Sep 2026· IEEE Transactions on Mobile Computing· Vol 25, pp. 14564-14579· 0 citations· 42 references
Abstract
The rise of edge-cloud computing has accelerated data sharing among mobile users. To resist malicious senders within organizations from leaking sensitive data, access control encryption (ACE) schemes have been employed to secure data flows, in which each sender obtains an encryption key according to the access control policy to encrypt the data, and a sanitizer (i.e., the edge node) inspects all shared data between the sender and receiver. Although attribute-based ACE schemes have been put forward to support fine-grained data sharing, they lack temporal constraints on write control, which is crucial in mobile data sharing scenarios, and have high sanitization overhead at the edge node. In addition, they only provide selective security and are therefore vulnerable to adaptive adversaries. To this end, we propose TSFlow, a time-aware secure flow control framework in mobile edge-cloud that regulates which senders can transmit data to which receivers during the authorized time interval, preventing malicious sending by expired senders. At its core is TA-ACE, a time-aware attribute-based ACE that issues each sender an encryption key tied to an expressive access structure and a time interval. Encrypted data can be sanitized at the edge only if it is well-formed with a valid encryption key and encrypted within the time interval, and any legitimate receiver satisfying the access structure can decrypt the sanitized ciphertext. We formally prove that TA-ACE satisfies the adaptive no-read and no-write rules, and demonstrate the reasonable efficiency of TSFlow through experiments for secure flow control in mobile edge-cloud.
Fine-grained, authenticated, traceable, and efficient encrypted access control is indispensable for secure data sharing in mobile edge cloud networks, especially for resource-constrained data requesters. Despite the prevalence of outsourced ciphertext-policy attribute-based encryption (CP-ABE) solutions, existing schemes still suffer from critical practical limitations. First, requester-side transformation keys are typically unverified prior to computationally expensive outsourced decryption operations. Second, commitment-based verification mechanisms fail to validate the identity of data publishers. Third, the online computational overhead scales linearly with either the requester attribute set or the policy-matching set, severely degrading practical efficiency. To address these issues, this paper proposes ePoFSC, a novel policy-oriented functional signcryption scheme for authenticated encrypted data sharing in mobile edge cloud scenarios. The proposed ePoFSC scheme integrates pre-auditing and caching mechanisms for requester trapdoors before online access requests, enabling constant-time operations for request generation, request verification, and request header construction independent of requester attribute scale. In the outsourced decryption phase, ePoFSC offloads all costly pairing and exponentiation operations with constant computational complexity, leaving only lightweight policy-dependent group multiplications for terminal requesters. Furthermore, ePoFSC tightly couples decryption verification with publisher authentication and requester traceability to realize comprehensive access accountability. Rigorous security analysis formally validates the confidentiality, publisher-side unforgeability, and requester traceability of the proposed scheme. Extensive experimental evaluations on the BLS12-381 curve verify that ePoFSC achieves prominent performance superiority over existing state-of-the-art schemes in both the encryption and data recovery phases.
In cloud computing environments, data sharing serves as a foundational enabler of collaborative operations across heterogeneous terminals. However, such sharing introduces critical challenges–including privacy leakage, inadequate data security, inflexible access control policies, and substantial computational latency. To address these limitations, this paper proposes a privacy-preserving, secure data-sharing framework tailored for edge-cloud collaborative architectures. Relative to conventional approaches, the proposed framework delivers three principal advancements: (1) User Privacy Protection: We design a secure query-matching algorithm that protects plaintext query keywords during data access. The Cloud Server (CS) performs matching over encrypted trapdoors without directly learning the queried keywords. (2) Computational Efficiency Improvement: Edge Servers (ESs) perform outsourced ciphertext transformation using user-specific transformation keys. The terminal only performs a lightweight local operation to recover the resource. This approach minimizes the computational overhead on the terminal side while safeguarding user privacy, and effectively reduces the overhead associated with user joining and revocation within the same group. (3) Fine-Grained, Policy-Driven Access Control: A cryptographically enforced, attribute- and keyword-aware access control mechanism is implemented, supporting precise, context-sensitive authorization decisions via encrypted keyword search and semantic matching–thereby enhancing both the security posture and operational flexibility of data access control.
Qikun Zhang, Zheng Cai, Jin-Bo Feng et al.· Journal of King Saud Univers...· 0 citations
As intelligent home services increasingly adopt IoT-Edge-Cloud architectures, protecting personal data during third-party data sharing has become an important challenge. This paper presents a Service-Aware Trust Chain framework that applies Privacy-Enhancing Technologies (PETs) according to data sensitivity. To support this approach, we introduce a 7-level security grading scheme based on Korea’s Personal Information Protection Act (PIPA) and practical deployment requirements in edge environments.A proof-of-concept system was implemented on a Raspberry Pi 5, integrating five privacy protection engines: ARX-based deidentification, Clusion searchable encryption, Microsoft SEAL homomorphic encryption, video face blurring, and sound masking. Performance measurements show that ARX and searchable encryption can be executed with low latency at the edge, whereas video and audio protection mechanisms are more suitable for batch-oriented processing. Homomorphic encryption incurs substantially higher overhead and is therefore better suited to a cloud-assisted deployment model. In addition, sound masking exhibited limited performance degradation as audio length increased, indicating its practicality for voice privacy protection in smart-home environments.To support data integrity verification, only cryptographic hashes are recorded on a cloud-hosted Trust Chain, avoiding the exposure of raw data. The proposed framework also outlines future extensions including sLLM-based data classification and DID-based access control.
