Malicious Participants Research Articles

Refiner

Modern mobile applications often produce decentralized data, i.e., a huge amount of privacy-sensitive data distributed over a large number of mobile devices. Techniques for learning models from decentralized data must properly handle two natures of such data, namely privacy and massive engagement. Federated learning (FL) is a promising approach for such a learning task since the technique learns models from data without exposing privacy. However, traditional FL methods assume that the participating mobile devices are honest volunteers. This assumption makes traditional FL methods unsuitable for applications where two kinds of participants are engaged: 1) self-interested participants who, without economical stimulus, are reluctant to contribute their computing resources unconditionally, and 2) malicious participants who send corrupt updates to disrupt the learning process. This paper proposes Refiner, a reliable federated learning system for tackling the challenges introduced by massive engagements of self-interested and malicious participants. Refiner is built upon Ethereum, a public blockchain platform. To engage self-interested participants, we introduce an incentive mechanism which rewards each participant in terms of the amount of its training data and the performance of its local updates. To handle malicious participants, we propose an audit scheme which employs a committee of randomly chosen validators for punishing them with no reward and preclude corrupt updates from the global model. The proposed incentive and audit scheme is implemented with cryptocurrency and smart contract, two primitives offered by Ethereum. This paper demonstrates the main features of Refiner by training a digit classification model on the MNIST dataset.

Cryptanalysis and improvement of a semi-quantum private comparison protocol based on Bell states

Semi-quantum private comparison (SQPC) allows two participants with limited quantum ability to securely compare the equality of their secrets with the help of a semi-dishonest third party (TP). Recently, Jiang (Quantum Inf Process 19(6): 180, 2020) proposed a SQPC protocol based on Bell states and claimed it is secure. In this paper, we present two types of attack on Jiang’s SQPC protocol. In the first type of attack, an outside eavesdropper can make participants accept a wrong result. In the second type of attack, a malicious participant not only can make the other participant accept an incorrect result, but also can learn the secret of the honest participant. Neither type of attack is possible to be detected. In addition, we propose an improved SQPC protocol that can resist these two types of attack.

Reliability check via weight similarity in privacy-preserving multi-party machine learning

Multi-party machine learning is a paradigm in which multiple participants collaboratively train a machine learning model to achieve a common learning objective without sharing their privately owned data. The paradigm has recently received a lot of attention from the research community aimed at addressing its associated privacy concerns. In this work, we focus on addressing the concerns of data privacy, model privacy, and data quality associated with privacy-preserving multi-party machine learning, i.e., we present a scheme for privacy-preserving collaborative learning that checks the participants’ data quality while guaranteeing data and model privacy. In particular, we propose a novel metric called weight similarity that is securely computed and used to check whether a participant can be categorized as a reliable participant (holds good quality data) or not. The problems of model and data privacy are tackled by integrating homomorphic encryption in our scheme and uploading encrypted weights, which prevent leakages to the server and malicious participants, respectively. The analytical and experimental evaluations of our scheme demonstrate that it is accurate and ensures data and model privacy.

Secure multiparty quantum key agreement against collusive attacks

Quantum key agreement enables remote participants to fairly establish a secure shared key based on their private inputs. In the circular-type multiparty quantum key agreement mode, two or more malicious participants can collude together to steal private inputs of honest participants or to generate the final key alone. In this work, we focus on a powerful collusive attack strategy in which two or more malicious participants in particular positions, can learn sensitive information or generate the final key alone without revealing their malicious behaviour. Many of the current circular-type multiparty quantum key agreement protocols are not secure against this collusive attack strategy. As an example, we analyze the security of a recently proposed multiparty key agreement protocol to show the vulnerability of existing circular-type multiparty quantum key agreement protocols against this collusive attack. Moreover, we design a general secure multiparty key agreement model that would remove this vulnerability from such circular-type key agreement protocols and describe the necessary steps to implement this model. The proposed model is general and does not depend on the specific physical implementation of the quantum key agreement.

