Xinyi Huang

• Fujian Normal University

Payment Channel Networks (PCNs), pivotal for blockchain scalability, facilitate multiple off-chain payments between any two users. They utilize scripts to define and execute payment conditions in various blockchains, but this poses privacy, efficiency, and compatibility challenges. To overcome these, scriptless cleverly embeds payment conditions in...

TLS 1.3 is widely used to realize secure communication over the Internet. Existing security analyses of TLS 1.3 primarily focus on its handshake protocol which is indeed an authenticated key exchange (AKE) protocol, and implicitly neglect the so-called subversion attacks (e.g., breaking TLS via Dual EC) in the real world. Reverse firewall (RF) is a...

Sparse inner product (SIP) has the attractive property of overhead being dominated by the intersection of inputs between parties, independent of the actual input size. It has intriguing prospects, especially for boosting machine learning on large-scale data, which are tangled with sparse data. In this paper, we investigate privacy-preserving SIP pr...

Many network middleboxes have been deployed to perform deep packet inspection (DPI) over packet payloads. However, such middleboxes cannot accomplish their tasks when the traffic is encrypted. BlindBox (SIGCOMM 2015) provided the first solution for performing DPI over encrypted traffic. To improve its efficiency, a later proposal PrivDPI (CCS 2019)...

The SM9 identity-based encryption (IBE) scheme is a cryptographic standard used in China, and has been incorporated into the ISO/IEC standard in 2021. This work primarily proposes a countermeasure to secure the SM9 IBE scheme if its implementation is tampered with or deviated from the standard specification. Such attacks, known as subversion attack...

Automatic dependent surveillance–broadcast (ADSB) serves as a fundamental component of the next-generation national airspace strategies in numerous states, facilitating the improvement and modernization of aviation infrastructure and operations. Within the ADS-B system, an aircraft equipped with ADS-B technology periodically transmits and shares in...

Blockchain as an open and immutable ledger is being posited as the next frontier in healthcare that will help solve the industry's interoperability challenges. However, immutability in processing personal data is no longer legal since the General Data Protection Regulation (GDPR) requires the “right to be forgotten” as a critical data subject right...

Reputation-based authentication is a mechanism used to establish trust and ensure the reliability of vehicle communication in vehicular ad hoc networks (VANETs). However, existing schemes ignore the importance of privacy protection and face issues such as malicious vehicles spreading false or duplicate messages. To address these issues, this paper...

Vehicular Ad-hoc Networks (VANETs) constitute crucial elements within intelligent transportation systems. However, the rapid development of VANETs has brought forth an increasing number of security concerns. Conditional Privacy-Preserving Certificateless Signature (CPP-CLS) has emerged as a promising solution to ensure data security, preserve vehic...

Fueled by its successful commercialization, the recommender system (RS) has gained widespread attention. However, as the training data fed into the RS models are often highly sensitive, it ultimately leads to severe privacy concerns, especially when data are shared among different platforms. In this paper, we follow the tune of existing works to in...

Motivated by the violation of two fundamental assumptions in secure communication - receiver-privacy and sender-freedom - by a certain entity referred to as “the dictator”, Persiano et al. introduced the concept of Anamorphic Encryption (AME) for public key cryptosystems (EUROCRYPT 2022). Specifically, they presented receiver/sender-AME, directly t...

The prosperity of blockchain has pushed various decentralized applications, e.g., cross-regional finance, due to its advantages of openness, immutability, and decentralization. The feature of openness inevitably leads to a serious privacy breach. Recently, various privacy-enhanced works (e.g., Zcash, Monero) were proposed focusing on this problem....

Bilateral access control model, emerging as a novel paradigm in access control, has garnered extensive deployment within the domain of fog computing. This model offers on-demand data services, enabling the efficient identification of sensitive data without resorting to resource-intensive decryption procedures. Nonetheless, prevailing solutions exhi...

In crowdsensing, we can leverage intelligent devices and real-time incentive mechanisms to facilitate the collection of reliable and timely data in Industrial Internet of Things (IIoT) settings. In such a setting, one can use cryptographic primitives to support data privacy preservation and quality-aware reward distribution simultaneously. However,...

Electronic Medical Records (EMRs) sharing enhances healthcare and biomedical discoveries but faces challenges: data provider centralization and limited interoperability. Blockchain can address these issues, but existing systems struggle with malicious EMR propagation due to challenges concerning the authenticity, non-repudiation, and integrity of t...

With the development of quantum computing, the existing cryptography schemes based on classical cryptographic primitives will no longer be secure. Hence, cryptographers are designing post-quantum cryptographic (PQC) schemes, and ideal lattice-based cryptography has emerged as a prime candidate. Today, as ideal lattice-based cryptography becomes mor...

