Sep 2026· IEEE Transactions on Mobile Computing· Vol 25, pp. 14564-14579· 0 citations· 42 references
Abstract
The rise of edge-cloud computing has accelerated data sharing among mobile users. To resist malicious senders within organizations from leaking sensitive data, access control encryption (ACE) schemes have been employed to secure data flows, in which each sender obtains an encryption key according to the access control policy to encrypt the data, and a sanitizer (i.e., the edge node) inspects all shared data between the sender and receiver. Although attribute-based ACE schemes have been put forward to support fine-grained data sharing, they lack temporal constraints on write control, which is crucial in mobile data sharing scenarios, and have high sanitization overhead at the edge node. In addition, they only provide selective security and are therefore vulnerable to adaptive adversaries. To this end, we propose TSFlow, a time-aware secure flow control framework in mobile edge-cloud that regulates which senders can transmit data to which receivers during the authorized time interval, preventing malicious sending by expired senders. At its core is TA-ACE, a time-aware attribute-based ACE that issues each sender an encryption key tied to an expressive access structure and a time interval. Encrypted data can be sanitized at the edge only if it is well-formed with a valid encryption key and encrypted within the time interval, and any legitimate receiver satisfying the access structure can decrypt the sanitized ciphertext. We formally prove that TA-ACE satisfies the adaptive no-read and no-write rules, and demonstrate the reasonable efficiency of TSFlow through experiments for secure flow control in mobile edge-cloud.
The proposed ePoFSC scheme integrates pre-auditing and caching mechanisms for requester trapdoors before online access requests, enabling constant-time operations for request generation, request verification, and request header construction independent of requester attribute scale.
In cloud computing environments, data sharing serves as a foundational enabler of collaborative operations across heterogeneous terminals. However, such sharing introduces critical challenges–including privacy leakage, inadequate data security, inflexible access control policies, and substantial computational latency. To address these limitations, this paper proposes a privacy-preserving, secure data-sharing framework tailored for edge-cloud collaborative architectures. Relative to conventional approaches, the proposed framework delivers three principal advancements: (1) User Privacy Protection: We design a secure query-matching algorithm that protects plaintext query keywords during data access. The Cloud Server (CS) performs matching over encrypted trapdoors without directly learning the queried keywords. (2) Computational Efficiency Improvement: Edge Servers (ESs) perform outsourced ciphertext transformation using user-specific transformation keys. The terminal only performs a lightweight local operation to recover the resource. This approach minimizes the computational overhead on the terminal side while safeguarding user privacy, and effectively reduces the overhead associated with user joining and revocation within the same group. (3) Fine-Grained, Policy-Driven Access Control: A cryptographically enforced, attribute- and keyword-aware access control mechanism is implemented, supporting precise, context-sensitive authorization decisions via encrypted keyword search and semantic matching–thereby enhancing both the security posture and operational flexibility of data access control.
Qikun Zhang, Zheng Cai, Jinbo Feng et al.· Journal of King Saud Univers...· 0 citations
As intelligent home services increasingly adopt IoT-Edge-Cloud architectures, protecting personal data during third-party data sharing has become an important challenge. This paper presents a Service-Aware Trust Chain framework that applies Privacy-Enhancing Technologies (PETs) according to data sensitivity. To support this approach, we introduce a 7-level security grading scheme based on Korea’s Personal Information Protection Act (PIPA) and practical deployment requirements in edge environments.A proof-of-concept system was implemented on a Raspberry Pi 5, integrating five privacy protection engines: ARX-based deidentification, Clusion searchable encryption, Microsoft SEAL homomorphic encryption, video face blurring, and sound masking. Performance measurements show that ARX and searchable encryption can be executed with low latency at the edge, whereas video and audio protection mechanisms are more suitable for batch-oriented processing. Homomorphic encryption incurs substantially higher overhead and is therefore better suited to a cloud-assisted deployment model. In addition, sound masking exhibited limited performance degradation as audio length increased, indicating its practicality for voice privacy protection in smart-home environments.To support data integrity verification, only cryptographic hashes are recorded on a cloud-hosted Trust Chain, avoiding the exposure of raw data. The proposed framework also outlines future extensions including sLLM-based data classification and DID-based access control.