Trustworthy and Cost-Effective Cell Selection for Sparse Mobile Crowdsensing Systems

Cell selection is a critical issue in sparse mobile crowdsensing (MCS) systems. However, the sensing cost heterogeneity among different cells (subareas) has long been ignored by existing works. Moreover, the data provided by participants are not always trustworthy, and some malicious participants may intend to launch data positioning attacks, which raises a new challenge for cell selection. In this paper, to address these issues, we propose a trustworthy and cost-effective cell selection (TCECS) framework that takes cell heterogeneity and malicious participants into consideration simultaneously. To this end, we first offer to utilize an iterative statistical spatial interpolation technique to identify trustworthy participants with the help of a small portion of dedicated sensors. Furthermore, we employ the regularized mutual coherence (RMC) in compressive sensing (CS) theory to characterize the contribution to inference accuracy of measurements submitted by different trustworthy participants. Finally, the cell selection strategy, which consumes the least sensing cost while satisfying a given sensing quality, is determined via an RMC-constrained optimization problem. Extensive experiments on a real-world taxi GPS dataset demonstrate that the proposed approach can mitigate the adverse effects of malicious participants and outperforms the baselines with less sensing cost for the same required sensing quality.

Voting System Based on Blockchain

Online ballot box system has the advantages of high efficiency and environmental protection, but the existing network voting technology still has a lot of matter. Almost all electronic voting system could be proved to be intrusion. The administrator of the system could tamper with the data for benefit, and the system may be attacked by hackers. The safety and fairness of the existing network voting system depend entirely on the safety and credibility of the website itself, but these cannot guarantee the fairness of voting. Make full use of blockchain technology, so that voting, even if there are malicious participants, but also to ensure the correctness and safety of the vote. The introduction of block chain technology, block chain has decentralized, data tampering and other characteristics. P2P network is applied in the block chain layer to construct a distributed database, digital signature algorithm and encryption technology are used to ensure that the data cannot be tampered with, consensus network algorithm is used to ensure the consistency of the data in the network, and timestamp technology is applied to save the data blocks in a chain structure connected end to end. It paper focuses on the implementation of P2P network networking mode, node block synchronization, data and block verification mechanism and consensus mechanism to ensure data consistency in the network layer of block chain layer. Using time stamp, Merkle tree, asymmetric encryption and other technologies to design data blocks and use chain structure to store data blocks. Combined with the characteristics of blockchain, a fair and transparent voting system is constructed. Model aims to apply the block chain technology to the voting scenario and design a secure block chain voting architecture. It system is designed and developed based on the block chain system. It makes full use of its decentralization, removes the dependence of electronic voting on trusted third parties, and protects the privacy of voters and candidates. Data cannot be tampered with. Once the data are stored in the block chain, it cannot be tampered with. It provides a real and credible database.

Cryptanalysis and improvement in semi-quantum private comparison based on Bell states

Recently, Jiang proposed a semi-quantum private comparison (SQPC) protocol without the use of a quantum measurement device (Quantum Inf Process 19:182, 2020). However, this paper highlights a security loophole during the transmission phase of the protocol in which a malicious participant can perform a double CNOT attack to steal partial information of the other participant’s private secret without being detected. With the same assumption of the semi-quantum environment as Jiang’s protocol, this paper presents an improved protocol by adopting a strategy of pre-sharing session keys to overcome the double CNOT attack. Moreover, a security analysis of the collective attack is also provided for Jiang’s and the improved SQPC protocols.

A(DP) 2SGD: Asynchronous Decentralized Parallel Stochastic Gradient Descent With Differential Privacy.

As deep learning models are usually massive and complex, distributed learning is essential for increasing training efficiency. Moreover, in many real-world application scenarios like healthcare, distributed learning can also keep the data local and protect privacy. Recently, the asynchronous decentralized parallel stochastic gradient descent (ADPSGD) algorithm has been proposed and demonstrated to be an efficient and practical strategy where there is no central server, so that each computing node only communicates with its neighbors. Although no raw data will be transmitted across different local nodes, there is still a risk of information leak during the communication process for malicious participants to make attacks. In this paper, we present a differentially private version of asynchronous decentralized parallel SGD framework, or A(DP) 2SGD for short, which maintains communication efficiency of ADPSGD and prevents the inference from malicious participants. Specifically, Rényi differential privacy is used to provide tighter privacy analysis for our composite Gaussian mechanisms while the convergence rate is consistent with the non-private version. Theoretical analysis shows A(DP) 2SGD also converges at the optimal O(1/√T) rate as SGD. Empirically, A(DP) 2SGD achieves comparable model accuracy as the differentially private version of Synchronous SGD (SSGD) but runs much faster than SSGD in heterogeneous computing environments.

