Collusion Attacks Research Articles

Enabling Efficient Deduplication and Secure Decentralized Public Auditing for Cloud Storage: A Redactable Blockchain Approach

Public auditing and data deduplication are integral considerations in providing efficient and secure cloud storage services. Nevertheless, the traditional data deduplication models that support public auditing can endure the enormous waste of storage and computation resources induced through data redundancy and repeated audit work by multiple tenants on trusted third-party auditor (TPA). In this work, we introduce blockchain-based secure decentralized public auditing in a decentralized cloud storage with an efficient deduplication model. We employ blockchain to take on the task of centralized TPA, which also mitigates the implications of malicious blockchain miners by using the concept of a decentralized autonomous organization (DAO). Specifically, we employ the idea of redactability for blockchain to handle often neglected security issues that would adversely affect the integrity of stored auditing records on blockchain in decentralized auditing models. However, the proposed model also employs an efficient deduplication scheme to attain adequate storage savings while preserving the users from data loss due to duplicate faking attacks. Moreover, the detailed concrete security analysis demonstrates the computational infeasibility of the proposed model against proof-of-ownership, duplicate faking attack (DFA), collusion attack, storage free-riding attack, data privacy, and forgery attack with high efficiency. Finally, the comprehensive performance analysis shows the scalability and feasibility of the proposed model.

Blockchain-based decentralized supply chain system with secure information sharing

Supply chain management (SCM) has become an important way for the companies to improve the production efficiency and reduce the management cost. However, the existing SCM system is usually built and performed with the semi-trusted certificate authority, which may be susceptible to the collusion attack and tampering attack launched by the malicious certificate authority, resulting in illegal modification of product provenance record. Moreover, the lack of transparent and mutual trust among the stakeholders in the SCM system remains a great challenging issue. In this paper, we propose a blockchain-based decentralized supply chain system with secure information sharing, which can ensure the security of product provenance record without relying on any fully trusted intermediary. In our system, two validation mechanisms, i.e., one-way validation mechanism and transaction-based validation mechanism are built to help the stakeholders to perform the validation of product provenance record without accessing their original content. Furthermore, the blockchain-based smart contract is used to achieve secure registration, proper authentication and fair payment for all stakeholders, where the valid stakeholders can pay for the purchased products, automatically and reliably. Security analysis and performance evaluation demonstrate that our proposed scheme is secure, feasible and efficient with a limited and reasonable computation cost.

IPAPS: An improved public auditing protocol for secure data storage in cloud‐based medical storage system

AbstractCloud‐based medical storage system is becoming popular. Cloud server is curious about the private information of stored cases, and the integrity of outsourced data has become increasingly concerned. Numerous public auditing protocols for the outsourced data into the cloud server were proposed. Unfortunately, in the existing protocols, some of them may neglect security to improve efficiency. Recently, Li et al. proposed an efficient privacy‐preserving public auditing protocol for cloud‐based medical storage system (EPPAP), which improved the communication efficiency by storing some of data owner's data in third part auditors, however we find that the protocol is vulnerable to collusion attack and replace attack. In this paper, we analyze the security attacks of the existing protocol, and further propose an improved public auditing protocol for secure data storage in cloud‐based medical storage system (IPAPS). In addition, we give the formal security proof and analyze the performance of our proposed protocol. The security proof shows our protocol takes into account integrity, collusion attack and replace attack at the same time. The simulation experiments in our performance analysis show that the proposed protocol is practical.

ReIPS: A Secure Cloud-Based Reputation Evaluation System for IoT-Enabled Pumped Storage Power Stations.

Reputation evaluation is an effective measure for maintaining secure Internet of Things (IoT) ecosystems, but there are still several challenges when applied in IoT-enabled pumped storage power stations (PSPSs), such as the limited resources of intelligent inspection devices and the threat of single-point and collusion attacks. To address these challenges, in this paper we present ReIPS, a secure cloud-based reputation evaluation system designed to manage intelligent inspection devices' reputations in IoT-enabled PSPSs. Our ReIPS incorporates a resource-rich cloud platform to collect various reputation evaluation indexes and perform complex evaluation operations. To resist single-point attacks, we present a novel reputation evaluation model that combines backpropagation neural networks (BPNNs) with a point reputation-weighted directed network model (PR-WDNM). The BPNNs objectively evaluate device point reputations, which are further integrated into PR-WDNM to detect malicious devices and obtain corrective global reputations. To resist collusion attacks, we introduce a knowledge graph-based collusion device identification method that calculates behavioral and semantic similarities to accurately identify collusion devices. Simulation results show that our ReIPS outperforms existing systems regarding reputation evaluation performance, particularly in single-point and collusion attack scenarios.