Jihwan Lee, Myoung Sun Oh, Minyoung Park et al.· International Conference on...· 0 citations
The growing demand for large models in industrial Internet necessitates secure sharing of cloud-stored training data. However, existing Ciphertext-Policy Attribute-Based Encryption schemes suffer from low efficiency and insufficient accuracy in tracing key-leaking users. We propose a traceable secure data sharing scheme based on credibility, which enforces dual access control via credibility and attributes. It strengthens the binding of user and key and integrates a large model to create an intelligent traceability framework, utilizing multi-layer query mechanisms and Merkle trees to reduce redundant verification operations and improve tracing efficiency. Under the DBDH assumption, the scheme is IND-CPA secure. Experiments on the “Insider Threat Test Dataset” demonstrate a traceability accuracy of 99.46%, significantly reducing unnecessary verification operations. The proposed scheme provides an efficient, accurate, and practical solution for secure data sharing and malicious user traceability in distributed industrial cloud environments.
Shaojian Zhang, Jun Ye· 2026 5th International Confe...· 0 citations
Cloud computing has revolutionized data storage and processing, yet it poses significant security challenges, necessitating robust access control mechanisms. This study proposes a novel approach to secure cloud data access control called the Robust Mechanism for Secure Cloud Data Access Control (SC-DAC), which combines advanced cryptographic techniques such as Ciphertext-Policy Attribute-Based Encryption (CP-ABE) and Hybrid Public Key Encryption. By enabling fine-grained access control based on user attributes and policies, and ensuring data confidentiality and integrity during transmission, SC-DAC addresses critical security challenges in cloud environments. It features two innovative protocols: Partially Outsourced Access Control Protocol (PO-ACP), which allows for partial delegation of access control tasks while retaining oversight of critical functions, and Fully Outsourced Access Control Protocol (FO-ACP), which streamlines operations by fully outsourcing challenge generation and resource accounting to the cloud provider. The mechanism’s effectiveness is rigorously validated through formal verification with the ProVerif tool, mathematical proofs, and informal security analyses, demonstrating resilience against replay attacks, man-in-the-middle attacks, and denial-of-service (DoS) attacks. This comprehensive approach significantly advances cloud security by providing a robust solution to unauthorized access and data breaches. Simulation results further show that SC-DAC achieves superior performance in computation and communication costs, significantly advancing cloud security.
Haqi Khalid, S. Hashim, Mohammed Abdul Majeed· PeerJ Computer Science· 1 citation
The framework converts security and privacy requirements into enforceable routing, cryptographic, access-control, isolation, auditing, and lifecycle policies, enabling reproducible security-performance co-optimization for distributed IoT.
Jing Su, Zi-Lin Guo· ICST Transactions on Scalabl...· 0 citations
Related blog posts
MIT News · Artificial Intelligence· news.mit.eduSep 2, 2026
What if pathology foundation models could do more with less? GigaPath-Flash and GigaTIME-Flash cut computational demands while maintaining strong performance, opening the door to larger studies and broader exploration. The post GigaPath-Flash and GigaTIME-Flash: Toward population-scale discovery with efficient pathology foundation models appeared first on Microsoft Research.
MIT News · Artificial Intelligence· news.mit.eduAug 31, 2026
With millions of users across the world, Julia has been used to conduct cutting-edge research and to design new drugs, jet engines, heat pumps, and more.
MIT News · Artificial Intelligence· news.mit.eduAug 27, 2026
A new machine-learning framework aims to improve the success rate of computational protein design while moving away from results that reproduce sequences found in nature.