Security Analysis of End-to-End Encryption for Zoom Meetings

In the wake of the global COVID-19 pandemic, video conference systems have become essential for not only business purposes, but also private, academic, and educational uses. Among the various systems, Zoom is the most widely deployed video conference system. In October 2020, Zoom Video Communications rolled out their end-to-end encryption (E2EE) to protect conversations in a meeting from even insiders, namely, the service provider Zoom. In this study, we conduct thorough security evaluations of the E2EE of Zoom (version 2.3.1) by analyzing their cryptographic protocols. We discover several attacks more powerful than those expected by Zoom according to their whitepaper. Specifically, if insiders collude with meeting participants, they can impersonate <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">any Zoom user</i> in target meetings, whereas Zoom indicates that they can impersonate only the current meeting participants. Besides, even without relying on malicious participants, insiders can impersonate any Zoom user in target meetings though they cannot decrypt meeting streams. In addition, we demonstrate several impersonation attacks by meeting participants or insiders colluding with meeting participants. Although these attacks may be beyond the scope of the security claims made by Zoom or may be already mentioned in the whitepaper, we reveal the details of the attack procedures and their feasibility in the real-world setting and propose effective countermeasures in this paper. Our findings are not an immediate threat to the E2EE of Zoom; however, we believe that these security evaluations are of value for deeply understanding the security of E2EE of Zoom.

Consortium Blockchain based Reputation Incentive Mechanism for Recommendation System

Recommendation systems have been widely used in many e-commerce services, but it is difficult to gather enough participants to supply their recommendations. Moreover, participants in the system may make malicious recommendations, which will affect the accuracy of recommendation results. In order to provide better recommendation service for users, incentive mechanisms are needed to attract more participants in recommendation and curb their malicious behaviors. In this paper, we propose a consortium blockchain based reputation incentive mechanism for recommendation systems(CRIM). Firstly, the monetary rewards are used to attract participants and motivate them to take part in the recommendation. Secondly, we design the incentive mechanism with reputation which is attached to the rewards. Honest participants will gain more rewards while malicious participants will be penalized. Meanwhile, we adopt the Stackelberg game to maximize the utility of participants, and prove that the mechanism can reach a unique Nash equilibrium. Thirdly, the decentralization and immutability of blockchain can guarantee the credibility and security of the stored data, thus ensuring the openness and transparency of the recommendation. Finally, we implement the system for education resources recommendation and conduct experiments, and the results demonstrate that our incentive mechanism is effective and has significant performance when compared with other incentive mechanisms.

A multi-hop cross-blockchain transaction model based on improved hash-locking

Blockchain is a decentralised, trust-free distributed ledger technology that has been applied in various fields such as finance, supply chain, and asset management. However, the network isolation between blockchains has limited their interoperability in asset exchange and business collaboration since it forms blockchain islands. Cross-blockchain is an important technology aiming to realise the interoperability between blockchains, and has become one of the hottest research topics in this area. This paper proposes a multi-hop cross-blockchain transaction model based on an improved hash-locking consulted by the notary and users. It can solve the security problems in the traditional hash-locking, and prevent malicious participants from creating a large number of transactions to block cross-blockchain system. Moreover, a notary multi-signature scheme is designed to solve the problem of lack of trust in the traditional model. A multi-hop cross-blockchain transaction loop is designed based on the loop detection method of directed graphs. The transaction process of key agreement, asset locking, lock releasing and security analysis based on the model is discussed in detail. Experiments of cross-blockchain transactions are carried out in Ethereum private chain, and prove that the proposed model has good applicability.

