Resource-constrained Users Research Articles

Service-Oriented SAGIN With Pervasive Intelligence for Resource-Constrained Users

Service-Oriented SAGIN With Pervasive Intelligence for Resource-Constrained Users

Edge-based secure image denoising scheme supporting flexible user authorization

Image denoising is a fundamental tool in the fields of image processing and computer vision. With the rapid development of multimedia and cloud computing, it has become popular for resource-constrained users to outsource the storage and denoising of massive images. However, it may cause privacy concerns and response delays. In this scenario, we propose an efFicient privAcy-preseRving Image deNoising schEme (FARINE) for outsourcing digital images. By introducing a key conversion mechanism, FARINE allows removing noise from a given noisy image using a non-local mean way without leaking any information about the plaintext content. Due to its low computational latency/communication cost, edge computing is considered to improve the user experience. To achieve a dynamic user set efficiently, we design a fine-grained access control mechanism to support user authorization and revocation in multi-user scenarios. Extensive experiments over several benchmark data sets show that FARINE obtains comparable performance to plaintext image denoising.

RDIMM: Revocable and dynamic identity-based multi-copy data auditing for multi-cloud storage

Multi-copy data possession on multi-cloud storage service provides resource-constrained users with a secure and effective way to process data maintenance. To enable integrity for the outsourced data, numerous multi-copy data auditing schemes for multi-cloud storage have been proposed. Nevertheless, existing solutions suffer from the following limitations: (i) cannot support dynamic data updates; (ii) fail to consider the user revocation feature; (iii) may leak the privacy of user identity. To address these limitations, we propose a new identity-based multi-copy data auditing scheme for multi-cloud storage, termed RDIMM. We introduce a new variant of Merkle Tree to enable fully dynamic data updates, in which all copies of a raw block are kept in the same leaf node. In addition, we design a new key generation strategy and a private key update technique, where the cost of user revocation is independent of the total number of file blocks owned by the revoked user. Moreover, we conduct a comprehensive correctness analysis and security analysis of our proposed RDIMM. In addition, we provide detailed theoretical analysis and experimental simulations, which illustrate the effective functionality and practical performance compared to state-of-the-art works.

Attribute-based searchable encrypted scheme with edge computing for Industrial Internet of Things

Storing the data generated in the Industrial Internet of Things has become a method to solve data redundancy. Still, data security and privacy protection have become an issue that cannot ignore. Attribute-based searchable encryption can encrypt and retrieve data without exposing users’ privacy. In this paper, we introduce an attribute-based searchable scheme combining online/offline encryption and outsourcing decryption technology, which uses a reusable ciphertext pool to reduce the computation in the encryption stage, and uses an edge server to reduce the cost of resource-constrained users through outsourcing decryption. To improve the solution’s security, the specified server can authenticate the cloud server in the searchable location. Finally, our scheme is proven to satisfy CCA2-secure and is efficient in performance and safety analysis. In a word, the algorithm is suitable for the actual Industrial Internet of Things environment.

Split: A Hash-based Memory Optimization Method for Zero-Knowledge Succinct Non-Interactive Argument of Knowledge (zk-SNARK)

Zero-Knowledge Succinct Non-Interactive Argument of Knowledge (zk-SNARK) is a practical zero-knowledge proof system for Rank-1 Constraint Satisfaction (R1CS), enabling privacy preservation and addressing the previous scalability concerns on zero-knowledge proofs. Existing constructions of zk-SNARKs require huge memory overhead to generate proofs in that the size of the zk-SNARK circuit can be large even for a very simple use case, which limits the applications for regular resource-constrained users. To reduce the memory utilization of zk-SNARKs, this paper presents a hash-based method “Split”. Concretely, Split intends to partition the zk-SNARK circuits so that components can be processed sequentially while ensuring strong security properties leveraging hash circuits. As a zk-SNARK circuit is partitioned, obsolete variables are no longer preserved in the memory. We further propose an enhanced Split as <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$n$</tex-math></inline-formula> -Split, which leads to better optimization by properly choosing multiple splits. Our experimental results validate the effectiveness and efficiency of Split in conserving memory usage for resource-constrained provers as long as the circuit can be partitioned to a Good Split, indicating that via Split zk-SNARKs can be brought one step closer to practical applications.

