Cuckoo Filter Research Articles

An efficient routing protocol based on a fast-lookup cuckoo filter for Internet of things networks

An efficient routing protocol based on a fast-lookup cuckoo filter for Internet of things networks

Efficient Cryptographic Solutions for Unbalanced Private Set Intersection in Mobile Communication

Private Set Intersection (PSI) is a cryptographic method in secure multi-party computation that allows entities to identify common elements in their datasets without revealing their private data. Traditional approaches assume similar-sized datasets and equal computational power, overlooking practical imbalances. In real-world applications, dataset sizes and computational capacities often vary, particularly in the Internet of Things and mobile scenarios where device limitations restrict computational types. Traditional PSI protocols are inefficient here, as computational and communication complexities correlate with the size of larger datasets. Thus, adapting PSI protocols to these imbalances is crucial. This paper explores unbalanced PSI scenarios where one party (the receiver) has a relatively small dataset and limited computational power, while the other party (the sender) has a large amount of data and strong computational capabilities. It introduces three innovative solutions for unbalanced PSI: an unbalanced PSI protocol based on the Cuckoo filter, an unbalanced PSI protocol based on single-cloud assistance, and an unbalanced PSI protocol based on dual-cloud assistance, with each subsequent solution addressing the shortcomings of the previous one. Depending on performance and security needs, different protocols can be employed for applications such as private contact discovery.

Secure and Efficient Multi-keyword Fuzzy Search Over Encrypted Data on Alliance Chain

Background:: Data regulation can effectively resist data privacy leakage and abuse in the process of external sharing of energy big data, but how to securely retrieve vast amounts of regulatory data is a challenge. Objective:: To securely retrieve vast amounts of regulatory data, a secure and efficient searchable encryption scheme that supports multi-keyword fuzzy retrieval on the alliance chain is proposed. Method:: This scheme encrypts and stores the regulatory data on the hyperledger fabric alliance chain. Energy big data files (EBDF) are encrypted and stored on a cloud server. Using the symmetric searchable encryption technology to achieve secure retrieval of regulatory data on the chain and secure access to EBDF. To improve search efficiency, we propose a SDPHashMap index structure and use the special manhatton distance matrix(SMDM) measurement to calculate the similarity of queried keywords and index keywords to locate the trapdoor retrieval hash address. Utilizing the cuckoo filter cluster to test the membership of queried keywords. Results:: This scheme stores EBDF off-chain, effectively relieving the storage and communication pressure of the blockchain, improving search speed, and providing more accurate retrieval services than single keyword fuzzy retrieval. By the simulation-based adversary- challenger game model, the security analysis demonstrates that the proposed scheme has adaptive selected keyword attack semantic security. Conclusion:: Experimental results show that the proposed scheme has high efficiency in trapdoor generation and multi-keyword search stages.

Enhancing Efficiency and Security in Unbalanced PSI-CA Protocols through Cloud Computing and Homomorphic Encryption in Mobile Networks

Private Set Intersection Cardinality (PSI-CA) is a cryptographic method in secure multi-party computation that allows entities to identify the cardinality of the intersection without revealing their private data. Traditional approaches assume similar-sized datasets and equal computational power, overlooking practical imbalances. In real-world applications, dataset sizes and computational capacities often vary, particularly in Internet of Things and mobile scenarios where device limitations restrict computational types. Traditional PSI-CA protocols are inefficient here, as computational and communication complexities correlate with the size of larger datasets. Thus, adapting PSI-CA protocols to these imbalances is crucial. This paper explores unbalanced scenarios where one party (the receiver) has a relatively small dataset and limited computational power, while the other party (the sender) has a large amount of data and strong computational capabilities.This paper, based on the concept of commutative encryption, introduces Cuckoo filter, cloud computing technology, and homomorphic encryption, among other technologies, to construct three novel solutions for unbalanced Private Set Intersection Cardinality (PSI-CA): an unbalanced PSI-CA protocol based on Cuckoo filter, an unbalanced PSI-CA protocol based on single-cloud assistance, and an unbalanced PSI-CA protocol based on dual-cloud assistance. Depending on performance and security requirements, different protocols can be employed for various applications.