Efficient Attribute-Based Signature With Collusion Resistance for Internet of Vehicles

Internet of Vehicles (IoV) realizes information interaction between vehicles and all networked entities, and the heterogeneous, openness, and diversity make it suffer from various security challenges such as authentication and access control problems. Attribute-based signature (ABS) is a promising cryptographic tool for addressing the above concerns, however, some existing ABS schemes take heavy computation overheads for signature verification. Though some server-aided ABS schemes are proposed to enhance performance, those schemes suffer from devastating collusion attacks. In addition, current signature-policy ABS schemes only support the single threshold access policy, which fails to meet various access control requirements of IoV. To address the above problems, we propose an efficient server-aided ABS with collusion resistance (SAABS-CR) for IoV. It utilizes server-aided computation technology to mitigate the computation burden of verifiers, while resisting perfectly the collusion attacks that include between signers and between the signer and the aided server. Moreover, SAABS-CR supports flexible expressions of access policy under the signature-policy framework by using the linear secret-sharing scheme (LSSS), and it is proved to be secure in the security model of strong unforgeability against chosen-message attacks (SU-CMA). Theoretical analyses and experimental evaluations show that SAABS-CR improves efficiency by reducing the time cost of signature generation at least 34.8% and user verification at least 15%.

Multiauthority Attribute-Based Encryption for Assuring Data Deletion

In order to alleviate key escrow issue, the notion of multiauthority attribute-based encryption (MA-ABE) was presented, which was widely applied in cloud storage environment. In data sharing environment, secure data deletion is very crucial and challenging issue. Hence, in this article, we concentrate on verification of data deletion operation, i.e., assuring data deletion. To solve this problem, we put forward a system model, formal definition and security model of MA-ABE for assuring data deletion. Furthermore, we design a MA-ABE scheme for assuring data deletion, which is more practicable than the single authority ABE scheme. The designed scheme not only overcomes key escrow issue, but also resists collusion attack between malicious user and unauthorized user. In addition, our scheme utilizes merkle hash tree to obtain verifiable data deletion. Based on decisional bilinear Diffie-Hellman (DBDH) assumption, the scheme is proven to be secure under the selective-policy model. The experimental result indicates that the designed scheme is efficient for practical application.

HCSC: A Hierarchical Certificate Service Chain Based on Reputation for VANETs

In vehicular ad hoc networks (VANETs), there are many resource constrained communication nodes, distributed geographical locations, and low delay requirements. The authentication system is required to be distributed. However, the information interaction between traditional distributed authentication entities (AEs) is not transparent, and the use of blockchain is only to save certificate status records on the chain. There is a lack of trusted security management mechanisms between AEs, so there is a risk of collusion attacks and behavior record forgery and tamper attacks between AEs. Therefore, this paper mainly addresses the management problems of opaque interaction and insufficient security verification of distributed authentication entities in the VANETs scenario. In this paper, based on the security features of blockchain technology, such as public audit and tamper proof block structure, and distributed trust consensus, we propose a hierarchical and trust certificate service chain based on reputation value called HCSC. We have a set of safe and reliable management mechanisms between distributed authentication entities such as the Bitcoin system. First, we integrate the traditional hierarchical authentication system and the blockchain network into a new hierarchical certificate service chain. Then, we propose a reputation evaluation model based on the logistic regression model by quantifying the behavior records of the AEs. In addition, a new hierarchical reputation consensus based on delegated proof of stake (DPoS) and proof of work (PoW) is given. Then, a fast verification based on block height and security verification for the efficiency and security of certificate verification is proposed. Finally, the security analysis is given, and a prototype implementation of HCSC is developed based on Fabric. The experimental simulation and security analysis reveal that the HCSC is very efficient and suitable for the above issues.