Verifiable Data Search with Fine-Grained Authorization in Edge Computing

In the research of searchable encryption, fine-grained data authorization is a convenient way to manage the search rights for users. Recently, Liu et al. proposed a fine-grained searchable scheme with verification, which can control the search authorization and verify the results. In this paper, we first present a forgery attack against Liu et al.’s scheme and then propose a novel scheme of verifiable data search with fine-grained authorization in edge environment. Based on the key aggregate mechanism and Merkle hash tree, our proposed scheme not only achieves file-oriented search permission management but also implements the correctness and completeness verification of search results. In addition, with the assistance of edge server, resource-constrained users can easily perform the tasks of search and verification. Finally, we prove our scheme is secure based on the decision l -bilinear Diffie–Hellman exponent problem. The performance analysis and experiment results demonstrate that our proposed scheme has lower computation, communication, and storage costs contrast to the existing schemes.

SCMA-Based Multiaccess Edge Computing in IoT Systems: An Energy-Efficiency and Latency Tradeoff

Sparse code multiple access (SCMA) is a kind of code-domain non-orthogonal multiple access (NOMA) scheme, which can support the increasing requirements for high spectral efficiency and massive connections. Meanwhile, multi-access edge computing (MEC) is a promising technology for providing resource-constrained users with computing resources. In this paper, we propose a novel optimization scheme in SCMA-based MEC network from the perspective of energy and latency for the Internet of Things (IoT) devices. Specifically, a system utility is first used to calculate the weighted energy consumption and task execution latency. The initial utility minimization problem is non-convex and then can be subdivided into two tractable subproblems by fixing task offloading decisions, namely, optimal local computing via CPU frequency scheduling and optimal edge computing via SCMA codebook assignment, subcarrier power allocation, and MEC server computing resources distribution. Primarily, a joint SCMA codebook assignment based on the bidirectional matching principle and optimal power allocation algorithm is proposed. Moreover, we come up with CPU frequency scheduling strategies utilizing convex optimization to optimize the computing resources allocation of local devices and the MEC server. Finally, a low-complexity task offloading policy based on simulated annealing is presented. Numerical results show that our proposed joint optimization algorithm for resource allocation and task offloading can achieve a good compromise between time delay and energy consumption for IoT devices. It is demonstrated that the proposed strategy has a remarkable advantage compared to previous SCMA-MEC schemes.

Fair Outsourcing Paid in Fiat Money Using Blockchain

Seeking outsourcing from cloud service providers is common for resource-constrained users to complete complex computing. Conventional cloud computing outsourcing solutions focus on guiding users to verify the returned results, which is unfair since malicious users can refuse to pay by falsely claiming that the results are wrong. To address this problem, fair payment schemes, both blockchain-free and blockchain-based, have been proposed. However, the former is usually inefficient and the latter only supports payment through cryptocurrencies. The use of cryptocurrencies faces hurdles as it exposes cloud service providers to a significant risk of sharp currency price fluctuations, as well as vulnerability to government bans due to regulatory concerns. In contrast, fiat money payment is not only more in line with the business norm, but also naturally avoids the above troubles. Motivated by this, a blockchain-based fair outsourcing scheme to support payment in fiat money is proposed in this paper. The proposed scheme has broad compatibility and, as an example, is subsequently instantiated with a conventional outsourcing solution of eigen-decomposition. The performance of the scheme in fairness, privacy, and efficiency is verified by both theoretical and experimental evaluations.

User Privacy Protection Scheme Based on Verifiable Outsourcing Attribute-Based Encryption

Given the rapid development of cloud computing and cloud storage technology, a growing number of enterprises and individuals use cloud storage services to save data or back up data. In the cloud storage services, although attribute-based encryption can protect users’ data security, the computational cost of key generation, data encryption, and data decryption linearly increases with the complexity of access strategies, which becomes more critical for resource-constrained users. Therefore, this paper proposes a verifiable attribute-based encryption scheme for a fully outsourced ciphertext policy. The scheme can simultaneously realize the functions of key generation, data encryption, and data decryption outsourcing and verify the correctness of the outsourcing calculation results. This scheme can effectively reduce the computational burden of a cloud storage system. The security and verifiability of the scheme are indicated and proved with the random oracle model. The experimental results show that the scheme has the advantages of function and efficiency compared with other schemes. The research results have theoretical and practical significance.