AS-T[formula omitted]BP: An efficient assignment scheme for space TT&C tasks with bidirectional privacy-preserving under blockchain architecture

In recent years, the space Tracking Telemetry and Command (TT&C) network has attracted much attention because it can provide users with secure and convenient information services. However, there are still challenges in achieving efficient task assignments and providing privacy-preserving for both TT&C parties in precise space TT&C services. In this paper, we propose an efficient blockchain-based task assignment scheme (AS-T3BP) in space TT&C network. Specifically, we introduce authorized privacy set intersection to ensure bidirectional privacy security for task requesters and performers and integrate an improved cuckoo filter algorithm to achieve batch assignment for tasks. And AS-T3BP allows the executor to customize the access policies of TT&C information flexibly, and only authorized satellites can access the information and verify the assignment results. For tasks that fail to be assigned, we propose a distributed and credible task reassignment method, which publishes the tasks on the blockchain built by the TT&C base station, thereby ensuring the real-time and accuracy of task assignments. Performance analysis shows that AS-T3BP is effective and can minimize misinform rates and reassignment rates of 23.39% and 8.85%, alleviate the problem of inefficient task assignment, and still maintain system stability.

Flexible fingerprint cuckoo filter for information retrieval optimization in distributed network

Flexible fingerprint cuckoo filter for information retrieval optimization in distributed network

CFAuditChain: Audit BlockChain Based On Cuckoo Filter

Abstract Log blockchain can be used to ensure the integrity of log data. However, current methods are facing the problems of throughput mismatch and rough audit granularity. Packaging multiple logs to generate integrity proofs improves throughput but reduces audit granularity, and the auditor can only locate the tampering log packet instead of specific records. This paper proposes CFAuditChain, an audit blockchain based on a cuckoo filter, where the proof of existence (PoE) of the single log is calculated while calculating the integrity proof of packet logs. The PoE is saved in the cuckoo filter and stored using blockchain for immutability. Therefore, the auditor can verify the credibility of each log based on the filter when the integrity proof of a log packet does not match. The theoretical analysis and experimental results show that CFAuditChain provides the granularity of audit logs down to the records level at an acceptable cost.

ASCF: Optimization of the Apriori Algorithm Using Spark-Based Cuckoo Filter Structure

Data mining is the process used for extracting hidden patterns from large databases using a variety of techniques. For example, in supermarkets, we can discover the items that are often purchased together and that are hidden within the data. This helps make better decisions which improve the business outcomes. One of the techniques that are used to discover frequent patterns in large databases is frequent itemset mining (FIM) that is a part of association rule mining (ARM). There are different algorithms for mining frequent itemsets. One of the most common algorithms for this purpose is the Apriori algorithm that deduces association rules between different objects which describe how these objects are related together. It can be used in different application areas like market basket analysis, student’s courses selection process in the E-learning platforms, stock management, and medical applications. Nowadays, there is a great explosion of data that will increase the computational time in the Apriori algorithm. Therefore, there is a necessity to run the data-intensive algorithms in a parallel-distributed environment to achieve a convenient performance. In this paper, optimization of the Apriori algorithm using the Spark-based cuckoo filter structure (ASCF) is introduced. ASCF succeeds in removing the candidate generation step from the Apriori algorithm to reduce computational complexity and avoid costly comparisons. It uses the cuckoo filter structure to prune the transactions by reducing the number of items in each transaction. The proposed algorithm is implemented on the Spark in-memory processing distributed environment to reduce processing time. ASCF offers a great improvement in performance over the other candidate algorithms based on Apriori, where it achieves a time of only 5.8% of the state-of-the-art approach on the retail dataset with a minimum support of 0.75%.

Multi-Client Secure and Efficient DPF-Based Keyword Search for Cloud Storage

In this paper, we propose a multi-client secure and efficient keyword search scheme for cloud storage, which is built upon distributed point function (DPF). Specifically, outsourced keyword indexes are encoded by using garbled bloom filter and cuckoo filter, instead of bloom filter adopted by most of the state-of-the-art DPF-based schemes. In this way, clients can apply cuckoo hashing into DPF and utilize a segmentation method to interact with cloud servers for keyword search, and servers can obliviously aggregate DPF evaluation results to perform the search. Accordingly, the computational complexity at server side can be significantly reduced. Furthermore, the proposed scheme preserves constant downlink overheads, which is more communication-efficient for multi-keyword conjunctive search. To achieve privacy preservation and access control for multiple clients, we propose a double encryption method to encrypt outsourced indexes and correspondingly put forward an authorization algorithm from set-constrained pseudorandom functions by which fine-grained search-authorized keys can be generated, and collusion attacks among clients are addressed by integrating Wegman-Carter message authentication codes and cover-free systems. Since our scheme is designed under both semi-honest and malicious models (i.e., malicious servers may return incorrect query results), we use a simulation-based proof to formally demonstrate its security properties. Finally, we develop a proof-of-concept prototype and perform extensive experiments to show our scheme's practicality and efficiency in terms of computation, communication, and storage overheads.