Trusted fingerprint localization for multimedia devices based on blockchain

The localization process is necessary for intelligent multimedia systems to provide appropriate service, but it is still a significant challenge to provide localization services for devices without active localization ability. The vulnerability of existing localization frameworks is that the incredibility of the information provided can not be verified. This remains the localization process vulnerable to forgery attacks, which can cause false localization results and impact the performance of intelligent multimedia systems. To address this problem, a blockchain-based fingerprint localization scheme is proposed and evaluated in this article. Firstly, A real-time database of verified and temper-proof electromagnetic fingerprints is established by collecting the information from contributors through blockchain. Secondly, a distributed algorithm is designed to obtain a trusted localization based on shared electromagnetic fingerprint information. Lastly, to save on-chain computing resources and defend against spoofing attacks and collusion attacks, an on-chain/off-chain scheme is proposed. The simulations show the practicability and robustness of the proposed scheme. The results are analyzed based on localization accuracy and resistance to malicious activities. It is shown that devices can be located without increasing location errors in malicious environments where 20% of data is uploaded by malicious nodes, and the localization results become more accurate as the decentralized database spontaneously established is expanded.

A Kind of (t, n) Threshold Quantum Secret Sharing with Identity Authentication.

Quantum secret sharing (QSS) is an important branch of quantum cryptography. Identity authentication is a significant means to achieve information protection, which can effectively confirm the identity information of both communication parties. Due to the importance of information security, more and more communications require identity authentication. We propose a d-level (t,n) threshold QSS scheme in which both sides of the communication use mutually unbiased bases for mutual identity authentication. In the secret recovery phase, the sharing of secrets that only the participant holds will not be disclosed or transmitted. Therefore, external eavesdroppers will not get any information about secrets at this phase. This protocol is more secure, effective, and practical. Security analysis shows that this scheme can effectively resist intercept-resend attacks, entangle-measure attacks, collusion attacks, and forgery attacks.

PPVerifier: A Privacy-Preserving and Verifiable Federated Learning Method in Cloud-Edge Collaborative Computing Environment

Federated Learning is a distributed machine learning framework, which mainly adopts cloud-edge collaborative computing mode and supports multiple participants to train models without directly sharing local data. However, participants’ sensitive information may still be leaked through their gradients. Besides, incorrect aggregated results returned by the aggregation server may reduce the effect of joint modeling. This paper proposes a privacy-preserving and verifiable federated learning method called PPVerifier to support privacy protection and verification of aggregated results in cloud-edge collaborative computing environment. By integrating Paillier homomorphic encryption and random number generation technique, all gradients and their ciphertexts can be protected. Meanwhile, an additive secret sharing scheme is introduced to resist potential collusion attacks among the aggregation server, malicious participants, and edge nodes. Moreover, a verification scheme based on discrete logarithm is proposed, which can not only verify the correctness of aggregated results, but also discover lazy aggregation servers, and the verification overhead can be reduced by over half compared with bilinear aggregate signature method. Finally, theoretical analysis and experiments conducted on MNIST dataset prove that our proposed method can achieve gradient protection and correctness verification of the aggregated results with higher efficiency.

VANET Secure Reputation Evaluation & Management Model Based on Double Layer Blockchain

Vehicle ad-hoc network (VANET) is interconnected through message forwarding and exchanging among vehicle nodes. Due to its highly dynamic topology and its wireless and heterogeneous communication mode, VANET is more vulnerable to security threats from multiple parties. Compared to entity-based security authentication, it is essential to consider how to protect the security of the data itself. Existing studies have evaluated the reliability of interactive data through reputation quantification, but there are still some issues in the design of secure reputation management schemes, such as its low efficiency, poor security, and unreliable management. Aiming at the above-mentioned issues, in this paper we propose an effective VANET model with a secure reputation based on a blockchain, and it is called the double-layer blockchain-based reputation evaluation & management model (DBREMM). In the DBREMM, we design a reputation management model based on two parallel blockchains that work collaboratively, and these are called the event chain and reputation chain. A complete set of reputation evaluation schemes is presented. Our schemes can reduce observation errors and improve evaluation reliability during trust computation by using direct trust calculation based on the multi-factor Bayesian inference. Additionally, we propose an indirect trust calculation based on the historical accumulated reputation value with an attenuation factor, and a secure a reputation fusion scheme based on the number threshold with the fluctuation factor, which can reduce the possibility of attacks, such as collusive attacks and false information injection. Theoretical analysis and extensive simulation experiments reflect the DBREMM’s security algorithm effectiveness, accuracy, and ability to resist several attacks.