PyRos: A State Channel-Based Access Control System for a Public Blockchain Network

Blockchain is a technology that enables the implementation of a decentralized system by replacing the role of the centralized entity with the consensus of participants in the system to solve the problem of subordination to the centralized entity. Blockchain technology is being considered for application in numerous fields; however, the scalability limitation of a public blockchain has led many researchers to consider private blockchains, which reduce the security of the system while improving scalability. A state channel represents a leading approach among several scalability solutions, intended to address public blockchain scalability challenges while ensuring the security of the blockchain network. Participants in the channel perform the process of updating the state of the channel outside the blockchain. This process can proceed very quickly because it does not require the consensus of the blockchain network, but still, like on-chain, it can guarantee features such as irreversibility. In this paper, we propose the PyRos protocol, an access control system that supports the trading and sharing of data between individuals on a public blockchain based on the state channel. As far as we know, the research using the off-chain state channel for access control has not been proposed yet, so PyRos is a new approach in this field. In PyRos, user-defined access control policies are stored off-chain, and policy updates are always rapid regardless of the performance of the blockchain network. Moreover, PyRos provides means to prevent malicious participants from arbitrarily using the channel’s previous state while resolving constraints due to scalability problems, along with privacy guarantees for the transaction content. To evaluate the efficiency and security of PyRos, we provide qualitative analysis of security requirements and analysis in terms of the performance of public blockchain platforms.

DAML

Data aggregation based on machine learning (ML), in mobile edge computing, allows participants to send ephemeral parameter updates of local ML on their private data instead of the exact data to the untrusted aggregator. However, it still enables the untrusted aggregator to reconstruct participants’ private data, although parameter updates contain significantly less information than the private data. Existing work either incurs extremely high overhead or ignores malicious participants dropping out. The latest research deals with the dropouts with desirable cost, but it is vulnerable to malformed message attacks. To this end, we focus on the data aggregation based on ML in a practical setting where malicious participants may send malformed parameter updates to perturb the total parameter updates learned by the aggregator. Moreover, malicious participants may drop out and collude with other participants or the untrusted aggregator. In such a scenario, we propose a scheme named DAML , which to the best of our knowledge is the first attempt toward verifying participants’ submissions in data aggregation based on ML. The main idea is to validate participants’ submissions via SSVP, a novel secret-shared verification protocol, and then aggregate participants’ parameter updates using SDA, a secure data aggregation protocol. Simulation results demonstrate that DAML can protect participants’ data privacy with preferable overhead.

Cryptanalysis and improvement of several quantum private comparison protocols

Recently, Wu et al (2019 Int. J. Theor. Phys. 58 1854) found a serious information leakage problem in Ye and Ji’s quantum private comparison protocol (2017 Int. J. Theor. Phys. 56 1517), that is, a malicious participant can steal another’s secret data without being detected through an active attack means. In this paper, we show that Wu et al’s active attack is also effective for several other existing protocols, including the ones proposed by Ji et al and Zha et al (2016 Commun. Theor. Phys. 65 711; 2018 Int. J. Theor. Phys. 57 3874). In addition, we propose what a passive attack means, which is different from Wu et al’s active attack in that the malicious participant can easily steal another’s secret data only by using his own secret data after finishing the protocol, instead of stealing the data by forging identities when executing the protocol. Furthermore, we find that several other existing quantum private comparison protocols also have such an information leakage problem. In response to the problem, we propose a simple solution, which is more efficient than the ones proposed by Wu et al, because it does not consume additional classical and quantum resources.

Securing Additive Manufacturing with Blockchains and Distributed Physically Unclonable Functions

Blockchain technology is a game-changing, enhancing security for the supply chain of smart additive manufacturing. Blockchain enables the tracking and recording of the history of each transaction in a ledger stored in the cloud that cannot be altered, and when blockchain is combined with digital signatures, it verifies the identity of the participants with its non-repudiation capabilities. One of the weaknesses of blockchain is the difficulty of preventing malicious participants from gaining access to public–private key pairs. Groups of opponents often interact freely with the network, and this is a security concern when cloud-based methods manage the key pairs. Therefore, we are proposing end-to-end security schemes by both inserting tamper-resistant devices in the hardware of the peripheral devices and using ternary cryptography. The tamper-resistant devices, which are designed with nanomaterials, act as Physical Unclonable Functions to generate secret cryptographic keys. One-time use public–private key pairs are generated for each transaction. In addition, the cryptographic scheme incorporates a third logic state to mitigate man-in-the-middle attacks. The generation of these public–private key pairs is compatible with post quantum cryptography. The third scheme we are proposing is the use of noise injection techniques used with high-performance computing to increase the security of the system. We present prototypes to demonstrate the feasibility of these schemes and to quantify the relevant parameters. We conclude by presenting the value of blockchains to secure the logistics of additive manufacturing operations.