Ciphertext-policy attribute-based encryption with hidden sensitive policy from keyword search techniques in smart city

Countless data generated in Smart city may contain private and sensitive information and should be protected from unauthorized users. The data can be encrypted by Attribute-based encryption (CP-ABE), which allows encrypter to specify access policies in the ciphertext. But, traditional CP-ABE schemes are limited because of two shortages: the access policy is public i.e., privacy exposed; the decryption time is linear with the complexity of policy, i.e., huge computational overheads. In this work, we introduce a novel method to protect the privacy of CP-ABE scheme by keyword search (KS) techniques. In detail, we define a new security model called chosen sensitive policy security: two access policies embedded in the ciphertext, one is public and the other is sensitive and hidden. If user's attributes don't satisfy the public policy, he/she cannot get any information (attribute name and its values) of the hidden one. Previous CP-ABE schemes with hidden policy only work on the “AND-gate” access structure or their ciphertext size or decryption time maybe super-polynomial. Our scheme is more expressive and compact. Since, IoT devices spread all over the smart city, so the computational overhead of encryption and decryption can be shifted to third parties. Therefore, our scheme is more applicable to resource-constrained users. We prove our scheme to be selective secure under the decisional bilinear Diffie-Hellman (DBDH) assumption.

PMTER-ABE: a practical multi-authority CP-ABE with traceability, revocation and outsourcing decryption for secure access control in cloud systems

Attribute-based encryption (ABE) has evolved as an efficient and secure method for storage of data with fine-grained access control in cloud platforms. In recent years, increasing diversification in the design of ABE schemes has led to significant research in the assimilation of properties like traceability, revocation, and outsourcing decryption. However, most of the recent ABE schemes incorporate few of these properties and hence lack in robustness to adapt with varying demands of cloud systems. In modern ABE designs, the notions of forward and backward secrecy have been introduced to accommodate the delegation of a large number of heterogeneous users in the system. In general, these features are realized under the concept of user revocation. On the other hand, to control malicious users in the system, it is necessary to implement traceability in integration with user revocation. Finally, for resource-constrained users, outsourcing decryption to proxy servers is a viable option. Thus, we propose PMTER-ABE, a practical decentralized multi-authority traceable and efficiently revocable attribute-based cryptosystem with outsourcing decryption advantage. The key features of our cryptosystem are (i) incorporating large attribute universe with highly expressive policies, (ii) integrating forward and backward secrecy under user revocation, (iii) implementing white-box traceability to detect malicious users, and (iv) outsourcing decryption to reduce the computational overhead of decryption on users. We present the formal proofs for correctness, security, and traceability of PMTER-ABE along with performance analysis. The efficiency and usability of PMTER-ABE is shown with practical implementation and experimental results.

Research on Searchable Symmetric Encryption

Cloud computing, as a new computing paradigm, offers dynamically scalable and seemly unbounded storage and computation resources in a pay-as-you-go manner. In order to enjoy superior data services and reduce the local maintenance cost, more and more resource-constrained users prefer to outsource their data to the cloud server. However, outsourcing data to the remote server suffers from data security concerns, because the server may try to learn the information of the outsourced data as much as possible for commercial purpose. The traditional encryption technique can protect the confidentiality of users’ data, however, it leads to the loss of search ability over the encrypted data. Fortunately, searchable encryption, as a promising solution, enables the server to perform keyword-based search over encrypted data. Recently, the design of searchable encryption scheme is becoming more and more diversified, aiming to improve the practicability of the scheme. This paper focuses on the current research for searchable encryption scheme in four aspects, including single keyword search, multi-modal search, forward/ backward secure search and verifiable search. This paper mainly introduces and analyzes the representative research results, summarizes the latest research progress and key technical difficulties, and finally prospects the future research direction.

Publicly Verifiable Shared Dynamic Electronic Health Record Databases With Functional Commitment Supporting Privacy-Preserving Integrity Auditing

Electronic health record (EHR) is a system that collects patients' digital health information and shares it with other healthcare providers in the cloud. Since EHR contains a large amount of significant and sensitive information about patients, it is required that the system ensures response correctness and storage integrity. Meanwhile, with the rise of IoT, more low-performance terminals are deployed for receiving and uploading patient data to the server, which increases the computational and communication burden of the EHR systems. The verifiable database (VDB), where a user outsources his large database to a cloud server and makes queries once he needs certain data, is proposed as an efficient updatable cloud storage model for resource-constrained users. To improve efficiency, most existing VDB schemes utilize proof reuse and proof updating technique to prove correctness of the query results. However, it ignores the “real-time” of proof generation, which results in an overhead that the user has to perform extra process (e.g., auditing schemes) to check storage integrity. In this article, we propose a publicly verifiable shared updatable EHR database scheme that supports privacy-preserving and batch integrity checking with minimum user communication cost. We modify the existing functional commitment (FC) scheme for the VDB design and construct a concrete FC under the computational <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">l</i> -BDHE assumption. In addition, the use of an efficient verifier-local revocation group signature scheme makes our scheme support dynamic group member operations, and gives nice features, such as traceability and non-frameability.