Jihwan Lee, Myoung Sun Oh, Minyoung Park et al.· International Conference on...· 0 citations
The growing demand for large models in industrial Internet necessitates secure sharing of cloud-stored training data. However, existing Ciphertext-Policy Attribute-Based Encryption schemes suffer from low efficiency and insufficient accuracy in tracing key-leaking users. We propose a traceable secure data sharing scheme based on credibility, which enforces dual access control via credibility and attributes. It strengthens the binding of user and key and integrates a large model to create an intelligent traceability framework, utilizing multi-layer query mechanisms and Merkle trees to reduce redundant verification operations and improve tracing efficiency. Under the DBDH assumption, the scheme is IND-CPA secure. Experiments on the “Insider Threat Test Dataset” demonstrate a traceability accuracy of 99.46%, significantly reducing unnecessary verification operations. The proposed scheme provides an efficient, accurate, and practical solution for secure data sharing and malicious user traceability in distributed industrial cloud environments.
Shaojian Zhang, Jun Ye· 2026 5th International Confe...· 0 citations
Cloud computing has revolutionized data storage and processing, yet it poses significant security challenges, necessitating robust access control mechanisms. This study proposes a novel approach to secure cloud data access control called the Robust Mechanism for Secure Cloud Data Access Control (SC-DAC), which combines advanced cryptographic techniques such as Ciphertext-Policy Attribute-Based Encryption (CP-ABE) and Hybrid Public Key Encryption. By enabling fine-grained access control based on user attributes and policies, and ensuring data confidentiality and integrity during transmission, SC-DAC addresses critical security challenges in cloud environments. It features two innovative protocols: Partially Outsourced Access Control Protocol (PO-ACP), which allows for partial delegation of access control tasks while retaining oversight of critical functions, and Fully Outsourced Access Control Protocol (FO-ACP), which streamlines operations by fully outsourcing challenge generation and resource accounting to the cloud provider. The mechanism’s effectiveness is rigorously validated through formal verification with the ProVerif tool, mathematical proofs, and informal security analyses, demonstrating resilience against replay attacks, man-in-the-middle attacks, and denial-of-service (DoS) attacks. This comprehensive approach significantly advances cloud security by providing a robust solution to unauthorized access and data breaches. Simulation results further show that SC-DAC achieves superior performance in computation and communication costs, significantly advancing cloud security.
Haqi Khalid, S. Hashim, Mohammed Abdul Majeed· PeerJ Computer Science· 1 citation
INTRODUCTION: Distributed Internet of Things (IoT) communication must jointly satisfy low-latency forwarding, data confidentiality, integrity, access control, and lifecycle protection. Performance-oriented routing may expose sensitive traffic to malicious relays, high-risk links, unauthorized domains, and tampered flow entries.
OBJECTIVES: This study reformulates route optimization as a secure data-transmission and privacy-preserving path-control problem.
METHODS: A three-layer SDN framework combines robust node-reputation and link-risk scoring, security-label matching, attribute-based access control, flow isolation, AES-256-GCM authenticated encryption with ephemeral keys, signed rules, and a diversity-aware improved genetic algorithm. A composite objective integrates delay, loss, utilization, route risk, privacy exposure, and hard policy constraints. A reproducible Python/NetworkX discrete-event simulation compares Dijkstra, ECMP, AODV, OLSR, RPL, classical GA, SDN-TE, trust-aware routing, and two proposed variants.
RESULTS: Across eight independent runs, the full scheme achieved 16.68 ± 1.35 ms normal-operation delay and 98.54 ± 0.21% packet delivery. With 20% malicious nodes, it maintained 98.18 ± 0.39% packet delivery, reduced malicious-link exposure from 20.83% for Dijkstra to 6.67%, eliminated observed plaintext leakage of sensitive payloads in the main runs, and reduced attack-response latency from 722.22 ± 23.53 ms to 130.92 ± 6.34 ms. Paired comparisons against Dijkstra were significant for malicious-link exposure, abnormal-path selection, leakage, packet delivery, and response latency (p < 0.05).
CONCLUSION: The framework converts security and privacy requirements into enforceable routing, cryptographic, access-control, isolation, auditing, and lifecycle policies, enabling reproducible security-performance co-optimization for distributed IoT.
Jing Su, Zi-Lin Guo· ICST Transactions on Scalabl...· 0 citations
Related blog posts
Microsoft Research Blog· microsoft.comAug 31, 2026
What if pathology foundation models could do more with less? GigaPath-Flash and GigaTIME-Flash cut computational demands while maintaining strong performance, opening the door to larger studies and broader exploration. The post GigaPath-Flash and GigaTIME-Flash: Toward population-scale discovery with efficient pathology foundation models appeared first on Microsoft Research.
MIT News · Artificial Intelligence· news.mit.eduAug 31, 2026
With millions of users across the world, Julia has been used to conduct cutting-edge research and to design new drugs, jet engines, heat pumps, and more.
MIT News · Artificial Intelligence· news.mit.eduAug 27, 2026
A new machine-learning framework aims to improve the success rate of computational protein design while moving away from results that reproduce sequences found in nature.