Efficiently mining frequent itemsets and association rules on the encrypted outsourced data remains a great challenge for the time-consuming ciphertext computations. Nowadays, it has been not well addressed for privacy-preserving frequent itemsets and association rule mining schemes with mining efficiency, dataset, and query confidentiality simulta...

An edge-cloud Industrial Internet of Things (IIoT) can help meet the computing requirements of industrial applications, particularly in time and latency-sensitive services. Ensuring the security and privacy of (sensitive) information collected by IIoT end devices is crucial, and has an important impact on the decision-making as well as operational...

In this paper, we study the problem of secure ML inference against a malicious client and a semi-trusted server such that the client only learns the inference output while the server learns nothing. This problem is first formulated by Lehmkuhl et al. with a solution (MUSE, Usenix Security'21), whose performance is then substantially improved by C...

Cloud-assisted Industrial Internet of Things (IIoT) gathers and analyzes multiple types of data (such as ambient and mechanical data) from physical devices to improve intelligent manufacturing. However, the heavy requirements for data storage and sharing have led to increased demands for efficiency and security in the IIoT system. Public-key Encryp...

Cloud computing has been widely accepted as a computing paradigm to offer high-quality data services on demand. However, it suffers from various attacks as the cloud service provider and data owners are not in the same trusted domain. To support data confidentiality, existing cloud-based systems apply cryptographic tools to issue the decryption key...

Secure cloud-assisted data publish/subscribe (Pub/Sub) service provides an asynchronous method for publishers and subscribers to non-interactively exchange encrypted messages. Besides performing conjunctive subscription policy, numerous data Pub/Sub systems have recently been proposed to provide dynamic access control enforced from the publisher si...

Despite the myriad benefits offered by blockchain technology, most of them still face several interrelated issues, such as limited transaction throughput, exorbitant transaction fees, and protracted confirmation times. Payment channel networks have emerged as a promising scalability solution, allowing two mutually distrustful users to engage in mul...

Cloud computing is the widespread acceptance of a promising paradigm offering a substantial amount of storage and data services on demand. To preserve data confidentiality, many cryptosystems have been introduced. However, current solutions are incompatible with the resource-constrained end-devices because of a variety of vulnerabilities in terms o...

This paper investigates data communication and access control in satellite-assisted Internet of Things. In particular, given the characteristics of an open communication environment, a multi-layer heterogeneous network, and a time-varying topology in the Space-Air-Ground-Sea Integrated Network (SAGSIN), traditional data communication and security m...

Payment Channel Networks (PCNs) are innovative second-layer scaling technologies that aim to improve transaction rates, reduce on-chain storage costs, and enable efficient atomic swaps for blockchain-based cryptocurrencies. Despite offering features like relationship anonymity, scriptless script, and cross-chain fairness, current PCNs encounter cha...

With the growing use of mobile devices, location-based services (LBS) are becoming increasingly popular. BLS deliver accurate services to individuals according to their geographical locations, but privacy issues have been the primary concerns of users. Privacy-preserving LBS (PPLBS) were proposed to protect location privacy, but there are still som...

Fueled by its successful commercialization, the recommender system (RS) has gained widespread attention. However, as the training data fed into the RS models are often highly sensitive, it ultimately leads to severe privacy concerns, especially when data are shared among different platforms. In this paper, we follow the tune of existing works to in...

Sparse inner product (SIP) has the attractive property of overhead being dominated by the intersection of inputs between parties, independent of the actual input size. It has intriguing prospects, especially for boosting machine learning on large-scale data, which is tangled with sparse data. In this paper, we investigate privacy-preserving SIP pro...

Identity-based cryptography is proposed to solve the complicated certificate management of traditional public-key cryptography. The pairing computation and high-level tower extension field arithmetic turn out to be the performance bottleneck of pairing-based signature schemes. Graphics Processing Units (GPUs) have been increasingly popular for gene...

CCA security is desirable when designing encryption schemes because it captures active attackers. One efficient approach for achieving CCA security is to use generic conversions. We first design a CPA secure scheme, and then transform it into a CCA secure scheme using the Fujisaki-Okamoto technique (CRYPTO ’99) in the random oracle model or the Can...

The sharing of energy usage data in smart grids is becoming increasingly popular because it not only allows different entities to access fine-grained energy consumption data but also improves the effectiveness of smart grid technologies. How to ensure both verifiability and privacy of the shared data is a vital issue. Most existing privacy-preservi...