CHAT: Accurate Network Latency Measurement for 5G E2E Networks

As numerous latency-sensitive applications have emerged with the popularization of 5G networking, accurate and rapid end-to-end latency measurement has come to play an essential role in network fault diagnosis and optimization. Although the Bloom hash-based timestamp aggregation method has been reported to be scalable and efficient, two shortcomings that reduce its accuracy have yet to be fully considered: frequent hash collisions and its fixed measurement interval. To address these challenges, we construct an end-to-end network latency measurement framework named Cuckoo Hash Adjustive Table exchange (CHAT). By employing an improved cuckoo filter, we decrease the number of hash collisions to assess the latency more accurately. Moreover, CHAT adjusts the receiver-side measurement interval dynamically based on a gain indicator, maximizing the total number of valid packets used for latency estimation. Additionally, the proposed measurement framework minimizes the number of packets transferred over links to avoid interfering with the end-to-end latency measurement in an actual network. Finally, extensive experiments on simulations and a practical real-world environment show the effectiveness and applicability of CHAT.

Finding recently persistent flows in high-speed packet streams based on cuckoo filter

In high-speed networks, flow-level traffic measurement is an essential tool to understand how network bandwidth is consumed and support the detection of anomalous traffic. While many prior work focuses on tracking the frequent flows (a.k.a. heavy hitters), in this paper, we put more focus on tracking the persistent flows, which jointly consider the frequency, duration and regularity of the packet arrival events of a flow. Although this more generalized metric called persistence has been defined before, it is still unknown how to use limited memory on data plane to monitor the top-k persistent flows in a recent time interval. In this paper, we propose an algorithm named PFD-DW built upon cuckoo filter (an improved version of hash table with better memory efficiency), to monitor the top-k persistent flows under the time-decaying window. It can be regarded as a variant of cuckoo filter, which transforms each bucket into a bucket-level min-heap. Its advantage is that, when the table is full and a packet of a new flow arrives, it can select the least persistent flow along the cuckoo kicking path as the victim of flow replacement. We deliberately avoid the scanning of the entire table to keep the high time efficiency. Based on real-world network traffic traces, we evaluate the performance of our DAKP-CF, a degraded version of PFD-DW that only considers each flow’s packet arrival frequency. The results show that it outperforms the existing algorithms for the top-k frequent flow identification task. It provides nearly 98% identification accuracy with roughly 50% less memory cost. We also evaluate our PFD-DW algorithm for the more generalized task of identifying the recently persistent flows. It provides 93% identification rate of top-3000 persistent flows using only 576KB memory, while attaining 1.5% persistence estimation error. Its memory cost is reduced by 97% than another proposed solution PFD-SW under sliding time window. We have also developed a prototype of PFD-DW, based on the Fd.io VPP software switch accelerated by Intel DPDK.

DINNRS: A Distributed In-Network Name Resolution System for information-centric networks

Information-Centric Networking (ICN) is a promising network paradigm designed to address the challenges arising from the inherent ambiguity of IP addresses. ICN prioritizes the content itself as the main factor in network transmission. The Name Resolution System (NRS) is the primary component of the ICN architecture, relying on flat naming. Unfortunately, existing NRS frequently encounters scalability and performance issues. In this paper, we present the Distributed In-Network Name Resolution System (DINNRS), an NRS that leverages the software-defined networking and ICN paradigm. DINNRS offers global-scale name-based routing with high scalability and minimal request delay. Additionally, we propose a modular control domain architecture for easy implementation and an enhanced marked cuckoo filter for fast resolving. Simulation experiments using the ICN emulator demonstrate that our methods result in significant performance gains, with a 61.2% reduction in data acquire latency and a 55.2% lower link load control overhead compared to MDHT.

