Jul 2026· International Conference on Computer Communications and Networks· pp. 1-9· 0 citations· 25 references
Abstract
The shift toward modular microservices has driven the success of serverless Function-as-a-Service (FaaS) as a way to offload infrastructure management. However, meeting the diverse needs of emerging applications—from ultra-low latency control to budget-constrained processing—requires FaaS to transcend centralized clouds and span the edge-cloud continuum. Yet, this introduces two challenges: orchestrating diverse user demands across heterogeneous capabilities and protecting sensitive requests from the underlying infrastructure. We propose a Privacy-Preserving FaaS Marketplace using decentralized orchestration agents. Providers autonomously trade function offers, enabling multi-objective placement that dynamically satisfies strict user QoS constraints. Crucially, Paillier homomorphic encryption blinds function identifiers during resolution to preserve client privacy. Simulations demonstrate our system improves on traditional latency-minimizing FaaS gateways by optimizing placement and proactively shielding clients from SLA violations. Results validate seamless orchestration in the Edge-Cloud continuum while enabling key trade-offs between agent state aggregation, function placement accuracy, and network overhead.
Telecommunications organizations face mounting pressure to manage data infrastructure that is simultaneously scalable, cost-efficient, privacy-compliant, and secure. Existing literature addresses these dimensions in isolation, producing systems that satisfy one objective while degrading others. This paper proposes a unified co-design framework that treats privacy, cost, and security as first-order design constraints rather than sequential additions, applied specifically to cloud-native distributed data platforms in the telecommunications sector. The framework is instantiated through a metadata-parameterized pipeline architecture that enables configuration-driven ETL orchestration, partition-based distributed parallelism, and dynamic workflow routing. Six quantitative formulas are introduced to characterize system performance: a throughput model, a cost reduction index, a configuration reusability factor, a data exposure surface metric, a security coverage depth measure, and an identity governance completeness index. Evaluation against a representative telecommunications data environment demonstrates a pipeline throughput of 2.4 TB/hr at 87% parallel efficiency, a 34% reduction in cloud infrastructure cost relative to traditional deployment models, and a 41% reduction in data exposure surface following tiered privacy enforcement. Security coverage depth reached 0.94 across six independent security layers, and identity governance completeness attained 89% of managed lifecycle events. The framework is validated against GDPR Article 5(1)(c), CCPA Section 1798.100, CISA Zero Trust Maturity Model v2.0, and NIST IR 8505 guidance for cloud-native data protection. Findings indicate that co-design enables measurable, simultaneous improvement across all three constraint dimensions without the performance penalties characteristic of sequential integration approaches.
Suresh Tambe· International journal of com...· 0 citations
Vehicular computation offloading (VCOff) enables resource-constrained vehicles to delegate delay-sensitive tasks to nearby providers. However, it remains vulnerable to strategic malicious nodes that withhold results, or behave intermittently to evade detection. Although reputation values evolve across repeated interactions, long-term security depends on how these signals are governed and enforced at the decision layer. This paper introduces REVS-T, a four-tier governance and tieraware selection mechanism using reputation bands, warningstreak escalation, and pool partitioning. Under persistent attack at 50% adversarial ratio, REVS-T achieves 91.9% task success and 96.7% malicious avoidance with zero false exclusions, outperforming Threshold by 5.5% and Beta by 14.9%. A four-step ablation under shared reputation-update logic shows composite scoring and four-tier governance as the dominant drivers, with ST-conditioned initialization providing phase-shift adaptation and a fairness guarantee no evaluated baseline achieves.
Sharifah Fayi, Ferheen Ayaz, Zhengguo Sheng· International Mediterranean...· 0 citations
Smart home platforms predominantly adopt the broker-mediated publish/subscribe model (e.g., MQTT) for seamless device-app coordination. However, this architecture introduces a fundamental privacy-functionality conflict: the broker requires plaintext metadata (topic strings) for message routing, which inadvertently exposes fine-grained user behavioral patterns to semi-trusted service providers. Furthermore, existing systems lack rigorous cryptographic enforcement for app permissions, leaving the ecosystem vulnerable to over-privileged or malicious apps. While conventional Attribute-Based Encryption (ABE) provides fine-grained read-side access control, it cannot enforce writer-bound policies and remains computationally prohibitive for resource-constrained IoT nodes. In this paper, we propose SHERLOC, a practical and privacy-preserving framework that reconciles secure message routing with fine-grained privilege control. SHERLOC introduces two core primitives: (1) Secret Queue Telemetry Transport (SQTT), which leverages a novel trapdoor-based matching mechanism to support multi-level wildcard routing while ensuring topic indistinguishability and resistance against inside keyword-guessing attacks (IKGA); and (2) Outsourced Inner-Product Access Control Encryption (OS-IPACE), an attribute-hiding scheme that enforces dual no-read and no-write security for apps by offloading intensive pairing operations to a local hub without compromising data secrecy. We provide formal security proofs reducing SHERLOC’s privacy guarantees to the SXDH assumption. Experimental results from a full-scale prototype, comprising ESP32-based devices and Android apps, demonstrate that SHERLOC incurs millisecond-level latency and maintains compatibility with legacy MQTT brokers without altering protocol semantics, making it a robust and deployable solution for modern smart home environments.