Correction to: A Tree-type Multiparty Quantum Key Agreement Protocol Against Collusive Attacks

Correction to: A Tree-type Multiparty Quantum Key Agreement Protocol Against Collusive Attacks

A certificateless multi-dimensional data aggregation scheme for smart grid

In the context of the smart grid, the use of smart meters to regularly collect electricity data from customers poses a significant risk of privacy disclosure. Furthermore, traditional data aggregation schemes assume a fully trusted authority, neglecting the possibility of malicious trusted third parties and collusive attacks from control centers and gateways, which raises privacy invasion concerns for users. To address this issue, this article proposes a multi-dimensional data aggregation scheme based on certificateless public key cryptography for smart grid, which utilizes Paillier homomorphic encryption system in a fog computing-based architecture and implements authentication and key negotiation among member users. This scheme is designed to resist collusive attacks from control centers (CC) and fog nodes (FNs), while also protecting users’ privacy even in the face of a malicious key generation center (KGC). Detailed security analysis demonstrates that the proposed scheme meets the security requirements of the smart grid. Additionally, Performance analysis shows that the proposed scheme can effectively reduce the computational overhead of both smart meters and aggregators compared to existing multidimensional data aggregation schemes.

PASPORT: A Secure and Private Location Proof Generation and Verification Framework

Abstract: Recently, there has been a rapid growth in locationbased systems and applications in which users submit their location information to service providers in order to gain access to a service, resource, or reward. We have seen that in these applications, dishonest users have an incentive to cheat on their location. Unfortunately, no effective protection mechanism has been adopted by service providers against these fake location submissions. This is a critical issue that causes severe consequences for these applications. Motivated by this, we propose the Privacy-Aware and Secure Proof Of pRoximiTy (PASPORT) scheme in this article to address the problem. Using PASPORT, users submit a location proof (LP) to service providers to prove that their submitted location is true. PASPORT has a decentralized architecture designed for ad hoc scenarios in which mobile users can act as witnesses and generate LPs for each other. It provides user privacy protection as well as security properties, such as unforgeability and non transferability of LPs. Furthermore, the PASPORT scheme is resilient to prover–prover collusions and significantly reduces the success probability of Prover–Witness collusion attacks. To further make the proximity checking process private, we propose P-TREAD, a privacy-aware distance bounding protocol and integrate it into PASPORT. To validate our model, we implement a prototype of the proposed scheme on the Android platform. Extensive experiments indicate that the proposed method can efficiently protect location-based applications against fake submissions

An anti-collusion attack defense method for physical layer key generation scheme based on transmission delay.

Physical layer security (PLS) is considered one of the most promising solutions to solve the security problems of massive Internet of Things (IoTs) devices because of its lightweight and high efficiency. Significantly, the recent physical layer key generation (PLKG) scheme based on transmission delay proposed by Huang et al. (2021) does not have any restrictions on communication methods and can extend the traditional physical layer security based on wireless channels to the whole Internet scene. However, the secret-sharing strategy adopted in this scheme has hidden dangers of collusion attack, which may lead to security problems such as information tampering and privacy disclosure. By establishing a probability model, this article quantitatively analyzes the relationship between the number of malicious collusion nodes and the probability of key exposure, which proves the existence of this security problem. In order to solve the problem of collusion attack in Huang et al.'s scheme, this article proposes an anti-collusion attack defense method, which minimizes the influence of collusion attack on key security by optimizing parameters including the number of the middle forwarding nodes, the random forwarding times, the time delay measurement times and the out-of-control rate of forwarding nodes. Finally, based on the game model, we prove that the defense method proposed in this article can reduce the risk of key leakage to zero under the scenario of the "Careless Defender" and "Cautious Defender" respectively.

Formula omitted]-separable codes with length 5

Separable codes can be used to construct fingerprints resistant to the averaging collusion attack on multimedia contents. In this paper, we first show an upper bound on the size of a 2‾-separable code with length 5 by using known results. Then we propose an equivalent condition of such a code. Finally, by using cyclic difference matrices and orthogonal arrays, q-ary 2‾-separable codes of length 5 are constructed for any positive integer q with gcd⁡(q,12)=1.