Edge-Cloud-Assisted Certificate Revocation Checking: An Efficient Solution Against Irresponsible Service Providers

Certificate revocation checking (CRC) is a fundamental requirement in certificate-based public-key cryptographic systems. Most existing CRC schemes are not tailored for edgecloud computing systems, and directly applying these schemes would cause security and efficiency problems. In this paper, we first propose a two-layer edge-cloud-assisted CRC framework, dubbed ECA-CRC, where edge nodes utilizing a probabilistic checking algorithm serve as a first layer, and the cloud server utilizing a deterministic checking algorithm serves as a second layer. Both the edge nodes and the cloud server collaboratively provide verifiable CRC services for devices. The most prominent manifestations of ECA-CRC are that (1) most CRC requests can be processed with the probabilistic checking layer, which reduces the checking delay significantly while providing an accurate CRC service; (2) devices can detect the irresponsible behavior of the service provider, including using an incorrect revoked certificate set (RCS) to compute checking results or procrastinating on updating the RCS, as soon as possible.We then propose an efficient instantiation of ECA-CRC, dubbed eECACRC, by utilizing a Merkle hash tree (MHT) based homomorphic signature, Cuckoo filter, and Othello. We formally prove the security of eECA-CRC against the irresponsible service provider under the random oracle model. We implement an eECA-CRC prototype and conduct a comprehensive performance evaluation based on a public certificate database. Our results show that 95% of CRC requests are completed on the edge nodes, and only 5% of CRC requests need to be handled by the cloud server.

LPPA-RCM: A lightweight privacy-preserving authentication scheme for road condition monitoring in fog-based VANETs

In vehicular ad-hoc networks (VANETs), vehicles can upload current road conditions to a traffic management agency (TMA) to improve traffic condition. However, road conditions submitted by different vehicles may be identical, which brings an extra workload on TMA. Filtering redundant road conditions is a possible solution, but road conditions are usually encrypted. It is time-consuming to filter ciphertext. This paper proposes a lightweight privacy-preserving authentication scheme for road condition monitoring (LPPA-RCM), which adopts a lightweight equality test method on ciphertexts. This method uses Lagrange interpolation to filter redundant road conditions. In addition, there is only one Lookup operation of the Cuckoo filter to determine redundant road condition, which is more efficient than comparing all stored messages one by one. Finally, security analysis demonstrates that LPPA-RCM satisfies the security requirements of VANETs. Besides, performance analysis demonstrates that LPPA-RCM is more efficient.

Analysis of Security Access Control Systems in Fog Computing Environment

Fog computing is a computing environment that can respond to user operational needs in real time. Aiming at the shortcomings of user privacy protection performance and structural performance, a method of completely hiding access structures is proposed under the framework of cloud and mist computing. The cuckoo filter is applied to the fog computing environment, and users are detected through fog nodes. If an attribute is detected to exist in the fully hidden access structure, the mapping function between the attribute and the access structure line number is returned. The research results show that with the increase of the number of attributes, the advantage of attribute confirmation time for fog servers is gradually obvious; The overall delay of fog computing is shorter, the Time To Live (TTL) is longer, the average delay is only 3 ms, and the delay is lower; The completely hidden access structure constructed by the cuckoo algorithm occupies only 1% of the total system steps, which can more effectively achieve user privacy protection without increasing overhead. The proposed scheme greatly reduces the amount of computation while fully protecting user privacy, and meets the needs of users for fast and secure access.

Cuckoo-Store Engine: A Reed–Solomon Code-Based Ledger Storage Optimization Scheme for Blockchain-Enabled IoT

As the distributed ledger technology underlying cryptocurrencies such as Bitcoin and Ethereum, blockchain has empowered various industries, such as supply chain management, healthcare, government services, e-voting, etc. However, the ever-growing ledger on each node has been the main bottleneck for blockchain scalability as the network scale expands, which worsens in blockchain-enabled IoT scenarios with resource-limited devices. With the support of the Reed–Solomon (RS) code, the Cuckoo-Store (CS), a ledger storage optimization engine, is proposed in this paper to dramatically decrease the storage burden on each node by encoding the ledger as data segments with redundancy and distributing them to multiple nodes. These distributed data segments can be collected and decoded using RS code to recover the original ledger. Furthermore, the Cuckoo filter (CF) is used to guarantee the integrity of the encoded segments, which helps detect the forged segments and facilitates the process of ledger recovery. Theoretical analysis and simulation results show that the CS engine can decrease the storage in each node by more than 94%, and the original ledger can be recovered efficiently with acceptable communication overheads.

