No abstract

No abstract

No abstract

Abstract-With the development and the implementation of the data outsourcing technology in cloud computing, there are increasing demands and concerns for the data access security. Recently, Hur proposed a scheme and claimed the following achievements: 1) the key escrow problem. 2) realizing finegrained user revocation. However, through our security analysis, there are three security flaws in Hur's scheme. Firstly, the scheme cannot ensure fine-grained user revocation security. We present two attacks, passive attack directed by revoked user and collusion attack, to illustrate its vulnerability, which will lead to disclosing the subsequent encrypted information for a revoked user.Secondly,we find out that the scheme cannot ensureuser secure join as it claimed, which means newly joined user is able to decrypt the message before his joining. Similarly, we present two attacks, passive attack directed by newly joined user and collusion attack, which lead to leakage of previous encrypted data for the new joining user. Thirdly, the key escrow problem cannot be solved completely in the scheme based on Dolev-Yao model, which means there is not any secure channel between the communication entities in, especially between the cloud server and users.Finally, in order to solve the above three security shortages in Hur's scheme, in this paper, we propose three countermeasures, which are efficient to withstand our proposed attacks.

Generative Adversarial Networks (GAN)-synthesized table publishing lets people privately learn insights without access to the private table. However, existing studies on Membership Inference (MI) Attacks show promising results on disclosing membership of training datasets of GAN-synthesized tables. Different from those works focusing on discovering membership of a given data point, in this paper, we propose a novel Membership Collision Attack against GANs (TableGAN-MCA), which allows an adversary given only synthetic entries randomly sampled from a black-box generator to recover partial GAN training data. Namely, a GAN-synthesized table immune to state-of-the-art MI attacks is vulnerable to the TableGAN-MCA. The success of TableGAN-MCA is boosted by an observation that GAN-synthesized tables potentially collide with the training data of the generator.Our experimental evaluations on TableGAN-MCA have five main findings. First, TableGAN-MCA has a satisfying training data recovery rate on three commonly used real-world datasets against four generative models. Second, factors, including the size of GAN training data, GAN training epochs and the number of synthetic samples available to the adversary, are positively correlated to the success of TableGAN-MCA. Third, highly frequent data points have high risks of being recovered by TableGAN-MCA. Fourth, some unique data are exposed to unexpected high recovery risks in TableGAN-MCA, which may attribute to GAN's generalization. Fifth, as expected, differential privacy, without the consideration of the correlations between features, does not show commendable mitigation effect against the TableGAN-MCA. Finally, we propose two mitigation methods and show promising privacy and utility trade-offs when protecting against TableGAN-MCA.