Privacy-Preserving Krawtchouk Moment feature extraction over encrypted image data

Resource-constrained users outsource the massive image data to the cloud to reduce storage and computation overhead locally, but security and privacy concerns seriously hinder the applications of outsourced image processing services. Besides, existing image processing solutions in the encrypted domain still bring high computation overhead, and even lead to characteristic loss. To this end, we propose a Privacy-Preserving Krawtchouk Moment (PPKM) feature extraction framework over encrypted image data by utilizing the Paillier cryptosystem. First, a mathematical framework for PPKM implementation and image reconstruction is presented in the encrypted domain. Then, the detailed expanding factor and upper bound analysis shows that plaintext Krawtchouk moment and plaintext image reconstruction can be realized over encrypted image with PPKM. Furthermore, the computation complexity of PPKM can be significantly reduced with the block-based parallel algorithm. Experimental results verify that the PPKM is feasible and acceptable in practice in terms of image reconstruction capability and image recognition accuracy.

A lightweight identity-based provable data possession supporting users’ identity privacy and traceability

Cloud storage auditing is considered as a significant service used to verify the integrity of data stored in public cloud. However, most existing auditing protocols suffer form complex certificate management/verification since they rely on expensive Public Key Infrastructure (PKI). On the other hand, most cloud users have constrained computational resources. The few existing ID-based storage auditing protocols in the literature, require resource-constrained users to perform costly operations for generating metadata on file blocks. In this paper, we propose a storage auditing protocol which benefits from ID-based structure and lightweight user computations, simultaneously. Our construction keeps user’s identity private from the server and TPA and also provides traceablity of misbehaving users. Our mechanism is also extended to support batch auditing of multiple tasks in multi-user setting. Performance evaluations demonstrate excellent efficiency of our scheme specially at the user’s side in comparison with the state of the art.

A Survey of Multi-Access Edge Computing in 5G and Beyond: Fundamentals, Technology Integration, and State-of-the-Art

Driven by the emergence of new compute-intensive applications and the vision of the Internet of Things (IoT), it is foreseen that the emerging 5G network will face an unprecedented increase in traffic volume and computation demands. However, end users mostly have limited storage capacities and finite processing capabilities, thus how to run compute-intensive applications on resource-constrained users has recently become a natural concern. Mobile edge computing (MEC), a key technology in the emerging fifth generation (5G) network, can optimize mobile resources by hosting compute-intensive applications, process large data before sending to the cloud, provide the cloud computing capabilities within the radio access network (RAN) in close proximity to mobile users, and offer context-aware services with the help of RAN information. Therefore, MEC enables a wide variety of applications, where the real-time response is strictly required, e.g., driverless vehicles, augmented reality, robotics, and immerse media. Indeed, the paradigm shift from 4G to 5G could become a reality with the advent of new technological concepts. The successful realization of MEC in the 5G network is still in its infancy and demands for constant efforts from both academic and industry communities. In this survey, we first provide a holistic overview of MEC technology and its potential use cases and applications. Then, we outline up-to-date researches on the integration of MEC with the new technologies that will be deployed in 5G and beyond. We also summarize testbeds and experimental evaluations, and open source activities, for edge computing. We further summarize lessons learned from state-of-the-art research works as well as discuss challenges and potential future directions for MEC research.

An identity-based online/offline secure cloud storage auditing scheme

Cloud storage has significantly reduced data management costs for data owners. However, loss of physical control over the data after outsourcing, triggers some security concerns such as data integrity. Provable Data Possession (PDP) protocols, enable data owners to audit the integrity of their outsourced data without the need to retrieve the file from cloud server. However, most existing PDP schemes require resource-constrained users to perform costly operations for generating metadata on file blocks. In online/offline PDP mechanisms introduced most recently, the user’s computation is divided into online/offline phases, where the costly operations are allowed to be carried out in the offline phase. The users only require to perform lightweight operations in the real-time online phase. In this paper, we propose an identity-based (ID-based) online/offline PDP protocol which not only has lightweight computations at the users side, but also removes the complex certificate management/verification costs caused by expensive Public Key Infrastructure. The proposed scheme is based on an ID-based online/offline signature designed in this paper. The protocol is proven to be secure against a malicious cloud server in the random oracle model. We also prove the privacy preserving property of the protocol in the sense that it leaks no information of the outsourced data to the public verifier during the protocol execution. Moreover, our mechanism supports batch verification of multiple auditing tasks and fully dynamic data operations, efficiently. Experimental results demonstrate fine efficiency of our scheme in comparison to the recent proposals.

