Fengwei Wang

In the advancing field of information technology, the Industrial Internet of Things (IIoT) plays a pivotal role across various domains. To fully leverage the massive data generated by IIoT, the Balanced Iterative Reducing and Clustering using Hierarchies (BIRCH) algorithm is well-suited for clustering large-scale time series data due to its incremental and order-sensitive design. Although aggregating multisource data on cloud servers becomes a practical and effective approach, it raises privacy concerns. Existing privacy-preserving BIRCH schemes designed to mitigate these concerns, however, rely on homomorphic encryption for atomic operations and reveal the insertion path of sample points, resulting in significant limitations in performance and security. To address these issues, we propose SBIRCH, a novel secure BIRCH scheme. Specifically, we first introduce oblivious hierarchical updates to preserve insertion paths. Then, we present a shuffling-based obfuscation technique to protect intermediate clustering results during node splitting. In addition, we optimize division operations on encrypted data, delivering high precision and significantly improving efficiency. Security analysis confirms that our scheme effectively protects multisource data, intermediate clustering results, and clustering relationships. While maintaining consistent security, experimental evaluations demonstrate that our scheme achieves substantial improvements in computational efficiency and markedly reduces communication overheads compared to existing schemes.

Fully homomorphic encryption (FHE) is a powerful technique that allows unlimited computations on encrypted data without decryption. However, FHE will incur huge computation and storage costs, making it difficult to be applied in real environments. To improve the efficiency of FHE, some optimized schemes have been proposed based on the trusted execution environment (TEE), which offer a lighter and lower overhead solution for FHE optimizations to a certain extent. However, they heavily rely on the confidentiality of the TEE, and their performance is still limited. To solve the above problems, we propose an efficient TEE-assistance CKKS scheme without bootstrapping, named TCKKS, which has the characteristics of security, efficiency, low memory, and scalability. First, to weaken the trust assumption of TEE, we consider TEE to be honest-but-curious, meaning the enclave's algorithm provider will execute the algorithm honestly but might monitor the data in the enclave. Based on this assumption, we design a lightweight secure multiplication protocol (SMP) and a secure rotation protocol (SRP) for TCKKS to efficiently achieve ciphertext multiplication and rotation operations. Then, to further improve the performance of TCKKS, we optimize the arithmetic operations and encryption/decryption operations based on the characteristics of our protocols. Moreover, we prove the security of SMP and SRP under the simulation-based real/ideal worlds model and further demonstrate the security of TCKKS based on the RLWE problem. In addition, extensive experiments indicate that TCKKS has a better performance than mainstream libraries, such as RNS-HEAAN, PALISADE and SEAL.

Promoting data sharing is one of the critical strategies for thriving in the digital age, and enormous demand for location-based services propels data sharing in the Internet of Vehicles (IoV), particularly in the case of integrating mobile crowdsensing (MCS). However, data security and privacy concerns are increasingly posing serious challenges to the development of data sharing. Although a slew of works have been designed to achieve secure data sharing in IoV, they are inadequate for addressing the privacy issues identified in the data sharing model and often suffer from performance limitations. In this work, we propose an efficient and secure data sharing scheme under the MCS-integrated IoV. Specifically, motivated by the distributed point function (DPF), we design a double-output DPF and leverage it to construct a secure updating scheme that protects full privacy while ensuring high efficiency. Then, based on the XOR filter and a series of subtle transformations, we carefully design a secure spatial test protocol to determine whether a point falls within an arbitrary spatial range efficiently. Afterward, we propose a secure retrieving protocol by using the idea of shared shuffling, in which the offline sub-protocol is presented to generate random masks, and the online sub-protocol is designed to quickly retrieve the desired data items. After formally proving the security of our proposed schemes, we experimentally evaluate their efficiency by comparing them with the alternative solutions, and the results indicate that our proposed schemes offer superior performance, particularly in terms of communication overheads.

Driven by increasingly tighter privacy restrictions, federated learning (FL), involving training global machine learning models over multiple participants while keeping their data localized, has shown its advantages and gained extensive attention. Despite the promising future, security and efficiency remain major concerns hindering its further development. In this paper, we propose a secure and efficient vertical FL scheme for the XGBoost model, named SXGB, in which the trusted execution environments (TEEs) are introduced to improve the efficiency without an additional security assumption. Specifically, we first design a bucket sharing algorithm to encode and secretly share participants' data buckets. Then, through a combination of the TEEs and symmetric homomorphic encryption techniques, we propose a secure split finding algorithm to accurately find the best splits while ensuring the privacy of data inside and outside the enclave. Moreover, a fingerprint verification method is embedded into the split finding algorithm to ensure the honest execution of the training program. A detailed security analysis shows that SXGB can effectively defend against inference and tamper attacks. Extensive experiments demonstrate that SXGB offers at least a 20× improvement in communication efficiency and a 10× speedup of running time compared to existing representative schemes.