Mobil Kitle Algılamada Mesaj Gecikme Zamanı Üzerine Bir Araştırma

The ubiquity of smart devices such as smartphones and wearables along with human mobility enabled collecting useful information at a larger scale through mobile crowd-sensing (MCS). The availability of several onboard sensors and wireless communication capabilities on such devices not only provides a means to monitor environmental conditions but also offers intermittent connectivity to otherwise unconnected nodes by leveraging mobility and data caching. Despite the availability of unprecedented opportunities, MCS also poses several challenges that need to be tackled such as sparsity and scarcity of the collected data. If the collected data is sparse, some of the regions in the data collection area may not be covered. On the other hand, if the data is scarce, it will be more difficult to validate the collected data considering malicious participants which may alter the data intentionally or friendly participants which may send inaccurate data due to uncalibrated sensors. In this paper, we present the results which the delay time of the message from connected nodes to base node for three random mobility entity models.

A training-integrity privacy-preserving federated learning scheme with trusted execution environment

Machine learning models trained on sensitive real-world data promise improvements to everything from medical screening to disease outbreak discovery. In many application domains, learning participants would benefit from pooling their private datasets, training precise machine learning models on the aggregate data, and sharing the profits of using these models. Considering privacy and security concerns often prevent participants from contributing sensitive data for training, researchers proposed several techniques to achieve data privacy in federated learning systems. However, such techniques are susceptible to causative attacks, whereby malicious participants can inject false training results with the aim of corrupting the well-learned model. To end this, in this paper, we propose a new privacy-preserving federated learning scheme that guarantees the integrity of deep learning processes. Based on the Trusted Execution Environment (TEE), we design a training-integrity protocol for this scheme, in which causative attacks can be detected. Thus, each participant is compelled to execute the privacy-preserving learning algorithm of the scheme correctly. We evaluate the performance of our scheme by prototype implementations. The experimental result shows that the scheme is training-integrity and practical.

Participant attack and improving dynamic quantum secret sharing using d-dimensional GHZ state

In 2017, Qin and Dai [Quantum Inf. Process. 16, 64 (2017). https://doi.org/10.1007/s11128-017-1525-y ], proposed a dynamic quantum secret sharing (DQSS) scheme based on the d-dimensional state. However, as shown in this study, a malicious participant can reveal the secret key of other participants without being detected. Furthermore, this study identifies a security issue in Qin and Dai’s DQSS protocol pertaining to the honesty of a revoked participant. Without considering these security issues, the DQSS protocol could fail at providing secret-sharing function. Therefore, two improvements are proposed to circumvent these problems.

Cheaper Private Set Intersection via Differentially Private Leakage

Abstract In this work we demonstrate that allowing differentially private leakage can significantly improve the concrete performance of secure 2-party computation (2PC) protocols. Specifically, we focus on the private set intersection (PSI) protocol of Rindal and Rosulek (CCS 2017), which is the fastest PSI protocol with security against malicious participants. We show that if differentially private leakage is allowed, the cost of the protocol can be reduced by up to 63%, depending on the desired level of differential privacy. On the technical side, we introduce a security model for differentially-private leakage in malicious-secure 2PC. We also introduce two new and improved mechanisms for “differentially private histogram overestimates,” the main technical challenge for differentially-private PSI.

Limited Resource Semi-Quantum Secret Sharing Based on Multi-Level Systems

In the actual quantum task, it is more realistic to achieve the same task with quantum resources as few as possible which is known as semi-quantum idea. This paper proposed a novel and resultful semi-quantum secret sharing protocol, which is implemented using product states based on multi-level systems. In this scheme, the quantum capabilities of the receivers Bob and Charlie are limited, and the sender Alice does not have to access quantum memory. In addition, the security of the protocol is analyzed in detail from two aspects of Intercept-measure-resend and Entangle-measuring attacks initiated by internal malicious participants. More importantly, among the premise of proximate security of Ref. Li et al. (Quantum Inf. Process. 17, 285, 2018), our scheme reduces the number of particles used for eavesdropping detection and increases the amount of information carried by each particle.