PVIDM: Privacy-preserving verifiable shape context based image denoising and matching with efficient outsourcing in the malicious setting

With the emerging techniques of wireless communication and cloud computing, large volumes of multimedia data are outsourced from resource-constrained users to the cloud with abundant resource for both delegated storage and computation. Unfortunately, there exists a risk of users’ image privacy leakage in the process of outsourcing to the cloud in the malicious setting. Most of the existing work achieved privacy-preserving verifiable image feature extraction and matching by using public key (fully) homomorphic encryption (FHE), and the heavy computational overhead and communication overhead cannot adapt to resource-constrained mobile devices. Other works disabled to achieve image denoising in the encrypted domain or only focused on the scale-invariant feature transform (SIFT) descriptor that is inappropriate for position-sensitive feature extraction. To address these issues, in this paper, a privacy-preserving verifiable shape context based image denoising and matching protocol PVIDM with efficient outsourcing in the malicious setting is proposed. To achieve this end, by exploiting any one-way trapdoor permutation, an efficient privacy-preserving verifiable image denoising scheme PPVID is firstly proposed to improve the accuracy of image matching, without exploiting public key FHE. Then, based on PPVID, a lightweight shape context based privacy-preserving verifiable image feature extraction and matching protocol PPVIM is devised, where secure and efficient comparison and counting protocols in the encrypted domain are respectively proposed. Both image privacy and image matching result privacy are well protected, and the correctness of image matching result can be efficiently verified. Finally, formal security proof and extensive simulations on real-world data sets demonstrate the efficiency and practicability of our proposed PVIDM. Especially, both the computational complexity for the usage of any one-way trapdoor permutation at data owner’s/user’s end and the size of the authentication tag generated by the cloud are O(1), independent to both the number of database images and the number of pixels in each image.

Efficiently and securely outsourcing compressed sensing reconstruction to a cloud

Compressed sensing has considerable potential for utilization in various fields owing to its efficient sampling process, but its reconstruction complexity is extremely high. For resource-constrained users, performing the compressed sensing reconstruction (CSR) task is impractical. In particular, the emergence of big data makes this task increasingly time-consuming. Cloud computing resources are abundant and can be employed to solve this task. However, owing to the lack of trust in the cloud, it is necessary to outsource the CSR task without privacy leakages. In this study, we design an efficient secure outsourcing protocol for the CSR task. In the basic outsourcing service model, a client samples a signal via a secure measurement matrix and then sends the acquired measurements to the cloud for CSR outsourcing. The reconstructed signal can not only be utilized by the client, but also by other users. The proposed outsourcing scheme is highly efficient and privacy-preserving, based on three aspects. First, the sensing matrix employed for reconstruction is assumed to be public, because it has a significantly larger size than the signal and consumes considerable resources if encrypted and transmitted. Second, a secret orthogonal sparsifying basis is contained only in the measurement matrix, rather than the sensing matrix. Third, a user can verify the reconstructed signal by leveraging the keys, which are the unique information shared between the client and user. We also demonstrate the privacy and analyze the efficiency of the proposed CSR outsourcing protocol, both theoretically and experimentally.

Person Re-Identification over Encrypted Outsourced Surveillance Videos

Person re-identification (Re-ID) has attracted extensive attention due to its potential to identify a person of interest from different surveillance videos. With the increasing amount of the surveillance videos, high computation and storage costs have posed a great challenge for the resource-constrained users. In recent years, the cloud storage services have made a large volume of video data outsourcing become possible. However, person Re-ID over outsourced surveillance videos could lead to a security threat, i.e., the privacy leakage of the innocent person in these videos. Therefore, we propose an ef F icient priv A cy-prese R ving pe R son Re- I D S cheme (FARRIS) over outsourced surveillance videos, which can ensure the privacy of the detected person while providing the person Re-ID service. Specifically, FARRIS exploits the convolutional neural network (CNN) and kernels based supervised hashing (KSH) to extract the efficient person Re-ID feature. Then, we design a secret sharing based Hamming distance computation protocol to allow cloud servers to calculate similarities among obfuscated feature indexes. Furthermore, a dual Merkle hash trees based verification is proposed, which permits users to validate the correctness of the matching results. The extensive experimental results and security analysis demonstrate that FARRIS can work efficiently, without compromising the privacy of the involved person.