In this paper, we address the problem of privacy-preserving federated neural network training with $N$ users. We present Hercules, an efficient and high-precision training framework that can tolerate collusion of up to $N-1$ users. Hercules follows the POSEIDON framework proposed by Sav et al. (NDSS'21), but makes a qualitative leap in performance...

The middle product learning with errors problem (MP-LWE) is a variant of the learning with errors problem (LWE). The public-key cryptography under MP-LWE assumption gets an equilibrium between “efficiency” and “security”. However, the hardness of MP-LWE has not been sufficiently explored since its introduction. So in this paper, we focus on the har...

The digital rights management is mainly about license management. Take software licensing as an example. A software license can be assigned to a user, a group of users, or an organization. To protect the copyright against software piracy, a software license is usually bound to the IP of the device or the identity of user. When a user wants to use a...

Immutability has been widely accepted as a fundamental property protecting the security of blockchain technology. However, this property impedes the development of blockchain because of the abuse of blockchain storage and legal obligations. To mitigate this issue, a novel construction of blockchain, called redactable blockchain , was introduced....

Image licensing regulates the scope, type, and limitations of using an image through an agreement. However, it is challenging to verify whether an agreement has been fulfilled honestly. Existing techniques, such as watermarking and perceptual hashing, help check image originality and editing operations specified in the agreement, but fail to achiev...

Vehicular Ad-hoc Networks (VANETs) are with great potentials to facilitate traffic management and improve driver safety. Blockchain-based conditional privacy-preserving authentication (BCPPA) is proposed to achieve an optimal tradeoff among anonymity, traceability and key/certificate management in VANETs. Existing BCPPA protocols mitigate these sec...

Secure cloud search service allows resource-constrained clients to effectively search over encrypted cloud storage. Towards enabling owner-enforced search authorization, the notion of attribute-based keyword search (ABKS) has been introduced and widely deployed in practice. To enhance traditional security of ABKS, two state-of-the-art solutions are...

Privacy-preserving pattern matching enables a user to find all occurrences of a pattern in a text without revealing any sensitive information. However, many previous works designed on homomorphic encryption suffer from expensive computational overhead and potential input leakage via access pattern during the matching process. In this paper, we prop...

The healthcare Internet of Things (IoT) is rapidly becoming an invaluable tool in the healthcare industry. However, sharing data in healthcare IoT raises many security and privacy concerns, such as how to ensure data integrity, source authentication, and data privacy. Redactable signature schemes ( ${\sf RSS}$ s) could be a feasible solution to ad...

In this paper, we address the problem of privacy-preserving federated neural network training with $N$ users. We present Hercules,, an efficient and high-precision training framework that can tolerate collusion of up to $N-1$ users. Hercules follows the POSEIDON framework proposed by Sav et al. (NDSS'21), but makes a qualitative leap in perfo...

Most blockchains are designed to be immutable such that an object, e.g., a block or a transaction, is persisted once it has been registered. However, blockchain immutability hinders blockchain development due to the increasing abuse of blockchain storage and legal obligations. To break immutability in a controlled way, Derler et al. (NDSS’19) propo...

Edge computing is an emerging distributed computing concept that allows edge servers to provide authorized consumers with various on-demand services. Due to highly dynamic and untrustworthy network environments, various potential security concerns (e.g., unauthorized access, data manipulation, and privacy leakage) have been the critical factors res...

Searchable encryption (SE) is a promising strategy for cloud-based file retrieval services, via structuring correspondences between files and keywords. Public key encryption with keyword search (PEKS) has been generally employed in file-sharing services, as compared to searchable symmetric encryption (SSE). However, PEKS is inherently vulnerable to...

The rapid development and wide application of blockchain not only highlight the significance of privacy protection (including anonymity and confidentiality) but also the necessity of auditability. While several ingenious schemes such as MiniLedger and traceable Monero supporting both privacy protection and auditability have been proposed, they eith...

Driven by various legal obligations and service requirements, the redactable blockchain was introduced to balance the modifiability and immutability of blockchain technology. However, such a blockchain inevitably generates one or even more acceptable versions for the same block data, enabling malicious full nodes to deceive light/new nodes with old...

With an increasing number of IoT devices being deployed in healthcare, massive amounts of electronic health records (EHRs) are generated and shared in the cloud. To preserve data privacy, one promising data-sharing tool named attribute-based encryption (ABE) has been widely employed. However, it is a challenge to achieve flexible data sharing witho...

Redactable signature plays a significant role in real-life applications such as electronic health records, and has been studied extensively. Nevertheless, how to construct a redactable signature scheme with designated redactors is still unknown. In this paper, we affirmatively answer this problem by presenting a notion of ring trapdoor redactable s...