Dual Cuckoo Filter with a Low False Positive Rate for Deep Packet Inspection

Network traffic control and classification have become increasingly dependent on deep packet inspection (DPI) approaches, which are the most precise techniques for intrusion detection and prevention. However, the increasing traffic volumes and link speed exert considerable pressure on DPI techniques to process packets with high performance in restricted available memory. To overcome this problem, we proposed dual cuckoo filter (DCF) as a data structure based on cuckoo filter (CF). The CF can be extended to the parallel mode called parallel Cuckoo Filter (PCF). The proposed data structure employs an extra hash function to obtain two potential indices of entries. The DCF magnifies the superiority of the CF with no additional memory. Moreover, it can be extended to the parallel mode, resulting in a data structure referred to as parallel Dual Cuckoo filter (PDCF). The implementation results show that using the DCF and PDCF as identification tools in a DPI system results in time improvements of up to 2% and 30% over the CF and PCF, respectively.

A Review of Cuckoo Filters for Privacy Protection and Their Applications

As the global digitalization process continues, information is transformed into data and widely used, while the data are also at risk of serious privacy breaches. The Cuckoo filter is a data structure based on the Cuckoo hash. It encrypts data when it is used and can achieve privacy protection to a certain extent. The Cuckoo filter is an alternative to the Bloom filter, with advantages such as support for deleting elements and efficient space utilization. Cuckoo filters are widely used and developed in the fields of network engineering, storage systems, databases, file systems, distributed systems, etc., because they are often used to solve collection element query problems. In recent years, many variants of the Cuckoo filter have emerged based on ideas such as improving the structure and introducing new technologies in order to accommodate a variety of different scenarios, as well as a huge collection. With the development of the times, the improvement of the structure and operation logic of the Cuckoo filter itself has become an important direction for the research of aggregate element query.

EBF: an enhanced Bloom Filter for intrusion detection in IoT

Intrusion Detection is essential to identify malicious incidents and continuously alert many users of the Internet of Things (IoT). The constant monitoring of events generated from many devices connected to the IoT and the extensive analysis of every event based on predefined security policies consumes enormous resources. Accordingly, performance enhancement is a crucial concern of Intrusion Detection in IoT and other massive Big Data Applications to ensure a secure environment. Like many Big Data Applications, the Intrusion Detection system of the IoT needs to employ the fast membership filter, Bloom Filter, to quickly identify possible attacks. Bloom Filter is an admiringly fast and space-efficient data structure that quickly handles elements of extensive datasets in small memory space. However, the trade-off between the query performance, the number of hash functions, memory space, and false positive probability remains an issue of Bloom Filter. Thus, this article presents an enhanced Bloom Filter (eBF) that remarkably improves memory efficiency and introduces new techniques to accelerate the filtering of malicious URLs. We experimentally show the efficacy of eBF using a real Intrusion Detection dataset. The experimental result shows that the proposed filter is remarkably memory efficient, faster, and more accurate than the state-of-the-art filters. eBF requires 15.6x, 13x, and 8x less memory compared with Standard Bloom Filter, Cuckoo filter, and robustBF, respectively. Therefore, this new system significantly enhances the performance of Intrusion Detection of IoT that concurrently monitors several billion events crosschecking with the defined security policies.

A Multi-Blockchain-Based Cross-Domain Authentication and Authorization Scheme for Energy Internet

The expansion of the scale of the Power Internet of Things stimulated by the development of the Energy Internet makes the growth in demand for the effective authentication and access control technologies in the cross-domain data exchange. Based on the cross-chain technology of the blockchain and the cuckoo filter, this paper proposes a cross-domain authentication scheme for Power Internet of Things. Firstly, a cross-chain authentication architecture is established. Combined with the existing authentication technologies used in intra-domain authentication, a cross-domain authentication process based on the cross-chain technology is proposed to realize the automatic transmission of the authentication credentials from application domain to authentication domain. The cuckoo filter is deployed on the blockchain as smart contracts, and the user certificate fingerprint is inserted into the filter to realize user registration, query, and revocation, which reduces the cost of the user certificate management. Experimental results show the effectiveness and feasibility of our scheme. Based on the proposed authentication scheme, a cross-domain access control scheme based on roles and object classes is presented, by treating the object classes as controlled objects and then applying the role-based access control to the object classes, on the condition that the heterogeneous domains in the Energy Internet have the same kinds of resources.