Ziyi Wan, Rui Zhang, Yang Tao et al.· Cybersecurity· 0 citations
In cloud computing environments, data sharing serves as a foundational enabler of collaborative operations across heterogeneous terminals. However, such sharing introduces critical challenges–including privacy leakage, inadequate data security, inflexible access control policies, and substantial computational latency. To address these limitations, this paper proposes a privacy-preserving, secure data-sharing framework tailored for edge-cloud collaborative architectures. Relative to conventional approaches, the proposed framework delivers three principal advancements: (1) User Privacy Protection: We design a secure query-matching algorithm that protects plaintext query keywords during data access. The Cloud Server (CS) performs matching over encrypted trapdoors without directly learning the queried keywords. (2) Computational Efficiency Improvement: Edge Servers (ESs) perform outsourced ciphertext transformation using user-specific transformation keys. The terminal only performs a lightweight local operation to recover the resource. This approach minimizes the computational overhead on the terminal side while safeguarding user privacy, and effectively reduces the overhead associated with user joining and revocation within the same group. (3) Fine-Grained, Policy-Driven Access Control: A cryptographically enforced, attribute- and keyword-aware access control mechanism is implemented, supporting precise, context-sensitive authorization decisions via encrypted keyword search and semantic matching–thereby enhancing both the security posture and operational flexibility of data access control.
Qikun Zhang, Zheng Cai, Jinbo Feng et al.· Journal of King Saud Univers...· 0 citations
As intelligent home services increasingly adopt IoT-Edge-Cloud architectures, protecting personal data during third-party data sharing has become an important challenge. This paper presents a Service-Aware Trust Chain framework that applies Privacy-Enhancing Technologies (PETs) according to data sensitivity. To support this approach, we introduce a 7-level security grading scheme based on Korea’s Personal Information Protection Act (PIPA) and practical deployment requirements in edge environments.A proof-of-concept system was implemented on a Raspberry Pi 5, integrating five privacy protection engines: ARX-based deidentification, Clusion searchable encryption, Microsoft SEAL homomorphic encryption, video face blurring, and sound masking. Performance measurements show that ARX and searchable encryption can be executed with low latency at the edge, whereas video and audio protection mechanisms are more suitable for batch-oriented processing. Homomorphic encryption incurs substantially higher overhead and is therefore better suited to a cloud-assisted deployment model. In addition, sound masking exhibited limited performance degradation as audio length increased, indicating its practicality for voice privacy protection in smart-home environments.To support data integrity verification, only cryptographic hashes are recorded on a cloud-hosted Trust Chain, avoiding the exposure of raw data. The proposed framework also outlines future extensions including sLLM-based data classification and DID-based access control.
Jihwan Lee, Myoung Sun Oh, Minyoung Park et al.· International Conference on...· 0 citations
Network slicing is a foundational capability of Fifth Generation (5G)-Advanced and emerging Sixth Generation (6G) networks, yet practical support for seamless runtime slice transitions remains limited. Standard cloud-native 5G architectures lack native support for stateful inter/intra-slice session migration, relying instead on high-overhead Non-Access Stratum (NAS) re-registrations, container redeployment etc., which disrupt userplane traffic for up to 245.50 ms. To address this limitation, we present Orchra, an intelligent orchestrator for stateful, low-latency context transfer. By externalizing critical user equipment state-including NAS context, security keys, and Protocol Data Unit (PDU) session information-into a transient staging layer, Orchra preserves session continuity across slice boundaries without requiring full re-registration. Experimental evaluation shows that Orchra reduces this userplane interruption by more than twice in comparison to conventional Third Generation Partnership Project (3GPP)-based approaches while incurring negligible security overhead. These results demonstrate a practical and reproducible approach for enabling seamless, state-preserving slice transitions in cloud-native 5G-Advanced networks.
Anthony Kiggundu, Bin Han, H. Schotten· 0 citations