Wireless medical sensor networks (WMSNs) have aroused widespread attention in recent years with the development of Internet of Things (IoT) technology. WMSNs offer many new opportunities for healthcare professionals to monitor patients and patient self-monitoring. To overcome the resource (such as memory and power) limitations of sensors and attain...

Our context is anonymous encryption schemes hiding their receiver, but in a setting which allows authorities to reveal the receiver when needed. While anonymous Identity-Based Encryption (IBE) is a natural candidate for such fair anonymity (it gives trusted authority access by design), the de facto security standard (a.k.a. IND-ID-CCA) is incompati...

To reduce the cost of human and material resources and improve the collaborations among medical systems, research laboratories and insurance companies for healthcare researches and commercial activities, electronic medical records (EMRs) have been proposed to shift from paperwork to friendly shareable electronic records. To take advantage of EMRs e...

Data deduplication and public auditing are significant for providing secure and efficient network storage services. However, the existing data deduplication schemes supporting auditing not only cannot effectively alleviate the threats of the single point of failure and duplicate-faking attack, but also have to bear the massive waste of computation...

As a versatile technique, cloud-fog computing extends the traditional cloud server to offer various on-demand data services. Maintaining data confidentiality is one of the most crucial requirements for data services, many cryptosystems have been proposed to reserve information privacy against such an untrusted environment. However, in cloud-fog com...

As an immutable append-only distributed ledger, blockchain allows a group of participants to reach a consensus in an untrustworthy ecosystem. Immutability is a blockchain feature that persists data forever, but it is no longer legal in reality. Blockchain has unchangeable improper contents that violate laws. Moreover, data regulation toward “the ri...

A privacy-preserving data analytics system enables a cloud user to perform the distributed job in a secure manner such that the data privacy can be guaranteed during the cloud-outsourced computation. However, many SGX-based solutions are vulnerable to some side-channel attacks, including the access pattern leakage from both network and memory. Seve...

Healthcare Internet-of-Things (IoT) enables lightweight devices to observe patients' vital signals and outsource them to a remote cloud to enjoy flexible data sharing. However, it faces many security threats as the outsourced data is no longer physically controlled by data owners, and the cloud that hosts the outsourced data is not fully trusted. M...

Over the past decade, the Internet of Things (IoT) is widely adopted in various domains, including education, commerce, government, and healthcare. There are also many IoT based applications drawn significantly attentions in recent years. With the increasing numbers of the connected devices in IoT system, one of the challenging tasks is to ensure d...

Outsourcing computations have been an indispensable part to meet the growing demand of computing capability, among which trust problem is one of critical issues to be solved urgently. Fair payment, as a candidate solution, offers the potential for facilitating fair trading among outsourcing computation participants such as users and workers. Howeve...

SM9 is a Chinese cryptography standard, which includes a set of identity-based cryptographic schemes over pairings. SM9 identity-based signature scheme (SM9-IBS) was standardized by ISO/IEC and has been widely used in many real-world applications such as blockchain. Nevertheless, the signing algorithm of SM9-IBS suffers from several heavy calculati...

The Chinese government releases the SM2 digital signature algorithm as one part of the Chinese public key crypto standard, and now it has become an international standard algorithm. To protect the privacy of messages, we propose an efficient blind signature scheme based on the SM2 signature algorithm in this paper. We prove that our scheme can sati...

Broadcast encryption provides a promising technique of data access control for specified users in cloud computing. A data uploader can generate a ciphertext for a set of chosen users such that only the intended users are able to learn the data content. However, with the rapidly increasing of collaboration between users, it is desired to extend the...

Credit system is generally associated with the banking and financial institutions, although it has far reaching implications for residents of countries, such as U.S., particularly for those with a poor credit history. Specifically, a credit score computation (CSC) quantifies an individual’s credit value or credit risk, which is used by banking and...

Nowadays, data privacy is one of the most critical concerns in cloud computing, and many privacy-preserving distributed computing systems based on the trusted execution environment (e.g., Intel SGX) have been proposed to protect the user's privacy during cloud-outsourced computation. However, these SGX-based solutions are vulnerable to some traffic...

Wireless body area networks (WBANs) technology nowadays has become a promising networking paradigm in the Internet of Things (IoT) as it can provide people with high quality of life and high level of medical service. In order to ensure the security and privacy of patients’ sensitive biomedical data and the efficiency of message processing across di...

Decentralized Anonymous Credential (DAC) has posed enormous potential in smart grids for protecting user privacy (e.g. preventing user’s daily life from being sketched out). However, the existing DAC protocols still compromise user privacy for a full list of attributes are disclosed during showing credentials. In this paper, to construct a privacy-...

