Research

CAGE is a system that adds confidential accelerator computing to Arm's Confidential Computing Architecture (CCA), which isolates workloads in realms. It introduces a shadow task mechanism to manage accelerator applications within CCA's realm-style design and uses CCA's memory isolation to protect data confidentiality and integrity. Implemented without hardware changes on a unified-memory GPU and a generic FPGA, it shows moderate overhead in evaluation.

Researchers propose Application Data Unit (ADU) length as a feature for classifying HTTPS encrypted traffic from over-the-top applications, since packet length sequences are distorted by protocol piecewise decoupling and encryption covering. They train a Length-Correction Multiple Regression Neural Network (LC-MRNN) to restore true ADU lengths, which the TLS encryption that covers the HTTP header prevents from being read directly. In experiments on the real CERNET network with HTTP-1.1 and HTTP-2.0, the method, paired with an LS-LSTM classifier, reaches an F1-score of 93.52%, about 4.2% higher than state-of-the-art methods.

The authors propose EdFROST, a threshold EdDSA protocol that supports identifiable aborts under a chosen-message attack (IA-CMA), built on FROST3 from Ruffing et al. (ACM CCS '22). They extend it into the first weighted threshold EdDSA scheme that accounts for both participant count and arbitrary weight distribution to reduce weight centralization. A game-theoretic incentive model, implemented via tamper-proof chaincode, aims for rational identifiable aborts with a unique sequential equilibrium, and experiments report EdFROST and the chaincode as efficient and lightweight.

The paper introduces SEOMA, described as the first multi-keyword encrypted search primitive that supports both owner authentication and multi-user access control for web data management. It uses attribute encryption for data owner authentication and a policy tree with linear secret-sharing for hierarchical user access control, with security shown in a random oracle model by reduction to the DBDH and CBDH problems. Computation and communication overhead is reported as only 0.05-0.4× and 0.07-0.47× that of prior schemes.

Researchers present an attention-based framework for privacy-preserving Moving Object Detection (MOD) in compressed video, where the video is encrypted on the user side and CVSE data is extracted from the encrypted video in the cloud. A two-stage training process is used: a deep learning approach interpolates CVSE-based motion feature maps, and a specialized backbone with an attention-based neck handles sparse CVSE data. On the VIRAT and DUKE-MTMC datasets, the framework reports state-of-the-art detection performance and greater robustness in challenging scenes than previous secure solutions.

Researchers propose Generalization First k-Member Clustering (GFKMC), a new k-anonymity method for healthcare data that applies early generalization to quasi-identifiers. Compared with Mondrian, Top-Down Greedy (TDG), and Clustering-Based (CB) baselines, GFKMC keeps information loss at roughly 25% across varying k values. It also better preserves machine learning model performance, especially at low k.

This empirical study runs federated learning experiments on a large network of real IoT and edge devices, rather than in simulation or small testbeds. It measures learning performance and the computation and communication costs of on-device FL, with a focus on heterogeneous scenarios. The authors aim to show the practical feasibility of FL in realistic environments.

The paper proposes VP-HPKG, a method that predicts vulnerable instructions to Silent Data Corruption by building a heterogeneous program knowledge graph of instruction and basic-block relations and modeling it with a Graph Neural Network and Transformer. Evaluated with 1,144,070 fault injections using LLFI across 22 programs, it improves accuracy by an average of 10.3% and F1-score by 18.4% over state-of-the-art baselines. It also reduces model complexity by about 2 times and fault injection overhead by 30%.

Hecate is a framework for threshold anonymous credentials that gives verifiers privacy as well as users. It lets a verifier define a function policy that a user must satisfy before receiving the verifier's private information, while keeping threshold issuance and issuer-hiding. The authors build it with subset predicate encryption and threshold signatures, prove unforgeability, privacy, anonymity and issuer-hiding, and report policy matching and credential presentation taking about 37 ms and 60 ms on a personal laptop.

The paper presents mmFace, a face authentication system that scans a face with a commodity millimeter wave radar moved along a set trajectory. The reflected signals carry facial biometric and structure features, which support liveness detection and authentication, and the system still works when users wear masks. To avoid on-site registration, the authors propose virtual registration using cross-modal transformation from photos to mmWave signals.

RDSAD is an unsupervised, adaptive anomaly-based intrusion detection method for evolving cyber-physical system (CPS) data streams. It combines Dynamic Deviation Recognition (DDR), which captures underlying system dynamics, with Shift-aware Model Adaptation (SMA), which updates the model as patterns change. It reached the best AUC of 0.90 on SWaT and 0.88 on WADI, outperforming static and streaming baselines with efficient runtime on large streams.

PrivateCharger is a side-channel attack that infers user activity by analyzing variations in the magnetic field emitted by a laptop charger, without physical access to the laptop. It uses only commercially available devices and no hardware modifications, and reaches an average of 84.6% recognition accuracy on two MacBook Pro models at 50% to 80% battery levels.

Forseti is a decentralized authorization framework for transferring IoT device permissions in leasing settings such as accommodation and hospitality. The authors present it as the first systematic study of device permission transfer, which they argue is under-examined compared with permission sharing. It combines zero-knowledge proofs with a decentralized ledger so that hosts and tenants keep their rights, and the paper reports that its evaluation shows the framework is effective, efficient, scalable, and compatible with existing IoT platforms.

OCEAN is a network-layer packet forwarding scheme for mission-critical Industrial IoT transmission, combining a programmable ASIC integrated with an FPGA for in-network caching and a lossless forwarding protocol in the data plane. Each en route node verifies packets from authorized end devices and caches them until the next node acknowledges, retransmitting after a short timeout. Simulation in BMv2 confirmed functionality, and hardware processed packets at line rate with 2519 ns to 6160 ns total latency.

The paper proposes OptiVersa-ECDSA, a threshold-ECDSA protocol with a cheater identification mechanism (CIM) and fast online signing, built on new tools called verifiable secret-product sharing (VSPS) and batch VSPS. The authors claim security against malicious adversaries in the dishonest majority model. Their performance analysis reports 35% to 65% bandwidth and runtime improvement over Canetti et al. (CCS'20), and 99% for the CIM module.

Researchers propose CQT-AKA, a two-factor authenticated key agreement scheme for mobile devices. The static private key is a cancelable biometric value derived by combining the user's biometrics with a password, so a leaked biometric feature can be replaced through a key update using a new password. The scheme is based on the RLWE assumption, which the authors say provides post-quantum security with lower storage and communication cost than multi-factor authentication.