate incorrect or targeted adversarial commands. Meanwhile, audio adversarial attacks are particularly susceptible to various factors, e.g., ambient noise, after applying them to a real-world attack. To circumvent this issue, we develop a universal adversarial perturbation (UAP) generation method to construct robust real-world UAP by integrating ambient noise into the generation process. The proposed UAP can work well in the case of input-agnostic and independent sources. We validate the effectiveness of our method on two different SRs in different real-world scenarios and parameters, the results demonstrate that our method yields state-of-the-art performance, i.e. given any audio waveform, the word error rate can be up to 80%. Extensive experiments investigate the impact of different parameters (e.g, signal-to-noise ratio, distance, and attack angle) on the attack success rate.

Tor onion services provide anonymous service to clients using the Tor browser without disclosing the real address of the server. But an adversary could use a circuit fingerprinting attack to classify circuit types and discovers the network address of the onion service. Recently, Tor has used padding defenses to inject dummy cells to protect against circuit fingerprinting attacks. But we found that circuits still expose much information to the adversary. In this paper, we present a novel circuit fingerprinting attack, which divides the circuit into the circuit generated by the client and the circuit generated by the onion service. To get a more effective attack, we tried three state-of-the-art classification models called SVM, Random Forest and XGBoost, respectively. As the best performance, we attain 99.99% precision and 99.99% recall when using Random Forest and XGBoost classification models, respectively. And we also tried to classify circuit types using our features and the classification model mentioned above, which was first proposed by Kwon. The best performance was achieved with 99.99% precision and 99.99% recall when using the random forest classifier in circuit type classification. The experimental results show that we achieved highly accurate circuit fingerprinting attacks even when application-layer traffic is identical and some type of circuits using the defenses provided by Tor.