Attribute-based multi-user collaborative searchable encryption in COVID-19

With the outbreak of COVID-19, the government has been forced to collect a large amount of detailed information about patients in order to effectively curb the epidemic of the disease, including private data of patients. Searchable encryption is an essential technology for ciphertext retrieval in cloud computing environments, and many searchable encryption schemes are based on attributes to control user‘s search permissions to protect their data privacy. The existing attribute-based searchable encryption (ABSE) scheme can only implement the situation where the search permission of one person meets the search policy and does not support users to obtain the search permission through collaboration. In this paper, we proposed a new attribute-based collaborative searchable encryption scheme in multi-user setting (ABCSE-MU), which takes the access tree as the access policy and introduces the translation nodes to implement collaborative search. The cooperation can only be reached on the translation node and the flexibility of search permission is achieved on the premise of data security. ABCSE-MU scheme solves the problem that a single user has insufficient search permissions but still needs to search, making the user’s access policy more flexible. We use random blinding to ensure the confidentiality and security of the secret key, further prove that our scheme is secure under the Decisional Bilinear Diffie–Hellman (DBDH) assumption. Security analysis further shows that the scheme can ensure the confidentiality of data under chosen-keyword attacks and resist collusion attacks.

RASS: Enabling privacy-preserving and authentication in online AI-driven healthcare applications

Powered by the rapid progress of analytics techniques and the increasing availability of healthcare data, artificial intelligence (AI) is bringing a paradigm shift to healthcare applications. AI techniques offer considerable advantages for the evaluation and assimilation of large amounts of complex healthcare data. However, to effectively use AI tools in healthcare, key issues need to be considered and several limitations must be addressed, such as privacy-preserving and authentication of the healthcare data for analysis in training and inference procedures. Although various techniques ranging from cryptographic tools to obfuscation mechanisms have been proposed to provide privacy guarantees for data in AI-based services, none of them is applicable to online AI-driven healthcare applications. For they require a heavy computational cost on protecting privacy without offering authentication services for third parties. In this paper, we present RASS, an efficient privacy-preserving and authentication scheme for securing analyzed data in an AI-driven healthcare system. The security proofs of our construction indicate that its unforgeability and multi-show unlinkability can defend against the tempering and collusion attacks respectively. Finally, we conduct sufficient efficiency analysis, and the results show that RASS achieves the above security demands without introducing complex computation and communication costs.

Reputation based novel trust management framework with enhanced availability for cloud

To select a cloud service provider (CSP) out of immense number of relevant CSPs available, cloud customer (CC) trusts on the reviews provided by the CCs who have used the services provided by CSPs. However, relying on these feedbacks may be hazardous if the review(s) have been deliberately posted with wicked motive. To mitigate the impact of malicious feedbacks, a framework, namely highly available credible cloud trust management framework (HA2CTMF) has been proposed with the intent of revamping the reputation and availability parameters of QoS by evaluating the trust of cloud service providers (CSPs) based on the credibility of feedbacks furnished by CC. HA2CTMF detects collusion and Sybil attacks on the labeled CloudArmor dataset and increases availability of the trust service. Collusion attack has been detected by comparing review count; service count; & mean of reviews with their respective threshold values. Further, Sybil attack has been uncovered with the help of these aspects: deviation from mean of reviews; pattern detection; & comparison of polarity value from both lower & upper threshold values. Additionally, enhanced availability has been ensured by working on disaster management and diminishing repercussions of single point of failure. The results have been accessed on the following parameters: precision; recall; f1-score & availability percentage on the dataset comprising 8774 data points. This framework has exhibited precision of 85.69%, recall of 89.45%, f1-score of 87.53% and availability of 96.71% compared to CloudArmor framework values on the same parameters as: 44.47%; 62.21%; 51.85% & 70.43% respectively. As per the results attained, we conclude that proposed HA2CTMF has demonstrated better outcome.

Secure Blockchain Transactions for Electronic Health Records based on an Improved Attribute-Based Signature Scheme (IASS)

Electronic Health Records (EHRs) are entirely controlled by hospitals, not patients, making it difficult to obtain medical advice from individual hospitals. Patients need to keep tabs on their health details and take back control of their medical data. The rapid development of blockchain technology has facilitated large-scale healthcare, including medical records and patient-related data. The technology provides comprehensive and immutable patient records and free access to electronic medical records for providers and treatment portals. To ensure the validity of the blockchain-connected EHR, the Improved Attribute-Based Signature Scheme (IASS) has considerable powers, allowing patients to approve messages based on attributes but not validated. In addition, it avoids the problem of having multiple authorities without a single or central source of trust for generating and distributing patient public/private keys and fits into the blockchain model for distributed data storage. By sharing a secret, pseudo-random activity seed between authorities, the protocol resists collusive attacks by corrupt officials. The technology provides patients with a comprehensive, immutable record and free access to their EHR from providers and treatment portals. To ensure the validity of blockchain-connected EHRs, propose an attribute-based multi-authority signature scheme that authorizes messages based on their attributes without revealing any information.