Existing (popular) blockchain architectures, including the widely used Ethereum and Hyperledger, are generally not designed to achieve conflicting properties such as anonymity and regulation, and transparency and confidentiality. In this article, we propose a privacy-preserving permissioned blockchain architecture (PPChain) that permits one to also...

Transport Layer Security Inspection (TLSI) enables enterprises to decrypt, inspect and then re-encrypt users’ traffic before it is routed to the destination. This breaks the end-to-end security guarantee of the TLS specification and implementation. It also raises privacy concerns since users’ traffic is now known by the enterprises, and third-party...

In certificateless proxy signature (CLPS), the key generation center is responsible for initializing the system parameters and can obtain the opportunity to adaptively set some trapdoors in them when wanting to launch some attacks. Until now, how to withstand the malicious-but-passive key generation center (MKGC) attacks in CLPS is still an interes...

Recently, reconstruction attacks on static encrypted database supporting range queries have been proposed. However, attacks on encrypted database within two updates in the similar setting have not been studied extensively. As far as we know, the only work is the update recovery attack presented by Grubbs et al. (CCS 2018). Following their semin...

Cloud-based data storage service has drawn increasing interests from both academic and industry in the recent years due to its efficient and low cost management. Since it provides services in an open network, it is urgent for service providers to make use of secure data storage and sharing mechanism to ensure data confidentiality and service user p...

While Vehicular Ad-hoc Networks (VANETs) can potentially improve driver safety and traffic mangement efficiency (e.g. through timely sharing of traffic status among vehicles), security and privacy are two ongoing issues that need to be addressed. Hence, security solutions such as conditional privacy-preserving authentication (CPPA) protocols have b...

Cloud-fog computing is a novel paradigm to extend the functionality of cloud computing for providing a variety of on-demand data services via the edge network. Many cryptographic tools have been introduced to preserve data confidentiality against the untrustworthy network and cloud servers. However, how to efficiently identify and retrieve useful d...

Password is commonly used to protect Bitcoin wallet, the most known application of blockchain. In this paper, we investigate a subtle issue when forgetting password: The account owner uses guessed passwords during the authentication with a service provider. This is different from password guessing by cyber attackers, because passwords guessed by th...

The sensing-as-a-service (SaaS) model has been explored to address the challenge of intractability of managing a large number of sensors faced by future smart cities. However, how to effectively share sensor data without compromising confidentiality, privacy protection, and fair trading without third parties is one of critical issues that must be s...

The primitive of verifiable database (VDB) can enable a resource-limited client to securely outsource an encrypted database to an untrusted cloud server and the client could efficiently retrieve and update the data at will. Meanwhile, the client can undoubtedly detect any misbehavior by the server if the database has been tampered with. We argue th...

The pervasive, ubiquitous, and heterogeneous properties of IoT make securing IoT systems a very challenging task. More so when access and storage are performed through a cloud-based IoT system. IoT data stored on cloud should be encrypted to ensure data privacy. It is also crucial to allow only authorized entities to access and decrypt the encrypte...

Blockchain, a distributed ledger technology, can potentially be deployed in a wide range of applications. Among these applications, decentralized payment systems (e.g. Bitcoin) have been one of the most mature blockchain applications with widespread adoption. While the early designs (e.g. Bitcoin) are often the currency of choice by cybercriminals...

Cryptographic keys should be established for smart home devices in order to secure home area networks. In certain smart home applications, however, the devices might be produced by different factories. As a result, it becomes impractical to assume devices are pre-loaded with secrets before leaving factories. Moreover, in some scenarios, smart home...

Personal electronic health records (EHR) enable medical workers to conveniently and quickly access each patient's medical history through the public cloud, which greatly facilitates patients' visits and makes telemedicine feasible. Additionally, since EHR involve patients' personal privacy information, EHR holders would hesitate to directly outsour...

Increasingly, governments around the world, particularly in technologically advanced countries, are exploring or implementing smart homes, or the related smart facilities for the benefits of the society. The capability to remotely access and control Internet of Things (IoT) devices (e.g. capturing of images, audios and other information) is conveni...

To secure the communications of home area networks, cryptographic keys need to be establish between smart home devices. Though many key agreement schemes have been proposed, they cannot be directly implemented. It is due to the reason that in some applications, smart home devices have no access to the online trusted third party. Moreover, in certai...

The wide employment of Internet of Things (IoT) across industrial sectors creates the Industrial Internet of Things (IIoT). In practical applications, however, the IIoT has many attack surfaces. As a result, the IIoT is vulnerable to kinds of attacks, including physical attacks (such as the invasive hardware attacks, side-channel attacks and revers...